Skip to content

chore(deps): update all non-major dependencies #312

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update all non-major dependencies #312

renovate wants to merge 1 commit into from
+371 −639

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Dec 6, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence Type Update
@antfu/eslint-config ^6.2.0 -> ^6.7.1 age confidence devDependencies minor
@types/node (source) ^24.10.1 -> ^24.10.4 age confidence devDependencies patch
esbuild 0.27.0 -> 0.27.2 age confidence devDependencies patch
node (source) 24.11.1 -> 24.12.0 age confidence minor
pnpm (source) 10.24.0 -> 10.26.0 age confidence packageManager minor
rollup (source) ^4.53.3 -> ^4.53.5 age confidence devDependencies patch
vite (source) ^7.2.4 -> ^7.3.0 age confidence devDependencies minor

Release Notes

antfu/eslint-config (@​antfu/eslint-config)

v6.7.1

Compare Source

   🐞 Bug Fixes
  • pnpm: Do not set catalogMode when catalogs is not enabled  -  by @​antfu (0471e)
    View changes on GitHub

v6.7.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v6.6.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.6.0

Compare Source

   🐞 Bug Fixes
  • pnpm: Enforce catalog usage based on smart detection  -  by @​antfu (654c0)
    View changes on GitHub

v6.5.1

Compare Source

   🐞 Bug Fixes
    View changes on GitHub

v6.5.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v6.4.2

Compare Source

   🐞 Bug Fixes
  • pnpm: Move pnpm-workspace.yaml sorting config from yaml to pnpm  -  by @​antfu (fc2b1)
    View changes on GitHub

v6.4.1

Compare Source

No significant changes

    View changes on GitHub

v6.3.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
evanw/esbuild (esbuild)

v0.27.2

Compare Source

  • Allow import path specifiers starting with #/ (#​4361)

    Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

    This change was contributed by @​hybrist.

  • Automatically add the -webkit-mask prefix (#​4357, #​4358)

    This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

    /* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}

/* Old output (with --target=chrome110) */
main {
  mask: url(x.png) center/5rem no-repeat;
}

/* New output (with --target=chrome110) */
main {
  -webkit-mask: url(x.png) center/5rem no-repeat;
  mask: url(x.png) center/5rem no-repeat;
}

    This change was contributed by @​BPJEnnova.

  • Additional minification of switch statements (#​4176, #​4359)

    This release contains additional minification patterns for reducing switch statements. Here is an example:

    // Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}

// Old output (with --minify)
switch(x){case 0:foo();break;case 1:default:bar()}

// New output (with --minify)
x===0?foo():bar();

  • Forbid using declarations inside switch clauses (#​4323)

    This is a rare change to remove something that was previously possible. The Explicit Resource Management proposal introduced using declarations. These were previously allowed inside case and default clauses in switch statements. This had well-defined semantics and was already widely implemented (by V8, SpiderMonkey, TypeScript, esbuild, and others). However, it was considered to be too confusing because of how scope works in switch statements, so it has been removed from the specification. This edge case will now be a syntax error. See tc39/proposal-explicit-resource-management#215 and rbuckton/ecma262#14 for details.

    Here is an example of code that is no longer allowed:

    switch (mode) {
  case 'read':
    using readLock = db.read()
    return readAll(readLock)

  case 'write':
    using writeLock = db.write()
    return writeAll(writeLock)
}

    That code will now have to be modified to look like this instead (note the additional { and } block statements around each case body):

    switch (mode) {
  case 'read': {
    using readLock = db.read()
    return readAll(readLock)
  }
  case 'write': {
    using writeLock = db.write()
    return writeAll(writeLock)
  }
}

    This is not being released in one of esbuild's breaking change releases since this feature hasn't been finalized yet, and esbuild always tracks the current state of the specification (so esbuild's previous behavior was arguably incorrect).

v0.27.1

Compare Source

  • Fix bundler bug with var nested inside if (#​4348)

    This release fixes a bug with the bundler that happens when importing an ES module using require (which causes it to be wrapped) and there's a top-level var inside an if statement without being wrapped in a { ... } block (and a few other conditions). The bundling transform needed to hoist these var declarations outside of the lazy ES module wrapper for correctness. See the issue for details.

  • Fix minifier bug with for inside try inside label (#​4351)

    This fixes an old regression from version v0.21.4. Some code was introduced to move the label inside the try statement to address a problem with transforming labeled for await loops to avoid the await (the transformation involves converting the for await loop into a for loop and wrapping it in a try statement). However, it introduces problems for cross-compiled JVM code that uses all three of these features heavily. This release restricts this transform to only apply to for loops that esbuild itself generates internally as part of the for await transform. Here is an example of some affected code:

    // Original code
d: {
  e: {
    try {
      while (1) { break d }
    } catch { break e; }
  }
}

// Old output (with --minify)
a:try{e:for(;;)break a}catch{break e}

// New output (with --minify)
a:e:try{for(;;)break a}catch{break e}

  • Inline IIFEs containing a single expression (#​4354)

    Previously inlining of IIFEs (immediately-invoked function expressions) only worked if the body contained a single return statement. Now it should also work if the body contains a single expression statement instead:

    // Original code
const foo = () => {
  const cb = () => {
    console.log(x())
  }
  return cb()
}

// Old output (with --minify)
const foo=()=>(()=>{console.log(x())})();

// New output (with --minify)
const foo=()=>{console.log(x())};

  • The minifier now strips empty finally clauses (#​4353)

    This improvement means that finally clauses containing dead code can potentially cause the associated try statement to be removed from the output entirely in minified builds:

    // Original code
function foo(callback) {
  if (DEBUG) stack.push(callback.name);
  try {
    callback();
  } finally {
    if (DEBUG) stack.pop();
  }
}

// Old output (with --minify --define:DEBUG=false)
function foo(a){try{a()}finally{}}

// New output (with --minify --define:DEBUG=false)
function foo(a){a()}

  • Allow tree-shaking of the Symbol constructor

    With this release, calling Symbol is now considered to be side-effect free when the argument is known to be a primitive value. This means esbuild can now tree-shake module-level symbol variables:

    // Original code
const a = Symbol('foo')
const b = Symbol(bar)

// Old output (with --tree-shaking=true)
const a = Symbol("foo");
const b = Symbol(bar);

// New output (with --tree-shaking=true)
const b = Symbol(bar);
nodejs/node (node)

v24.12.0: 2025-12-10, Version 24.12.0 'Krypton' (LTS), @​targos

Compare Source

Notable Changes
  • [1a00b5f68a] - (SEMVER-MINOR) http: add optimizeEmptyRequests server option (Rafael Gonzaga) #​59778
  • [ff5754077d] - (SEMVER-MINOR) lib: add options to util.deprecate (Rafael Gonzaga) #​59982
  • [8987159234] - (SEMVER-MINOR) module: mark type stripping as stable (Marco Ippolito) #​60600
  • [92c484ebf4] - (SEMVER-MINOR) node-api: add napi_create_object_with_properties (Miguel Marcondes Filho) #​59953
  • [b11bc5984e] - (SEMVER-MINOR) sqlite: allow setting defensive flag (Bart Louwers) #​60217
  • [e7da5b4b7d] - (SEMVER-MINOR) src: add watch config namespace (Marco Ippolito) #​60178
  • [a7f7d10c06] - (SEMVER-MINOR) src: add an option to make compile cache portable (Aditi) #​58797
  • [92ea669240] - (SEMVER-MINOR) src,permission: add --allow-inspector ability (Rafael Gonzaga) #​59711
  • [05d7509bd2] - (SEMVER-MINOR) v8: add cpu profile (theanarkh) #​59807
Commits
pnpm/pnpm (pnpm)

v10.26.0

Compare Source

v10.25.0

Compare Source

rollup/rollup (rollup)

v4.53.5

Compare Source

2025-12-16

Bug Fixes
  • Fix wrong semicolon insertion position when using JSX (#​6206)
  • Generate spec-compliant sourcemaps when sources content is excluded (#​6196)
Pull Requests

v4.53.4

Compare Source

2025-12-15

Bug Fixes
  • Ensure Symbol.dispose and Symbol.asyncDispose properties are never removed with (await) using declarations. (#​6209)
Pull Requests
vitejs/vite (vite)

v7.3.0

Compare Source

Please refer to CHANGELOG.md for details.

v7.2.7

Compare Source

v7.2.6

Compare Source

7.2.6 (2025-12-01)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies label Dec 6, 2025
@bolt-new-by-stackblitz
Copy link

bolt-new-by-stackblitz bot commented Dec 6, 2025

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@socket-security
Copy link

socket-security bot commented Dec 6, 2025 •
edited
Loading

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedesbuild@​0.27.0 ⏵ 0.27.2911007394100
Updated@​types/​node@​24.10.1 ⏵ 24.10.410010081 +196 +1100
Updatedvite@​7.2.4 ⏵ 7.3.092 -61008299 +2100
Updatedrollup@​4.53.3 ⏵ 4.53.588 -910010099100
Updated@​antfu/​eslint-config@​6.2.0 ⏵ 6.7.194 -210010096 +4100

View full report

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from c468e16 to 7dc0ddc Compare December 14, 2025 10:12
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 504d765 to 575c388 Compare December 17, 2025 03:06
@socket-security
Copy link

socket-security bot commented Dec 17, 2025 •
edited
Loading

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm vite is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: package.json → npm/[email protected]

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 575c388 to 2c4bf09 Compare December 18, 2025 05:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants