Skip to content

chore(deps): Bump the npm-minor-patch group with 6 updates - #62

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-b09bc45f3b
Open

chore(deps): Bump the npm-minor-patch group with 6 updates#62
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-b09bc45f3b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 6 updates:

Package From To
@biomejs/biome 2.5.2 2.5.8
vitest 4.1.9 4.1.10
esbuild 0.28.1 0.28.2
@modelcontextprotocol/sdk 1.29.0 1.30.0
jose 6.2.3 6.2.8
tsx 4.22.4 4.23.12

Updates @biomejs/biome from 2.5.2 to 2.5.8

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.8

2.5.8

Patch Changes

  • #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

  • #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

  • #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

    Invalid:

    {#each boxes as box}
  {@const area = box.width * box.height}
  <p>{area}</p>
{/each}

    Valid:

    {#each boxes as box}
  {const area = $derived(box.width * box.height)}
  <p>{area}</p>
{/each}

  • #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

  • #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

  • #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

     :root {
   --font-stack:
-/* comment */
+    /* comment */
     system-ui;
 }

  • #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

    -:/* comment */ where(div) {}
+:where(/* comment */ div) {}

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.8

Patch Changes

  • #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

  • #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

  • #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

    Invalid:

    {#each boxes as box}
  {@const area = box.width * box.height}
  <p>{area}</p>
{/each}

    Valid:

    {#each boxes as box}
  {const area = $derived(box.width * box.height)}
  <p>{area}</p>
{/each}

  • #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

  • #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

  • #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

     :root {
   --font-stack:
-/* comment */
+    /* comment */
     system-ui;
 }

  • #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

    -:/* comment */ where(div) {}
+:where(/* comment */ div) {}

... (truncated)

Commits

Updates vitest from 4.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates jose from 6.2.3 to 6.2.8

Release notes

Sourced from jose's releases.

v6.2.8

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

v6.2.6

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)
  • stop claiming the JWK "use" parameter is used during import (47a07b2)
  • update CHANGELOG.md (fc51bf5)

Refactor

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.8 (2026-08-03)

Fixes

  • enforce a single recipient when decrypting dir and ECDH-ES (505c383)
  • reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

  • index the JWS and JWE registries without a wrapper (925f3bb)
  • name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

  • require own JOSE properties for presence checks (90ab09c)

Refactor

6.2.6 (2026-07-31)

Fixes

  • types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

  • compare claim values for falsy validation options (eb86956)
  • forward key management parameters for a single JWE recipient (2d4f801)
  • handle a zero-length JWE additional authenticated data (16ca398)
  • reject a generateKeyPair crv option the algorithm does not imply (76364e9)
  • reject an unencoded payload in the JWS Compact Serialization (01d053f)
  • reject characters outside the Base64URL alphabet (0ebb971), references #879
  • reject duplicate "crit" values when producing (31d60e1)
  • reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
  • reject truncated ASN.1 key data (7a16c66)
  • surface non-ASCII token segments as JOSE errors (194fe11)
  • types: correct JWK and CryptoKey types (62a196d)
  • types: correct key resolver and JWT header types (e95f8c4)
  • validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

  • correct subpaths and API documentation (2daec38)
  • document consumer-supplied type parameters (9e9f66c)

... (truncated)

Commits
  • 8b768eb chore(release): 6.2.8
  • 1500459 refactor: name the "alg" source in unsupported algorithm failures
  • 714f870 fix: reject a non-string "alg" in EmbeddedJWK
  • 925f3bb refactor: index the JWS and JWE registries without a wrapper
  • 505c383 fix: enforce a single recipient when decrypting dir and ECDH-ES
  • 514831d chore(deps): bump the actions group with 3 updates
  • 45965db chore: cleanup after release
  • 60b941f chore(release): 6.2.7
  • 90ab09c fix: require own JOSE properties for presence checks
  • 767d7f1 refactor: reduce bundle size
  • Additional commits viewable in compare view

Updates tsx from 4.22.4 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

This release is also available on:

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

  • map Node test locations (2f55884)
  • support data URLs in tsImport (b94f46f)

This release is also available on:

v4.23.8

... (truncated)

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • 2f55884 fix: map Node test locations
  • de935d5 docs: document Node source-map stack formatting
  • b94f46f fix: support data URLs in tsImport
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): Bump the npm-minor-patch group with 6 updates
5fe990d 
Bumps the npm-minor-patch group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.2` | `2.5.8` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.10` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.8` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.12` |


Updates `@biomejs/biome` from 2.5.2 to 2.5.8
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.8/packages/@biomejs/biome)

Updates `vitest` from 4.1.9 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `jose` from 6.2.3 to 6.2.8
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.3...v6.2.8)

Updates `tsx` from 4.22.4 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.4...v4.23.12)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: jose
  dependency-version: 6.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants