build: update all non-major dependencies

[angular-robot]

This PR contains the following updates:

Package	Type	Update	Change
@typescript-eslint/eslint-plugin (source)	devDependencies	minor	8.35.1 -> 8.36.0
@typescript-eslint/parser (source)	devDependencies	minor	8.35.1 -> 8.36.0
baseline-browser-mapping	devDependencies	minor	2.4.4 -> 2.5.3
beasties (source)	dependencies	patch	0.3.4 -> 0.3.5
beasties (source)	devDependencies	patch	0.3.4 -> 0.3.5
esbuild	optionalDependencies	patch	0.25.5 -> 0.25.6
esbuild	dependencies	patch	0.25.5 -> 0.25.6
esbuild	devDependencies	patch	0.25.5 -> 0.25.6
esbuild-wasm	dependencies	patch	0.25.5 -> 0.25.6
esbuild-wasm	devDependencies	patch	0.25.5 -> 0.25.6
piscina	dependencies	patch	5.1.2 -> 5.1.3
vite (source)	dependencies	patch	7.0.2 -> 7.0.4
webpack	devDependencies	minor	5.99.9 -> 5.100.0
webpack	dependencies	minor	5.99.9 -> 5.100.0
zod (source)	dependencies	patch	3.25.75 -> 3.25.76

---

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.36.0

Compare Source

This was a version bump only for eslint-plugin to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.36.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.5.3

Compare Source

What's Changed

• fix: Add main entry point to exports to support ESM resolution by @​alan-agius4 in https://github.com/web-platform-dx/baseline-browser-mapping/pull/92
  • The /legacy import path is no longer required for CommonJS context as the distinction is handled in package.json; however, the option to use /legacy has been preserved in case anyone started using it in production in the last 24 hrs.
• update tests to check module resolution rather than using relative directory.

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.5.2...v2.5.3

v2.5.2: - types bug fix

Compare Source

What's Changed

• fix: correct path of types fields in package.json by @​alan-agius4 in https://github.com/web-platform-dx/baseline-browser-mapping/pull/91

New Contributors

• Big thanks to @​alan-agius4 for their first contribution in https://github.com/web-platform-dx/baseline-browser-mapping/pull/91

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.5.1...v2.5.2

v2.5.1: - data updates

Compare Source

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.5.0...v2.5.1

v2.5.0: - Browser support, simplified dependencies!

Compare Source

✨ What's new for users?

• baseline-browser-mapping is now supported in browser contexts. Frameworks that support module resolution will now load a single JS file of ~110kb (~22kb when compressed) and allows loading from CDNs like jsdelivr and unpkg.
• Adds support for CommonJS Node environments using the /legacy export path - no shimming required!
• baseline-browser-mapping will now Issues a console warning if the current version of the module is >2 months old.

⚙️ Under the hood

• Refactors methodology for including data from web-features, @mdn/browser-compat-data and downstream-browsers.json. Instead of using direct dependencies, these modules are now pre-packaged into the exported script using daily GitHub Actions.
• Jasmine test suite and other CLI tests now included to make it easier to contribute and prevent unintended regressions - all tests can be executed together using npm run test.
• Simplifies GitHub actions and removes Dependabot - critical data updates to web-feature and @mdn/browser-compat-data are now part of the refresh_data.yml action which only creates a new version of baseline-browser-mapping if the features or browsers information from the data provider modules has changed meaningfully.
• Incoporates @​notpushkin 's simplified compareVersions() function from https://github.com/web-platform-dx/baseline-browser-mapping/pull/68
• Updates web-features to 2.41.0 and @mdn/browser-compat-data to 6.0.29.

New Contributors

• @​mrtnvh made their first contribution in https://github.com/web-platform-dx/baseline-browser-mapping/pull/64

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.4.5...v2.5.0

danielroe/beasties (beasties)

v0.3.5

Compare Source

   🐞 Bug Fixes

• Write pruned css to disk when pruneSource is enabled  -  by @​shishkin17 in https://github.com/danielroe/beasties/issues/138 (91453)

    View changes on GitHub

evanw/esbuild (esbuild)

v0.25.6

Compare Source

• Fix a memory leak when cancel() is used on a build context (#​4231)

  Calling rebuild() followed by cancel() in rapid succession could previously leak memory. The bundler uses a producer/consumer model internally, and the resource leak was caused by the consumer being termianted while there were still remaining unreceived results from a producer. To avoid the leak, the consumer now waits for all producers to finish before terminating.

• Support empty :is() and :where() syntax in CSS (#​4232)

  Previously using these selectors with esbuild would generate a warning. That warning has been removed in this release for these cases.

• Improve tree-shaking of try statements in dead code (#​4224)

  With this release, esbuild will now remove certain try statements if esbuild considers them to be within dead code (i.e. code that is known to not ever be evaluated). For example:

  // Original code
  return 'foo'
  try { return 'bar' } catch {}
  
  // Old output (with --minify)
  return"foo";try{return"bar"}catch{}
  
  // New output (with --minify)
  return"foo";

• Consider negated bigints to have no side effects

  While esbuild currently considers 1, -1, and 1n to all have no side effects, it didn't previously consider -1n to have no side effects. This is because esbuild does constant folding with numbers but not bigints. However, it meant that unused negative bigint constants were not tree-shaken. With this release, esbuild will now consider these expressions to also be side-effect free:

  // Original code
  let a = 1, b = -1, c = 1n, d = -1n
  
  // Old output (with --bundle --minify)
  (()=>{var n=-1n;})();
  
  // New output (with --bundle --minify)
  (()=>{})();

• Support a configurable delay in watch mode before rebuilding (#​3476, #​4178)

  The watch() API now takes a delay option that lets you add a delay (in milliseconds) before rebuilding when a change is detected in watch mode. If you use a tool that regenerates multiple source files very slowly, this should make it more likely that esbuild's watch mode won't generate a broken intermediate build before the successful final build. This option is also available via the CLI using the --watch-delay= flag.

  This should also help avoid confusion about the watch() API's options argument. It was previously empty to allow for future API expansion, which caused some people to think that the documentation was missing. It's no longer empty now that the watch() API has an option.

• Allow mixed array for entryPoints API option (#​4223)

  The TypeScript type definitions now allow you to pass a mixed array of both string literals and object literals to the entryPoints API option, such as ['foo.js', { out: 'lib', in: 'bar.js' }]. This was always possible to do in JavaScript but the TypeScript type definitions were previously too restrictive.

• Update Go from 1.23.8 to 1.23.10 (#​4204, #​4207)

  This should have no effect on existing code as this version change does not change Go's operating system support. It may remove certain false positive reports (specifically CVE-2025-4673 and CVE-2025-22874) from vulnerability scanners that only detect which version of the Go compiler esbuild uses.

• Experimental support for esbuild on OpenHarmony (#​4212)

  With this release, esbuild now publishes the @esbuild/openharmony-arm64 npm package for OpenHarmony. It contains a WebAssembly binary instead of a native binary because Go doesn't currently support OpenHarmony. Node does support it, however, so in theory esbuild should now work on OpenHarmony through WebAssembly.

  This change was contributed by @​hqzing.

piscinajs/piscina (piscina)

v5.1.3

Compare Source

What's Changed

• test: remove c8 by @​github-actions in https://github.com/piscinajs/piscina/pull/832
• feat: offload drain events to microtask by @​github-actions in https://github.com/piscinajs/piscina/pull/835
• [Backport v5] chore(deps): bump @​napi-rs/nice by @​github-actions in https://github.com/piscinajs/piscina/pull/838
• [Backport v5] Change assert.strictEqual to a safe early exit by @​github-actions in https://github.com/piscinajs/piscina/pull/844

Full Changelog: piscinajs/piscina@v5.1.2...v5.1.3

vitejs/vite (vite)

v7.0.4

Compare Source

Bug Fixes

• allow resolving bare specifiers to relative paths for entries (#​20379) (324669c)

Build System

• remove @oxc-project/runtime devDep (#​20389) (5e29602)

v7.0.3

Compare Source

Bug Fixes

• client: protect against window being defined but addEv undefined (#​20359) (31d1467)
• define: replace optional values (#​20338) (9465ae1)
• deps: update all non-major dependencies (#​20366) (43ac73d)

Miscellaneous Chores

• deps: update dependency dotenv to v17 (#​20325) (45040d4)
• deps: update dependency rolldown to ^1.0.0-beta.24 (#​20365) (5ab25e7)
• use n/prefer-node-protocol rule (#​20368) (38bb268)

Code Refactoring

• minor changes to reduce diff between normal Vite and rolldown-vite (#​20354) (2e8050e)

webpack/webpack (webpack)

v5.100.0

Compare Source

Fixes

• Fixed the case where an ES modules entry chunk depends on the runtime chunk hash
• Handle function exports in webpack module wrapper
• Ensure dependent chunks are imported before startup & fix duplicate export of 'default'
• Generate lose closing brace when exports are unprovided
• CleanPlugin doesn't unlink same file twice
• Fixed unexpected error codes from fs.unlink on Windows
• Typescript types

Features

• HMR support for ES modules output
• ES module output mode now fully supports splitChunks when external variables and runtimeChunk are not set.
• Added support using keyword
• Implemented tc39 Defer Module Evaluation (experiment)
• Support dynamic template literals expressions for new URL(...)
• Enable ES modules worker chunk loading for Node.js targets
• Improved support for destructing in DefinePlugin
• Added VirtualUrlPlugin to support virtual: scheme

Performance Improvements

• Remove useless startup entrypoint runtime for ES modules output
• Cache new URL(...) evaluate expression

colinhacks/zod (zod)

v3.25.76

Compare Source

Commits:

• 91c9ca6 fix: cleanup _idmap of $ZodRegistry (#​4837)
• 9cce1c5 docs: fix typo in flattenError example on error-formatting page (#​4819) (#​4833)
• a3560ae v3.25.76 (#​4838)
• 5060661 Release 3.25.76
• 7baee4e Update index.mdx (#​4831)

---

Configuration

📅 Schedule: Branch creation - "after 10:00pm every weekday,before 5:00am every weekday,every weekend" in timezone America/Tijuana, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}