deps(node): bump the js-dev-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the js-dev-dependencies group with 3 updates in the /src/bindings/nodejs directory: @rspack/core, astro and esbuild.

Updates @rspack/core from 2.1.7 to 2.1.8

Release notes

Sourced from @​rspack/core's releases.

v2.1.8

Highlights

Persistent cache storage options now align with webpack

Rspack now supports cache.name and cache.storage.location, aligning with webpack's persistent cache semantics. cache.storage.directory is now the base directory, while the final cache location defaults to <directory>/<cache.name>. Default cache paths remain unchanged.

If you previously used storage.directory as the exact cache path, migrate it to storage.location. Existing cache data is not migrated automatically.

cache: {
  type: 'persistent',
  storage: {
    type: 'filesystem',
-   directory: '/custom/cache',
+   location: '/custom/cache',
  },
}

What's Changed

New Features 🎉

• feat(rstest): inject module origin for import.meta.rstest by @​9aoy in web-infra-dev/rspack#15006
• feat: align persistent cache storage options with webpack by @​hardfist in web-infra-dev/rspack#15049
• feat(hmr): emit css.c / css.r in the hot-update manifest for precise CSS updates by @​stormslowly in web-infra-dev/rspack#14682

Performance 🚀

• perf: avoid cloning Lightning CSS stylesheet AST by @​chenjiahan in web-infra-dev/rspack#14982
• perf: avoid cloning CSS module lists during ordering by @​chenjiahan in web-infra-dev/rspack#14984
• perf(copy): offload asset reads by @​LingyuCoder in web-infra-dev/rspack#15022
• perf: share source across linking diagnostics by @​hardfist in web-infra-dev/rspack#15048

Bug Fixes 🐞

• fix(binding): preserve entry dependency identity by @​matthewdavis-oai in web-infra-dev/rspack#14964
• fix(loader): preserve lightningcss license comments by @​chenjiahan in web-infra-dev/rspack#14980
• fix(esm): add missing CJS interop runtime requirement by @​LingyuCoder in web-infra-dev/rspack#14978
• fix(runtime): avoid dead require bootstrap by @​LingyuCoder in web-infra-dev/rspack#14991
• fix(runtime): preserve collision-free createRequire imports by @​LingyuCoder in web-infra-dev/rspack#14994
• fix: clean up compilation-scoped plugin caches by @​matthewdavis-oai in web-infra-dev/rspack#14999
• fix(rstest): hoist test API imports by source order by @​chenjiahan in web-infra-dev/rspack#15007
• fix(binding): release custom runtime module generators on close by @​SyMind in web-infra-dev/rspack#15008
• fix: preserve context exports in rspack runtime mode by @​LingyuCoder in web-infra-dev/rspack#15001
• fix(runtime): correct full-hash chunk filenames by @​matthewdavis-oai in web-infra-dev/rspack#14997
• fix(copy-plugin): use POSIX asset keys by @​matthewdavis-oai in web-infra-dev/rspack#15015
• fix(runtime): remove redundant runtime declarations by @​LingyuCoder in web-infra-dev/rspack#14993
• fix(worker): handle SharedWorker string name option by @​elecmonkey in web-infra-dev/rspack#15012
• fix: avoid runtime scope conflicts in module factories by @​LingyuCoder in web-infra-dev/rspack#15002
• fix: preserve direct exports bindings by @​LingyuCoder in web-infra-dev/rspack#15003
• fix(dll): serialize buildMeta.defaultObject as redirect-warn by @​tusharsingh308 in web-infra-dev/rspack#15016
• fix(json): match webpack source map behavior for generated modules by @​matthewdavis-oai in web-infra-dev/rspack#15014
• fix: keep property name when global is used in object shorthand by @​lazerg in web-infra-dev/rspack#15054
• fix: prevent compiler abort for exported rspackRequire by @​LingyuCoder in web-infra-dev/rspack#15050

... (truncated)

Commits

• e1eca76 chore(release): release 2.1.8
• 565c319 feat(hmr): emit css.c / css.r in the hot-update manifest for precise CSS upda...
• f14af4d chore(build): enable createRequire parser in Rslib builds (#15058)
• 216e595 feat: align persistent cache storage options with webpack (#15049)
• 17b7c75 chore(deps): update dependency @​rspack/lite-tapable to v1.1.5 (#15028)
• d9d0078 chore: migrate Rslib and Rsbuild to Rstack CLI (#14992)
• 32e8df7 chore: release version 2.1.7 (#14979)
• See full diff in compare view

Updates astro from 7.1.6 to 7.2.0

Release notes

Sourced from astro's releases.

astro@7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  logger: {
  
  entrypoint: new URL('./src/logger.js', import.meta.url),
  
  
  entrypoint: './src/logger.js',
  },
  });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

#17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

import type { AstroPrerenderer, PrerenderResult } from 'astro';
const prerenderer: AstroPrerenderer = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.0

Minor Changes

• #17174 0224a3a Thanks @​matthewp! - Adds the astro preview --background flag to start preview servers as background processes.

  This makes preview servers easier to manage from scripts and AI coding agents because the command returns after the server is ready instead of keeping the terminal attached to the long-running process.

  astro preview --background

  When a preview server is running in the background, you can inspect or stop it with new astro preview subcommands:

  astro preview status
  astro preview logs
  astro preview logs --follow
  astro preview stop

  If Astro detects that astro preview is being run by an AI coding agent, background mode is enabled automatically. This matches the existing behavior for astro dev, allowing agents to continue working after the preview server starts while still receiving the server URL and process ID.

  To opt out of automatic background mode for preview servers, set ASTRO_PREVIEW_BACKGROUND=0 before running astro preview.

• #17532 7f94895 Thanks @​florian-lefebvre! - Adds support for paths relative to your project root in logger.entrypoint

  Previously, pointing logger.entrypoint at a custom log handler living in your own project required building an absolute URL. You can now write the path directly:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  logger: {
  
  entrypoint: new URL('./src/logger.js', import.meta.url),
  
  
  entrypoint: './src/logger.js',
  },
  });

Paths starting with ./ or ../ are resolved against your project root. Package specifiers such as @org/astro-logger, absolute paths, and URL entrypoints keep working as before.

#17084 961bbe5 Thanks @​matthewp! - Widens the AstroPrerenderer render() return type so prerenderers can report incremental-build metadata

A prerenderer's render() may now resolve to either a Response (as before) or a PrerenderResult object that pairs the response with the content entries and optimized-image transforms the page resolved. This lets prerenderers that render out of process (for example, in an adapter's runtime like workerd) report those dependencies back to the build, so incremental static builds can track and replay them for skipped pages.

import type { AstroPrerenderer, PrerenderResult } from 'astro';

... (truncated)

Commits

• 60e9432 [ci] release (#17558)
• af92694 docs: slightly reword session options description (#17607)
• caace2e [ci] format
• 0224a3a Add background mode for astro preview (#17174)
• 961bbe5 Experimental incremental static builds (#17084)
• 7f94895 feat(logger): allow passing relative string entrypoints (#17532)
• 90c98ae feat(session): add session: false to opt out of session support (#16871)
• 3ea55ce Support detect devEngines for installs (#17579)
• 0089f83 Fix Content Layer build crash when neotraverse 0.6.x is hoisted by another de...
• f4150da [ci] format
• Additional commits viewable in compare view

Updates esbuild from 0.25.12 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by @​hybrist.

• Automatically add the -webkit-mask prefix (#4357, #4358)

  This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

  /* Original code */
  main {
    mask: url(x.png) center/5rem no-repeat
  }
  /* Old output (with --target=chrome110) */
  main {
  mask: url(x.png) center/5rem no-repeat;
  }
  /* New output (with --target=chrome110) */
  main {
  -webkit-mask: url(x.png) center/5rem no-repeat;
  mask: url(x.png) center/5rem no-repeat;
  }

  This change was contributed by @​BPJEnnova.

• Additional minification of switch statements (#4176, #4359)

  This release contains additional minification patterns for reducing switch statements. Here is an example:

  // Original code
  switch (x) {
    case 0:
      foo()
      break
    case 1:
    default:
      bar()
  }

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions