chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #140 · unjs/hookable

renovate · 2026-04-15T02:05:28Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@types/node (source)	`^25.6.0` → `^25.9.5`
@typescript/native-preview (source)	`^7.0.0-dev.20260414.1` → `^7.0.0-dev.20260707.2`
@vitest/coverage-v8 (source)	`^4.1.4` → `^4.1.10`
esbuild	`^0.28.0` → `^0.28.2`
expect-type	`^1.3.0` → `^1.4.0`
hookable-prev	`^6.1.0` → `^6.1.1`
obuild	`^0.4.33` → `^0.4.38`
oxfmt (source)	`^0.45.0` → `^0.62.0`
oxlint (source)	`^1.60.0` → `^1.77.0`
pnpm (source)	`10.33.0` → `10.34.5`
typescript (source)	`^6.0.2` → `^6.0.3`
vite (source)	`^8.0.8` → `^8.2.1`
vitest (source)	`^4.1.4` → `^4.1.10`

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

microsoft/typescript-go (@typescript/native-preview)

vitest-dev/vitest (@vitest/coverage-v8)

`v4.1.10`

Compare Source

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #10680 (5c18d)
vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in #10661 (bae52)

View changes on GitHub

`v4.1.9`

Compare Source

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)
browser:
- Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #10555 (7fb29)
- Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #10497 and #10556 (fbc62)
mocker:
- Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #10548 (2c955)
pool:
- Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #10543 and #10564 (934b0)

View changes on GitHub

`v4.1.8`

Compare Source

🐞 Bug Fixes

browser:
- Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)
- Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in #10474 (675b4)

View changes on GitHub

`v4.1.7`

Compare Source

🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in #10384 (4f0f2)

View changes on GitHub

`v4.1.6`

Compare Source

🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in #10138 (31882)
Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in #10196 (2847d)
browser: Simplify orchestrator otel carrier - by @hi-ogawa in #10285 (18af9)

🏎 Performance

Stringify diff objects only once - by @sheremet-va in #10276 (9f7b1)

View changes on GitHub

`v4.1.5`

Compare Source

🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in #10119 (0e0ff)

🐞 Bug Fixes

--project negation excludes browser instances - by @felamaslen in #10131 (9423d)
Project color label on html reporter - by @hi-ogawa in #10142 (596f7)
Fix vi.defineHelper called as object method - by @hi-ogawa in #10163 (122c2)
Alias agent reporter to minimal - by @sheremet-va in #10157 (663b9)
Respect diff config options in soft assertions - by @Copilot, sheremet-va and @sheremet-va in #8696 (9787d)
Respect diff config options in soft assertions " - by @sheremet-va in #8696 (7dc6d)
ast-collect: Recognize _vi_import prefix in static test discovery - by @Yejneshwar in #10129 (32546)
coverage: Descriptive error message when reports directory is removed during test run - by @DaveT1991 and @AriPerkkio in #10117 (14133)
snapshot: Increase default snapshot max output length - by @hi-ogawa and Codex in #10150 (21e66)
ui: Fix jsx/tsx syntax highlight - by @hi-ogawa in #10152 (f1b1f)
web-worker: Support MessagePort objects referenced inside postMessage data - by @whitphx and Claude Opus 4.6 (1M context) in #9927 and #10124 (7ad7d)
api: Make test-specification options writable - by @sheremet-va in #10154 (6abd5)

View changes on GitHub

evanw/esbuild (esbuild)

`v0.28.2`

Compare Source

Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
```
import Base from './dep.js';
import Alias = Base.SomeType;
```
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
```
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}

/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}

/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
```
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.
Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
```
// Original code
function foo() {
  let x
  bar(x ||= {})
}

// Old output (with --minify-syntax --target=es6)
function foo() {
  bar(void 0 || (x = {}));
}

// New output (with --minify-syntax --target=es6)
function foo() {
  let x;
  bar(x || (x = {}));
}
```
Fix a potential deadlock when the JavaScript API is used incorrectly (#4503, #4506)

The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

This fix was submitted by @ZuBB.
Handle target collisions (#4509)

It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.
Force .mp3 files to use the audio/mpeg MIME type (#4485)

MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

Add a new TypeScript syntax warning

TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]

    example.ts:1:28:
      1 │ console.log(1 + 2 as number * 3)
        ╵                             ^

  This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
  precedence in this case. Surround the inner expression in parentheses to silence this warning:

    example.ts:1:12:
      1 │ console.log(1 + 2 as number * 3)
        │             ~~~~~~~~~~~~~~~
        ╵             (             )

See microsoft/TypeScript#63527 for more information.

Add support for formatting errors for Visual Studio (#4460)

Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:
```
$ esbuild example.ts --log-style=visualstudio
/Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator
```
This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.
Fix a bug with CSS gamut mapping (#4488)

Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

This fix was submitted by @chatman-media.

`v0.28.1`

Compare Source

Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.
Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
```
// Original code
{
  using x = new Resource()
  x.activate()
}

// Old output (with --minify)
new Resource().activate();

// New output (with --minify)
{using e=new Resource;e.activate()}
```
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
```
// Original code
new (foo()`bar`)()
new (foo()?.bar)()

// Old output
new foo()`bar`();
new (foo())?.bar();

// New output
new (foo())`bar`();
new (foo()?.bar)();
```
Fix renaming of nested var declarations (#4471)

This release fixes a bug where var declarations in nested scopes that are hoisted up to module scope were not correctly being renamed during bundling. That could previously lead to name collisions when minification was disabled, which could potentially cause a

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "after 1am and before 5am"
Automerge
- "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/all-minor-patch branch from 325f298 to bc6d641 Compare April 15, 2026 10:54

renovate Bot changed the title ~~chore(deps): update devdependency hookable-prev to ^6.1.1~~ chore(deps): update all non-major dependencies Apr 15, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 13 times, most recently from 85f2a51 to 6113a69 Compare April 23, 2026 12:39

renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 5e61242 to 41321f1 Compare April 30, 2026 13:05

renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 6f4580f to a863710 Compare May 5, 2026 12:03

renovate Bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from f739c31 to 6a89734 Compare May 18, 2026 13:54

renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from aa1a2bd to 46d5f00 Compare May 22, 2026 16:52

renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 203bf54 to d280a03 Compare June 4, 2026 19:34

renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 7ee91bf to a40a0a3 Compare June 12, 2026 12:45

chore(deps): update all non-major dependencies

da1c0e4

Navigation Menu

Uh oh!

chore(deps): update all non-major dependencies - #140

chore(deps): update all non-major dependencies#140
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🐞 Bug Fixes

🏎 Performance

🚀 Experimental Features

🐞 Bug Fixes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 15, 2026 •

edited

Loading