Skip to content

Comments

chore(deps): lock file maintenance npm packages#6301

Merged
renovate[bot] merged 1 commit intomainfrom
renovate/npm-packages
Sep 24, 2025
Merged

chore(deps): lock file maintenance npm packages#6301
renovate[bot] merged 1 commit intomainfrom
renovate/npm-packages

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 21, 2025

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
lockFileMaintenance All locks refreshed
fs-extra dependencies patch 11.3.1 -> 11.3.2 age adoption passing confidence
web-tree-sitter (source) devDependencies patch 0.25.9 -> 0.25.10 age adoption passing confidence
zx (source) dependencies patch 8.8.1 -> 8.8.3 age adoption passing confidence
@types/node (source) devDependencies minor 24.4.0 -> 24.5.2 age adoption passing confidence
knip (source) devDependencies minor 5.63.1 -> 5.64.0 age adoption passing confidence
oxc-minify (source) devDependencies minor ^0.87.0 -> ^0.92.0 age adoption passing confidence
remeda (source) devDependencies minor 2.31.1 -> 2.32.0 age adoption passing confidence
vite (source) dependencies patch 7.1.5 -> 7.1.7 age adoption passing confidence
lint-staged devDependencies minor 16.1.6 -> 16.2.0 age adoption passing confidence
oxlint (source) devDependencies minor 1.15.0 -> 1.17.0 age adoption passing confidence
pnpm (source) packageManager minor 10.16.1 -> 10.17.1 age adoption passing confidence
remove-unused-vars devDependencies patch ^0.0.6 -> ^0.0.7 age adoption passing confidence
rollup (source) devDependencies minor 4.50.1 -> 4.52.2 age adoption passing confidence
esbuild devDependencies patch 0.25.9 -> 0.25.10 age adoption passing confidence
zx (source) devDependencies patch 8.8.1 -> 8.8.3 age adoption passing confidence

🔧 This Pull Request updates lock files to use the latest dependency versions.


Release Notes

jprichardson/node-fs-extra (fs-extra)

v11.3.2

Compare Source

  • Fix spurrious UnhandledPromiseRejectionWarning that could occur when calling .copy() in some cases (#​1056, #​1058)
tree-sitter/tree-sitter (web-tree-sitter)

v0.25.10

Compare Source

google/zx (zx)

v8.8.3: — Sealing Gasket

Compare Source

Continues #​1339 to prevent injections via Proxy input or custom toString() manipulations.

v8.8.2: — Leaking Valve

Compare Source

Fixes potential cmd injection via kill() method for Windows platform. #​1337 #​1339. Affects the versions range 8.7.1...8.8.1.

webpro-nl/knip (knip)

v5.64.0

Compare Source

oxc-project/oxc (oxc-minify)

v0.92.0

🐛 Bug Fixes
  • 2f9e16d napi/minifier, napi/transformer: Rename CommonJS file to .cjs (#​14047) (overlookmotel)
🚜 Refactor

v0.91.0

💥 BREAKING CHANGES
  • 6fcb0d0 minifier: [BREAKING] Receive supported engines instead of ecmascript versions (#​13933) (sapphi-red)
🐛 Bug Fixes
  • 21bbf95 napi: Rebuild bindings file for NAPI packages (#​13889) (overlookmotel)
💼 Other

v0.90.0

🚀 Features
  • b52389a node: Bump engines field to require Node.js 20.19.0+ for ESM support (#​13879) (Copilot)
🐛 Bug Fixes
  • 9796ec1 napi: Fix binding files (Boshen)
remeda/remeda (remeda)

v2.32.0

Compare Source

Features
vitejs/vite (vite)

v7.1.7

Compare Source

Bug Fixes
  • build: fix ssr environment emitAssets: true when sharedConfigBuild: true (#​20787) (4c4583c)
  • client: use CSP nonce when rendering error overlay (#​20791) (9bc9d12)
  • deps: update all non-major dependencies (#​20811) (9f2247c)
  • glob: handle glob imports from folders starting with dot (#​20800) (105abe8)
  • hmr: trigger prune event when import is removed from non hmr module (#​20768) (9f32b1d)
  • hmr: wait for import.meta.hot.prune callbacks to complete before running other HMRs (#​20698) (98a3484)

v7.1.6

Compare Source

Bug Fixes
  • deps: update all non-major dependencies (#​20773) (88af2ae)
  • esbuild: inject esbuild helper functions with minified $ variables correctly (#​20761) (7e8e004)
  • fallback terser to main thread when nameCache is provided (#​20750) (a679a64)
  • types: strict env typings fail when skipLibCheck is false (#​20755) (cc54e29)
Miscellaneous Chores
lint-staged/lint-staged (lint-staged)

v16.2.0

Compare Source

Minor Changes
  • #​1615 99eb742 Thanks @​iiroj! - Added a new option --fail-on-changes to make lint-staged exit with code 1 when tasks modify any files, making the precommit hook fail. This is similar to the git diff --exit-code option. Using this flag also implies the --no-revert flag which means any changes made my tasks will be left in the working tree after failing, so that they can be manually staged and the commit tried again.

