chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 8 updates by dependabot[bot] · Pull Request #1193 · objectstack-ai/framework

dependabot · 2026-04-20T11:43:39Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the development-dependencies group with 8 updates in the / directory:

Package	From	To
@changesets/cli	`2.30.0`	`2.31.0`
@oclif/plugin-plugins	`5.4.60`	`5.4.61`
@types/vscode	`1.115.0`	`1.116.0`
@vscode/vsce	`3.7.1`	`3.9.1`
fastify	`5.8.4`	`5.8.5`
postcss	`8.5.9`	`8.5.10`
esbuild	`0.24.2`	`0.28.0`
vite	`8.0.8`	`8.0.9`

Updates @changesets/cli from 2.30.0 to 2.31.0

Release notes

Sourced from @changesets/cli's releases.

@changesets/cli@2.31.0

Minor Changes

#1889 96ca062 Thanks @mixelburg! - Error on unsupported flags for individual CLI commands and print the matching command usage to make mistakes easier to spot.

#1873 42943b7 Thanks @mixelburg! - Respond to --help on all subcommands. Previously, --help was only handled when it was the sole argument; passing it alongside a subcommand (e.g. changeset version --help) would silently execute the command instead. Now --help always exits early and prints per-command usage when a known subcommand is provided, or the general help text otherwise.

Patch Changes

d2121dc Thanks @Andarist! - Fix npm auth for path-based registries during publish by preserving configured registry URLs instead of normalizing them.

#1888 036fdd4 Thanks @mixelburg! - Fix several changeset version issues with workspace protocol dependencies. Valid explicit workspace: ranges and aliases are no longer rewritten unnecessarily, and workspace path references are handled correctly during versioning.

#1903 5c4731f Thanks @Andarist! - Gracefully handle stale npm info data leading to duplicate publish attempts.

#1867 f61e716 Thanks @Andarist! - Improved detection for published state of prerelease-only packages without latest dist-tag on GitHub Packages registry.

Updated dependencies [036fdd4, 036fdd4, 036fdd4]:

@changesets/assemble-release-plan@6.0.10

@changesets/get-dependents-graph@2.1.4

@changesets/apply-release-plan@7.1.1

@changesets/get-release-plan@4.0.16

@changesets/config@3.1.4

Commits

9cce6db Version Packages (#1897)
d2121dc Fix npm auth for path-based registries during publish by preserving configure...
036fdd4 Fix several changeset version issues with workspace protocol dependencies (...
5c4731f Gracefully handle stale npm info data leading to duplicate publish attempts...
96ca062 Error on unsupported flags for individual CLI commands (#1889)
42943b7 fix(cli): respond to --help on all subcommands (#1873)
f61e716 Improved detection for published state of prerelease-only packages without ...
See full diff in compare view

Updates @oclif/plugin-plugins from 5.4.60 to 5.4.61

Release notes

Sourced from @oclif/plugin-plugins's releases.

5.4.61

Bug Fixes

added failing test for sequential plugin installation @W-21915680@ (cf1a801)

improved test coverage for sequential plugin installation @W-21915680@ (0678888)

removed errant console.log @W-21915680@ (12e72a5)

sequential plugin installation now works @W-21915680@ (a8aa113)

tarballs properly installable @W-21915680@ (3217be0)

Changelog

Sourced from @oclif/plugin-plugins's changelog.

5.4.61 (2026-04-14)

Bug Fixes

added failing test for sequential plugin installation @W-21915680@ (cf1a801)

improved test coverage for sequential plugin installation @W-21915680@ (0678888)

removed errant console.log @W-21915680@ (12e72a5)

sequential plugin installation now works @W-21915680@ (a8aa113)

tarballs properly installable @W-21915680@ (3217be0)

Commits

d17a761 chore(release): 5.4.61 [skip ci]
ef6fbf0 Merge pull request #1295 from oclif/jf/W-21915680
a27f90e chore: fixing git2gus syntax error
3217be0 fix: tarballs properly installable @W-21915680@
288f6c7 chore(dev-deps): bump oclif from 4.22.92 to 4.23.0 (#1300)
b0f5c45 chore(dev-deps): bump @oclif/plugin-help from 6.2.38 to 6.2.43 (#1301)
739fe8c chore(dev-deps): bump eslint-config-oclif from 6.0.150 to 6.0.156 (#1297)
12e72a5 fix: removed errant console.log @W-21915680@
0678888 fix: improved test coverage for sequential plugin installation @W-21915680@
a8aa113 fix: sequential plugin installation now works @W-21915680@
Additional commits viewable in compare view

Updates @types/vscode from 1.115.0 to 1.116.0

Commits

See full diff in compare view

Updates @vscode/vsce from 3.7.1 to 3.9.1

Release notes

Sourced from @vscode/vsce's releases.

v3.9.1

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

v3.9.1-0

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

v3.9.0

Changes:

#1263: fix: build regressions in 3.8.1

#1261: Add override for serialize-javascript

This list of changes was auto generated.

v3.8.2-1

Changes:

#1263: fix: build regressions in 3.8.1

This list of changes was auto generated.

v3.8.2-0

Changes:

#1261: Add override for serialize-javascript

This list of changes was auto generated.

v3.8.1

Changes:

... (truncated)

Commits

98cca9e fix: module type mismatch (#1266)
9329b35 fix: build regressions in 3.8.1 (#1263)
165b0f2 Add override for serialize-javascript (#1261)
7d124ab chore: update @azure/identity to 4.13.1 and modernize TypeScript/Node.js conf...
cbdd401 fix: run npm audit fix to update package-lock.json (#1258)
13c5fa8 Merge pull request #1255 from microsoft/dependabot/npm_and_yarn/multi-580a7c2f10
c6f98dc Bump brace-expansion
01da009 Bump picomatch from 2.3.1 to 2.3.2 (#1253)
bb899fa Merge pull request #1252 from microsoft/dependabot/npm_and_yarn/yauzl-3.2.1
3f4fa96 Bump yauzl from 2.10.0 to 3.2.1
Additional commits viewable in compare view

Updates fastify from 5.8.4 to 5.8.5

Release notes

Sourced from fastify's releases.

v5.8.5

⚠️ Security Release

This fixes CVE CVE-2026-33806 GHSA-247c-9743-5963.

What's Changed

chore: Fix port parsing by @jsumners in fastify/fastify#6603

chore: upgrade to typescript v6.0.2 by @Tony133 in fastify/fastify#6605

fix: restore trustProxy function for number and string types, add null check for socketAddr by @mcollina in fastify/fastify#6613

ci: reduce cron scheduled workflows from daily/weekly to monthly by @Fdawgs in fastify/fastify#6623

chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 by @dependabot[bot] in fastify/fastify#6629

chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 by @dependabot[bot] in fastify/fastify#6632

chore: Bump borp from 0.21.0 to 1.0.0 by @dependabot[bot] in fastify/fastify#6633

chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 by @dependabot[bot] in fastify/fastify#6630

docs(ecosystem): add @pompelmi/fastify-plugin by @SonoTommy in fastify/fastify#6610

New Contributors

@SonoTommy made their first contribution in fastify/fastify#6610

Full Changelog: fastify/fastify@v5.8.4...v5.8.5

Commits

3983cce Bumped v5.8.5
3ce3ae6 Merge commit from fork
b06a196 docs(ecosystem): add @pompelmi/fastify-plugin (#6610)
909c5d5 chore: Bump actions/dependency-review-action from 4.8.3 to 4.9.0 (#6630)
4db21a3 chore: Bump borp from 0.21.0 to 1.0.0 (#6633)
0f4e544 chore: Bump markdownlint-cli2 from 0.21.0 to 0.22.0 (#6632)
33a2fcd chore: Bump pnpm/action-setup from 4.2.0 to 5.0.0 (#6629)
fd35d82 ci: reduce cron schedules from daily/weekly to monthly (#6623)
8dee9be fix: restore trustProxy function for number and string types, add null check ...
d457aed chore: upgrade to typescript v6.0.2 (#6605)
Additional commits viewable in compare view

Updates postcss from 8.5.9 to 8.5.10

Release notes

Sourced from postcss's releases.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

Changelog

Sourced from postcss's changelog.

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

Commits

33b9790 Release 8.5.10 version
536c79e Escape </style> in CSS output (#2074)
afa96b2 Update dependencies (#2073)
effe88b Typo (#2072)
3ee79a2 Thread model (#2071)
2e0683d Create incident response docs (#2070)
See full diff in compare view

Updates esbuild from 0.24.2 to 0.28.0

Release notes

Sourced from esbuild's releases.

v0.28.0
Add support for with { type: 'text' } imports (#4435)

The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:
import string from './example.txt' with { type: 'text' }
console.log(string)
Add integrity checks to fallback download path (#4343)

Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

Update the Go compiler from 1.25.7 to 1.26.1

This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

It now uses the new garbage collector that comes with Go 1.26.

The Go compiler is now more aggressive with allocating memory on the stack.

The executable format that the Go linker uses has undergone several changes.

The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

You can read the Go 1.26 release notes for more information.
v0.27.7
Fix lowering of define semantics for TypeScript parameter properties (#4421)

The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)
class Foo {
constructor(x = 1) {
this.x = x;
__publicField(this, "y", 2);
}
x;
}
// New output (with --loader=ts --target=es2021)
class Foo {

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

Commits

6a794df publish 0.28.0 to npm
64ee0ea fix #4435: support with { type: text } imports
ef65aee fix sort order in snapshots_packagejson.txt
1a26a8e try to fix test-old-ts, also shuffle CI tasks
556ce6c use '' instead of null to omit build hashes
8e675a8 ci: allow missing binary hashes for tests
7067763 Reapply "update go 1.25.7 => 1.26.1"
39473a9 fix #4343: integrity check for binary download
2025c9f publish 0.27.7 to npm
c6b586e fix typo in Makefile for @esbuild/win32-x64
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Updates vite from 8.0.8 to 8.0.9

Release notes

Sourced from vite's releases.

v8.0.9

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.9 (2026-04-20)

Features

update rolldown to 1.0.0-rc.16 (#22248) (2947edd)

Bug Fixes

allow binding when strictPort is set but wildcard port is in use (#22150) (dfc8aa5)

build: emptyOutDir should happen for watch rebuilds (#22207) (ee52267)

bundled-dev: reject requests to HMR patch files in non potentially trustworthy origins (#22269) (868f141)

css: use unique key for cssEntriesMap to prevent same-basename collision (#22039) (374bb5d)

deps: update all non-major dependencies (#22219) (4cd0d67)

deps: update all non-major dependencies (#22268) (c28e9c1)

detect Deno workspace root (fix #22237) (#22238) (1b793c0)

dev: handle errors in watchChange hook (#22188) (fc08bda)

optimizer: handle more chars that will be sanitized (#22208) (3f24533)

skip fallback sourcemap generation for ?raw imports (#22148) (3ec9cda)

Documentation

align the descriptions in READMEs (#22231) (44c42b9)

fix reuses wording in dev environment comment (#22173) (9163412)

fix wording in sass error comment (#22214) (bc5c6a7)

update build CLI defaults (#22261) (605bb97)

Miscellaneous Chores

deps: update dependency dotenv-expand to v13 (#22271) (0a3887d)

Commits

ce729f5 release: v8.0.9
605bb97 docs: update build CLI defaults (#22261)
c28e9c1 fix(deps): update all non-major dependencies (#22268)
0a3887d chore(deps): update dependency dotenv-expand to v13 (#22271)
868f141 fix(bundled-dev): reject requests to HMR patch files in non potentially trust...
3ec9cda fix: skip fallback sourcemap generation for ?raw imports (#22148)
3f24533 fix(optimizer): handle more chars that will be sanitized (#22208)
1b793c0 fix: detect Deno workspace root (fix #22237) (#22238)
fc08bda fix(dev): handle errors in watchChange hook (#22188)
374bb5d fix(css): use unique key for cssEntriesMap to prevent same-basename collision...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… 1 directory with 8 updates Bumps the development-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@changesets/cli](https://github.com/changesets/changesets) | `2.30.0` | `2.31.0` | | [@oclif/plugin-plugins](https://github.com/oclif/plugin-plugins) | `5.4.60` | `5.4.61` | | [@types/vscode](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/vscode) | `1.115.0` | `1.116.0` | | [@vscode/vsce](https://github.com/Microsoft/vsce) | `3.7.1` | `3.9.1` | | [fastify](https://github.com/fastify/fastify) | `5.8.4` | `5.8.5` | | [postcss](https://github.com/postcss/postcss) | `8.5.9` | `8.5.10` | | [esbuild](https://github.com/evanw/esbuild) | `0.24.2` | `0.28.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.8` | `8.0.9` | Updates `@changesets/cli` from 2.30.0 to 2.31.0 - [Release notes](https://github.com/changesets/changesets/releases) - [Commits](https://github.com/changesets/changesets/compare/@changesets/cli@2.30.0...@changesets/cli@2.31.0) Updates `@oclif/plugin-plugins` from 5.4.60 to 5.4.61 - [Release notes](https://github.com/oclif/plugin-plugins/releases) - [Changelog](https://github.com/oclif/plugin-plugins/blob/main/CHANGELOG.md) - [Commits](oclif/plugin-plugins@5.4.60...5.4.61) Updates `@types/vscode` from 1.115.0 to 1.116.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/vscode) Updates `@vscode/vsce` from 3.7.1 to 3.9.1 - [Release notes](https://github.com/Microsoft/vsce/releases) - [Commits](microsoft/vscode-vsce@v3.7.1...v3.9.1) Updates `fastify` from 5.8.4 to 5.8.5 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.8.4...v5.8.5) Updates `postcss` from 8.5.9 to 8.5.10 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.9...8.5.10) Updates `esbuild` from 0.24.2 to 0.28.0 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.24.2...v0.28.0) Updates `vite` from 8.0.8 to 8.0.9 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.9/packages/vite) --- updated-dependencies: - dependency-name: "@changesets/cli" dependency-version: 2.31.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@oclif/plugin-plugins" dependency-version: 5.4.61 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@types/vscode" dependency-version: 1.116.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@vscode/vsce" dependency-version: 3.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: fastify dependency-version: 5.8.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: postcss dependency-version: 8.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: esbuild dependency-version: 0.28.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: vite dependency-version: 8.0.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-04-20T11:43:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectstack-demo	Ready	Preview, Comment	Apr 20, 2026 11:50am
spec	Ready	Preview, Comment	Apr 20, 2026 11:50am

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 20, 2026

github-actions Bot added documentation Improvements or additions to documentation size/s labels Apr 20, 2026

vercel Bot deployed to Preview – objectstack-demo April 20, 2026 11:46 View deployment

vercel Bot deployed to Preview – spec April 20, 2026 11:50 View deployment

hotlong merged commit 418c789 into main Apr 20, 2026
25 of 26 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/development-dependencies-6de75dede6 branch April 20, 2026 13:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 8 updates#1193

chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 8 updates#1193
hotlong merged 1 commit intomainfrom
dependabot/npm_and_yarn/development-dependencies-6de75dede6

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Apr 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​changesets/cli@​2.31.0

Minor Changes

Patch Changes

5.4.61

Bug Fixes

5.4.61 (2026-04-14)

Bug Fixes

v3.9.1

Changes:

v3.9.1-0

Changes:

v3.9.0

Changes:

v3.8.2-1

Changes:

v3.8.2-0

Changes:

v3.8.1

Changes:

v5.8.5

⚠️ Security Release

What's Changed

New Contributors

8.5.10

8.5.10

v0.28.0

v0.27.7

Changelog: 2024

v8.0.9

8.0.9 (2026-04-20)

Features

Bug Fixes

Documentation

Miscellaneous Chores

Uh oh!

vercel Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

`@changesets/cli@2`.31.0

vercel Bot commented Apr 20, 2026 •

edited

Loading