Bump the npm-packages group with 6 updates by dependabot[bot] · Pull Request #877 · clangd/vscode-clangd

dependabot · 2025-10-01T04:04:23Z

Bumps the npm-packages group with 6 updates:

Package	From	To
@types/node	`24.3.0`	`24.6.1`
@vscode/vsce	`3.6.0`	`3.6.2`
esbuild	`0.25.9`	`0.25.10`
mocha	`11.7.1`	`11.7.3`
ovsx	`0.10.5`	`0.10.6`
typescript	`5.9.2`	`5.9.3`

Updates @types/node from 24.3.0 to 24.6.1

Commits

See full diff in compare view

Updates @vscode/vsce from 3.6.0 to 3.6.2

Release notes

Sourced from @vscode/vsce's releases.

v3.6.2

Changes:

#1199: fix: generate language model tag for languageModelChatProvider contributions

This list of changes was auto generated.

v3.6.2-0

Changes:

#1199: fix: generate language model tag for languageModelChatProvider contributions

This list of changes was auto generated.

v3.6.1

Changes:

#1198: chore: bump vsce-sign to 2.0.7

#1194: Engineering - do not run Azure Pipeline for pull requests

#1193: fix: check exec params

#1191: Bump tmp from 0.2.3 to 0.2.4

#1188: Avoid Node.js DEP0190 warning by using string form for prepublish command

#1190: chore: migrate PR check to GitHub Actions

#1189: update secretlint

#1187: Bump form-data from 4.0.0 to 4.0.4

#1185: chore: onboard OSS pipeline to 1ES template

#1179: add commonjs annotation to package.json

This list of changes was auto generated.

v3.6.1-9

Changes:

#1198: chore: bump vsce-sign to 2.0.7

This list of changes was auto generated.

v3.6.1-8

Changes:

... (truncated)

Commits

6a944cc Merge pull request #1199 from joyceerhl/patch-1
623d46c fix test
70f3535 fix: generate language model tag for languageModelChatProvider contributions
d9422df chore: bump vsce-sign to 2.0.7 (#1198)
91b5381 Engineering - do not run Azure Pipeline for pull requests (#1194)
6d9f87e fix: check exec params (#1193)
8fa2eb5 Bump tmp from 0.2.3 to 0.2.4 (#1191)
6b0b21d Avoid Node.js DEP0190 warning by using string form for prepublish command (#1...
29a2b75 chore: migrate PR check to GitHub Actions (#1190)
472e6ec Merge pull request #1189 from microsoft/benibenj/other-tarantula
Additional commits viewable in compare view

Updates esbuild from 0.25.9 to 0.25.10

Release notes

Sourced from esbuild's releases.

v0.25.10
Fix a panic in a minification edge case (#4287)

This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):
function identity(x) { return x }
identity({ y: identity(123) })
Fix @supports nested inside pseudo-element (#4265)

When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:
/* Original code */
::placeholder {
  color: red;
  body & { color: green }
  @supports (color: blue) { color: blue }
}
/* Old output (with --supported:nesting=false) */
::placeholder {
color: red;
}
body :is() {
color: green;
}
@supports (color: blue) {
{
color: blue;
}
}
/* New output (with --supported:nesting=false) */
::placeholder {
color: red;
}
body :is() {
color: green;
}
@supports (color: blue) {
::placeholder {
color: blue;
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.25.10
Fix a panic in a minification edge case (#4287)

This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):
function identity(x) { return x }
identity({ y: identity(123) })
Fix @supports nested inside pseudo-element (#4265)

When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:
/* Original code */
::placeholder {
  color: red;
  body & { color: green }
  @supports (color: blue) { color: blue }
}
/* Old output (with --supported:nesting=false) */
::placeholder {
color: red;
}
body :is() {
color: green;
}
@supports (color: blue) {
{
color: blue;
}
}
/* New output (with --supported:nesting=false) */
::placeholder {
color: red;
}
body :is() {
color: green;
}
@supports (color: blue) {
::placeholder {
color: blue;

... (truncated)

Commits

d6b668f publish 0.25.10 to npm
5088c19 refactor: use strings.Builder (#4290)
755da31 run make update-compat-table
a1d9c86 fix #4287: marked the wrong issue as fixed
73a0b2a fix #4286: minifier panic due to identity function
134dadf fix #4265: @supports nested inside ::pseudo
See full diff in compare view

Updates mocha from 11.7.1 to 11.7.3

Release notes

Sourced from mocha's releases.

v11.7.3

11.7.3 (2025-09-30)

🩹 Fixes

use original require() error for TS files if ERR_UNKNOWN_FILE_EXTENSION (#5408) (ebdbc48)

📚 Documentation

add security escalation policy (#5466) (4122c7d)

fix duplicate global leak documentation (#5461) (1164b9d)

migrate third party UIs wiki page to docs (#5434) (6654704)

update maintainer release notes for release-please (#5453) (185ae1e)

🤖 Automation

deps: bump actions/setup-node in the github-actions group (#5459) (48c6f40)

v11.7.2

11.7.2 (2025-09-01)

🩹 Fixes

fail with an informative error message on a file with a broken default import (#5413) (b0e6135)

load mjs files correctly (#5429) (a947b9b)

📚 Documentation

add banner from old site to new site, link from new to old (#5414) (dedef11)

add info on spies to legacy docs (#5421) (21f5544)

explain node import swallowing error (#5401) (09f5b2c)

fix links in new site (#5416) (b2bc769)

migrate assertion libraries wiki link to main docs (#5442) (95f3ca8)

migrate count assertions wiki page to docs (#5438) (02a306c)

migrate shared behaviours to docs-next (#5432) (1dc4aa9)

migrate Spies wiki page to explainers (#5420) (cbcf007)

Migrate tagging wiki page to docs (#5435) (876247a)

migrate third party reporters wiki page to docs (#5433) (f70764c)

migrate to global leak wiki page to docs (#5437) (8a6fdca)

update /next bug report link to be docs issue template (#5424) (668cb66)

🧹 Chores

add issue form for ⚡️ Performance (#5406) (a908b3b)

... (truncated)

Changelog

Sourced from mocha's changelog.

11.7.3 (2025-09-30)

🩹 Fixes

use original require() error for TS files if ERR_UNKNOWN_FILE_EXTENSION (#5408) (ebdbc48)

📚 Documentation

add security escalation policy (#5466) (4122c7d)

fix duplicate global leak documentation (#5461) (1164b9d)

migrate third party UIs wiki page to docs (#5434) (6654704)

update maintainer release notes for release-please (#5453) (185ae1e)

🤖 Automation

deps: bump actions/setup-node in the github-actions group (#5459) (48c6f40)

11.7.2 (2025-09-01)

🩹 Fixes

fail with an informative error message on a file with a broken default import (#5413) (b0e6135)

load mjs files correctly (#5429) (a947b9b)

📚 Documentation

add banner from old site to new site, link from new to old (#5414) (dedef11)

add info on spies to legacy docs (#5421) (21f5544)

explain node import swallowing error (#5401) (09f5b2c)

fix links in new site (#5416) (b2bc769)

migrate assertion libraries wiki link to main docs (#5442) (95f3ca8)

migrate count assertions wiki page to docs (#5438) (02a306c)

migrate shared behaviours to docs-next (#5432) (1dc4aa9)

migrate Spies wiki page to explainers (#5420) (cbcf007)

Migrate tagging wiki page to docs (#5435) (876247a)

migrate third party reporters wiki page to docs (#5433) (f70764c)

migrate to global leak wiki page to docs (#5437) (8a6fdca)

update /next bug report link to be docs issue template (#5424) (668cb66)

🧹 Chores

add issue form for ⚡️ Performance (#5406) (a908b3b)

add test for -R import-only-loader (#5391) (6ee5b48)

also test Node.js 24 in CI (#5405) (15f5980)

... (truncated)

Commits

c805327 chore(main): release 11.7.3 (#5455)
ebdbc48 fix: use original require() error for TS files if ERR_UNKNOWN_FILE_EXTENSION ...
4122c7d docs: add security escalation policy (#5466)
1164b9d docs: fix duplicate global leak documentation (#5461)
48c6f40 build(deps): bump actions/setup-node in the github-actions group (#5459)
6654704 docs: migrate third party UIs wiki page to docs (#5434)
55fd22a Cleanup "related tools" pages (#5457)
56486b1 Update authors, make release-please do the same (#5456)
185ae1e docs: update maintainer release notes for release-please (#5453)
5f8e8a8 chore(main): release 11.7.2 (#5398)
Additional commits viewable in compare view

Updates ovsx from 0.10.5 to 0.10.6

Changelog

Sourced from ovsx's changelog.

v0.10.6 (Seo. 2025)

Dependencies

Upgrade tar-fs from 2.1.3 to 2.1.4 (#1353)

Upgrade tmp from 0.2.3 to 0.2.4 (#1304)

Upgrade form-data from 4.0.0 to 4.0.4 (#1291)

Commits

See full diff in compare view

Updates typescript from 5.9.2 to 5.9.3

Release notes

Sourced from typescript's releases.

TypeScript 5.9.3

Commits

31a0ead Don't compare "missing" to undefined in compareProperties under `exactOpt...
d4b15eb Enhance type argument completions (#62170)
83ff202 Bump the github-actions group across 1 directory with 2 updates (#62507)
e350126 Port microsoft/typescript-go#1764 (#62510)
97610a8 Port microsoft/typescript-go#1757 (#62501)
1cd5309 Port microsoft/typescript-go#1759 (#62502)
5f183ad Revert PR 61928 (#62423)
6f6efb4 Disable conditional exports fallbacks on null values (#62483)
96acaa5 Remove no-default-lib (#62435)
904e7dd Enable noUncheckedSideEffectImports by default (#62443)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-packages group with 6 updates: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.3.0` | `24.6.1` | | [@vscode/vsce](https://github.com/Microsoft/vsce) | `3.6.0` | `3.6.2` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.9` | `0.25.10` | | [mocha](https://github.com/mochajs/mocha) | `11.7.1` | `11.7.3` | | [ovsx](https://github.com/eclipse/openvsx/tree/HEAD/cli) | `0.10.5` | `0.10.6` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.2` | `5.9.3` | Updates `@types/node` from 24.3.0 to 24.6.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vscode/vsce` from 3.6.0 to 3.6.2 - [Release notes](https://github.com/Microsoft/vsce/releases) - [Commits](microsoft/vscode-vsce@v3.6.0...v3.6.2) Updates `esbuild` from 0.25.9 to 0.25.10 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.25.9...v0.25.10) Updates `mocha` from 11.7.1 to 11.7.3 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md) - [Commits](mochajs/mocha@v11.7.1...v11.7.3) Updates `ovsx` from 0.10.5 to 0.10.6 - [Release notes](https://github.com/eclipse/openvsx/releases) - [Changelog](https://github.com/eclipse/openvsx/blob/master/cli/CHANGELOG.md) - [Commits](https://github.com/eclipse/openvsx/commits/HEAD/cli) Updates `typescript` from 5.9.2 to 5.9.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release-publish.yml) - [Commits](microsoft/TypeScript@v5.9.2...v5.9.3) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 24.6.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-packages - dependency-name: "@vscode/vsce" dependency-version: 3.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-packages - dependency-name: esbuild dependency-version: 0.25.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-packages - dependency-name: mocha dependency-version: 11.7.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-packages - dependency-name: ovsx dependency-version: 0.10.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-packages - dependency-name: typescript dependency-version: 5.9.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-packages ... Signed-off-by: dependabot[bot] <support@github.com>

tamird · 2025-10-01T11:15:48Z

@dependabot merge

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2025

dependabot bot merged commit 8fb50f0 into master Oct 1, 2025
1 check passed

dependabot bot deleted the dependabot/npm_and_yarn/npm-packages-7c157a7bb2 branch October 1, 2025 11:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm-packages group with 6 updates#877

Bump the npm-packages group with 6 updates#877
dependabot[bot] merged 1 commit intomasterfrom
dependabot/npm_and_yarn/npm-packages-7c157a7bb2

dependabot bot commented on behalf of github Oct 1, 2025

Uh oh!

tamird commented Oct 1, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Oct 1, 2025

v3.6.2

Changes:

v3.6.2-0

Changes:

v3.6.1

Changes:

v3.6.1-9

Changes:

v3.6.1-8

Changes:

v0.25.10

0.25.10

v11.7.3

11.7.3 (2025-09-30)

🩹 Fixes

📚 Documentation

🤖 Automation

v11.7.2

11.7.2 (2025-09-01)

🩹 Fixes

📚 Documentation

🧹 Chores

11.7.3 (2025-09-30)

🩹 Fixes

📚 Documentation

🤖 Automation

11.7.2 (2025-09-01)

🩹 Fixes

📚 Documentation

🧹 Chores

v0.10.6 (Seo. 2025)

Dependencies

TypeScript 5.9.3

Uh oh!

tamird commented Oct 1, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant