Skip to content

fix(deps): update all non-major dependencies#127

Open
renovate[bot] wants to merge 1 commit into
trunkfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#127
renovate[bot] wants to merge 1 commit into
trunkfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Mar 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@ls-lint/ls-lint 2.3.0 → 2.3.1 age confidence
@types/css-tree (source) 2.3.10 → 2.3.11 age confidence
@types/node (source) 22.15.21 → 22.19.19 age confidence
@vitest/coverage-v8 (source) 3.1.4 → 3.2.6 age confidence
bignumber.js ^9.3.0 → ^9.3.1 age confidence
browserslist ^4.24.5 → ^4.28.2 age confidence
cosmiconfig ^9.0.0 → ^9.0.1 age confidence
css-tree ^3.1.0 → ^3.2.1 age confidence
esbuild 0.25.4 → 0.28.0 age confidence
esbuild ^0.25.4 → ^0.28.0 age confidence
eslint (source) 9.27.0 → 9.39.4 age confidence
eslint (source) 9.31.0 → 9.39.4 age confidence
execa ^9.5.3 → ^9.6.1 age confidence
knip (source) 5.57.1 → 5.88.1 age confidence
lefthook 1.11.13 → 1.13.6 age confidence
lightningcss ^1.30.1 → ^1.32.0 age confidence
mlly 1.7.4 → 1.8.2 age confidence
mlly ^1.7.4 → ^1.8.2 age confidence
prettier (source) 3.5.3 → 3.8.3 age confidence
tsx (source) 4.19.4 → 4.22.4 age confidence
zod (source) 3.25.20 → 3.25.76 age confidence
zod (source) ^3.25.20 → ^3.25.76 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

loeffel-io/ls-lint (@​ls-lint/ls-lint)

v2.3.1

Compare Source

What's Changed

New Contributors

Full Changelog: loeffel-io/ls-lint@v2.3.0...v2.3.1

vitest-dev/vitest (@​vitest/coverage-v8)

v3.2.6

Compare Source

v3.2.5

Compare Source

v3.2.4

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v3.2.3

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v3.2.2

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v3.2.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v3.2.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
browserslist/browserslist (browserslist)

v4.28.2

Compare Source

v4.28.1

Compare Source

  • Removed Baseline warning since we have it own warning.
cosmiconfig/cosmiconfig (cosmiconfig)

v9.0.1

Compare Source

  • Fixed a race condition where multiple instances existing simultaneously could cause cosmiconfig to fail to load TypeScript config files.
  • Fixed an issue on Windows where CWD being a short path (e.g. C:\Users\USERNA~1) would cause cosmiconfig to fail to load ESM config files.
csstree/csstree (css-tree)

v3.2.1

Compare Source

  • Fixed parsing of nested function in a group in definition syntax (#​358)

v3.2.0

Compare Source

  • Added "sideEffects": false in package.json
  • Added list option to the parse() method to specify whether the parser should produce a List (by default, list: true) or an array (list: false) for node's children (e.g., SelectorList, Block, etc.)
  • Added support for Functional Notation in definition syntax (for now by wrapping function arguments into an implicit group when necessary, see #​292)
  • Added support for stacked multipliers {A}? and {A,B}? according to spec in definition syntax parsing (#​346)
  • Added math functions support in syntax matching (e.g., min(), max(), etc.) (#​344)
  • Added onToken option to the parse() method, which can be either an array or a function:
    • When the value is an array, it is populated with objects { type, start, end } (token type, and its start and end offsets).
    • When the value is a function, it accepts type, start, end, and index parameters, and is invoked with a token API as this, enabling advanced token handling (see onToken). For example, the following demonstrates checking if all block tokens have matching pairs: 
      parse(css, {
    onToken(type, start, end, index) {
        if (this.isBlockOpenerTokenType(type)) {
            if (this.getBlockPairTokenIndex(index) === -1) {
                console.warn('No closing pair for', this.getTokenValue(index), this.getRangeLocation(start, end));
            }
        } else if (this.isBlockCloserTokenType(type)) {
            if (this.getBlockPairTokenIndex(index) === -1) {
                console.warn('No opening pair for', this.getTokenValue(index), this.getRangeLocation(start, end));
            }
        }
    }
});
  • Extended TokenStream with the following methods:
    • getTokenEnd(tokenIndex) – returns the token's end offset by index, complementing getTokenStart(tokenIndex)
    • getTokenType(tokenIndex) – returns the token's type by index
    • isBlockOpenerTokenType(tokenType) – returns true for <function-token>, <(-token>, <[-token>, and <{-token>
    • isBlockCloserTokenType(tokenType) – returns true for <)-token>, <]-token>, and <}-token>
    • getBlockTokenPairIndex(tokenIndex) – returns the index of the pair token for a block, or -1 if no pair exists
  • Changed generate() to not auto insert whitespaces between tokens for raw values (#​356)
  • Fixed fork() to extend node definitions instead of overriding them. For example, fork({ node: { Dimension: { generate() { /* ... */ } } } }) will now update only the generate() method on the Dimension node, while inheriting all other properties from the previous syntax definition.
  • Bumped mdn/data to 2.27.1 and various fixes in syntaxes
evanw/esbuild (esbuild)

v0.28.0

Compare Source

v0.27.7

Compare Source

v0.27.5

Compare Source

v0.27.4

Compare Source

v0.27.3

Compare Source

v0.27.2

Compare Source

v0.27.1

Compare Source

v0.27.0

Compare Source

v0.26.0

Compare Source

v0.25.12

Compare Source

  • Fix a minification regression with CSS media queries (#​4315)

    The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.

