Skip to content

chore(deps-dev): bump the development-dependencies group with 6 updates#246

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-c12591f3a4
Open

chore(deps-dev): bump the development-dependencies group with 6 updates#246
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-c12591f3a4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 6 updates:

Package From To
lint-staged 17.1.0 17.2.0
oxfmt 0.59.0 0.60.0
oxlint 1.74.0 1.75.0
turbo 2.10.5 2.10.7
happy-dom 20.11.0 20.11.1
wrangler 4.112.0 4.114.0

Updates lint-staged from 17.1.0 to 17.2.0

Release notes

Sourced from lint-staged's releases.

v17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

    Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

    Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};

v17.1.1

Patch Changes

  • #1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.
Changelog

Sourced from lint-staged's changelog.

17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

    Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

    Also, native JavaScript/Node.js function tasks won't be chunked at all, when previously they were run multiple times when chunked:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.js": {
    title: "Log staged JS files to console",
    task: async (files) => {
      console.log("Staged JS files:", files);
    },
  },
};

17.1.1

Patch Changes

  • #1820 a626a9f - It's now possible to set --max-arg-length=Infinity to effectively disable chunking of tasks based on the number of staged files. The parsing and validation of the numeric CLI options --max-arg-length and --concurrency has been improved.
Commits
  • fb540fb Merge pull request #1824 from lint-staged/changeset-release/main
  • dc0a738 chore(changeset): release
  • 60cbb88 Merge pull request #1823 from lint-staged/reimplement-chunk-files
  • 2354dc4 build(deps): update dependencies
  • 0516e7f docs: adjust debug logs
  • e22f6ed style: run oxfmt on README.md
  • 37e8e1a fix: restore chunking of git add command after running tasks
  • 2c75f1d chore: remove unused file
  • ee156cc feat: add improved lazy-chunking of command strings
  • baa7c98 feat: remove current chunkFiles implementation
  • Additional commits viewable in compare view

Updates oxfmt from 0.59.0 to 0.60.0

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

Updates oxlint from 1.74.0 to 1.75.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

  • 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
  • 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
  • bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
  • 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
  • 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
  • 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
  • ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

  • 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
  • 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
  • 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
  • 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
  • a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
  • ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
  • 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
  • ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
  • e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
  • 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
  • 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
  • fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
  • ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
  • dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
  • 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
  • cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

  • 25d577e language_server: Start tools in parallel (#15500) (Sysix)
  • 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
  • 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
  • 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
  • 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
  • 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

  • 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
  • 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
  • a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
  • 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
  • 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
  • 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.75.0] - 2026-07-20

🚀 Features

  • dd18383 linter/node: Implement no-top-level-await rule (#24634) (Connor Shea)
  • 16a65f2 linter/react: Implement function-component-definition rule (#24471) (Cole Ellison)
  • 7f1f585 linter: Reuse jest/padding-around-test-blocks for vitest/padding-around-test-blocks (#24519) (Mikhail Baev)
  • 99978a8 linter/import/consistent-type-specifier-style: Support prefer-top-level-if-only-type-imports option (#24502) (camc314)

🐛 Bug Fixes

  • 8694167 linter/eslint/prefer-destructuring: Handle typed declarations (#24616) (camc314)
Commits
  • 83abe3b release(apps): oxlint v1.75.0 && oxfmt v0.60.0 (#24713)
  • 6ce51d3 chore(deps): update dependency oxlint-tsgolint to v7.0.2000 (#24763)
  • dd18383 feat(linter/node): implement no-top-level-await rule (#24634)
  • 8694167 fix(linter/eslint/prefer-destructuring): handle typed declarations (#24616)
  • e2e0f94 chore(docs): update sponsor section (#24588)
  • 16a65f2 feat(linter/react): implement function-component-definition rule (#24471)
  • 7f1f585 feat(linter): reuse jest/padding-around-test-blocks for `vitest/padding-aro...
  • 99978a8 feat(linter/import/consistent-type-specifier-style): support `prefer-top-leve...
  • See full diff in compare view

Updates turbo from 2.10.5 to 2.10.7

Release notes

Sourced from turbo's releases.

Turborepo v2.10.7-canary.1

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.6-canary.5...v2.10.7-canary.1

Turborepo v2.10.6

What's Changed

Changelog

... (truncated)

Commits

Updates happy-dom from 20.11.0 to 20.11.1

Release notes

Sourced from happy-dom's releases.

v20.11.1

👷‍♂️ Patch fixes

  • Improve performance of query selectors by avoiding construction of DOMException when not needed - By @@​cyfung1031 in task #2228
Commits

Updates wrangler from 4.112.0 to 4.114.0

Release notes

Sourced from wrangler's releases.

wrangler@4.114.0

Minor Changes

  • #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

    wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

    You can explore this data two ways:

    • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
    • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

    While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

  • #14373 246ce92 Thanks @​Jacroney! - Improve the D1 database-limit error message

    When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

  • #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260721.1 ^5.20260722.1
    workerd 1.20260721.1 1.20260722.1

  • #14788 8416b33 Thanks @​chinesepowered! - Fix grammar in the container image-too-large error

    The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."

  • #14809 4683ff8 Thanks @​jamesopstad! - Ignore the removed legacy_env field when reading a redirected configuration

    Older versions of tools such as the Vite plugin can generate a redirected configuration (.wrangler/deploy/config.json) that still includes the removed legacy_env field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips legacy_env from redirected configurations. User-authored configurations still report an error so that the field can be removed.

  • #14593 02232f3 Thanks @​spk-ai! - Fix dev proxy silently hanging or returning a misleading 503 on network errors for non-root-path requests

    During wrangler dev, a transient network error on any request path other than / could be misclassified as the worker being reloaded, even when it wasn't: GET/HEAD requests would silently hang (with nothing logged) until the client timed out, and other methods would receive a misleading Your worker restarted mid-request 503. Such errors are now reported and surfaced immediately when the worker has not actually changed.

  • #14797 f8a8c2c Thanks @​roerohan! - Explain how to provision Flagship bindings if app_id missing in remote development

    Wrangler now reports that a Flagship binding without an app_id must first be created with wrangler flagship apps create.

  • Updated dependencies [c38a2c3, c079ba3, 95b026e, c4bacec, 3203b5d]:

    • miniflare@4.20260722.0

wrangler@4.113.0

Minor Changes

... (truncated)

Commits
  • 16b3d5a Version Packages (#14799)
  • 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
  • 246ce92 [wrangler] Improve d1 create database-limit error message (#14373)
  • 02232f3 [wrangler] compare origins, not hrefs, when classifying dev proxy fetch error...
  • 8416b33 [wrangler] Fix grammar in container image-too-large error (#14788)
  • f8a8c2c [wrangler] Explain missing Flagship app ID (#14797)
  • 88f42e7 Version Packages (#14740)
  • 9e61971 unskip agent memory remote bindings test (#14786)
  • 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
  • 4815711 [miniflare] Report the Worker's error for HEAD requests (#14766)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the development-dependencies group with 6 updates
9ebc395 
Bumps the development-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.1.0` | `17.2.0` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.59.0` | `0.60.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.74.0` | `1.75.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.5` | `2.10.7` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.11.0` | `20.11.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.112.0` | `4.114.0` |


Updates `lint-staged` from 17.1.0 to 17.2.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.1.0...v17.2.0)

Updates `oxfmt` from 0.59.0 to 0.60.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.60.0/npm/oxfmt)

Updates `oxlint` from 1.74.0 to 1.75.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.75.0/npm/oxlint)

Updates `turbo` from 2.10.5 to 2.10.7
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](https://github.com/vercel/turborepo/commits)

Updates `happy-dom` from 20.11.0 to 20.11.1
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.11.0...v20.11.1)

Updates `wrangler` from 4.112.0 to 4.114.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.114.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: lint-staged
  dependency-version: 17.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: oxfmt
  dependency-version: 0.60.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: oxlint
  dependency-version: 1.75.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: turbo
  dependency-version: 2.10.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: happy-dom
  dependency-version: 20.11.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: wrangler
  dependency-version: 4.114.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@greptile-apps

greptile-apps Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@socket-security

socket-security Bot commented Jul 27, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedhappy-dom@​20.11.1661008895100
Addedwrangler@​4.114.0661009296100
Addedturbo@​2.10.71001008597100
Addedoxfmt@​0.60.0861008896100
Addedoxlint@​1.75.0991009196100
Addedlint-staged@​17.2.010010010097100

View full report

@socket-security

socket-security Bot commented Jul 27, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm happy-dom is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/catalog/package.json → npm/happy-dom@20.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/happy-dom@20.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants