chore(deps): update all non-major dependencies#220
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update all non-major dependencies#220renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
036e7de to
9a7c9cc
Compare
27d21a0 to
7ba4462
Compare
60f99d4 to
00591e2
Compare
6fa43a1 to
141a6b3
Compare
166c348 to
7920351
Compare
e59c5ab to
68cfac5
Compare
549cf5b to
58769f5
Compare
26540c1 to
40d5fcc
Compare
40d5fcc to
58d6970
Compare
c4dbb8f to
8a04d8d
Compare
885d8c2 to
740db3c
Compare
7f70629 to
a372229
Compare
c3d60a5 to
4d03323
Compare
1cd44a7 to
c6d4cf7
Compare
c6d4cf7 to
1cba0b9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^22.18.8→^22.19.10^0.25.10→^0.27.3^9.37.0→^9.39.2^0.5.0→^0.6.210.18.0→10.29.2^3.6.2→^3.8.1^2.0.2→^2.1.0Release Notes
evanw/esbuild (esbuild)
v0.27.3Compare Source
Preserve URL fragments in data URLs (#4370)
Consider the following HTML, CSS, and SVG:
index.html:icons.css:triangle.svg:The CSS uses a URL fragment (the
#x) to reference theclipPathelement in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using thedataurlloader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:Parse and print CSS
@scoperules (#4322)This release includes dedicated support for parsing
@scoperules in CSS. These rules include optional "start" and "end" selector lists. One important consequence of this is that the local/global status of names in selector lists is now respected, which improves the correctness of esbuild's support for CSS modules. Minification of selectors inside@scoperules has also improved slightly.Here's an example:
Fix a minification bug with lowering of
for await(#4378, #4385)This release fixes a bug where the minifier would incorrectly strip the variable in the automatically-generated
catchclause of loweredfor awaitloops. The code that generated the loop previously failed to mark the internal variable references as used.Update the Go compiler from v1.25.5 to v1.25.7 (#4383, #4388)
This PR was contributed by @MikeWillCook.
v0.27.2Compare Source
Allow import path specifiers starting with
#/(#4361)Previously the specification for
package.jsondisallowed import path specifiers starting with#/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping#/*to./src/*(previously you had to use another character such as#_*instead, which was more confusing). There is some more context in nodejs/node#49182.This change was contributed by @hybrist.
Automatically add the
-webkit-maskprefix (#4357, #4358)This release automatically adds the
-webkit-vendor prefix for themaskCSS shorthand property:This change was contributed by @BPJEnnova.
Additional minification of
switchstatements (#4176, #4359)This release contains additional minification patterns for reducing
switchstatements. Here is an example:Forbid
usingdeclarations insideswitchclauses (#4323)This is a rare change to remove something that was previously possible. The Explicit Resource Management proposal introduced
usingdeclarations. These were previously allowed insidecaseanddefaultclauses inswitchstatements. This had well-defined semantics and was already widely implemented (by V8, SpiderMonkey, TypeScript, esbuild, and others). However, it was considered to be too confusing because of how scope works in switch statements, so it has been removed from the specification. This edge case will now be a syntax error. See tc39/proposal-explicit-resource-management#215 and rbuckton/ecma262#14 for details.Here is an example of code that is no longer allowed:
That code will now have to be modified to look like this instead (note the additional
{and}block statements around each case body):This is not being released in one of esbuild's breaking change releases since this feature hasn't been finalized yet, and esbuild always tracks the current state of the specification (so esbuild's previous behavior was arguably incorrect).
