chore: bump cspell from 10.3.3 to 10.3.4

[dependabot]

Bumps cspell from 10.3.3 to 10.3.4.

Release notes

Sourced from cspell's releases.

v10.3.4

Fixes

fix: Report errors (#9267)

This pull request introduces improvements to error handling and debugging information in the spell-checking workflow. The main changes focus on providing more informative error messages and ensuring that errors encountered during document processing are surfaced promptly.

Error handling improvements:

• In processFile (packages/cspell/src/lint/processFile.ts), the function now throws the first error from r.errors if any are present, ensuring that errors encountered during spell checking are not silently ignored.

Debugging and diagnostics:

• In resolveParser (packages/cspell-lib/src/lib/Settings/CSpellSettingsServer.ts), the assertion message has been enhanced to include a list of available parsers when a requested parser is not found, making it easier to diagnose configuration issues.

---

fix: ParsedTag can only be boolean values for now. (#9268)

This pull request updates the ParsedTag type throughout the codebase to remove the possibility of a string value, restricting it to only boolean or undefined. This change is applied consistently across type definitions and source files.

Note: The is possible because it has only been an experimental feature and isn't used.

Type definition changes:

• Updated the ParsedTag type in packages/cspell-types/api/Parser/index.d.mts to only allow boolean or undefined, removing support for string.
• Updated the ParsedTag type in packages/cspell-types/api/index.d.mts to only allow boolean or undefined, removing support for string.
• Updated the ParsedTag type in packages/cspell-types/src/Parser/parser.ts to only allow boolean or undefined, removing support for string.

---

fix: Fix Sponsor cards on npmjs (#9260)

---

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.3.4 (2026-09-24)

Fixes

fix: Report errors (#9267)

This pull request introduces improvements to error handling and debugging information in the spell-checking workflow. The main changes focus on providing more informative error messages and ensuring that errors encountered during document processing are surfaced promptly.

Error handling improvements:

• In processFile (packages/cspell/src/lint/processFile.ts), the function now throws the first error from r.errors if any are present, ensuring that errors encountered during spell checking are not silently ignored.

Debugging and diagnostics:

• In resolveParser (packages/cspell-lib/src/lib/Settings/CSpellSettingsServer.ts), the assertion message has been enhanced to include a list of available parsers when a requested parser is not found, making it easier to diagnose configuration issues.

---

fix: ParsedTag can only be boolean values for now. (#9268)

This pull request updates the ParsedTag type throughout the codebase to remove the possibility of a string value, restricting it to only boolean or undefined. This change is applied consistently across type definitions and source files.

Note: The is possible because it has only been an experimental feature and isn't used.

Type definition changes:

• Updated the ParsedTag type in packages/cspell-types/api/Parser/index.d.mts to only allow boolean or undefined, removing support for string.
• Updated the ParsedTag type in packages/cspell-types/api/index.d.mts to only allow boolean or undefined, removing support for string.
• Updated the ParsedTag type in packages/cspell-types/src/Parser/parser.ts to only allow boolean or undefined, removing support for string.

---

fix: Fix Sponsor cards on npmjs (#9260)

---

... (truncated)

Commits

• 7bb5c47 v10.3.4
• 0168977 chore: Prepare Release v10.3.4 (auto-deploy) (#9263)
• 7475fb9 fix: Report errors (#9267)
• f52ee7e v10.3.4-alpha.0
• 7c0aafa chore: Prepare Release v10.3.4-alpha.0 (auto-deploy) (#9256)
• b60e9f5 chore: Update README.md (#9259)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Caution

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. For more information please check in at #security-help. For License Policy Violations, please refer to ADR-656 (https://github.com/Gusto/adr/pull/656)

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		License policy violation: npm vscode-languageserver-textdocument under LGPL-2.1-or-later AND MIT Location: Package overview From: package-lock.json → npm/cspell@10.3.4 → npm/vscode-languageserver-textdocument@1.0.15 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vscode-languageserver-textdocument@1.0.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report