Skip to content

build(deps-dev): bump the npm-development-minor-patch group with 6 updates#305

Merged
chhoumann merged 2 commits into
masterfrom
dependabot/npm_and_yarn/npm-development-minor-patch-10cccfddba
Jul 23, 2026
Merged

build(deps-dev): bump the npm-development-minor-patch group with 6 updates#305
chhoumann merged 2 commits into
masterfrom
dependabot/npm_and_yarn/npm-development-minor-patch-10cccfddba

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-development-minor-patch group with 6 updates:

Package From To
oxfmt 0.58.0 0.59.0
oxlint 1.73.0 1.74.0
svelte 5.56.4 5.56.5
svelte-check 4.7.2 4.7.3
vite 8.1.4 8.1.5
wrangler 4.107.1 4.111.0

Updates oxfmt from 0.58.0 to 0.59.0

Changelog

Sourced from oxfmt's changelog.

[0.59.0] - 2026-07-13

🐛 Bug Fixes

  • 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

  • 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

  • dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
  • f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

  • 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

  • 43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

  • 6e8e818 oxfmt: Experimental .svelte support (#21700) (leaysgur)

[0.45.0] - 2026-04-13

🐛 Bug Fixes

  • 50c389b oxfmt: Support .editorconfig quote_type (#20989) (leaysgur)

[0.44.0] - 2026-04-06

🐛 Bug Fixes

  • dd2df87 npm: Export package.json for oxlint and oxfmt (#20784) (kazuya kawaguchi)
  • 4216380 oxfmt: Support .editorconfig tab_width fallback (#20988) (leaysgur)

... (truncated)

Commits
  • 2d4e8d2 release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)
  • 415fe1e fix(oxfmt): error on ignorePatterns that cannot match files outside the confi...
  • See full diff in compare view

Updates oxlint from 1.73.0 to 1.74.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

  • 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
  • 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
  • bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
  • 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
  • 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
  • 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
  • ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

  • 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
  • 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
  • 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
  • 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
  • a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
  • ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
  • 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
  • ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
  • e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
  • 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
  • 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
  • fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
  • ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
  • dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
  • 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
  • cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

  • 25d577e language_server: Start tools in parallel (#15500) (Sysix)
  • 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
  • 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
  • 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
  • 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
  • 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

  • 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
  • 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
  • a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
  • 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
  • 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
  • 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.74.0] - 2026-07-13

🚀 Features

  • 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#24044) (Boshen)

🐛 Bug Fixes

  • 8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#24341) (leaysgur)
  • 2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#24339) (leaysgur)

⚡ Performance

  • 7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#24413) (connorshea)
  • 6272051 linter/typescript/no-require-imports: Compile allow patterns once (#24417) (connorshea)
  • 33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#24420) (connorshea)
Commits
  • 2d4e8d2 release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)
  • 7f80cac perf(linter/vue/prop-name-casing): precompile ignoreProps regex pattern (#2...
  • 6272051 perf(linter/typescript/no-require-imports): compile allow patterns once (#24417)
  • 33805b9 perf(linter/jsdoc/require-param): compile checkTypesPattern regex once (#24420)
  • 0433a83 feat(linter/eslint/no-inner-declarations): add namespaces option (#24044)
  • 8337835 fix(linter): error on ignorePatterns that cannot match files aoutside the c...
  • 2ce5a33 fix(linter): resolve ignorePatterns relative to the config dir (#24339)
  • See full diff in compare view

Updates svelte from 5.56.4 to 5.56.5

Release notes

Sourced from svelte's releases.

svelte@5.56.5

Patch Changes

  • chore: drop dead code that make TSGO fail (#18496)

  • fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

  • fix: skip unnecessary derived effect in earlier batch (#18525)

  • fix: avoid declaration tag warning in event handlers (#18500)

  • fix: abort deriveds own AbortSignal when it disconnects (#18400)

  • fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

  • fix: correctly transform declaration tags during SSR (#18492)

  • fix: transform computed keys in keyed {#each} destructuring patterns (#18521)

  • fix: chain preprocessor sourcemaps with an empty sources[0] instead of dropping them (#18518)

  • fix: clear previous_task reference after abort in Tween to prevent memory leak on interrupted tweens (#18541)

  • fix: don't treat declaration tags as parts inside each blocks (#18507)

Changelog

Sourced from svelte's changelog.

5.56.5

Patch Changes

  • chore: drop dead code that make TSGO fail (#18496)

  • fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

  • fix: skip unnecessary derived effect in earlier batch (#18525)

  • fix: avoid declaration tag warning in event handlers (#18500)

  • fix: abort deriveds own AbortSignal when it disconnects (#18400)

  • fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

  • fix: correctly transform declaration tags during SSR (#18492)

  • fix: transform computed keys in keyed {#each} destructuring patterns (#18521)

  • fix: chain preprocessor sourcemaps with an empty sources[0] instead of dropping them (#18518)

  • fix: clear previous_task reference after abort in Tween to prevent memory leak on interrupted tweens (#18541)

  • fix: don't treat declaration tags as parts inside each blocks (#18507)

Commits
  • 602a873 Version Packages (#18497)
  • a4fd67e fix: $state.eager() is sometimes incorrect in SSR (#18530)
  • 199ffeb fix: clear previous_task reference after abort in Tween (#18541)
  • edeef1f chore: add some failing tests (#18528)
  • a91b068 fix: abort deriveds own AbortSignal when it disconnects (#18400)
  • b4d1583 fix: transform computed keys in keyed each block destructuring patterns (#18521)
  • 08a9e9e fix: prevent derived connection leak in untracked contexts (#18517)
  • bfbb026 fix: skip unnecessary derived effect in earlier batch (#18525)
  • 5edd8b0 fix: chain preprocessor sourcemaps with an empty sources[0] (#18518)
  • 41642b7 fix: avoid declaration tag warning in event handlers (#18500)
  • Additional commits viewable in compare view

Updates svelte-check from 4.7.2 to 4.7.3

Release notes

Sourced from svelte-check's releases.

svelte-check@4.7.3

Patch Changes

  • feat: zero-config +error.svelte props (#3076)
Commits

Updates vite from 8.1.4 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

  • bundled-dev: avoid duplicated buildEnd (#22931) (8100320)
  • client: overlay error message format align rolldown (#22869) (5a72b87)
  • deps: update all non-major dependencies (#22921) (fef682d)
  • deps: update rolldown-related dependencies (#22922) (3c345e4)
  • module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)
  • optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)
  • ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

  • build: fix incorrect @default for build.cssMinify (#22948) (c88c236)
  • build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

  • avoid scanner scanning all files under __tests__ (#22912) (c961cae)
Commits
  • 5e7fe12 release: v8.1.5
  • 6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
  • 5a72b87 fix(client): overlay error message format align rolldown (#22869)
  • f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
  • 8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
  • c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
  • b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
  • fef682d fix(deps): update all non-major dependencies (#22921)
  • 3c345e4 fix(deps): update rolldown-related dependencies (#22922)
  • 369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
  • Additional commits viewable in compare view

Updates wrangler from 4.107.1 to 4.111.0

Release notes

Sourced from wrangler's releases.

wrangler@4.111.0

Minor Changes

  • #14602 7692a61 Thanks @​edmundhung! - Add Durable Object eviction support to createTestHarness

    You can now gracefully evict a running Durable Object by class name or binding name to verify how it recovers after its instance is torn down:

    const worker = server.getWorker();
await worker.evictDurableObject("Counter", { name: "user-123" });

  • #14620 899c297 Thanks @​penalosa! - Remove support for service environments and the legacy_env configuration field

    Service environments have been removed. Wrangler now always deploys each environment as its own Worker named <name>-<environment>, which matches the behaviour of the previous default (legacy_env = true). The --legacy-env CLI flag has been removed, and the legacy_env configuration field is no longer supported — including it in your configuration file will now raise an error.

    Because legacy_env = true was already the default, removing the field will not change how your Worker is deployed. If you were relying on service environments (legacy_env = false), each environment will now be deployed as a standalone Worker instead of as an environment of a single Worker. See https://developers.cloudflare.com/workers/wrangler/environments/ for more information.

  • #14652 317ce1f Thanks @​jamesopstad! - Append Workers runtime types to the generated types under --x-new-config, with a new dev.types.includeRuntime option

    When running wrangler dev --x-new-config, the runtime types generated from your compatibility date and flags are now appended to worker-configuration.d.ts, alongside the types inferred from cloudflare.config.ts. This is controlled by a new dev.types.includeRuntime option in wrangler.config.ts, which defaults to true.

    This applies to the experimental new config path only and does not change type generation for existing wrangler.jsonc/wrangler.toml projects.

Patch Changes

  • #14627 ed33326 Thanks @​tpmmorris! - Add convenient logging for worker emails in the project directory. In addition to the system's temp directory, logs for emails sent by workers are also written to a local temp directory defined by the calling process, e.g for an simple text email sent via Wrangler this is .wrangler/tmp/email/<session>/email-text/<message-uuid>.txt (and related files) in the project root. Callers of Miniflare can control this location via the new defaultProjectTmpPath option, which Wrangler and Vite plugin now set automatically.

  • #14642 018574b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260708.1 ^5.20260710.1
    workerd 1.20260708.1 1.20260710.1

  • #14588 eb99ab1 Thanks @​emily-shen! - fix: Respect auth profiles when using remote bindings in the Vite plugin

    Auth profiles (configured via wrangler auth create and wrangler auth activate) were previously being ignored when using remote bindings with the Vite plugin. This is now fixed.

    Note that the profile directory is resolved based on the Vite project root.

  • #14658 cdf3148 Thanks @​ATKasem! - Fix wrangler dev corrupting external hostnames in proxied response headers

    When a Worker was run with routes configured, wrangler dev's proxy rewrote the host inside URL-valued headers (such as Location) using a boundary-less substring replace. Any host that merely contained the route host as a substring was corrupted — e.g. with an example.com route, a Location: https://books.example.com/read/ch01 header became https://books.127.0.0.1:8788/read/ch01, and https://myexample.com/path became https://my127.0.0.1:8788/path.

    The proxy now only rewrites absolute URLs whose host is exactly the proxied host, swapping the scheme and host together (which also fixes a related case where an https: scheme survived on a plain-HTTP dev address). Unrelated hosts and subdomains pass through untouched.

  • #14601 3015320 Thanks @​MattieTK! - Improve the agent-facing --force guidance for Pages-to-Workers delegation

... (truncated)

Commits
  • b449bb0 Version Packages (#14644)
  • 764bf97 Enforce the use of detectAgent instead of using am-i-vibing directly (#14...
  • 3895ac0 [wrangler] Remove retired snapshot flag from container E2E (#14691)
  • 2cd84d4 publish @​cloudflare/config (#14689)
  • 8e29318 move preview code into deploy-helpers (#14681)
  • 42df9bb [workers-auth] Extract auth into @​cloudflare/workers-auth, make it product-ag...
  • ed33326 [miniflare] Add logging of emails sent by workers to .wrangler/tmp. (#14627)
  • 317ce1f Generate runtime types when using the new config in vite dev and `wrangler ...
  • cdf3148 Fix wrangler dev corrupting external hostnames in proxied headers (#14658)
  • eb99ab1 fix: pass auth profiles to vite (#14588)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the npm-development-minor-patch group with 6 up…
602c530 
…dates

Bumps the npm-development-minor-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.58.0` | `0.59.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.73.0` | `1.74.0` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.4` | `5.56.5` |
| [svelte-check](https://github.com/sveltejs/language-tools) | `4.7.2` | `4.7.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.4` | `8.1.5` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.107.1` | `4.111.0` |


Updates `oxfmt` from 0.58.0 to 0.59.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.59.0/npm/oxfmt)

Updates `oxlint` from 1.73.0 to 1.74.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.74.0/npm/oxlint)

Updates `svelte` from 5.56.4 to 5.56.5
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.5/packages/svelte)

Updates `svelte-check` from 4.7.2 to 4.7.3
- [Release notes](https://github.com/sveltejs/language-tools/releases)
- [Commits](https://github.com/sveltejs/language-tools/compare/svelte-check@4.7.2...svelte-check@4.7.3)

Updates `vite` from 8.1.4 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

Updates `wrangler` from 4.107.1 to 4.111.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.111.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: oxfmt
  dependency-version: 0.59.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development-minor-patch
- dependency-name: oxlint
  dependency-version: 1.74.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development-minor-patch
- dependency-name: svelte
  dependency-version: 5.56.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development-minor-patch
- dependency-name: svelte-check
  dependency-version: 4.7.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development-minor-patch
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-development-minor-patch
- dependency-name: wrangler
  dependency-version: 4.111.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-development-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 23, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying podnotes with  Cloudflare Pages  Cloudflare Pages

Latest commit: 753bd81
Status: ✅  Deploy successful!
Preview URL: https://9015d489.podnotes.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-npm-qeza.podnotes.pages.dev

View logs

@chhoumann

chhoumann commented Jul 23, 2026

Copy link
Copy Markdown
Owner

Maintainer validation

  • Added exact same-major overrides for brace-expansion 1.1.16, 2.1.2, and 5.0.7 plus fast-uri 3.1.4. This removes the two independently fixable high-severity audit findings without broad dependency churn.
  • npm audit decreased from 5 high-severity package entries to 3. The remaining entries are one upstream sharp advisory propagated through Miniflare and Wrangler. Sharp has no patched 0.35.x release available, and npm's suggested Wrangler 4.15.2 downgrade is not a valid forward fix.
  • Verified on Node 22 with a clean npm ci, npm run lint, npm run format:check, npm run build, npm run test -- --run (77 files, 1,132 tests), and the pinned MkDocs build.
  • Fresh Test, CodeQL, and Cloudflare checks are green on amended head 753bd810ddf9d8ab1e26848d8ed78fd7888d9998.

@chhoumann
chhoumann merged commit 99fb1a7 into master Jul 23, 2026
5 checks passed
@chhoumann
chhoumann deleted the dependabot/npm_and_yarn/npm-development-minor-patch-10cccfddba branch July 23, 2026 12:43
@chhoumann chhoumann mentioned this pull request Jul 23, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chhoumann