fix(deps): update all non-major dependencies #65

renovate · 2025-04-14T02:29:07Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/types (source)	`^7.27.0` -> `^7.27.1`
@sxzz/test-utils	`^0.5.4` -> `^0.5.6`
@types/node (source)	`^22.13.14` -> `^22.15.14`
ast-kit	`^1.4.2` -> `^1.4.3`
esbuild	`^0.25.2` -> `^0.25.4`
eslint (source)	`^9.23.0` -> `^9.26.0`
pnpm (source)	`10.7.0` -> `10.10.0`
rollup (source)	`^4.38.0` -> `^4.40.2`
tsdown	`^0.6.10` -> `^0.11.0`
tsx (source)	`^4.19.3` -> `^4.19.4`
typescript (source)	`^5.8.2` -> `^5.8.3`
unplugin	`^2.2.2` -> `^2.3.2`
unplugin-oxc	`^0.3.2` -> `^0.3.6`
unplugin-replace	`^0.5.1` -> `^0.5.2`
vite (source)	`^6.2.4` -> `^6.3.5`
vitest (source)	`^3.1.1` -> `^3.1.3`
webpack	`^5.98.0` -> `^5.99.8`

Release Notes

babel/babel (@babel/types)

`v7.27.1`

Compare Source

👓 Spec Compliance

babel-parser
- #17254 Allow using of as lexical declaration within for (@JLHwung)
- #17230 Disallow get/set in TSPropertySignature (@JLHwung)
babel-parser, babel-types
- #17193 Stricter TSImportType options parsing (@JLHwung)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions, babel-traverse
- #17137 fix: do expressions should allow early exit (@kermanx)
babel-helper-wrap-function, babel-plugin-transform-async-to-generator
- #17251 Fix: propagate argument evaluation errors through async promise chain (@magic-akari)
babel-helper-remap-async-to-generator, babel-plugin-transform-async-to-generator
- #17231 fix apply()/call() annotated as pure (@Lacsw)
babel-helper-fixtures, babel-parser
- #17233 Create ChainExpression within TSInstantiationExpression (@JLHwung)
babel-generator, babel-parser
- #17226 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 2) (@JLHwung)
babel-parser
- #17224 Fill optional AST properties when both estree and typescript parser plugin are enabled (Part 1) (@JLHwung)
- #17080 Fix start of TSParameterProperty (@JLHwung)
babel-compat-data, babel-preset-env
- #17228 Update firefox bugfix compat data (@JLHwung)
babel-traverse
- #17156 fix: Objects and arrays with multiple references should not be evaluated (@liuxingbaoyu)
babel-generator
- #17216 Fix: support const type parameter in generator (@JLHwung)

💅 Polish

babel-plugin-bugfix-v8-spread-parameters-in-optional-chaining, babel-plugin-proposal-decorators, babel-plugin-transform-arrow-functions, babel-plugin-transform-class-properties, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-traverse
- #17221 Reduce generated names size for the 10th-11th (@nicolo-ribaudo)

🏠 Internal

babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #17263 Remove unused regenerator-runtime dep in @babel/runtime (@nicolo-ribaudo)
babel-compat-data, babel-preset-env
- #17256 Tune plugin compat data (@JLHwung)
babel-compat-data, babel-standalone
- #17236 migrate babel-compat-data build script to mjs (@JLHwung)
Other
- #17232 Bump typescript-eslint to 8.29.1 (@JLHwung)
- #17219 test: add basic typescript-eslint integration tests (@JLHwung)
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
babel-register
- #16844 Migrate @babel/register to cts (@liuxingbaoyu)
babel-cli, babel-compat-data, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-fixtures, babel-helper-module-imports, babel-helper-module-transforms, babel-helper-plugin-test-runner, babel-helper-transform-fixture-test-runner, babel-helpers, babel-node, babel-parser, babel-plugin-transform-modules-amd, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-modules-umd, babel-plugin-transform-react-display-name, babel-plugin-transform-regenerator, babel-plugin-transform-runtime, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-preset-env, babel-register, babel-standalone, babel-types
- #17207 Enforce node protocol import (@JLHwung)
babel-plugin-transform-regenerator
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
babel-helpers, babel-plugin-transform-regenerator
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)
babel-helpers
- #17205 Inline regenerator in the relevant packages (@nicolo-ribaudo)

🔬 Output optimization

babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
- #16538 Reduce interopRequireWildcard size (@liuxingbaoyu)
babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
- #17213 Reduce regeneratorRuntime size (@liuxingbaoyu)

sxzz/test-utils (@sxzz/test-utils)

`v0.5.6`

Compare Source

🚀 Features

Export path-related utils - by @sxzz (4690d)

🐞 Bug Fixes

Normalize path - by @sxzz (21a61)
deps: Update all non-major dependencies - in https://github.com/sxzz/test-utils/issues/40 (7f458)

View changes on GitHub

`v0.5.5`

Compare Source

🚀 Features

Arrayable input for rollup/rolldown build - by @sxzz (34a05)

View changes on GitHub

sxzz/ast-kit (ast-kit)

`v1.4.3`

Compare Source

🐞 Bug Fixes

deps:
- Update all non-major dependencies - in https://github.com/sxzz/ast-kit/issues/97 (416a1)
- Update all non-major dependencies - in https://github.com/sxzz/ast-kit/issues/99 (758f7)

View changes on GitHub

evanw/esbuild (esbuild)

`v0.25.4`

Compare Source

Add simple support for CORS to esbuild's development server (#4125)

Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

Some examples:
- CLI:
```
esbuild --servedir=. --cors-origin=https://example.com
```
- JS:
```
const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {
    origin: 'https://example.com',
  },
})
```
- Go:
```
ctx, _ := api.Context(api.BuildOptions{})
ctx.Serve(api.ServeOptions{
  Servedir: ".",
  CORS: api.CORSOptions{
    Origin: []string{"https://example.com"},
  },
})
```
The special origin * can be used to allow any origin to access esbuild's development server. Note that this means any website you visit will be able to read everything served by esbuild.
Pass through invalid URLs in source maps unmodified (#4169)

This fixes a regression in version 0.25.0 where sources in source maps that form invalid URLs were not being passed through to the output. Version 0.25.0 changed the interpretation of sources from file paths to URLs, which means that URL parsing can now fail. Previously URLs that couldn't be parsed were replaced with the empty string. With this release, invalid URLs in sources should now be passed through unmodified.
Handle exports named __proto__ in ES modules (#4162, #4163)

In JavaScript, the special property name __proto__ sets the prototype when used inside an object literal. Previously esbuild's ESM-to-CommonJS conversion didn't special-case the property name of exports named __proto__ so the exported getter accidentally became the prototype of the object literal. It's unclear what this affects, if anything, but it's better practice to avoid this by using a computed property name in this case.

This fix was contributed by @magic-akari.

eslint/eslint (eslint)

pnpm/pnpm (pnpm)

`v10.10.0`

Compare Source

Minor Changes

Allow loading the preResolution, importPackage, and fetchers hooks from local pnpmfile.

Patch Changes

Fix cd command, when shellEmulator is true #7838.
Sort keys in pnpm-workspace.yaml #9453.
Pass the npm_package_json environment variable to the executed scripts #9452.
Fixed a mistake in the description of the --reporter=silent option.

`v10.9.0`

Compare Source

Minor Changes

Added support for installing JSR packages. You can now install JSR packages using the following syntax:
```
pnpm add jsr:<pkg_name>
```
or with a version range:
```
pnpm add jsr:<pkg_name>@&#8203;<range>
```
For example, running:
```
pnpm add jsr:@&#8203;foo/bar
```
will add the following entry to your package.json:
```
{
  "dependencies": {
    "@&#8203;foo/bar": "jsr:^0.1.2"
  }
}
```
When publishing, this entry will be transformed into a format compatible with npm, older versions of Yarn, and previous pnpm versions:
```
{
  "dependencies": {
    "@&#8203;foo/bar": "npm:@&#8203;jsr/foo__bar@^0.1.2"
  }
}
```
Related issue: #8941.

Note: The @jsr scope defaults to https://npm.jsr.io/ if the @jsr:registry setting is not defined.
Added a new setting, dangerouslyAllowAllBuilds, for automatically running any scripts of dependencies without the need to approve any builds. It was already possible to allow all builds by adding this to pnpm-workspace.yaml:
```
neverBuiltDependencies: []
```
dangerouslyAllowAllBuilds has the same effect but also allows to be set globally via:
```
pnpm config set dangerouslyAllowAllBuilds true
```
It can also be set when running a command:
```
pnpm install --dangerously-allow-all-builds
```

Patch Changes

Fix a false negative in verifyDepsBeforeRun when nodeLinker is hoisted and there is a workspace package without dependencies and node_modules directory #9424.
Explicitly drop verifyDepsBeforeRun support for nodeLinker: pnp. Combining verifyDepsBeforeRun and nodeLinker: pnp will now print a warning.

`v10.8.1`

Compare Source

Patch Changes

Removed bright white highlighting, which didn't look good on some light themes #9389.
If there is no pnpm related configuration in package.json, onlyBuiltDependencies will be written to pnpm-workspace.yaml file #9404.

`v10.8.0`

Compare Source

Minor Changes

Experimental. A new hook is supported for updating configuration settings. The hook can be provided via .pnpmfile.cjs. For example:

module.exports = {
  hooks: {
    updateConfig: (config) => ({
      ...config,
      nodeLinker: "hoisted",
    }),
  },
};

Now you can use the pnpm add command with the --config flag to install new configurational dependencies #9377.

Patch Changes

Do not hang indefinitely, when there is a glob that starts with !/ in pnpm-workspace.yaml. This fixes a regression introduced by #9169.
pnpm audit --fix should update the overrides in pnpm-workspace.yaml.
pnpm link should update overrides in pnpm-workspace.yaml, not in package.json #9365.

`v10.7.1`: pnpm 10.7.1

Compare Source

Patch Changes

pnpm config set should convert the settings to their correct type before adding them to pnpm-workspace.yaml #9355.
pnpm config get should read auth related settings via npm CLI #9345.
Replace leading ~/ in a path in .npmrc with the home directory #9217.

Platinum Sponsors

Gold Sponsors

rollup/rollup (rollup)

`v4.40.2`

Compare Source

2025-05-06

Bug Fixes

Create correct IIFE/AMD/UMD bundles when using a mutable default export (#5934)
Fix execution order when using top-level await for dynamic imports with inlineDynamicImports (#5937)
Throw when the output is watched in watch mode (#5939)

Pull Requests

#5934: fix(exports): avoid "exports is not defined" ReferenceError (@dasa)
#5937: consider TLA imports have higher execution priority (@TrickyPi)
#5939: fix: watch mode input should not be an output subpath (@btea)
#5940: chore(deps): update dependency vite to v6.3.4 [security] (@renovate[bot])
#5941: chore(deps): update dependency eslint-plugin-unicorn to v59 (@renovate[bot])
#5942: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])
#5943: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

`v4.40.1`

Compare Source

2025-04-28

Bug Fixes

Limit hash size for asset file names to the supported 21 (#5921)
Do not inline user-defined entry chunks or chunks with explicit file name (#5923)
Avoid top-level-await cycles when non-entry chunks use top-level await (#5930)
Expose package.json via exports (#5931)

Pull Requests

#5921: fix(assetFileNames): reduce max hash size to 21 (@shulaoda)
#5923: fix: generate the separate chunk for the entry module with explicated chunk filename or name (@TrickyPi)
#5926: fix(deps): update rust crate swc_compiler_base to v18 (@renovate[bot])
#5927: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])
#5928: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])
#5930: Avoid chunks TLA dynamic import circular when TLA dynamic import used in non-entry modules (@TrickyPi)
#5931: chore: add new ./package.json entry (@JounQin, @lukastaegert)
#5936: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

`v4.40.0`

Compare Source

2025-04-12

Features

Only show eval warnings on first render and only when the call is not tree-shaken (#5892)
Tree-shake non-included dynamic import members when the handler just maps to one named export (#5898)

Bug Fixes

Consider dynamic imports nested within top-level-awaited dynamic import expressions to be awaited as well (#5900)
Fix namespace rendering when tree-shaking is disabled (#5908)
When using multiple transform hook filters, all of them need to be satisfied together (#5909)

Pull Requests

#5892: Warn when eval or namespace calls are rendered, not when they are parsed (@SunsetFi, @lukastaegert)
#5898: feat: treeshake dynamic import chained member expression (@privatenumber, @lukastaegert)
#5900: consider the dynamic import within a TLA call expression as a TLA import (@TrickyPi)
#5904: fix(deps): update swc monorepo (major) (@renovate[bot])
#5905: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])
#5908: Fix treeshake: false breaking destructured namespace imports (@Skn0tt)
#5909: Correct the behavior when multiple transform filter options are specified (@sapphi-red)
#5915: chore(deps): update dependency @types/picomatch to v4 (@renovate[bot])
#5916: fix(deps): update rust crate swc_compiler_base to v17 (@renovate[bot])
#5917: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)
#5918: chore(deps): update dependency vite to v6.2.6 [security] (@renovate[bot], @lukastaegert)

`v4.39.0`

Compare Source

2025-04-02

Features

Do not create separate facade chunks if a chunk would contain several entry modules that allow export extension if there are no export name conflicts (#5891)

Bug Fixes

Mark the id property as optional in the filter for the resolveId hook (#5896)

Pull Requests

#5891: chunk: merge allow-extension modules (@wmertens, @lukastaegert)
#5893: chore(deps): update dependency vite to v6.2.4 [security] (@renovate[bot])
#5896: fix: resolveId id filter is optional (@sapphi-red)

rolldown/tsdown (tsdown)

`v0.11.0`

Compare Source

🚨 Breaking Changes

Require node >= v20.11.0, drop node 18 - by @sxzz (27c53)
unplugin-lightningcss as peer dependency - by @sxzz (32be4)
Upgrade dts plugin, rework dts resolver - by @sxzz (5bb23)

🚀 Features

Add removeNodeProtocol option - by @wChenonly and @sxzz in https://github.com/rolldown/tsdown/issues/179 (06ec6)
Add copy & publicDir options - by @sxzz in https://github.com/rolldown/tsdown/issues/188 (512ea)
Resolve engines.node as default for target option - by @sxzz (8a553)
cli: Add tsconfig option - by @sxzz (694bc)

🐞 Bug Fixes

semver/ranges/min-version module not found - by @kingsword09 in https://github.com/rolldown/tsdown/issues/191 (dd926)
Types & upgrade dts plugin - by @sxzz (778aa)
Expose UserConfigFn type - by @sxzz (6fb72)

🏎 Performance

Upgrade rolldown & dts plugin - by @sxzz (4575c)

View changes on GitHub

`v0.10.2`

Compare Source

🚀 Features

cli: Add on-success option - by @sxzz (186b0)

🐞 Bug Fixes

clean: Delete empty folder - by @wChenonly and @sxzz in https://github.com/rolldown/tsdown/issues/173 (0420f)

View changes on GitHub

`v0.10.1`

Compare Source

🐞 Bug Fixes

Wire up publint options - by @lishaduck and @sxzz in https://github.com/rolldown/tsdown/issues/169 (ff772)
Add suffix for iife & umd - by @sxzz (97c02)

View changes on GitHub

`v0.10.0`

Compare Source

🚨 Breaking Changes

Clean output dir by default - by @sxzz (cda6f)
Enable dts based on typings field in package.json - by @sxzz (c7109)

🚀 Features

Show migration guide link - by @sxzz (0ff39)

View changes on GitHub

`v0.9.9`

Compare Source

🚀 Features

Support declaration maps - by @sxzz (10565)
Support CSS syntax lowering - by @ocavue and @sxzz in https://github.com/rolldown/tsdown/issues/159 (8634d)

🏎 Performance

Disable report plugin when silent - by @sxzz (46051)

View changes on GitHub

`v0.9.8`

Compare Source

🚀 Features

Functional config - by @sxzz (2680c)

View changes on GitHub

`v0.9.7`

Compare Source

🚀 Features

Add --debug option - by @btea and @sxzz in https://github.com/rolldown/tsdown/issues/147 (1e6f2)
cli: Support compile-time env option - by @fu050409 in https://github.com/rolldown/tsdown/issues/152 (e7edf)

🐞 Bug Fixes

Watch directory cannot be an output directory - by @btea and @sxzz in https://github.com/rolldown/tsdown/issues/146 (e8471)

🏎 Performance

Enable compiler cache via module.enableCompileCache() - by @btea in https://github.com/rolldown/tsdown/issues/153 (a60d9)
watch: Defer chokidar import - by @sxzz (516fa)

View changes on GitHub

`v0.9.6`

Compare Source

🐞 Bug Fixes

Resolve comma for format & target - by @sxzz (06700)
Add build start log - by @sxzz (8662d)
report: Disable brotli by default for performance - by @sxzz (4b95e)

View changes on GitHub

`v0.9.5`

Compare Source

🚀 Features

Hooks - by @sxzz (55a9c)

View changes on GitHub

`v0.9.4`

Compare Source

🚀 Features

Add external cli option - by @sxzz (87cf4)

View changes on GitHub

`v0.9.3`

Compare Source

🚀 Features

Output report - by @MatteoGabriele and @sxzz in https://github.com/rolldown/tsdown/issues/136 (6b9d5)
Report total file size - by @sxzz (3aea3)

🐞 Bug Fixes

Report dts for cjs - by @sxzz (294e2)

View changes on GitHub

`v0.9.2`

[Compare Source](https://redirect.github.com/rolldown/tsdown/compare/v0

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

bolt-new-by-stackblitz · 2025-04-14T02:29:11Z

Run & review this pull request in StackBlitz Codeflow.

socket-security · 2025-04-14T02:29:28Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
esbuild@0.25.3 ⏵ 0.25.4			⁺³
@sxzz/test-utils@0.5.4 ⏵ 0.5.6	^-1	⁺¹
unplugin-replace@0.5.1 ⏵ 0.5.2	⁺¹
unplugin-oxc@0.3.2 ⏵ 0.3.6	⁺¹		^-1
vitest@3.1.1 ⏵ 3.1.3			⁺³
@babel/types@7.27.0 ⏵ 7.27.1
@types/node@22.13.14 ⏵ 22.15.14	⁺¹	⁺¹
vite@6.2.7 ⏵ 6.3.5
ast-kit@1.4.2 ⏵ 1.4.3	⁺¹	⁺¹	^-2
tsdown@0.6.10 ⏵ 0.11.0	⁺¹	⁺¹	⁺¹
typescript@5.8.2 ⏵ 5.8.3
eslint@9.23.0 ⏵ 9.26.0
webpack@5.98.0 ⏵ 5.99.8
rollup@4.38.0 ⏵ 4.40.2	⁺¹		⁺¹

View full report

renovate bot added the dependencies label Apr 14, 2025

renovate bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from ff1ced0 to 7fa35c0 Compare April 20, 2025 06:41

renovate bot force-pushed the renovate/all-minor-patch branch 15 times, most recently from 9c95780 to d3858f4 Compare April 28, 2025 05:57

renovate bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from f598161 to d23019c Compare May 5, 2025 09:53

renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 3f38ec6 to 0d95699 Compare May 6, 2025 16:55

fix(deps): update all non-major dependencies

157bafc

renovate bot force-pushed the renovate/all-minor-patch branch from 0d95699 to 157bafc Compare May 6, 2025 22:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update all non-major dependencies #65

fix(deps): update all non-major dependencies #65

renovate bot commented Apr 14, 2025 •

edited

Loading

bolt-new-by-stackblitz bot commented Apr 14, 2025

socket-security bot commented Apr 14, 2025 •

edited

Loading

fix(deps): update all non-major dependencies #65

Are you sure you want to change the base?

fix(deps): update all non-major dependencies #65

Conversation

renovate bot commented Apr 14, 2025 • edited Loading

Release Notes

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

🏠 Internal

🔬 Output optimization

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

v10.7.1: pnpm 10.7.1

Patch Changes

Platinum Sponsors

Gold Sponsors

Bug Fixes

Pull Requests

Bug Fixes

Pull Requests

Features

Bug Fixes

Pull Requests

Features

Bug Fixes

Pull Requests

🚨 Breaking Changes

🚀 Features

🐞 Bug Fixes

🏎 Performance

🚀 Features

🐞 Bug Fixes

🐞 Bug Fixes

🚨 Breaking Changes

🚀 Features

🚀 Features

🏎 Performance

🚀 Features

🚀 Features

🐞 Bug Fixes

🏎 Performance

🐞 Bug Fixes

🚀 Features

🚀 Features

🚀 Features

🐞 Bug Fixes

Configuration

bolt-new-by-stackblitz bot commented Apr 14, 2025

socket-security bot commented Apr 14, 2025 • edited Loading

renovate bot commented Apr 14, 2025 •

edited

Loading

`v10.7.1`: pnpm 10.7.1

socket-security bot commented Apr 14, 2025 •

edited

Loading