  • #​1611 cd05fd3 Thanks @​rlorenzo! - Added a new option --continue-on-error so that lint-staged will run all tasks to completion even if some of them fail. By default, lint-staded will exit early on the first failure.

  • #​1637 82fcc07 Thanks @​iiroj! - Internal lint-staged errors are now thrown and visible in the console output. Previously they were caught with the process exit code set to 1, but not logged. This happens when, for example, there's a syntax error in the lint-staged configuration file.

  • #​1647 a5ecc06 Thanks @​iiroj! - Remove debug as a dependency due to recent malware issue; read more at debug-js/debug#1005. Because of this, the DEBUG environment variable is no longer supported — use the --debug to enable debugging

  • #​1636 8db2717 Thanks @​iiroj! - Added a new option --hide-unstaged so that lint-staged will hide all unstaged changes to tracked files before running tasks. The changes will be applied back after running the tasks. Note that the combination of flags --hide-unstaged --no-hide-partially-staged isn't meaningful and behaves the same as just --hide-unstaged.

    Thanks to @​ItsNickBarry for the idea and initial implementation in #​1552.

  • #​1648 7900b3b Thanks @​iiroj! - Remove lilconfig to reduce reliance on third-party dependencies. It was used to find possible config files outside of those tracked in Git, including from the parent directories. This behavior has been moved directly into lint-staged and should work about the same.

Patch Changes
oxc-project/oxc (oxlint)

v1.17.0

Compare Source

🚀 Features
🚜 Refactor
  • bb040bc parser, linter: Replace .mjs files with .js (#​14045) (overlookmotel)
  • 7e0d736 linter/plugins: Rename --experimental-js-plugins to --js-plugins (#​13860) (overlookmotel)

v1.16.0: oxlint v1.16.0

Compare Source

[1.16.0] - 2025-09-16

🚀 Features
  • 97c8d06 linter: Add preserve-caught-error rule (#​13748) (孔辉)
  • 8c19b18 linter/exhaustive-deps: Implement fixer for dep in global scope (#​13783) (camc314)
  • 06bce8f linter/exhaustive-deps: Implement fixer for missing dep (#​13782) (camc314)
  • a8675f4 linter: Add eslint/class-methods-use-this rule (#​12977) (Peter Cardenas)
  • db33196 parser: Adds typescript rule for empty argument list (#​13730) (Karan Kiri)
  • 2751193 linter: Add eslint/no-useless-computed-key rule (#​13428) (yefan)
  • 9a205d1 regex-parser: Parse simple TemplateLiterals (#​13265) (Sysix)
🐛 Bug Fixes
  • a2c91cd linter: Drop rules to allow mutable access to ctx_host in run_external_rules (#​13832) (camc314)
  • 3af1e5d linter/no-unsafe-declaration-merging: Always mark first span as primary (#​13830) (camc314)
  • 1c43c7c linter: Keep message when merging composite fixes (#​13827) (camc314)
  • 26af302 linter/exhaustive-deps: Check stable value is on lhs of assignment expr (#​13815) (camc314)
  • 4bc12d0 linter/exhaustive-deps: Remove impossible comparison with parent kind (#​13814) (camc314)
  • 12baf5e linter/exhaustive-deps: Respect primary span when identifying disable directive location (#​13781) (camc314)
  • fa7400a linter/no-undef: False positive with arguments in functions (#​13763) (camc314)
  • 50e6e3c editor: Restrict servers paths for oxc.path.server (#​13740) (Sysix)
  • b45077d editor: Strip leading slash for bin path on windows (#​13738) (Sysix)
  • 8fa6227 editor: Don't allow oxc.path.server for untrusted workspaces (#​13734) (Sysix)
  • 56da114 linter/react/jsx-handler-names: Do not detect the function name within the inline-function's body block (#​13456) (Takuji Shimokawa)
  • b2bc5b4 linter/react-perf/jsx-no-new-object-as-prop: Skip as/satisfies exprs (#​13718) (camc314)
  • ab51394 raw_transfer: Disable layout assertions on some 32-bit platforms (#​13716) (overlookmotel)
  • 09428f6 linter/plugins: Remove outdated comment (#​13691) (overlookmotel)
  • a294721 linter/plugins: Exit early if JS plugins enabled on unsupported platforms (#​13689) (overlookmotel)
  • 68a2280 linter/plugins: More graceful exit for --experimental-js-plugins CLI option (#​13688) (overlookmotel)
🚜 Refactor
  • 395d40d linter: Derive inmpls for PartialEq, Eq over manual ones (#​13828) (camc314)
  • 8e4cd8f linter/func-names: Use run_once over looping over all nodes (#​13798) (camc314)
  • 7f4e2fe eslint/func-names: Clean up implementation and improve documentation (#​13601) (Antoine Zanardi)
  • 137896a language_server: Split options for linting and formatting (#​13627) (Sysix)
  • 7346099 linter: Move oxlint application code into separate module (#​13745) (overlookmotel)
  • 6dd4107 linter: Remove #[cfg(test)] attributes from tester module (#​13714) (overlookmotel)
  • c40c6ef linter/plugins: Directory for JS plugins-related code (#​13701) (overlookmotel)
  • a0022c1 linter/plugins: Improve error messages for JS plugins (#​13699) (overlookmotel)
  • 1fd993f napi/oxlint: Rename napi/oxlint2 to napi/oxlint (#​13682) (overlookmotel)
⚡ Performance
  • 90c8286 linter: Detect node types from let..else statements (#​13690) (camchenry)
  • 08c05df semantic: Make CFG construction a compile-time feature (#​13678) (Boshen)
🎨 Styling
  • 99a7638 linter: Add comments + re-organise imports (#​13715) (overlookmotel)
🧪 Testing
  • 18a1145 linter: Add debug assertions for skipping rules (#​13724) (camc314)
  • cb080de linter/no-unused-vars: Add test for non ASCII chars in JSX components (#​13820) (camc314)
  • b6eba27 linter/no-undef: Add more test cases for arguments (#​13764) (camc314)
  • fb2d087 linter: Set CWD for tests (#​13722) (overlookmotel)
💼 Other
pnpm/pnpm (pnpm)

v10.17.1

Compare Source

Patch Changes
  • When a version specifier cannot be resolved because the versions don't satisfy the minimumReleaseAge setting, print this information out in the error message #​9974.
  • Fix state.json creation path when executing pnpm patch in a workspace project #​9733.
  • When minimumReleaseAge is set and the latest tag is not mature enough, prefer a non-deprecated version as the new latest #​9987.

v10.17.0

Compare Source

Minor Changes
  • The minimumReleaseAgeExclude setting now supports patterns. For instance:

    minimumReleaseAge: 1440
    minimumReleaseAgeExclude:
      - "@​eslint/*"

    Related PR: #​9984.

Patch Changes
  • Don't ignore the minimumReleaseAge check, when the package is requested by exact version and the packument is loaded from cache #​9978.
  • When minimumReleaseAge is set and the active version under a dist-tag is not mature enough, do not downgrade to a prerelease version in case the original version wasn't a prerelease one #​9979.
webpro-nl/remove-unused-vars (remove-unused-vars)

v0.0.7

Compare Source

rollup/rollup (rollup)

v4.52.2

Compare Source

2025-09-23

Bug Fixes
  • Fix Android build crashing due to failed dlopen (#​6109)
Pull Requests

v4.52.1

Compare Source

2025-09-23

Bug Fixes
  • Opt-out of dynamic import optimization when using top-level await to effectively prevent deadlocks (#​6121)
Pull Requests

v4.52.0

Compare Source

2025-09-19

Features
  • Add option output.onlyExplicitManualChunks to turn off merging additional dependencies into manual chunks (#​6087)
  • Add support for x86_64-pc-windows-gnu platform (#​6110)
Pull Requests

v4.51.0

Compare Source

2025-09-19

Features
  • Support ROLLUP_FILE_URL_OBJ placeholder to inject file URLs into the generated code (#​6108)
Bug Fixes
  • Improve OpenHarmony build to work in more situations (#​6115)
Pull Requests

v4.50.2

Compare Source

2025-09-15

Bug Fixes
  • Resolve an issue where unused destructured array pattern declarations would conflict with included variables (#​6100)
Pull Requests
evanw/esbuild (esbuild)

v0.25.10

Compare Source

  • Fix a panic in a minification edge case (#​4287)

    This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):

    function identity(x) { return x }
    identity({ y: identity(123) })
  • Fix @supports nested inside pseudo-element (#​4265)

    When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

    The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

    However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:

    /* Original code */
    ::placeholder {
      color: red;
      body & { color: green }
      @​supports (color: blue) { color: blue }
    }
    
    /* Old output (with --supported:nesting=false) */
    ::placeholder {
      color: red;
    }
    body :is() {
      color: green;
    }
    @​supports (color: blue) {
       {
        color: blue;
      }
    }
    
    /* New output (with --supported:nesting=false) */
    ::placeholder {
      color: red;
    }
    body :is() {
      color: green;
    }
    @​supports (color: blue) {
      ::placeholder {
        color: blue;
      }
    }

Configuration

📅 Schedule: Branch creation - "before 9am on monday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) September 21, 2025 23:20
@graphite-app
Copy link
Contributor

graphite-app bot commented Sep 21, 2025

How to use the Graphite Merge Queue

Add the label graphite: merge to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

@socket-security
Copy link

socket-security bot commented Sep 21, 2025

@netlify
Copy link

netlify bot commented Sep 21, 2025

Deploy Preview for rolldown-rs ready!

Name Link
🔨 Latest commit 4017259
🔍 Latest deploy log https://app.netlify.com/projects/rolldown-rs/deploys/68d3a42487b14000086f5305
😎 Deploy Preview https://deploy-preview-6301--rolldown-rs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@shulaoda shulaoda marked this pull request as draft September 21, 2025 23:38
auto-merge was automatically disabled September 21, 2025 23:38

Pull request was converted to draft

@renovate renovate bot force-pushed the renovate/npm-packages branch 12 times, most recently from fc6b309 to e2c1020 Compare September 23, 2025 01:04
@shulaoda shulaoda self-assigned this Sep 23, 2025
@renovate renovate bot force-pushed the renovate/npm-packages branch 10 times, most recently from e6b459e to 3cdd391 Compare September 24, 2025 05:56
@renovate renovate bot force-pushed the renovate/npm-packages branch from 3cdd391 to 4017259 Compare September 24, 2025 07:56
@shulaoda shulaoda marked this pull request as ready for review September 24, 2025 07:58
@renovate renovate bot enabled auto-merge (squash) September 24, 2025 07:59
@renovate renovate bot merged commit 84f4416 into main Sep 24, 2025
44 checks passed
@renovate renovate bot deleted the renovate/npm-packages branch September 24, 2025 08:13
shulaoda pushed a commit that referenced this pull request Sep 24, 2025
## [1.0.0-beta.40] - 2025-09-24

⚡ Sourcemap Performance Boost
- 20%-30% faster sourcemap generation
- Consistent gains across all platforms

### 🚀 Features

- rolldown: oxc v0.92.0 (#6322) by @Boshen
- adding partial `MagicString` binding (#6289) by @IWANABETHATGUY
- rolldown_plugin_vite_html: initialize (#6292) by @shulaoda

### 🐛 Bug Fixes

- rolldown_plugin_react_refresh_wrapper: avoid using cwd to allow using as a callable plugin (#6318) by @sapphi-red
- rolldown_plugin_transform: resolve tsconfig from absolute path (#6311) by @shulaoda

### 🚜 Refactor

- Construct MagicString with `Cow<str>` instead of `&str` (#6288) by @IWANABETHATGUY
- throw error if generating oxc runtime helper fails (#6291) by @shulaoda

### 📚 Documentation

- add more description about sourcemapIgnoreList (#6314) by @IWANABETHATGUY

### ⚡ Performance

- reduce `sourcemap_ignore_list` js function call (#6313) by @IWANABETHATGUY
- string_wizard: use memchr to find patterns in `replace` (#6312) by @IWANABETHATGUY
- simplify sourcemap token processing in collapse_sourcemaps (#6310) by @IWANABETHATGUY
- rolldown: some minor perf optimization (#6306) by @Brooooooklyn
- rolldown: fine-tuning the tokio scheduler (#6272) by @Brooooooklyn

### ⚙️ Miscellaneous Tasks

- deps: lock file maintenance rust crates (#6302) by @renovate[bot]
- deps: lock file maintenance npm packages (#6301) by @renovate[bot]
- use `lto: thin` in profile mode for better profiling experience. (#6320) by @IWANABETHATGUY
- adjust the tokio runtime config in bench (#6305) by @Brooooooklyn
- deps: update dependency rolldown-plugin-dts to v0.16.8 (#6307) by @renovate[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant