-
Notifications
You must be signed in to change notification settings - Fork 678
chore(deps): lock file maintenance npm packages #5266
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
✅ Deploy Preview for rolldown-rs canceled.
|
cd12f8b to
b4b2c4e
Compare
b4b2c4e to
fea62b4
Compare
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This was referenced Jul 17, 2025
shulaoda
pushed a commit
that referenced
this pull request
Jul 17, 2025
## [1.0.0-beta.28] - 2025-07-17 ### 🚀 Features - rolldown: oxc v0.77.2 (#5328) by @Boshen - hmr: add `module` and `exports` parameters to CJS initializer functions (#5322) by @hyf0 - rolldown_plugin_transform: align with `vitejs/rolldown-vite#318` (#5318) by @shulaoda - rolldown_plugin_transform: align with `vitejs/rolldown-vite#315` (#5315) by @shulaoda - hmr: automatically disable treeshaking in hmr (#5311) by @hyf0 - hmr: use `trait HmrAstBuilder` to unify ast construction (#5310) by @hyf0 - rolldown_plugin_chunk_import_map: basic implementation (#5307) by @shulaoda - add `watch.onInvalidate` (#5239) by @situ2001 - rolldown_plugin_chunk_import_map: implement initial `render_chunk` logic (#5306) by @shulaoda - rolldown: oxc v0.77.1 (#5304) by @Boshen - js: expose `experimental.incrementalBuild` option (#5300) by @IWANABETHATGUY - js: support `experimental.onDemandWrapping` option (#5299) by @IWANABETHATGUY - support on demand wrapping for entry chunk (#5291) by @IWANABETHATGUY - rolldown_plugin_chunk_import_map: initialize (#5289) by @shulaoda - show owner module id for "canonical name not found for" errors (#5288) by @sapphi-red ### 🐛 Bug Fixes - only transform VarDeclaration when enable `keepNames` (#5323) by @IWANABETHATGUY - keepNames with special Ifstmt (#5320) by @IWANABETHATGUY - incremental watch panic when adding dynamic import (#5309) by @IWANABETHATGUY - make leaf module wrapping optimization opt-in (#5305) by @IWANABETHATGUY - `keepNames` should consider exportNamed function declaration (#5298) by @IWANABETHATGUY - undefined `process.versions` for browser build (#5295) by @sxzz - sanitizeFileName: entry name should be sanitized (#5283) by @shulaoda - minify-internal-exports: ensure minifying internal exports stably (#5281) by @hyf0 - keep legal and annotation comments for `minify: 'dce-only'` (#5280) by @sapphi-red - unstable chunk generation when `preserveEntrySignatures: false` is used (#5274) by @IWANABETHATGUY ### 🚜 Refactor - pass the while CodegenOptions to `EcmaCompiler::minify` (#5279) by @sapphi-red - avoid iterate `canonical_exports` twice (#5276) by @IWANABETHATGUY ### 📚 Documentation - pluginutils: add README file (#5262) by @TheAlexLichter ### ⚡ Performance - inline function expression when rewriting `name` property with `keepNames` enabled (#5321) by @IWANABETHATGUY - rolldown_sourcemap: cache source id -> source text mapping (#5285) by @Boshen - rolldown_sourcemap: disable rayon (#5284) by @Boshen ### 🧪 Testing - rust: prevent meaningless snapshot change from bumping oxc runtime versions (#5312) by @hyf0 ### ⚙️ Miscellaneous Tasks - upgrade to NAPI-RS 3.0 stable (#5324) by @Brooooooklyn - infra: add onlyBuiltDependencies (#5287) by @situ2001 - improve the order of import keys in the exports field (#5314) by @btea - deps: update dependency rolldown-plugin-dts to v0.13.14 (#5293) by @renovate[bot] - deps: lock file maintenance rust crates (#5267) by @renovate[bot] - deps: lock file maintenance npm packages (#5266) by @renovate[bot] - deps: update github-actions (#5265) by @renovate[bot] ### ❤️ New Contributors * @situ2001 made their first contribution in [#5287](#5287) Co-authored-by: IWANABETHATGUY <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.25.6->0.25.88.6.1->8.7.124.0.10->24.0.130.25.5->0.25.610.12.4->10.13.17.0.2->7.0.41.4.3->1.4.42.24.0->2.25.04.44.2->4.45.08.6.1->8.7.1🔧 This Pull Request updates lock files to use the latest dependency versions.
Release Notes
tree-sitter/tree-sitter (web-tree-sitter)
v0.25.8Compare Source
v0.25.7Compare Source
google/zx (zx)
v8.7.1: — Pipe WhispererCompare Source
Continues v8.7.0: handles new
ps()corner case and improves$.killmechanics on Windows #1266 #1267 #1269 webpod/ps#14v8.7.0: — Solder SaviorCompare Source
Important fixes for annoying flaky bugs
kill() 🐞
We've found an interesting case #1262
If we kill the process again, the result might be unexpected:
This happens because the
pidmay be reused by the system for another process, so we've added extra assertions to prevent indeterminacy:ps() 🐛
ps()uses wmic internally on Windows, it relies on fragile heuristics to parse the output. We have improved this logic to handle more format variants, but over time (in v9 maybe) we're planning to change the approach.#1256 #1263 webpod/ps#12 webpod/ingrid#6
v8.6.2: — Flow UnstoppableCompare Source
Fixes
$.prefix&$.postfixvalues settings via env variables #1261 #1260evanw/esbuild (esbuild)
v0.25.6Compare Source
Fix a memory leak when
cancel()is used on a build context (#4231)Calling
rebuild()followed bycancel()in rapid succession could previously leak memory. The bundler uses a producer/consumer model internally, and the resource leak was caused by the consumer being termianted while there were still remaining unreceived results from a producer. To avoid the leak, the consumer now waits for all producers to finish before terminating.Support empty
:is()and:where()syntax in CSS (#4232)Previously using these selectors with esbuild would generate a warning. That warning has been removed in this release for these cases.
Improve tree-shaking of
trystatements in dead code (#4224)With this release, esbuild will now remove certain
trystatements if esbuild considers them to be within dead code (i.e. code that is known to not ever be evaluated). For example:Consider negated bigints to have no side effects
While esbuild currently considers
1,-1, and1nto all have no side effects, it didn't previously consider-1nto have no side effects. This is because esbuild does constant folding with numbers but not bigints. However, it meant that unused negative bigint constants were not tree-shaken. With this release, esbuild will now consider these expressions to also be side-effect free:Support a configurable delay in watch mode before rebuilding (#3476, #4178)
The
watch()API now takes adelayoption that lets you add a delay (in milliseconds) before rebuilding when a change is detected in watch mode. If you use a tool that regenerates multiple source files very slowly, this should make it more likely that esbuild's watch mode won't generate a broken intermediate build before the successful final build. This option is also available via the CLI using the--watch-delay=flag.This should also help avoid confusion about the
watch()API's options argument. It was previously empty to allow for future API expansion, which caused some people to think that the documentation was missing. It's no longer empty now that thewatch()API has an option.Allow mixed array for
entryPointsAPI option (#4223)The TypeScript type definitions now allow you to pass a mixed array of both string literals and object literals to the
entryPointsAPI option, such as['foo.js', { out: 'lib', in: 'bar.js' }]. This was always possible to do in JavaScript but the TypeScript type definitions were previously too restrictive.Update Go from 1.23.8 to 1.23.10 (#4204, #4207)
This should have no effect on existing code as this version change does not change Go's operating system support. It may remove certain false positive reports (specifically CVE-2025-4673 and CVE-2025-22874) from vulnerability scanners that only detect which version of the Go compiler esbuild uses.
Experimental support for esbuild on OpenHarmony (#4212)
With this release, esbuild now publishes the
@esbuild/openharmony-arm64npm package for OpenHarmony. It contains a WebAssembly binary instead of a native binary because Go doesn't currently support OpenHarmony. Node does support it, however, so in theory esbuild should now work on OpenHarmony through WebAssembly.This change was contributed by @hqzing.
pnpm/pnpm (pnpm)
v10.13.1Compare Source
Patch Changes
v10.13.0Compare Source
Minor Changes
Added the possibility to load multiple pnpmfiles. The
pnpmfilesetting can now accept a list of pnpmfile locations #9702.pnpm will now automatically load the
pnpmfile.cjsfile from any config dependency named@pnpm/plugin-*orpnpm-plugin-*#9729.The order in which config dependencies are initialized should not matter — they are initialized in alphabetical order. If a specific order is needed, the paths to the
pnpmfile.cjsfiles in the config dependencies can be explicitly listed using thepnpmfilesetting inpnpm-workspace.yaml.Patch Changes
pkg.pr.new, treat them as Git tarball URLs #9694.dangerouslyAllowAllBuilds,onlyBuiltDependencies,onlyBuiltDependenciesFile, andneverBuiltDependencies#9628.pnpm-workspace.yamlwith deep #9701.pnpm rebuildcommand should not add pkgs included inignoredBuiltDependenciestoignoredBuildsinnode_modules/.modules.yaml#9338.shell-quotewithshlexfor quoting command arguments #9381.vitejs/vite (vite)
v7.0.4Compare Source
Bug Fixes
Build System
@oxc-project/runtimedevDep (#20389) (5e29602)v7.0.3Compare Source
Bug Fixes
Miscellaneous Chores
n/prefer-node-protocolrule (#20368) (38bb268)Code Refactoring
toyobayashi/emnapi (emnapi)
v1.4.4Compare Source
remeda/remeda (remeda)
v2.25.0Compare Source
Features
v2.24.1Compare Source
Bug Fixes
rollup/rollup (rollup)
v4.45.0Compare Source
2025-07-12
Features
Bug Fixes
this(#6001)Pull Requests
Configuration
📅 Schedule: Branch creation - "before 9am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.