v0.27.1Compare Source
Fix bundler bug with
varnested insideif(#4348)This release fixes a bug with the bundler that happens when importing an ES module using
require(which causes it to be wrapped) and there's a top-levelvarinside anifstatement without being wrapped in a{ ... }block (and a few other conditions). The bundling transform needed to hoist thesevardeclarations outside of the lazy ES module wrapper for correctness. See the issue for details.Fix minifier bug with
forinsidetryinside label (#4351)This fixes an old regression from version v0.21.4. Some code was introduced to move the label inside the
trystatement to address a problem with transforming labeledfor awaitloops to avoid theawait(the transformation involves converting thefor awaitloop into aforloop and wrapping it in atrystatement). However, it introduces problems for cross-compiled JVM code that uses all three of these features heavily. This release restricts this transform to only apply toforloops that esbuild itself generates internally as part of thefor awaittransform. Here is an example of some affected code:Inline IIFEs containing a single expression (#4354)
Previously inlining of IIFEs (immediately-invoked function expressions) only worked if the body contained a single
returnstatement. Now it should also work if the body contains a single expression statement instead:The minifier now strips empty
finallyclauses (#4353)This improvement means that
finallyclauses containing dead code can potentially cause the associatedtrystatement to be removed from the output entirely in minified builds:Allow tree-shaking of the
SymbolconstructorWith this release, calling
Symbolis now considered to be side-effect free when the argument is known to be a primitive value. This means esbuild can now tree-shake module-level symbol variables:v0.27.0Compare Source
This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of
esbuildin yourpackage.jsonfile (recommended) or be using a version range syntax that only accepts patch upgrades such as^0.26.0or~0.26.0. See npm's documentation about semver for more information.Use
Uint8Array.fromBase64if available (#4286)With this release, esbuild's
binaryloader will now use the newUint8Array.fromBase64function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specifytargetwhen using this feature with Node (for example--target=node22) unless you're using Node v25+.Update the Go compiler from v1.23.12 to v1.25.4 (#4208, #4311)
This raises the operating system requirements for running esbuild:
v0.26.0Compare Source
Enable trusted publishing (#4281)
GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.
Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).
v0.25.12Compare Source
Fix a minification regression with CSS media queries (#4315)
The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for
@media <media-type> and <media-condition-without-or> { ... }was missing an equality check for the<media-condition-without-or>part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.Update the list of known JavaScript globals (#4310)
This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global
Arrayproperty is considered to be side-effect free but accessing the globalscrollYproperty can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:From ES2017:
AtomicsSharedArrayBufferFrom ES2020:
BigInt64ArrayBigUint64ArrayFrom ES2021:
FinalizationRegistryWeakRefFrom ES2025:
Float16ArrayIteratorNote that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from
Iterator:Add support for the new
@view-transitionCSS rule (#4313)With this release, esbuild now has improved support for pretty-printing and minifying the new
@view-transitionrule (which esbuild was previously unaware of):The new view transition feature provides a mechanism for creating animated transitions between documents in a multi-page app. You can read more about view transition rules here.
This change was contributed by @yisibl.
Trim CSS rules that will never match
The CSS minifier will now remove rules whose selectors contain
:is()and:where()as those selectors will never match. These selectors can currently be automatically generated by esbuild when you give esbuild nonsensical input such as the following:This input is nonsensical because CSS nesting is (unfortunately) not supported inside of pseudo-elements such as
:before. Currently esbuild generates a rule containing:is()in this case when you tell esbuild to transform nested CSS into non-nested CSS. I think it's reasonable to do that as it sort of helps explain what's going on (or at least indicates that something is wrong in the output). It shouldn't be present in minified code, however, so this release now strips it out.v0.25.11Compare Source
Add support for
with { type: 'bytes' }imports (#4292)The import bytes proposal has reached stage 2.7 in the TC39 process, which means that although it isn't quite recommended for implementation, it's generally approved and ready for validation. Furthermore it has already been implemented by Deno and Webpack. So with this release, esbuild will also add support for this. It behaves exactly the same as esbuild's existing
binaryloader. Here's an example:Lower CSS media query range syntax (#3748, #4293)
With this release, esbuild will now transform CSS media query range syntax into equivalent syntax using
min-/max-prefixes for older browsers. For example, the following CSS:will be transformed like this with a target such as
--target=chrome100(or more specifically with--supported:media-range=falseif desired):eslint/eslint (eslint)
v9.39.2Compare Source
v9.39.1Compare Source
v9.39.0Compare Source
v9.38.0Compare Source
Features
ce40f74feat: updatecomplexityrule to only highlight function header (#20048) (Atul Nair)e37e590feat: correctno-loss-of-precisionfalse positives withenotation (#20187) (Francesco Trotta)Bug Fixes
50c3dfdfix: improve type support for isolated dependencies in pnpm (#20201) (Francesco Trotta)a1f06a3fix: correct SourceCode typings (#20114) (Pixel998)Documentation
462675adocs: improve web accessibility by hiding non-semantic character (#20205) (루밀LuMir)c070e65docs: correct formatting inno-irregular-whitespacerule documentation (#20203) (루밀LuMir)b39e71adocs: Update README (GitHub Actions Bot)cd39983docs: movecustom-formatterstype descriptions tonodejs-api(#20190) (Percy Ma)Chores
d17c795chore: upgrade @eslint/js@9.38.0 (#20221) (Milos Djermanovic)25d0e33chore: package.json update for @eslint/js release (Jenkins)c82b5efrefactor: Use types from @eslint/core (#20168) (Nicholas C. Zakas)ff31609ci: add Node.js 25 toci.yml(#20220) (루밀LuMir)004577eci: bump github/codeql-action from 3 to 4 (#20211) (dependabot[bot])eac71fbtest: remove use ofnodejsScopeoption of eslint-scope from tests (#20206) (Milos Djermanovic)4168a18chore: fix typo in legacy-eslint.js (#20202) (Sweta Tanwar)205dbd2chore: fix typos (#20200) (ntnyq)dbb200echore: use team member's username when name is not available in data (#20194) (Milos Djermanovic)8962089chore: mark deprecated rules as available until v11.0.0 (#20184) (Pixel998)unjs/eslint-config (eslint-config-unjs)
v0.6.2Compare Source
compare changes
🩹 Fixes
❤️ Contributors
v0.6.1Compare Source
compare changes
💅 Refactors
@eslint/markdown(2f92a53)📦 Build
🏡 Chore
❤️ Contributors
v0.6.0Compare Source
compare changes
💅 Refactors
@eslint/markdown(2f92a53)📦 Build
🏡 Chore
❤️ Contributors
pnpm/pnpm (pnpm)
v10.29.2Compare Source
v10.29.1: pnpm 10.29.1Compare Source
Minor Changes
pnpm dlx/pnpxcommand now supports thecatalog:protocol. Example:pnpm dlx shx@catalog:.auditLevelin thepnpm-workspace.yamlfile #10540.workspace:protocol without version specifier. It is now treated asworkspace:*and resolves to the concrete version during publish #10436.Patch Changes
Fixed
pnpm list --jsonreturning incorrect paths when using global virtual store #10187.Fix
pnpm store pathandpnpm store statususing workspace root for path resolution whenstoreDiris relative #10290.Fixed
pnpm run -rfailing with "No projects matched the filters" when an emptypnpm-workspace.yamlexists #10497.Fixed a bug where
catalogMode: strictwould write the literal string"catalog:"topnpm-workspace.yamlinstead of the resolved version specifier when re-adding an existing catalog dependency #10176.Fixed the documentation URL shown in
pnpm completion --helpto point to the correct page at https://pnpm.io/completion #10281.Skip local
file:protocol dependencies duringpnpm fetch. This fixes an issue wherepnpm fetchwould fail in Docker builds when local directory dependencies were not available #10460.Fixed
pnpm audit --jsonto respect the--audit-levelsetting for both exit code and output filtering #10540.update tar to version 7.5.7 to fix security issue
Updating the version of dependency tar to 7.5.7 because the previous one have a security vulnerability reported here: CVE-2026-24842
Fix
pnpm audit --fixreplacing reference overrides (e.g.$foo) with concrete versions #10325.Fix
shamefullyHoistset viaupdateConfigin.pnpmfile.cjsnot being converted topublicHoistPattern#10271.pnpm helpshould correctly report if the currently running pnpm CLI is bundled with Node.js #10561.Add a warning when the current directory contains the PATH delimiter character. On macOS, folder names containing forward slashes (/) appear as colons (:) at the Unix layer. Since colons are PATH separators in POSIX systems, this breaks PATH injection for
node_modules/.bin, causing binaries to not be found when running commands likepnpm exec#10457.Platinum Sponsors
Gold Sponsors
v10.28.2: pnpm 10.28.2Compare Source
Patch Changes
Security fix: prevent path traversal in
directories.binfield.When pnpm installs a
file:orgit:dependency, it now validates that symlinks point within the package directory. Symlinks to paths outside the package root are skipped to prevent local data from being leaked intonode_modules.This fixes a security issue where a malicious package could create symlinks to sensitive files (e.g.,
/etc/passwd,~/.ssh/id_rsa) and have their contents copied when the package is installed.Note: This only affects
file:andgit:dependencies. Registry packages (npm) have symlinks stripped during publish and are not affected.Fixed optional dependencies to request full metadata from the registry to get the
libcfield, which is required for proper platform compatibility checks #9950.Platinum Sponsors
Gold Sponsors
v10.28.1Compare Source
v10.28.0Compare Source
v10.27.0Compare Source
v10.26.2: pnpm 10.26.2Compare Source
Patch Changes
Improve error message when a package version exists but does not meet the
minimumReleaseAgeconstraint. The error now clearly states that the version exists and shows a human-readable time since release (e.g., "released 6 hours ago") #10307.Fix installation of Git dependencies using annotated tags #10335.
Previously, pnpm would store the annotated tag object's SHA in the lockfile instead of the actual commit SHA. This caused
ERR_PNPM_GIT_CHECKOUT_FAILEDerrors because the checked-out commit hash didn't match the stored tag object hash.Binaries of runtime engines (Node.js, Deno, Bun) are written to
node_modules/.binbefore lifecycle scripts (install, postinstall, prepare) are executed #10244.Try to avoid making network calls with preferOffline #10334.
Platinum Sponsors
Gold Sponsors
v10.26.1: pnpm 10.26.1Compare Source
Patch Changes
pnpm add, whenblockExoticSubdepsis set totrue#10324.HEADpoints to the commit after checkout #10310.Platinum Sponsors
Gold Sponsors
v10.26.0Compare Source
v10.25.0Compare Source
v10.24.0Compare Source
v10.23.0: pnpm 10.23Compare Source
Minor Changes
--lockfile-onlyoption topnpm list#10020.Patch Changes
pnpm self-updateshould download pnpm from the configured npm registry #10205.pnpm self-updateshould always install the non-executable pnpm package (pnpm in the registry) and never the@pnpm/exepackage, when installing v11 or newer. We currently cannot ship@pnpm/exeaspkgdoesn't work with ESM #10190.pnpm add, if there's aengines.runtimesetting declared inpackage.json#10209.pnpm listandpnpm whynow display npm: protocol for aliased packages (e.g.,foo npm:is-odd@3.0.1) #8660.pnpm store pruneshould not fail if the store contains Node.js packages #10131.Platinum Sponsors
Gold Sponsors
v10.22.0: pnpm 10.22Compare Source
Minor Changes
Added support for
trustPolicyExclude#10164.You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:
Allow to override the
enginesfield on publish by thepublishConfig.enginesfield.Patch Changes
Platinum Sponsors
Gold Sponsors
v10.21.0Compare Source
v10.20.0Compare Source
Minor Changes
--alloption inpnpm --helpto list all commands #8628.Patch Changes
latestversion doesn't satisfy the maturity requirement configured byminimumReleaseAge, pick the highest version that is mature enough, even if itConfiguration
📅 Schedule: Branch creation - "after 2am and before 3am" (UTC), Automerge - "after 1am and before 2am" (UTC).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.