chore(deps): lock file maintenance npm packages#6301
Merged
renovate[bot] merged 1 commit intomainfrom Sep 24, 2025
Merged
Conversation
Contributor
How to use the Graphite Merge QueueAdd the label graphite: merge to this PR to add it to the merge queue. You must have a Graphite account in order to use the merge queue. Sign up using this link. An organization admin has enabled the Graphite Merge Queue in this repository. Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
✅ Deploy Preview for rolldown-rs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
auto-merge was automatically disabled
September 21, 2025 23:38
Pull request was converted to draft
fc6b309 to
e2c1020
Compare
e6b459e to
3cdd391
Compare
3cdd391 to
4017259
Compare
shulaoda
pushed a commit
that referenced
this pull request
Sep 24, 2025
## [1.0.0-beta.40] - 2025-09-24 ⚡ Sourcemap Performance Boost - 20%-30% faster sourcemap generation - Consistent gains across all platforms ### 🚀 Features - rolldown: oxc v0.92.0 (#6322) by @Boshen - adding partial `MagicString` binding (#6289) by @IWANABETHATGUY - rolldown_plugin_vite_html: initialize (#6292) by @shulaoda ### 🐛 Bug Fixes - rolldown_plugin_react_refresh_wrapper: avoid using cwd to allow using as a callable plugin (#6318) by @sapphi-red - rolldown_plugin_transform: resolve tsconfig from absolute path (#6311) by @shulaoda ### 🚜 Refactor - Construct MagicString with `Cow<str>` instead of `&str` (#6288) by @IWANABETHATGUY - throw error if generating oxc runtime helper fails (#6291) by @shulaoda ### 📚 Documentation - add more description about sourcemapIgnoreList (#6314) by @IWANABETHATGUY ### ⚡ Performance - reduce `sourcemap_ignore_list` js function call (#6313) by @IWANABETHATGUY - string_wizard: use memchr to find patterns in `replace` (#6312) by @IWANABETHATGUY - simplify sourcemap token processing in collapse_sourcemaps (#6310) by @IWANABETHATGUY - rolldown: some minor perf optimization (#6306) by @Brooooooklyn - rolldown: fine-tuning the tokio scheduler (#6272) by @Brooooooklyn ### ⚙️ Miscellaneous Tasks - deps: lock file maintenance rust crates (#6302) by @renovate[bot] - deps: lock file maintenance npm packages (#6301) by @renovate[bot] - use `lto: thin` in profile mode for better profiling experience. (#6320) by @IWANABETHATGUY - adjust the tokio runtime config in bench (#6305) by @Brooooooklyn - deps: update dependency rolldown-plugin-dts to v0.16.8 (#6307) by @renovate[bot]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.
This PR contains the following updates:
11.3.1->11.3.20.25.9->0.25.108.8.1->8.8.324.4.0->24.5.25.63.1->5.64.0^0.87.0->^0.92.02.31.1->2.32.07.1.5->7.1.716.1.6->16.2.01.15.0->1.17.010.16.1->10.17.1^0.0.6->^0.0.74.50.1->4.52.20.25.9->0.25.108.8.1->8.8.3🔧 This Pull Request updates lock files to use the latest dependency versions.
Release Notes
jprichardson/node-fs-extra (fs-extra)
v11.3.2Compare Source
UnhandledPromiseRejectionWarningthat could occur when calling.copy()in some cases (#1056, #1058)tree-sitter/tree-sitter (web-tree-sitter)
v0.25.10Compare Source
google/zx (zx)
v8.8.3: — Sealing GasketCompare Source
Continues #1339 to prevent injections via
Proxyinput or customtoString()manipulations.v8.8.2: — Leaking ValveCompare Source
Fixes potential cmd injection via
kill()method for Windows platform. #1337 #1339. Affects the versions range8.7.1...8.8.1.webpro-nl/knip (knip)
v5.64.0Compare Source
9000681)env-cmdSupport (#1254) (21d6b51) - thanks @joealden!185c638)a54021b) - thanks @wattanx!3d1c3c5) - thanks @Zamiell!6f30611)9913ee7)a61d9fe)0a23450) - thanks @cylewaitforit!5b54dae)087a98e)3d76e51)432bdcc) - thanks @nyarthan!b0814c9)06d4df8)0d8fd13)f54a7bd)ec0be7e)96c822a)getAccessedIdentifiers(8fb9501)6e339ca) - thanks @nyarthan!e9e6e91)binariesvalues in plugins (aac28c4)containingFilePathvalue in angular plugin (9208927)isRootOnlyto pnpm plugin (fe99f59)497bddb)time&unzipto ignored binaries (#1276) (4f8d9df) - thanks @nyarthan!RstestPlugin (#1277) (5b7d92f) - thanks @nyarthan!847ccf1)bumpp(#1278) (136a14b) - thanks @nyarthan!19dd367)77d683e)oxc-project/oxc (oxc-minify)
v0.92.0🐛 Bug Fixes
2f9e16dnapi/minifier, napi/transformer: Rename CommonJS file to.cjs(#14047) (overlookmotel)🚜 Refactor
cc0019fnapi: Move scripts intoscriptsdirectory (#14048) (overlookmotel)v0.91.0💥 BREAKING CHANGES