  • Update the list of known JavaScript globals (#​4310)

    This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

    From ES2017:

    • Atomics
    • SharedArrayBuffer

    From ES2020:

    • BigInt64Array
    • BigUint64Array

    From ES2021:

    • FinalizationRegistry
    • WeakRef

    From ES2025:

    • Float16Array
    • Iterator

    Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:

    // This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}

  • Add support for the new @view-transition CSS rule (#​4313)

    With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):

    /* Original code */
@&#8203;view-transition {
  navigation: auto;
  types: check;
}

/* Old output */
@&#8203;view-transition { navigation: auto; types: check; }

/* New output */
@&#8203;view-transition {
  navigation: auto;
  types: check;
}

    The new view transition feature provides a mechanism for creating animated transitions between documents in a multi-page app. You can read more about view transition rules here.

    This change was contributed by @​yisibl.

  • Trim CSS rules that will never match

    The CSS minifier will now remove rules whose selectors contain :is() and :where() as those selectors will never match. These selectors can currently be automatically generated by esbuild when you give esbuild nonsensical input such as the following:

    /* Original code */
div:before {
  color: green;
  &.foo {
    color: red;
  }
}

/* Old output (with --supported:nesting=false --minify) */
div:before{color:green}:is().foo{color:red}

/* New output (with --supported:nesting=false --minify) */
div:before{color:green}

    This input is nonsensical because CSS nesting is (unfortunately) not supported inside of pseudo-elements such as :before. Currently esbuild generates a rule containing :is() in this case when you tell esbuild to transform nested CSS into non-nested CSS. I think it's reasonable to do that as it sort of helps explain what's going on (or at least indicates that something is wrong in the output). It shouldn't be present in minified code, however, so this release now strips it out.

v0.25.11

Compare Source

  • Add support for with { type: 'bytes' } imports (#​4292)

    The import bytes proposal has reached stage 2.7 in the TC39 process, which means that although it isn't quite recommended for implementation, it's generally approved and ready for validation. Furthermore it has already been implemented by Deno and Webpack. So with this release, esbuild will also add support for this. It behaves exactly the same as esbuild's existing binary loader. Here's an example:

    import data from './image.png' with { type: 'bytes' }
const view = new DataView(data.buffer, 0, 24)
const width = view.getInt32(16)
const height = view.getInt32(20)
console.log('size:', width + '\xD7' + height)

  • Lower CSS media query range syntax (#​3748, #​4293)

    With this release, esbuild will now transform CSS media query range syntax into equivalent syntax using min-/max- prefixes for older browsers. For example, the following CSS:

    @&#8203;media (640px <= width <= 960px) {
  main {
    display: flex;
  }
}

    will be transformed like this with a target such as --target=chrome100 (or more specifically with --supported:media-range=false if desired):

    @&#8203;media (min-width: 640px) and (max-width: 960px) {
  main {
    display: flex;
  }
}

v0.25.10

Compare Source

  • Fix a panic in a minification edge case (#​4287)

    This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):

    function identity(x) { return x }
identity({ y: identity(123) })

  • Fix @supports nested inside pseudo-element (#​4265)

    When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

    The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

    However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:

    /* Original code */
::placeholder {
  color: red;
  body & { color: green }
  @&#8203;supports (color: blue) { color: blue }
}

/* Old output (with --supported:nesting=false) */
::placeholder {
  color: red;
}
body :is() {
  color: green;
}
@&#8203;supports (color: blue) {
   {
    color: blue;
  }
}

/* New output (with --supported:nesting=false) */
::placeholder {
  color: red;
}
body :is() {
  color: green;
}
@&#8203;supports (color: blue) {
  ::placeholder {
    color: blue;
  }
}

v0.25.9

Compare Source

  • Better support building projects that use Yarn on Windows (#​3131, #​3663)

    With this release, you can now use esbuild to bundle projects that use Yarn Plug'n'Play on Windows on drives other than the C: drive. The problem was as follows:

    1. Yarn in Plug'n'Play mode on Windows stores its global module cache on the C: drive
    2. Some developers put their projects on the D: drive
    3. Yarn generates relative paths that use ../.. to get from the project directory to the cache directory
    4. Windows-style paths don't support directory traversal between drives via .. (so D:\.. is just D:)
    5. I didn't have access to a Windows machine for testing this edge case

    Yarn works around this edge case by pretending Windows-style paths beginning with C:\ are actually Unix-style paths beginning with /C:/, so the ../.. path segments are able to navigate across drives inside Yarn's implementation. This was broken for a long time in esbuild but I finally got access to a Windows machine and was able to debug and fix this edge case. So you should now be able to bundle these projects with esbuild.

  • Preserve parentheses around function expressions (#​4252)

    The V8 JavaScript VM uses parentheses around function expressions as an optimization hint to immediately compile the function. Otherwise the function would be lazily-compiled, which has additional overhead if that function is always called immediately as lazy compilation involves parsing the function twice. You can read V8's blog post about this for more details.

    Previously esbuild did not represent parentheses around functions in the AST so they were lost during compilation. With this change, esbuild will now preserve parentheses around function expressions when they are present in the original source code. This means these optimization hints will not be lost when bundling with esbuild. In addition, esbuild will now automatically add this optimization hint to immediately-invoked function expressions. Here's an example:

    // Original code
const fn0 = () => 0
const fn1 = (() => 1)
console.log(fn0, function() { return fn1() }())

// Old output
const fn0 = () => 0;
const fn1 = () => 1;
console.log(fn0, function() {
  return fn1();
}());

// New output
const fn0 = () => 0;
const fn1 = (() => 1);
console.log(fn0, (function() {
  return fn1();
})());

    Note that you do not want to wrap all function expressions in parentheses. This optimization hint should only be used for functions that are called on initial load. Using this hint for functions that are not called on initial load will unnecessarily delay the initial load. Again, see V8's blog post linked above for details.

  • Update Go from 1.23.10 to 1.23.12 (#​4257, #​4258)

    This should have no effect on existing code as this version change does not change Go's operating system support. It may remove certain false positive reports (specifically CVE-2025-4674 and CVE-2025-47907) from vulnerability scanners that only detect which version of the Go compiler esbuild uses.

v0.25.8

Compare Source

  • Fix another TypeScript parsing edge case (#​4248)

    This fixes a regression with a change in the previous release that tries to more accurately parse TypeScript arrow functions inside the ?: operator. The regression specifically involves parsing an arrow function containing a #private identifier inside the middle of a ?: ternary operator inside a class body. This was fixed by propagating private identifier state into the parser clone used to speculatively parse the arrow function body. Here is an example of some affected code:

    class CachedDict {
  #has = (a: string) => dict.has(a);
  has = window
    ? (word: string): boolean => this.#has(word)
    : this.#has;
}

  • Fix a regression with the parsing of source phase imports

    The change in the previous release to parse source phase imports failed to properly handle the following cases:

    import source from 'bar'
import source from from 'bar'
import source type foo from 'bar'

    Parsing for these cases should now be fixed. The first case was incorrectly treated as a syntax error because esbuild was expecting the second case. And the last case was previously allowed but is now forbidden. TypeScript hasn't added this feature yet so it remains to be seen whether the last case will be allowed, but it's safer to disallow it for now. At least Babel doesn't allow the last case when parsing TypeScript, and Babel was involved with the source phase import specification.

v0.25.7

Compare Source

  • Parse and print JavaScript imports with an explicit phase (#​4238)

    This release adds basic syntax support for the defer and source import phases in JavaScript:

    • defer

      This is a stage 3 proposal for an upcoming JavaScript feature that will provide one way to eagerly load but lazily initialize imported modules. The imported module is automatically initialized on first use. Support for this syntax will also be part of the upcoming release of TypeScript 5.9. The syntax looks like this:

      import defer * as foo from "<specifier>";
const bar = await import.defer("<specifier>");

      Note that this feature deliberately cannot be used with the syntax import defer foo from "<specifier>" or import defer { foo } from "<specifier>".

    • source

      This is a stage 3 proposal for an upcoming JavaScript feature that will provide another way to eagerly load but lazily initialize imported modules. The imported module is returned in an uninitialized state. Support for this syntax may or may not be a part of TypeScript 5.9 (see this issue for details). The syntax looks like this:

      import source foo from "<specifier>";
const bar = await import.source("<specifier>");

      Note that this feature deliberately cannot be used with the synt

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 7fc4c6f to 72a06cf Compare March 27, 2026 00:34
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from fb5925f to fa413ae Compare April 7, 2026 13:45
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from c54e574 to ef3a12e Compare April 9, 2026 21:00
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 0edbead to 0eb0fcf Compare April 22, 2026 01:32
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 0eb0fcf to 5f88bea Compare April 27, 2026 18:12
@renovate

renovate Bot commented Apr 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
[WARN] The "pnpm" field in package.json is no longer read by pnpm. The following keys were ignored: "pnpm.onlyBuiltDependencies". See https://pnpm.io/settings for the new home of each setting.

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 5f88bea to 6016de5 Compare April 27, 2026 22:17
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 474e374 to 9c1fd08 Compare May 21, 2026 14:10
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 8ba0a1e to 85081d7 Compare May 26, 2026 11:36
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 295ba2f to 77ff050 Compare June 8, 2026 18:49
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 77ff050 to 8bbc774 Compare June 9, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants