fix(deps): update npm - #89
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Test Results75 tests 75 ✅ 5s ⏱️ Results for commit 7411d85. ♻️ This comment has been updated with latest results. |
renovate
Bot
force-pushed
the
renovate/npm
branch
14 times, most recently
from
April 11, 2026 13:03
8189936 to
f37e58d
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
4 times, most recently
from
April 20, 2026 10:15
a0a4c55 to
c575442
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
4 times, most recently
from
April 30, 2026 06:28
19a2d92 to
f684299
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
6 times, most recently
from
May 6, 2026 00:44
28bf73b to
bf392ad
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
from
June 15, 2026 00:12
4e3fc98 to
5f07bd2
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
from
June 16, 2026 00:41
5f07bd2 to
b918e2a
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
7 times, most recently
from
June 30, 2026 05:49
5e27d7b to
b28e33f
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
6 times, most recently
from
July 12, 2026 11:52
3e81a34 to
97141a9
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
5 times, most recently
from
July 21, 2026 13:56
04e64e1 to
7fb8e19
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
3 times, most recently
from
July 30, 2026 17:52
9ffa86d to
8350e69
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
4 times, most recently
from
August 8, 2026 21:01
c804754 to
ff6b0f1
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
from
August 11, 2026 21:13
ff6b0f1 to
7411d85
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.27.0→^0.28.07.0.0→7.3.00.5.19→0.5.201.32.0→1.33.01.32.0→1.33.01.32.0→1.33.01.32.0→1.33.01.32.0→1.33.01.32.0→1.33.01.14.1→1.15.23.8.1→3.9.63.5.1→3.5.2^0.7.2→^0.8.04.4.5→4.7.53.2.2→3.3.16.0.2→6.0.34.3.6→4.4.3Release Notes
evanw/esbuild (@esbuild/linux-arm64)
v0.28.2Compare Source
Fix tree shaking bug due to TypeScript import alias (#4507)
This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific
importassignment and looks something like this:Fix CSS minification bug involving
&(#4497)This release fixes a bug where esbuild's CSS minifier incorrectly removed a
&when it was unsafe to do so. Here is an example:This should match
<span class="a"><span class="b"><span class="b">yes</span></span></span>but not<span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.Avoid overwriting input files without
--allow-overwrite(#4484)For example:
esbuild input.js --outfile=input.jstells esbuild to overwriteinput.jswith the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless
--allow-overwriteis explicitly present. This is done by not writing out any files when a build error is encountered.Fix incorrect code generated when using top-level await (#4498)
Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing
asyncon one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing anasyncmodule wrapper.Fix a minification bug with lowered logical assignment operators (#4508)
This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
Fix a potential deadlock when the JavaScript API is used incorrectly (#4503, #4506)
The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.
Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.
This fix was submitted by @ZuBB.
Handle target collisions (#4509)
It's possible to specify the same target engine multiple times, such as with
--target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (sochrome99in this case instead ofchrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.Force
.mp3files to use theaudio/mpegMIME type (#4485)MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence
ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start withID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some.mp3files incorrectly using theapplication/octet-streamMIME type instead ofaudio/mpeg. With this release, esbuild will now always use theaudio/mpegMIME type for files ending in.mp3.Add a new TypeScript syntax warning
TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts
1 + 2 as number * 3as valid syntax but confusingly converts it to(1 + 2) * 3instead of the more intuitive conversion to1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:See microsoft/TypeScript#63527 for more information.
Add support for formatting errors for Visual Studio (#4460)
Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.
With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with
--log-style=visualstudio. Here is an example log message in this style:This log style is also available via the JS and Go APIs, and can now be used with the existing
formatMessagesAPI.Fix a bug with CSS gamut mapping (#4488)
Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.
This fix was submitted by @chatman-media.
v0.28.1Compare Source
Disallow
\in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a
\backslash character. It happened due to the use of Go'spath.Clean()function, which only handles Unix-style/characters. HTTP requests with paths containing\are no longer allowed.Thanks to @dellalibera for reporting this issue.
Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)
The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
Note that esbuild's Deno API installs from
registry.npmjs.orgby default, but allows theNPM_CONFIG_REGISTRYenvironment variable to override this with a custom package registry. This change means that the esbuild executable served byNPM_CONFIG_REGISTRYmust now match the expected content.Thanks to @sondt99 for reporting this issue.
Avoid inlining
usingandawait usingdeclarations (#4482)Previously esbuild's minifier sometimes incorrectly inlined
usingandawait usingdeclarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done forletandconstdeclarations by avoiding doing it forvardeclarations, which no longer worked when more declaration types were added. Here's an example:Fix module evaluation when an error is thrown (#4461, #4467)
If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if
import()orrequire()is used to import a module multiple times. The thrown error is supposed to be thrown by every call toimport()orrequire(), not just the first. With this release, esbuild will now throw the same error every time you callimport()orrequire()on a module that throws during its evaluation.Fix some edge cases around the
newoperator (#4477)Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a
newexpression (specifically an optional chain and/or a tagged template literal). The generated code for thenewtarget was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap thenewtarget in parentheses. Here is an example of some affected code:Fix renaming of nested
vardeclarations (#4471)This release fixes a bug where
vardeclarations in nested scopes that are hoisted up to module scope were not correctly being renamed during bundling. That could previously lead to name collisions when minification was disabled, which could potentially cause a behavior change. The bug has been fixed so that these hoisted declarations are now considered to be module-level symbols during the name collision avoidance pass.Emit
varinstead ofconstfor certain TypeScript-only constructs for ES5 (#4448)While esbuild doesn't generally support converting
consttovarfor ES5 due to nested scoping rules (which is currently a build-time error), esbuild previously incorrectly converted TypeScript-onlyimportassignment constructs into aconstdeclaration even when targeting ES5. With this release, esbuild will now usevarfor this case instead:v0.28.0Compare Source
Add support for
with { type: 'text' }imports (#4435)The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing
textloader. Here's an example:Add integrity checks to fallback download path (#4343)
Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the
npmcommand, and then with a HTTP request toregistry.npmjs.orgas a last resort).This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level
esbuildpackage. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.Update the Go compiler from 1.25.7 to 1.26.1
This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:
You can read the Go 1.26 release notes for more information.
sveltejs/vite-plugin-svelte (@sveltejs/vite-plugin-svelte)
v7.3.0Compare Source
Minor Changes
dynamicCompileOptions(#1386)Patch Changes
v7.2.0Compare Source
Minor Changes
v7.1.4Compare Source
Patch Changes
v7.1.3Compare Source
Patch Changes
v7.1.2Compare Source
Patch Changes
v7.1.1Compare Source
Patch Changes
fix: pass
typescript.onlyRemoveTypeImportstotransformWithOxcinvitePreprocessso that value imports are not dropped when they are only referenced in Svelte template markup (#1326)fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (#1336)
v7.1.0Compare Source
Minor Changes
tailwindlabs/tailwindcss-typography (@tailwindcss/typography)
v0.5.20Compare Source
Fixed
parcel-bundler/lightningcss (lightningcss-darwin-arm64)
v1.33.0Compare Source
Added
::highlightby @lucasweng in #970#851
:target-before/after/currentpseudo-class by @yisibl in #1185Fixed
attywithstd::io::IsTerminalby @fkeiler in #1197externalto return type ofresolveby @sapphi-red in #1261Profiidev/positron_components (positron-components)
v1.15.2Compare Source
Bug Fixes
v1.15.1Compare Source
Bug Fixes
v1.15.0Compare Source
Features
Bug Fixes
v1.14.4Compare Source
Bug Fixes
v1.14.3Compare Source
Bug Fixes
v1.14.2Compare Source
Bug Fixes
prettier/prettier (prettier)
v3.9.6Compare Source
v3.9.5Compare Source
diff
Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)
CommonMark parsers only support ordered list item numbers up to 999,999,999.
With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:
Markdown: Avoid corrupting empty link with title (#19487 by @andersk)
Do not remove
<>from an inline link or image with an empty URL and a title, as this removal would change its interpretation.Less: Remove extra spaces after
[in map lookups (#19503 by @kovsu)CSS: Prevent addition space in
type()with+(#19516 by @bigandy)This fixes the addition space before
+in CSStype()declaration. For exampletype(<number>+)was being converted intotype(<number> +)which is invalid CSS and does not work.Less: Remove spaces between merge markers and colons (#19517 by @kovsu)
Markdown: Preserve wiki links with aliases (#19527 by @kovsu)
TypeScript: Fix comments being dropped on shorthand
typeimport/export specifiers (#19565 by @kirkwaiblinger)Miscellaneous: Preserving comments'
placementproperty (#19567 by @Janther)Prettier@3.9.0 deleted an undocumented property on comments, which was already used by plugins,
comment.placementis now available again after comment attach.Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)
Angular: Support expression for exhaustive typechecking (#19571 by @fisker)
TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)
Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)
JavaScript: Handle dangling comments in
SwitchStatement(#19581 by @fisker)TypeScript: Remove space in comment-only object type (#19583 by @fisker)
v3.9.4Compare Source
v3.9.3Compare Source
v3.9.2Compare Source
v3.9.1Compare Source
v3.9.0Compare Source
diff
🔗 Release Notes
v3.8.5Compare Source
v3.8.4Compare Source
diff
Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)
Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.
v3.8.3Compare Source
diff
SCSS: Prevent trailing comma in
if()function (#18471 by @kovsu)v3.8.2Compare Source
diff
Angular: Support Angular v21.2 (#18722, #19034 by @fisker)
Exhaustive typechecking with
@default never;arrow functionandinstanceofexpressions.sveltejs/prettier-plugin-svelte (prettier-plugin-svelte)
v3.5.2Compare Source
bind:get/set tuple{#each}blockstailwindlabs/prettier-plugin-tailwindcss (prettier-plugin-tailwindcss)
v0.8.1Compare Source
Fixed
class={...}expressions when usingprettier-plugin-sveltev4 (#462)v0.8.0Compare Source
Changed
Added
/sorter(#438)Fixed
canCollapseWhitespaceInhandling for"tailwindPreserveWhitespace": true(#428)v0.7.4Compare Source
Same as v0.7.2, since v0.7.3 contained breaking changes.
v0.7.3Compare Source
Changed
Fixed
sveltejs/language-tools (svelte-check)
v4.7.5Compare Source
Patch Changes
fix: prevent silent error during start-up caused by unhandled promise (#3096)
Updated dependencies [
1df53d8]:v4.7.4Compare Source
Patch Changes
v4.7.3Compare Source
Patch Changes
+error.svelteprops (#3076)v4.7.2Compare Source
Patch Changes
fix: resolve tsgo bin path with package.json (#3074)
fix: report tsconfig errors in --tsgo-experimental-api (#3070)
v4.7.1Compare Source
Patch Changes
v4.7.0Compare Source
Minor Changes
feat: add
--configoption (#3066)feat: svelte-check tsgo support with experimental api (#3036)
Patch Changes
fix: load esm version of Vite (#3065)
fix: stop excluding workspaces under dot-prefixed ancestors (#3037)
Updated dependencies [
7a3464b,a2561fc]:v4.6.0Compare Source
Minor Changes
vite.config.js/ts(#3031)Patch Changes
151cf45]:v4.5.0Compare Source
Minor Changes
Patch Changes
fix: properly handle props with the name
slotinside Svelte 5 snippets (#3030)feat: add support for svelte config ts/mts files (#3009)
v4.4.8Compare Source
Patch Changes
v4.4.7Compare Source
Patch Changes
fix: flush stdout/stderr before exit (#3014)
fix: report diagnostics in tsconfig.json (#3005)
v4.4.6Compare Source
Patch Changes
fix: prevent config loading message in svelte-check --incremental (#2974)
fix: resolve svelte files with NodeNext in --incremental/tsgo (#2990)
perf: various optimization with ast walk (#2969)
fix: prevent error with escape sequence in attribute (#2968)
fix: typescript 6.0 compatibility (#2988)
heroui-inc/tailwind-variants (tailwind-variants)
v3.3.1Compare Source
Bug Fixes
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.