6fcb0d0minifier: [BREAKING] Receive supported engines instead of ecmascript versions (#13933) (sapphi-red)🐛 Bug Fixes
21bbf95napi: Rebuild bindings file for NAPI packages (#13889) (overlookmotel)💼 Other
fb347dacrates: V0.91.0 (#13961) (Boshen)v0.90.0🚀 Features
b52389anode: Bumpenginesfield to require Node.js 20.19.0+ for ESM support (#13879) (Copilot)🐛 Bug Fixes
9796ec1napi: Fix binding files (Boshen)remeda/remeda (remeda)
v2.32.0Compare Source
Features
vitejs/vite (vite)
v7.1.7Compare Source
Bug Fixes
emitAssets: truewhensharedConfigBuild: true(#20787) (4c4583c)import.meta.hot.prunecallbacks to complete before running other HMRs (#20698) (98a3484)v7.1.6Compare Source
Bug Fixes
$variables correctly (#20761) (7e8e004)skipLibCheckisfalse(#20755) (cc54e29)Miscellaneous Chores
lint-staged/lint-staged (lint-staged)
v16.2.0Compare Source
Minor Changes
#1615
99eb742Thanks @iiroj! - Added a new option--fail-on-changesto make lint-staged exit with code 1 when tasks modify any files, making theprecommithook fail. This is similar to thegit diff --exit-codeoption. Using this flag also implies the--no-revertflag which means any changes made my tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.#1611
cd05fd3Thanks @rlorenzo! - Added a new option--continue-on-errorso that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.#1637
82fcc07Thanks @iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.#1647
a5ecc06Thanks @iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, theDEBUGenvironment variable is no longer supported — use the--debugto enable debugging#1636
8db2717Thanks @iiroj! - Added a new option--hide-unstagedso that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags--hide-unstaged --no-hide-partially-stagedisn't meaningful and behaves the same as just--hide-unstaged.Thanks to @ItsNickBarry for the idea and initial implementation in #1552.
#1648
7900b3bThanks @iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.Patch Changes
#1633
7f9e485Thanks @dependabot! - Bumps listr2 from 9.0.3 to 9.0.4.#1626
99d5a9bThanks @iiroj! - Due to recent phishing attacks, for example [email protected] was released with malware. To avoid lint-staged's users being at risk the direct dependencies are pinned to exact versions, instead of allowing future patch versions with the caret (^) range.#1588
035bbf2Thanks @outslept! - Increase performance by listing staged files and searching for configuration concurrently.#1645
deba3adThanks @iiroj! - Remove chalk as a dependency due to recent malware issue; read more at chalk/chalk#656.If you are having trouble with ANSI color codes when using lint-staged, you can try setting either
FORCE_COLOR=trueorNO_COLOR=trueenv variables.oxc-project/oxc (oxlint)
v1.17.0Compare Source
🚀 Features
3e117c6linter/plugins: AdddefineRuleAPI (#13945) (overlookmotel)a14aa79npm/oxlint: Convert to ES modules (#13876) (Boshen)b52389anode: Bumpenginesfield to require Node.js 20.19.0+ for ESM support (#13879) (Copilot)53d04ddlinter: Convertoxlintto NAPI app (#13723) (overlookmotel)🚜 Refactor
bb040bcparser, linter: Replace.mjsfiles with.js(#14045) (overlookmotel)7e0d736linter/plugins: Rename--experimental-js-pluginsto--js-plugins(#13860) (overlookmotel)v1.16.0: oxlint v1.16.0Compare Source
[1.16.0] - 2025-09-16
🚀 Features
97c8d06linter: Addpreserve-caught-errorrule (#13748) (孔辉)8c19b18linter/exhaustive-deps: Implement fixer for dep in global scope (#13783) (camc314)06bce8flinter/exhaustive-deps: Implement fixer for missing dep (#13782) (camc314)a8675f4linter: Add eslint/class-methods-use-this rule (#12977) (Peter Cardenas)db33196parser: Adds typescript rule for empty argument list (#13730) (Karan Kiri)2751193linter: Addeslint/no-useless-computed-keyrule (#13428) (yefan)9a205d1regex-parser: Parse simpleTemplateLiterals(#13265) (Sysix)🐛 Bug Fixes
a2c91cdlinter: Droprulesto allow mutable access toctx_hostinrun_external_rules(#13832) (camc314)3af1e5dlinter/no-unsafe-declaration-merging: Always mark first span as primary (#13830) (camc314)1c43c7clinter: Keep message when merging composite fixes (#13827) (camc314)26af302linter/exhaustive-deps: Check stable value is on lhs of assignment expr (#13815) (camc314)4bc12d0linter/exhaustive-deps: Remove impossible comparison with parent kind (#13814) (camc314)12baf5elinter/exhaustive-deps: Respect primary span when identifying disable directive location (#13781) (camc314)fa7400alinter/no-undef: False positive withargumentsin functions (#13763) (camc314)50e6e3ceditor: Restrict servers paths foroxc.path.server(#13740) (Sysix)b45077deditor: Strip leading slash for bin path on windows (#13738) (Sysix)8fa6227editor: Don't allowoxc.path.serverfor untrusted workspaces (#13734) (Sysix)56da114linter/react/jsx-handler-names: Do not detect the function name within the inline-function's body block (#13456) (Takuji Shimokawa)b2bc5b4linter/react-perf/jsx-no-new-object-as-prop: Skip as/satisfies exprs (#13718) (camc314)ab51394raw_transfer: Disable layout assertions on some 32-bit platforms (#13716) (overlookmotel)09428f6linter/plugins: Remove outdated comment (#13691) (overlookmotel)a294721linter/plugins: Exit early if JS plugins enabled on unsupported platforms (#13689) (overlookmotel)68a2280linter/plugins: More graceful exit for--experimental-js-pluginsCLI option (#13688) (overlookmotel)🚜 Refactor
395d40dlinter: Derive inmpls forPartialEq,Eqover manual ones (#13828) (camc314)8e4cd8flinter/func-names: Userun_onceover looping over all nodes (#13798) (camc314)7f4e2feeslint/func-names: Clean up implementation and improve documentation (#13601) (Antoine Zanardi)137896alanguage_server: Split options for linting and formatting (#13627) (Sysix)7346099linter: Moveoxlintapplication code into separate module (#13745) (overlookmotel)6dd4107linter: Remove#[cfg(test)]attributes fromtestermodule (#13714) (overlookmotel)c40c6eflinter/plugins: Directory for JS plugins-related code (#13701) (overlookmotel)a0022c1linter/plugins: Improve error messages for JS plugins (#13699) (overlookmotel)1fd993fnapi/oxlint: Renamenapi/oxlint2tonapi/oxlint(#13682) (overlookmotel)⚡ Performance
90c8286linter: Detect node types fromlet..elsestatements (#13690) (camchenry)08c05dfsemantic: Make CFG construction a compile-time feature (#13678) (Boshen)🎨 Styling
99a7638linter: Add comments + re-organise imports (#13715) (overlookmotel)🧪 Testing
18a1145linter: Add debug assertions for skipping rules (#13724) (camc314)cb080delinter/no-unused-vars: Add test for non ASCII chars in JSX components (#13820) (camc314)b6eba27linter/no-undef: Add more test cases forarguments(#13764) (camc314)fb2d087linter: Set CWD for tests (#13722) (overlookmotel)💼 Other
b99de17oxlint: V1.16.0 (#13833) (Boshen)pnpm/pnpm (pnpm)
v10.17.1Compare Source
Patch Changes
minimumReleaseAgesetting, print this information out in the error message #9974.state.jsoncreation path when executingpnpm patchin a workspace project #9733.minimumReleaseAgeis set and thelatesttag is not mature enough, prefer a non-deprecated version as the newlatest#9987.v10.17.0Compare Source
Minor Changes
The
minimumReleaseAgeExcludesetting now supports patterns. For instance:Related PR: #9984.
Patch Changes
minimumReleaseAgecheck, when the package is requested by exact version and the packument is loaded from cache #9978.minimumReleaseAgeis set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #9979.webpro-nl/remove-unused-vars (remove-unused-vars)
v0.0.7Compare Source
rollup/rollup (rollup)
v4.52.2Compare Source
2025-09-23
Bug Fixes
Pull Requests
v4.52.1Compare Source
2025-09-23
Bug Fixes
Pull Requests
v4.52.0Compare Source
2025-09-19
Features
output.onlyExplicitManualChunksto turn off merging additional dependencies into manual chunks (#6087)Pull Requests
v4.51.0Compare Source
2025-09-19
Features
Bug Fixes
Pull Requests
v4.50.2Compare Source
2025-09-15
Bug Fixes
Pull Requests
evanw/esbuild (esbuild)
v0.25.10Compare Source
Fix a panic in a minification edge case (#4287)
This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value
undefinedin this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):Fix
@supportsnested inside pseudo-element (#4265)When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as
::placeholderfor correctness. The CSS nesting specification says the following:However, it seems like this behavior is different for nested at-rules such as
@supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:Configuration
📅 Schedule: Branch creation - "before 9am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.