chore(deps): update node dependencies#793
Open
loopingz wants to merge 1 commit into
Open
Conversation
loopingz
force-pushed
the
renovate/node-dependencies
branch
7 times, most recently
from
3d1398d to
f8f0e41
Compare
loopingz
force-pushed
the
renovate/node-dependencies
branch
9 times, most recently
from
33138e2 to
f82d88e
Compare
loopingz
force-pushed
the
renovate/node-dependencies
branch
5 times, most recently
from
6af554e to
eb0f7a1
Compare
loopingz
force-pushed
the
renovate/node-dependencies
branch
7 times, most recently
from
d0a02f0 to
d353601
Compare
loopingz
force-pushed
the
renovate/node-dependencies
branch
14 times, most recently
from
26f7343 to
8df2675
Compare
loopingz
force-pushed
the
renovate/node-dependencies
branch
13 times, most recently
from
e37d0b5 to
2850fe9
Compare
loopingz
force-pushed
the
renovate/node-dependencies
branch
from
2850fe9 to
31beaf7
Compare
Contributor
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.4.1→^4.4.4^1.19.5→^1.19.14^1.19.10→^1.19.14^0.25.1→^0.25.3^1.2.0→^1.3.0^28.0.8→^28.0.9^28.0.3→^28.0.9^16.0.1→^16.0.3^6.0.2→^6.0.3^12.1.2→^12.3.0^4.0.9→^4.0.10^24.1.0→^24.12.4^24.1.0→^24.12.4^24.1.0→^24.12.4^24.1.0→^24.12.4^5.5.1→^5.5.2^3.1.3→^3.1.40.82.1→0.82.4^8.17.1→^8.20.0^6.14.0→^6.15.0](https://renovatebot.com/diffs/npm/ajv@>=6.0.0 <6.14.0/6.14.0/6.15.0)^8.18.0→^8.20.0](https://renovatebot.com/diffs/npm/ajv@>=7.0.0 <8.18.0/8.18.0/8.20.0)^6.2.0→^6.2.1^5.0.5→^5.0.6^1.1.12→^1.1.14](https://renovatebot.com/diffs/npm/brace-expansion@>=1.0.0 <2.0.0/1.1.12/1.1.14)^2.0.2→^2.1.0](https://renovatebot.com/diffs/npm/brace-expansion@>=2.0.0 <3.0.0/2.0.2/2.1.0)^5.3.0→^5.6.2^5.4.1→^5.6.2^2.9.1→^2.9.2^14.0.2→^14.0.3^14.0.2→^14.0.3^9.1.2→^9.2.1^1.11.19→^1.11.20^8.0.3→^8.0.4](https://renovatebot.com/diffs/npm/diff@>=6.0.0 <8.0.3/8.0.3/8.0.4)^3.3.2→^3.4.3^3.4.0→^3.4.3^17.2.3→^17.4.2^0.27.1→^0.28.0^3.0.6→^3.0.7^1.1.1→^1.1.2^5.7.2→^5.8.0^5.7.2→^5.8.0^10.12.2→^10.14.1^17.3.0→^17.6.0^17.3.0→^17.6.0^4.10.3→^4.12.18^4.12.14→^4.12.18^26.0.1→^26.1.0^1.51.5→^1.56.121.0.10→1.1.2^6.0.11→^6.2.3^0.16.28→^0.16.45^4.17.23→^4.18.1^7.0.0→^7.0.1^4.0.0→^4.1.0^4.0.4→^4.1.0^10.2.4→^10.2.5](https://renovatebot.com/diffs/npm/minimatch@>=10.0.0 <11.0.0/10.2.4/10.2.5)^10.2.0→^10.8.2^0.52.2→^0.55.13.0.0-canary.1→3.0.0-canary.202508261828^10.1.0→^10.2.03.5.3→3.8.3^6.14.1→^6.15.1](https://renovatebot.com/diffs/npm/qs@>=6.0.0 <6.14.0/6.14.1/6.15.1)^2.0.0→^2.1.0^6.1.2→^6.1.3^5.0.5→^5.0.10^4.60.1→^4.60.3^4.59.0→^4.60.3^4.59.0→^4.60.3^0.33.4→^0.34.5^0.33.5→^0.34.5^3.1.7→^3.2.0^0.2.4→^0.2.5^4.8.1→^4.21.0^2.8.10→^2.9.12^6.0.2→^6.0.3^6.0.2→^6.0.3^6.0.2→^6.0.3^6.0.2→^6.0.3^7.24.1→^7.25.0](https://renovatebot.com/diffs/npm/undici@>=6.0.0 <6.21.3/7.24.1/7.25.0)^5.0.0→^5.1.0^6.4.1→^6.4.3^2.6.0→^2.9.0^2.8.3→^2.9.0](https://renovatebot.com/diffs/npm/yaml@>=2.0.0 <2.8.3/2.8.3/2.9.0)^2.8.3→^2.9.0](https://renovatebot.com/diffs/npm/yaml@>=2.0.0 <2.8.3/2.8.3/2.9.0)^4.3.5→^4.4.3^3.24.1→^3.25.76Release Notes
honojs/node-server (@hono/node-server)
v1.19.14Compare Source
What's Changed
Full Changelog: honojs/node-server@v1.19.13...v1.19.14
honojs/vite-plugins (@hono/vite-dev-server)
v0.25.3Compare Source
Patch Changes
cbb97d65ee8ea143a842128cd36735d856f6c7b8Thanks @yusukebe! - fix: correct exporting adaptersv0.25.2Compare Source
Patch Changes
81c9cbe1bae1d864a8a246480b234ff266058fa3Thanks @yuintei! - fix: use public ssrModule getter in handleHotUpdateBrooooooklyn/keyring-node (@napi-rs/keyring)
v1.3.0Compare Source
What's Changed
New Contributors
Full Changelog: Brooooooklyn/keyring-node@v1.2.0...v1.3.0
vertesia/composableai (@vertesia/client)
v0.82.4Compare Source
v0.82.3Compare Source
v0.82.2Compare Source
ajv-validator/ajv (ajv)
v8.20.0Compare Source
What's Changed
Full Changelog: ajv-validator/ajv@v8.19.0...v8.20.0
juliangruber/brace-expansion (brace-expansion@<5.0.5)
v5.0.6Compare Source
tj/commander.js (commander)
v14.0.3Compare Source
Added
Changes
.outputHelp()([#2427])iamkun/dayjs (dayjs)
v1.11.20Compare Source
Bug Fixes
kpdecker/jsdiff (diff@>=6.0.0 <8.0.3)
v8.0.4Compare Source
diffWordswhen used with anIntl.Segmenter. If the text to be diffed included a combining mark after a whitespace character (i.e. roughly speaking, an accented space),diffWordswould previously crash. Now this case is handled correctly.cure53/DOMPurify (dompurify)
v3.4.3: DOMPurify 3.4.3Compare Source
v3.4.2: DOMPurify 3.4.2Compare Source
ADD_ATTRcallback, thanks @nelstromv3.4.1: DOMPurify 3.4.1Compare Source
font-face,color-profile,missing-glyph,font-face-src,font-face-uri,font-face-format,font-face-name) under permissiveCUSTOM_ELEMENT_HANDLINGannotation-xmlcheck that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML modeSANITIZE_NAMED_PROPSrepeatedly prefixing already-prefixedidandnamevalues on subsequent sanitizationIN_PLACEroot-node check to explicitly guard against non-stringnodeName(DOM-clobbering robustness)slotentry from the default HTML attribute allow-listSANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fireSAFE_FOR_TEMPLATESgreedy scrub, hook-added attribute handling)3.xand2.xmaintenance branchesmotdotla/dotenv (dotenv)
v17.4.2Compare Source
Changed
v17.4.1Compare Source
Changed
injectingtoinjected(#1005)v17.4.0Compare Source
Added
skills/folder with focused agent skills:skills/dotenv/SKILL.md(core usage) andskills/dotenvx/SKILL.md(encryption, multiple environments, variable expansion) for AI coding agent discovery via the skills.sh ecosystem (npx skills add motdotla/dotenv)Changed
◇ injecting env (14) from .env(#1003)evanw/esbuild (esbuild@<0.25.0)
v0.28.0Compare Source
Add support for
with { type: 'text' }imports (#4435)The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing
textloader. Here's an example:Add integrity checks to fallback download path (#4343)
Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the
npmcommand, and then with a HTTP request toregistry.npmjs.orgas a last resort).This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level
esbuildpackage. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.Update the Go compiler from 1.25.7 to 1.26.1
This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:
You can read the Go 1.26 release notes for more information.
v0.27.7Compare Source
Fix lowering of define semantics for TypeScript parameter properties (#4421)
The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
v0.27.5Compare Source
Fix for an async generator edge case (#4401, #4417)
Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code:
Previously esbuild's output of the above code behaved incorrectly when async generators were transformed (such as with
--supported:async-generator=false). The transformation should be fixed starting with this release.This fix was contributed by @2767mr.
Fix a regression when
metafileis enabled (#4420, #4418)This release fixes a regression introduced by the previous release. When
metafile: truewas enabled in esbuild's JavaScript API, builds with build errors were incorrectly throwing an error about an empty JSON string instead of an object containing the build errors.Use define semantics for TypeScript parameter properties (#4421)
Parameter properties are a TypeScript-specific code generation feature that converts constructor parameters into class fields when they are prefixed by certain keywords. When
"useDefineForClassFields": trueis present intsconfig.json, the TypeScript compiler automatically generates class field declarations for parameter properties. Previously esbuild didn't do this, but esbuild will now do this starting with this release:Allow
es2025as a target intsconfig.json(#4432)TypeScript recently added
es2025as a compilation target, so esbuild now supports this in thetargetfield oftsconfig.jsonfiles, such as in the following configuration file:{ "compilerOptions": { "target": "ES2025" } }As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.
v0.27.4Compare Source
Fix a regression with CSS media queries (#4395, #4405, #4406)
Version 0.25.11 of esbuild introduced support for parsing media queries. This unintentionally introduced a regression with printing media queries that use the
<media-type> and <media-condition-without-or>grammar. Specifically, esbuild was failing to wrap anorclause with parentheses when inside<media-condition-without-or>. This release fixes the regression.Here is an example:
Fix an edge case with the
injectfeature (#4407)This release fixes an edge case where esbuild's
injectfeature could not be used with arbitrary module namespace names exported using anexport {} fromstatement with bundling disabled and a target environment where arbitrary module namespace names is unsupported.With the fix, the following
injectfile:Can now always be rewritten as this without esbuild sometimes incorrectly generating an error:
Attempt to improve API handling of huge metafiles (#4329, #4415)
This release contains a few changes that attempt to improve the behavior of esbuild's JavaScript API with huge metafiles (esbuild's name for the build metadata, formatted as a JSON object). The JavaScript API is designed to return the metafile JSON as a JavaScript object in memory, which makes it easy to access from within a JavaScript-based plugin. Multiple people have encountered issues where this API breaks down with a pathologically-large metafile.
The primary issue is that V8 has an implementation-specific maximum string length, so using the
JSON.parseAPI with large enough strings is impossible. This release will now attempt to use a fallback JavaScript-based JSON parser that operates directly on the UTF8-encoded JSON bytes instead of usingJSON.parsewhen the JSON metafile is too big to fit in a JavaScript string. The new fallback path has not yet been heavily-tested. The metafile will also now be generated with whitespace removed if the bundle is significantly large, which will reduce the size of the metafile JSON slightly.However, hitting this case is potentially a sign that something else is wrong. Ideally you wouldn't be building something so enormous that the build metadata can't even fit inside a JavaScript string. You may want to consider optimizing your project, or breaking up your project into multiple parts that are built independently. Another option could potentially be to use esbuild's command-line API instead of its JavaScript API, which is more efficient (although of course then you can't use JavaScript plugins, so it may not be an option).
v0.27.3Compare Source
Preserve URL fragments in data URLs (#4370)
Consider the following HTML, CSS, and SVG:
index.html:icons.css:triangle.svg:The CSS uses a URL fragment (the
#x) to reference theclipPathelement in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using thedataurlloader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:Parse and print CSS
@scoperules (#4322)This release includes dedicated support for parsing
@scoperules in CSS. These rules include optional "start" and "end" selector lists. One important consequence of this is that the local/global status of names in selector lists is now respected, which improves the correctness of esbuild's support for CSS modules. Minification of selectors inside@scoperules has also improved slightly.Here's an example:
Fix a minification bug with lowering of
for await(#4378, #4385)This release fixes a bug where the minifier would incorrectly strip the variable in the automatically-generated
catchclause of loweredfor awaitloops. The code that generated the loop previously failed to mark the internal variable references as used.Update the Go compiler from v1.25.5 to v1.25.7 (#4383, #4388)
This PR was contributed by @MikeWillCook.
v0.27.2Compare Source
Allow import path specifiers starting with
#/(#4361)Previously the specification for
package.jsondisallowed import path specifiers starting with#/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping#/*to./src/*(previously you had to use another character such as#_*instead, which was more confusing). There is some more context in nodejs/node#49182.This change was contributed by @hybrist.
Automatically add the
-webkit-maskprefix (#4357, #4358)This release automatically adds the
-webkit-vendor prefix for themaskCSS shorthand property:This change was contributed by @BPJEnnova.
Additional minification of
switchstatements (#4176, #4359)This release contains additional minification patterns for reducing
switchstatements. Here is an example:Forbid
usingdeclarations insideswitchclauses (#4323)This is a rare change to remove something that was previously possible. The Explicit Resource Management proposal introduced
usingdeclarations. These were previously allowed insidecaseanddefaultclauses inswitchstatements. This had well-defined semantics and was already widely implemented (by V8, SpiderMonkey, TypeScript, esbuild, and others). However, it was considered to be too confusing because of how scope works in switch statements, so it has been removed from the specification. This edge case will now be a syntax error. See tc39/proposal-explicit-resource-management#215 and rbuckton/ecma262#14 for details.Here is an example of code that is no longer allowed:
That code will now have to be modified to look like this instead (note the additional
{and}block statements around each case body):This is not being released in one of esbuild's breaking change releases since this feature hasn't been finalized yet, and esbuild always tracks the current state of the specification (so esbuild's previous behavior was arguably incorrect).
NaturalIntelligence/fast-xml-parser (fast-xml-parser)
v5.8.0: update strnum, FXB. Use xml-naming for DOCTYPECompare Source
v5.7.3: fix minor old bugs and update builderCompare Source
sindresorhus/globals (globals)
v17.6.0Compare Source
00a4dd9v17.5.0Compare Source
5d84602honojs/hono (hono@<4.12.14)
v4.12.18Compare Source
Security fixes
This release includes fixes for the following security issues:
Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage
Affects: Cache Middleware. Fixes missing cache-skip handling for
Vary: AuthorizationandVary: Cookie, where a response cached for one authenticated user could be served to other users. GHSA-p77w-8qqv-26rmCSS Declaration Injection via Style Object Values in JSX SSR
Affects: hono/jsx. Fixes a missing CSS-context escape for
styleobject values and property names, where untrusted input could inject additional CSS declarations. The impact is limited to CSS and does not allow JavaScript execution. GHSA-qp7p-654g-cw7pImproper validation of NumericDate claims (exp, nbf, iat) in JWT verify()
Affects:
hono/utils/jwt. Fixes improper validation ofexp,nbf, andiatclaims, where falsy, non-finite, or non-numeric values could silently bypass time-based checks instead of being rejected per RFC 7519. GHSA-hm8q-7f3q-5f36Users who use the JWT helper, hono/jsx, or the Cache middleware are strongly encouraged to upgrade to this version.
v4.12.17Compare Source
What's Changed
atom+xmlandrss+xmltodefaultExtensionMapby @yuintei in #4899New Contributors
Full Changelog: honojs/hono@v4.12.16...v4.12.17
v4.12.16Compare Source
Security fixes
This release includes fixes for the following security issues:
Unvalidated JSX Tag Names in hono/jsx May Allow HTML In
Configuration
📅 Schedule: (UTC)
* * * * 3)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.