fix(deps): update npm - #89
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Test Results75 tests 75 ✅ 6s ⏱️ Results for commit b1717b0. ♻️ This comment has been updated with latest results. |
renovate
Bot
force-pushed
the
renovate/npm
branch
14 times, most recently
from
April 11, 2026 13:03
8189936 to
f37e58d
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
4 times, most recently
from
April 20, 2026 10:15
a0a4c55 to
c575442
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
4 times, most recently
from
April 30, 2026 06:28
19a2d92 to
f684299
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
6 times, most recently
from
May 6, 2026 00:44
28bf73b to
bf392ad
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
3 times, most recently
from
May 21, 2026 11:30
d7bb7c6 to
f8d2771
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
from
May 21, 2026 21:04
f8d2771 to
4e3fc98
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
from
June 15, 2026 00:12
4e3fc98 to
5f07bd2
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
from
June 16, 2026 00:41
5f07bd2 to
b918e2a
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
7 times, most recently
from
June 30, 2026 05:49
5e27d7b to
b28e33f
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
6 times, most recently
from
July 12, 2026 11:52
3e81a34 to
97141a9
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
5 times, most recently
from
July 21, 2026 13:56
04e64e1 to
7fb8e19
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
3 times, most recently
from
July 30, 2026 17:52
9ffa86d to
8350e69
Compare
renovate
Bot
force-pushed
the
renovate/npm
branch
from
August 3, 2026 16:46
8350e69 to
b1717b0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.27.0→^0.28.07.0.0→7.2.00.5.19→0.5.201.32.0→1.33.01.32.0→1.33.01.32.0→1.33.01.32.0→1.33.01.32.0→1.33.01.32.0→1.33.01.14.1→1.15.23.8.1→3.9.63.5.1→3.5.2^0.7.2→^0.8.04.4.5→4.7.43.2.2→3.3.16.0.2→6.0.34.3.6→4.4.3Release Notes
evanw/esbuild (@esbuild/linux-arm64)
v0.28.1Compare Source
Disallow
\in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a
\backslash character. It happened due to the use of Go'spath.Clean()function, which only handles Unix-style/characters. HTTP requests with paths containing\are no longer allowed.Thanks to @dellalibera for reporting this issue.
Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)
The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.
Note that esbuild's Deno API installs from
registry.npmjs.orgby default, but allows theNPM_CONFIG_REGISTRYenvironment variable to override this with a custom package registry. This change means that the esbuild executable served byNPM_CONFIG_REGISTRYmust now match the expected content.Thanks to @sondt99 for reporting this issue.
Avoid inlining
usingandawait usingdeclarations (#4482)Previously esbuild's minifier sometimes incorrectly inlined
usingandawait usingdeclarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done forletandconstdeclarations by avoiding doing it forvardeclarations, which no longer worked when more declaration types were added. Here's an example:Fix module evaluation when an error is thrown (#4461, #4467)
If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if
import()orrequire()is used to import a module multiple times. The thrown error is supposed to be thrown by every call toimport()orrequire(), not just the first. With this release, esbuild will now throw the same error every time you callimport()orrequire()on a module that throws during its evaluation.Fix some edge cases around the
newoperator (#4477)Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a
newexpression (specifically an optional chain and/or a tagged template literal). The generated code for thenewtarget was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap thenewtarget in parentheses. Here is an example of some affected code:Fix renaming of nested
vardeclarations (#4471)This release fixes a bug where
vardeclarations in nested scopes that are hoisted up to module scope were not correctly being renamed during bundling. That could previously lead to name collisions when minification was disabled, which could potentially cause a behavior change. The bug has been fixed so that these hoisted declarations are now considered to be module-level symbols during the name collision avoidance pass.Emit
varinstead ofconstfor certain TypeScript-only constructs for ES5 (#4448)While esbuild doesn't generally support converting
consttovarfor ES5 due to nested scoping rules (which is currently a build-time error), esbuild previously incorrectly converted TypeScript-onlyimportassignment constructs into aconstdeclaration even when targeting ES5. With this release, esbuild will now usevarfor this case instead:v0.28.0Compare Source
Add support for
with { type: 'text' }imports (#4435)The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing
textloader. Here's an example:Add integrity checks to fallback download path (#4343)
Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the
npmcommand, and then with a HTTP request toregistry.npmjs.orgas a last resort).This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level
esbuildpackage. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.Update the Go compiler from 1.25.7 to 1.26.1
This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:
You can read the Go 1.26 release notes for more information.
sveltejs/vite-plugin-svelte (@sveltejs/vite-plugin-svelte)
v7.2.0Compare Source
Minor Changes
v7.1.4Compare Source
Patch Changes
v7.1.3Compare Source
Patch Changes
v7.1.2Compare Source
Patch Changes
v7.1.1Compare Source
Patch Changes
fix: pass
typescript.onlyRemoveTypeImportstotransformWithOxcinvitePreprocessso that value imports are not dropped when they are only referenced in Svelte template markup (#1326)fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (#1336)
v7.1.0Compare Source
Minor Changes
tailwindlabs/tailwindcss-typography (@tailwindcss/typography)
v0.5.20Compare Source
Fixed
parcel-bundler/lightningcss (lightningcss-darwin-arm64)
v1.33.0Compare Source
Added
::highlightby @lucasweng in #970#851
:target-before/after/currentpseudo-class by @yisibl in #1185Fixed
attywithstd::io::IsTerminalby @fkeiler in #1197externalto return type ofresolveby @sapphi-red in #1261Profiidev/positron_components (positron-components)
v1.15.2Compare Source
Bug Fixes
v1.15.1Compare Source
Bug Fixes
v1.15.0Compare Source
Features
Bug Fixes
v1.14.4Compare Source
Bug Fixes
v1.14.3Compare Source
Bug Fixes
v1.14.2Compare Source
Bug Fixes
prettier/prettier (prettier)
v3.9.6Compare Source
v3.9.5Compare Source
diff
Markdown: Cap ordered list mark at 999,999,999 (#19351 by @tats-u)
CommonMark parsers only support ordered list item numbers up to 999,999,999.
With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:
Markdown: Avoid corrupting empty link with title (#19487 by @andersk)
Do not remove
<>from an inline link or image with an empty URL and a title, as this removal would change its interpretation.Less: Remove extra spaces after
[in map lookups (#19503 by @kovsu)CSS: Prevent addition space in
type()with+(#19516 by @bigandy)This fixes the addition space before
+in CSStype()declaration. For exampletype(<number>+)was being converted intotype(<number> +)which is invalid CSS and does not work.Less: Remove spaces between merge markers and colons (#19517 by @kovsu)
Markdown: Preserve wiki links with aliases (#19527 by @kovsu)
TypeScript: Fix comments being dropped on shorthand
typeimport/export specifiers (#19565 by @kirkwaiblinger)Miscellaneous: Preserving comments'
placementproperty (#19567 by @Janther)Prettier@3.9.0 deleted an undocumented property on comments, which was already used by plugins,
comment.placementis now available again after comment attach.Flow: Stop enforcing empty module declaration to break (#19568 by @fisker)
Angular: Support expression for exhaustive typechecking (#19571 by @fisker)
TypeScript: Ignore comments inside mapped type when checking type parameter comments (#19572 by @fisker)
Less: Fix adjacent block comments being corrupted (#19574 by @kovsu)
JavaScript: Handle dangling comments in
SwitchStatement(#19581 by @fisker)TypeScript: Remove space in comment-only object type (#19583 by @fisker)
v3.9.4Compare Source
v3.9.3Compare Source
v3.9.2Compare Source
v3.9.1Compare Source
v3.9.0Compare Source
diff
🔗 Release Notes
v3.8.5Compare Source
v3.8.4Compare Source
diff
Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)
Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.
v3.8.3Compare Source
diff
SCSS: Prevent trailing comma in
if()function (#18471 by @kovsu)v3.8.2Compare Source
diff
Angular: Support Angular v21.2 (#18722, #19034 by @fisker)
Exhaustive typechecking with
@default never;arrow functionandinstanceofexpressions.sveltejs/prettier-plugin-svelte (prettier-plugin-svelte)
v3.5.2Compare Source
bind:get/set tuple{#each}blockstailwindlabs/prettier-plugin-tailwindcss (prettier-plugin-tailwindcss)
v0.8.1Compare Source
Fixed
class={...}expressions when usingprettier-plugin-sveltev4 (#462)v0.8.0Compare Source
Changed
Added
/sorter(#438)Fixed
canCollapseWhitespaceInhandling for"tailwindPreserveWhitespace": true(#428)v0.7.4Compare Source
Same as v0.7.2, since v0.7.3 contained breaking changes.
v0.7.3Compare Source
Changed
Fixed
sveltejs/language-tools (svelte-check)
v4.7.4Compare Source
Patch Changes
v4.7.3Compare Source
Patch Changes
+error.svelteprops (#3076)v4.7.2Compare Source
Patch Changes
fix: resolve tsgo bin path with package.json (#3074)
fix: report tsconfig errors in --tsgo-experimental-api (#3070)
v4.7.1Compare Source
Patch Changes
v4.7.0Compare Source
Minor Changes
feat: add
--configoption (#3066)feat: svelte-check tsgo support with experimental api (#3036)
Patch Changes
fix: load esm version of Vite (#3065)
fix: stop excluding workspaces under dot-prefixed ancestors (#3037)
Updated dependencies [
7a3464b,a2561fc]:v4.6.0Compare Source
Minor Changes
vite.config.js/ts(#3031)Patch Changes
151cf45]:v4.5.0Compare Source
Minor Changes
Patch Changes
fix: properly handle props with the name
slotinside Svelte 5 snippets (#3030)feat: add support for svelte config ts/mts files (#3009)
v4.4.8Compare Source
Patch Changes
v4.4.7Compare Source
Patch Changes
fix: flush stdout/stderr before exit (#3014)
fix: report diagnostics in tsconfig.json (#3005)
v4.4.6Compare Source
Patch Changes
fix: prevent config loading message in svelte-check --incremental (#2974)
fix: resolve svelte files with NodeNext in --incremental/tsgo (#2990)
perf: various optimization with ast walk (#2969)
fix: prevent error with escape sequence in attribute (#2968)
fix: typescript 6.0 compatibility (#2988)
heroui-inc/tailwind-variants (tailwind-variants)
v3.3.1Compare Source
Bug Fixes
v3.3.0Compare Source
3.2.1 (2025-11-22)
Bug Fixes
microsoft/TypeScript (typescript)
v6.0.3: TypeScript 6.0.3Compare Source
For release notes, check out the release announcement blog post.
Downloads are available on:
colinhacks/zod (zod)
v4.4.3Compare Source
Commits:
4c2fa95docs: use Zernio primary wordmark for gold sponsor logo2aeec83docs: prune lapsed gold sponsors and rebalance logo sizing7391be8docs: prune lapsed silver/bronze sponsors and add active ones2c70332docs: normalize bronze sponsor logos to github avatar pattern9195250docs: remove Mintlify from bronze sponsors (churned)b8dffe9docs: remove Numeric and Speakeasy (2+ missed monthly cycles)1cab693fix(v4): restore catch handling for absent object keys (#5937) (#5939)c2be4f8fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#5941)f3c9ec04.4.31fb56a5docs: document release procedure in AGENTS.mdv4.4.2Compare Source
Commits:
0c62df0Clean up docs navigation and stale labels (#5901)20cc794chore: add security policy and refresh tooling deps6fbe07bfix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)4bbed1bTighten discriminated union option typingbbac3e5Update PR guidance for agentscf0dc94Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint292c894docs: add Zernio gold sponsor1fc9f31docs: document codec inversion1373c85docs: remove AI disclosure guidancee20d02bchore: ignore triage notese58ea4ddocs: test Zod Mini tab code heights905761adocs: document preprocess input type narrowingbf64bacchore: tighten test guidance in AGENTS.md8ec4e73chore: update play.ts scratch02c2bafMake z.preprocess defer optionality to inner schema (#5929)88015dffix(docs): drop deprecatedbaseUrlfrom tsconfigc59d4474.4.2v4.4.1Compare Source
Commits:
481f7beci: gate release publishing on full test workflow95ccab4test(v3): restore optional undefined expectationscede2c6fix(v4): reject tuple holes before required defaults (#5900)edd0bf0release: 4.4.1180d83ddocs: remove Jazz featured sponsorv4.4.0Compare Source
4.4.0
This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.
Potentially breaking bug fixes
Tuple defaults now materialize output values correctly
Fixed in #5661. Tuple parsing now more accurately reflects defaults, optional tails, explicit
undefined, and under-filled inputs. The headline behavior is that defaults in tuple positions now properly appear in parsed output.Trailing optional elements that are absent still stay absent; they are not filled with
undefined.But explicit
undefinedvalues supplied by the caller are preserved.When optional elements appear before later defaults, the parsed tuple is now dense so array operations behave predictably.
Tuple length errors are also more consistent now. Since
z.function()arguments are tuple-shaped, function input errors may look different.Required object properties with
z.undefined()Fixed in [#5661](https
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.