-
-
Notifications
You must be signed in to change notification settings - Fork 12
Update all non-major dependencies #854
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
fe860e6
to
4d6e156
Compare
fb7923d
to
d876a0e
Compare
56c7674
to
32b2e8e
Compare
670a8cc
to
627dc83
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.14.1
->1.14.4
22.0.1
->22.0.2
11.9.1
->11.10.0
0.25.0
->0.25.5
4.7.6
->4.7.11
0.9.2
->0.11.0
9.6.0
->9.7.0
10.6.2
->10.12.1
2.12.1
->2.13.0
8.4.0
->8.5.0
4.40.0
->4.41.0
1.0.0
->1.1.0
Release Notes
honojs/node-server (@hono/node-server)
v1.14.4
Compare Source
What's Changed
Full Changelog: honojs/node-server@v1.14.3...v1.14.4
v1.14.3
Compare Source
What's Changed
RequestError
name properly by @yusukebe in https://github.com/honojs/node-server/pull/243Full Changelog: honojs/node-server@v1.14.2...v1.14.3
v1.14.2
Compare Source
What's Changed
headers
,status
, andok
, and then drop thegetInternalBody
function. by @usualoma in https://github.com/honojs/node-server/pull/242Full Changelog: honojs/node-server@v1.14.1...v1.14.2
tsconfig/bases (@tsconfig/node22)
v22.0.2
Compare Source
WiseLibs/better-sqlite3 (better-sqlite3)
v11.10.0
Compare Source
What's Changed
New Contributors
Full Changelog: WiseLibs/better-sqlite3@v11.9.1...v11.10.0
evanw/esbuild (esbuild)
v0.25.5
Compare Source
Fix a regression with
browser
inpackage.json
(#4187)The fix to #4144 in version 0.25.3 introduced a regression that caused
browser
overrides specified inpackage.json
to fail to override relative path names that end in a trailing slash. That behavior change affected theaxios@0.30.0
package. This regression has been fixed, and now has test coverage.Add support for certain keywords as TypeScript tuple labels (#4192)
Previously esbuild could incorrectly fail to parse certain keywords as TypeScript tuple labels that are parsed by the official TypeScript compiler if they were followed by a
?
modifier. These labels includedfunction
,import
,infer
,new
,readonly
, andtypeof
. With this release, these keywords will now be parsed correctly. Here's an example of some affected code:Add CSS prefixes for the
stretch
sizing value (#4184)This release adds support for prefixing CSS declarations such as
div { width: stretch }
. That CSS is now transformed into this depending on what the--target=
setting includes:v0.25.4
Compare Source
Add simple support for CORS to esbuild's development server (#4125)
Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from
localhost
where the esbuild development server is running.To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new
cors
option will now set theAccess-Control-Allow-Origin
response header when the request has a matchingOrigin
header. Note that this currently only works for requests that don't send a preflightOPTIONS
request, as esbuild's development server doesn't currently supportOPTIONS
requests.Some examples:
CLI:
JS:
Go:
The special origin
*
can be used to allow any origin to access esbuild's development server. Note that this means any website you visit will be able to read everything served by esbuild.Pass through invalid URLs in source maps unmodified (#4169)
This fixes a regression in version 0.25.0 where
sources
in source maps that form invalid URLs were not being passed through to the output. Version 0.25.0 changed the interpretation ofsources
from file paths to URLs, which means that URL parsing can now fail. Previously URLs that couldn't be parsed were replaced with the empty string. With this release, invalid URLs insources
should now be passed through unmodified.Handle exports named
__proto__
in ES modules (#4162, #4163)In JavaScript, the special property name
__proto__
sets the prototype when used inside an object literal. Previously esbuild's ESM-to-CommonJS conversion didn't special-case the property name of exports named__proto__
so the exported getter accidentally became the prototype of the object literal. It's unclear what this affects, if anything, but it's better practice to avoid this by using a computed property name in this case.This fix was contributed by @magic-akari.
v0.25.3
Compare Source
Fix lowered
async
arrow functions beforesuper()
(#4141, #4142)This change makes it possible to call an
async
arrow function in a constructor before callingsuper()
when targeting environments withoutasync
support, as long as the function body doesn't referencethis
. Here's an example (notice the change fromthis
tonull
):Some background: Arrow functions with the
async
keyword are transformed into generator functions for older language targets such as--target=es2016
. Since arrow functions capturethis
, the generated code forwardsthis
into the body of the generator function. However, JavaScript class syntax forbids usingthis
in a constructor before callingsuper()
, and this forwarding was problematic since previously happened even when the function body doesn't usethis
. Starting with this release, esbuild will now only forwardthis
if it's used within the function body.This fix was contributed by @magic-akari.
Fix memory leak with
--watch=true
(#4131, #4132)This release fixes a memory leak with esbuild when
--watch=true
is used instead of--watch
. Previously using--watch=true
caused esbuild to continue to use more and more memory for every rebuild, but--watch=true
should now behave like--watch
and not leak memory.This bug happened because esbuild disables the garbage collector when it's not run as a long-lived process for extra speed, but esbuild's checks for which arguments cause esbuild to be a long-lived process weren't updated for the new
--watch=true
style of boolean command-line flags. This has been an issue since this boolean flag syntax was added in version 0.14.24 in 2022. These checks are unfortunately separate from the regular argument parser because of how esbuild's internals are organized (the command-line interface is exposed as a separate Go API so you can build your own custom esbuild CLI).This fix was contributed by @mxschmitt.
More concise output for repeated legal comments (#4139)
Some libraries have many files and also use the same legal comment text in all files. Previously esbuild would copy each legal comment to the output file. Starting with this release, legal comments duplicated across separate files will now be grouped in the output file by unique comment content.
Allow a custom host with the development server (#4110)
With this release, you can now use a custom non-IP
host
with esbuild's local development server (either with--serve=
for the CLI or with theserve()
call for the API). This was previously possible, but was intentionally broken in version 0.25.0 to fix a security issue. This change adds the functionality back except that it's now opt-in and only for a single domain name that you provide.For example, if you add a mapping in your
/etc/hosts
file fromlocal.example.com
to127.0.0.1
and then useesbuild --serve=local.example.com:8000
, you will now be able to visit http://local.example.com:8000/ in your browser and successfully connect to esbuild's development server (doing that would previously have been blocked by the browser). This should also work with HTTPS if it's enabled (see esbuild's documentation for how to do that).Add a limit to CSS nesting expansion (#4114)
With this release, esbuild will now fail with an error if there is too much CSS nesting expansion. This can happen when nested CSS is converted to CSS without nesting for older browsers as expanding CSS nesting is inherently exponential due to the resulting combinatorial explosion. The expansion limit is currently hard-coded and cannot be changed, but is extremely unlikely to trigger for real code. It exists to prevent esbuild from using too much time and/or memory. Here's an example:
Previously, transforming this file with
--target=safari1
took 5 seconds and generated 40mb of CSS. Trying to do that will now generate the following error instead:Fix path resolution edge case (#4144)
This fixes an edge case where esbuild's path resolution algorithm could deviate from node's path resolution algorithm. It involves a confusing situation where a directory shares the same file name as a file (but without the file extension). See the linked issue for specific details. This appears to be a case where esbuild is correctly following node's published resolution algorithm but where node itself is doing something different. Specifically the step
LOAD_AS_FILE
appears to be skipped when the input ends with..
. This release changes esbuild's behavior for this edge case to match node's behavior.Update Go from 1.23.7 to 1.23.8 (#4133, #4134)
This should have no effect on existing code as this version change does not change Go's operating system support. It may remove certain reports from vulnerability scanners that detect which version of the Go compiler esbuild uses, such as for CVE-2025-22871.
As a reminder, esbuild's development server is intended for development, not for production, so I do not consider most networking-related vulnerabilities in Go to be vulnerabilities in esbuild. Please do not use esbuild's development server in production.
v0.25.2
Compare Source
Support flags in regular expressions for the API (#4121)
The JavaScript plugin API for esbuild takes JavaScript regular expression objects for the
filter
option. Internally these are translated into Go regular expressions. However, this translation previously ignored theflags
property of the regular expression. With this release, esbuild will now translate JavaScript regular expression flags into Go regular expression flags. Specifically the JavaScript regular expression/\.[jt]sx?$/i
is turned into the Go regular expression`(?i)\.[jt]sx?$`
internally inside of esbuild's API. This should make it possible to use JavaScript regular expressions with thei
flag. Note that JavaScript and Go don't support all of the same regular expression features, so this mapping is only approximate.Fix node-specific annotations for string literal export names (#4100)
When node instantiates a CommonJS module, it scans the AST to look for names to expose via ESM named exports. This is a heuristic that looks for certain patterns such as
exports.NAME = ...
ormodule.exports = { ... }
. This behavior is used by esbuild to "annotate" CommonJS code that was converted from ESM with the original ESM export names. For example, when converting the fileexport let foo, bar
from ESM to CommonJS, esbuild appends this to the end of the file:However, this feature previously didn't work correctly for export names that are not valid identifiers, which can be constructed using string literal export names. The generated code contained a syntax error. That problem is fixed in this release:
Basic support for index source maps (#3439, #4109)
The source map specification has an optional mode called index source maps that makes it easier for tools to create an aggregate JavaScript file by concatenating many smaller JavaScript files with source maps, and then generate an aggregate source map by simply providing the original source maps along with some offset information. My understanding is that this is rarely used in practice. I'm only aware of two uses of it in the wild: ClojureScript and Turbopack.
This release provides basic support for indexed source maps. However, the implementation has not been tested on a real app (just on very simple test input). If you are using index source maps in a real app, please try this out and report back if anything isn't working for you.
Note that this is also not a complete implementation. For example, index source maps technically allows nesting source maps to an arbitrary depth, while esbuild's implementation in this release only supports a single level of nesting. It's unclear whether supporting more than one level of nesting is important or not given the lack of available test cases.
This feature was contributed by @clyfish.
v0.25.1
Compare Source
Fix incorrect paths in inline source maps (#4070, #4075, #4105)
This fixes a regression from version 0.25.0 where esbuild didn't correctly resolve relative paths contained within source maps in inline
sourceMappingURL
data URLs. The paths were incorrectly being passed through as-is instead of being resolved relative to the source file containing thesourceMappingURL
comment, which was due to the data URL not being a file URL. This regression has been fixed, and this case now has test coverage.Fix invalid generated source maps (#4080, #4082, #4104, #4107)
This release fixes a regression from version 0.24.1 that could cause esbuild to generate invalid source maps. Specifically under certain conditions, esbuild could generate a mapping with an out-of-bounds source index. It was introduced by code that attempted to improve esbuild's handling of "null" entries in source maps (i.e. mappings with a generated position but no original position). This regression has been fixed.
This fix was contributed by @jridgewell.
Fix a regression with non-file source map paths (#4078)
The format of paths in source maps that aren't in the
file
namespace was unintentionally changed in version 0.25.0. Path namespaces is an esbuild-specific concept that is optionally available for plugins to use to distinguish paths fromfile
paths and from paths meant for other plugins. Previously the namespace was prepended to the path joined with a:
character, but version 0.25.0 unintentionally failed to prepend the namespace. The previous behavior has been restored.Fix a crash with
switch
optimization (#4088)The new code in the previous release to optimize dead code in switch statements accidentally introduced a crash in the edge case where one or more switch case values include a function expression. This is because esbuild now visits the case values first to determine whether any cases are dead code, and then visits the case bodies once the dead code status is known. That triggered some internal asserts that guard against traversing the AST in an unexpected order. This crash has been fixed by changing esbuild to expect the new traversal ordering. Here's an example of affected code:
Update Go from 1.23.5 to 1.23.7 (#4076, #4077)
This should have no effect on existing code as this version change does not change Go's operating system support. It may remove certain reports from vulnerability scanners that detect which version of the Go compiler esbuild uses.
This PR was contributed by @MikeWillCook.
honojs/hono (hono)
v4.7.11
Compare Source
What's Changed
URLSearchParams
to the query-params benchmark by @yusukebe in https://github.com/honojs/hono/pull/4149c.newResponse()
for the response oferr.getResponse()
by @yusukebe in https://github.com/honojs/hono/pull/4181New Contributors
Full Changelog: honojs/hono@v4.7.10...v4.7.11
v4.7.10
Compare Source
What's Changed
#clone()
by @yusukebe in https://github.com/honojs/hono/pull/4139header.alg
as fallback inverifyFromJwks
by @yusukebe in https://github.com/honojs/hono/pull/4144Full Changelog: honojs/hono@v4.7.9...v4.7.10
v4.7.9
Compare Source
What's Changed
getSignedCookie
parameters type by @Hill-98 in https://github.com/honojs/hono/pull/4123New Contributors
Full Changelog: honojs/hono@v4.7.8...v4.7.9
v4.7.8
Compare Source
What's Changed
4.12.0
by @yusukebe in https://github.com/honojs/hono/pull/4096replaceRequest: false
option for.mount
by @geelen in https://github.com/honojs/hono/pull/4113New Contributors
Full Changelog: honojs/hono@v4.7.7...v4.7.8
v4.7.7
Compare Source
What's Changed
c.header()
when it's finalized by @yusukebe in https://github.com/honojs/hono/pull/4078New Contributors
Full Changelog: honojs/hono@v4.7.6...v4.7.7
humanwhocodes/mentoss (mentoss)
v0.11.0
Compare Source
Features
Bug Fixes
v0.10.0
Compare Source
Features
pinojs/pino (pino)
v9.7.0
Compare Source
pnpm/pnpm (pnpm)
v10.12.1
Minor Changes
Experimental. Added support for global virtual stores. When enabled,
node_modules
contains only symlinks to a central virtual store, rather tonode_modules/.pnpm
. By default, this central store is located at<store-path>/links
(you can find the store path by runningpnpm store path
).In the central virtual store, each package is hard linked into a directory whose name is the hash of its dependency graph. This allows multiple projects on the system to symlink shared dependencies from this central location, significantly improving installation speed when a warm cache is available.
To enable the global virtual store, set
enableGlobalVirtualStore: true
in your rootpnpm-workspace.yaml
, or globally via:NOTE: In CI environments, where caches are typically cold, this setting may slow down installation. pnpm automatically disables the global virtual store when running in CI.
Related PR: #8190
pnpm update
command now supports updatingcatalog:
protocol dependencies and writes new specifiers topnpm-workspace.yaml
.--save-catalog
and--save-catalog-name=<name>
) topnpm add
to save new dependencies as catalog entries.catalog:
orcatalog:<name>
will be added topackage.json
and the package specifier will be added to thecatalogs
orcatalog[<name>]
object inpnpm-workspace.yaml
#9425.ci
for explicitly telling pnpm if the current environment is a CI or not.Patch Changes
pnpm patch
using semantic versioning rules.v10.11.1
Compare Source
Patch Changes
pnpm deploy --legacy
creates unexpected directories when the rootpackage.json
has a workspace package as a peer dependency #9550.strictPeerDependencies
istrue
but all issues are ignored bypeerDependencyRules
#9505.pnpm_config_
env variables instead ofnpm_config_
#9571.--lockfile-only
flag onpnpm update
to produce a differentpnpm-lock.yaml
than an update without the flag.pnpm deploy
work in repos withoverrides
wheninject-workspace-packages=true
#9283.pnpm -r --silent run
should not print out section #9563.v10.11.0
Compare Source
Minor Changes
A new setting added for
pnpm init
to create apackage.json
withtype=module
, wheninit-type
ismodule
. Works as a flag for the init command too #9463.Added support for Nushell to
pnpm setup
#6476.Added two new flags to the
pnpm audit
command,--ignore
and--ignore-unfixable
#8474.Ignore all vulnerabilities that have no solution:
> pnpm audit --ignore-unfixable
Provide a list of CVE's to ignore those specifically, even if they have a resolution.
> pnpm audit --ignore=CVE-2021-1234 --ignore=CVE-2021-5678
Added support for recursively running pack in every project of a workspace #4351.
Now you can run
pnpm -r pack
to pack all packages in the workspace.Patch Changes
dangerouslyAllowAllBuilds
is set totrue
#9472.pnpm link
should work from inside a workspace #9506.workspaceConcurrency
toMath.min(os.availableParallelism(), 4)
#9493.strictPeerDependencies
istrue
but all issues are ignored bypeerDependencyRules
#9505.updateConfig
frompnpm-workspace.yaml
#9500.recursive pack
url.parse
usage to fix warning on Node.js 24 #9492.pnpm run
should be able to run commands from the workspace root, ifignoreScripts
is set tottrue
#4858.v10.10.0
Compare Source
Minor Changes
preResolution
,importPackage
, andfetchers
hooks from local pnpmfile.Patch Changes
cd
command, whenshellEmulator
istrue
#7838.pnpm-workspace.yaml
#9453.npm_package_json
environment variable to the executed scripts #9452.--reporter=silent
option.v10.9.0
Compare Source
Minor Changes
Added support for installing JSR packages. You can now install JSR packages using the following syntax:
or with a version range:
For example, running:
will add the following entry to your
package.json
:When publishing, this entry will be transformed into a format compatible with npm, older versions of Yarn, and previous pnpm versions:
Related issue: #8941.
Note: The
@jsr
scope defaults to https://npm.jsr.io/ if the@jsr:registry
setting is not defined.Added a new setting,
dangerouslyAllowAllBuilds
, for automatically running any scripts of dependencies without the need to approve any builds. It was already possible to allow all builds by adding this topnpm-workspace.yaml
:dangerouslyAllowAllBuilds
has the same effect but also allows to be set globally via:It can also be set when running a command:
Patch Changes
verifyDepsBeforeRun
whennodeLinker
ishoisted
and there is a workspace package without dependencies andnode_modules
directory #9424.verifyDepsBeforeRun
support fornodeLinker: pnp
. CombiningverifyDepsBeforeRun
andnodeLinker: pnp
will now print a warning.v10.8.1
Compare Source
Patch Changes
package.json
,onlyBuiltDependencies
will be written topnpm-workspace.yaml
file #9404.v10.8.0
Compare Source
Minor Changes
Experimental. A new hook is supported for updating configuration settings. The hook can be provided via
.pnpmfile.cjs
. For example:Now you can use the
pnpm add
command with the--config
flag to install new configurational dependencies #9377.Patch Changes
!/
inpnpm-workspace.yaml
. This fixes a regression introduced by #9169.pnpm audit --fix
should update the overrides inpnpm-workspace.yaml
.pnpm link
should update overrides inpnpm-workspace.yaml
, not inpackage.json
#9365.v10.7.1
: pnpm 10.7.1Compare Source
Patch Changes
pnpm config set
should convert the settings to their correct type before adding them topnpm-workspace.yaml
#9355.pnpm config get
should read auth related settings via npm CLI #9345.~/
in a path in.npmrc
with the home directory #9217.Platinum Sponsors
Gold Sponsors
Configuration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.