Skip to content

deps(node): bump the js-dev-dependencies group across 1 directory with 8 updates - #19

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/bindings/nodejs/js-dev-dependencies-33872f76c2
Open

deps(node): bump the js-dev-dependencies group across 1 directory with 8 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/bindings/nodejs/js-dev-dependencies-33872f76c2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown

Bumps the js-dev-dependencies group with 7 updates in the /src/bindings/nodejs directory:

Package From To
@napi-rs/cli 3.8.2 3.8.6
@rspack/core 2.1.7 2.2.1
@vitest/coverage-v8 4.1.10 4.1.11
astro 7.1.6 7.2.9
esbuild 0.25.12 0.28.2
rollup 4.62.4 4.63.1
webpack 5.109.2 5.110.1

Updates @napi-rs/cli from 3.8.2 to 3.8.6

Commits
  • 70c1493 chore(release): publish
  • aeba312 fix(cli): compatible with emnapi v1 & v2 (#3454)
  • d532909 chore(deps): update dependency oxc-parser to ^0.144.0 (#3453)
  • b8ba732 fix(deps): update emnapi to v2.0.0-alpha.4 (#3451)
  • 06349eb chore(deps): update cross-platform-actions/action action to v1.4.0 (#3452)
  • a5b5f27 chore(release): publish
  • 980b0b3 fix(cli): validate publish-effective exports in threadless wasi pre-publish (...
  • f5c8872 chore(deps): lock file maintenance (#3435)
  • 956e452 chore: release (#3448)
  • 73048f5 chore(release): publish
  • Additional commits viewable in compare view

Updates @rspack/core from 2.1.7 to 2.2.1

Release notes

Sourced from @​rspack/core's releases.

v2.2.1

Highlights

Corrected compact-hashed IDs naming

Rspack 2.2.0 introduced compact hashed module and chunk IDs under the mistakenly named compat-hashed option and CompatHashedModuleIdsPlugin / CompatHashedChunkIdsPlugin APIs. Rspack 2.2.1 corrects these names to compact-hashed, CompactHashedModuleIdsPlugin, and CompactHashedChunkIdsPlugin.

The names introduced in 2.2.0 remain available as deprecated compatibility aliases, but we recommend upgrading to Rspack 2.2.1 and using the corrected names:

module.exports = {
  optimization: {
    moduleIds: 'compact-hashed',
    chunkIds: 'compact-hashed',
  },
};

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

Refactor 🔨

Document 📖

Other Changes

New Contributors

Full Changelog: web-infra-dev/rspack@v2.2.0...v2.2.1

... (truncated)

Commits

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates astro from 7.1.6 to 7.2.9

Release notes

Sourced from astro's releases.

astro@7.2.9

Patch Changes

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

astro@7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.9

Patch Changes

7.2.8

Patch Changes

7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

... (truncated)

Commits

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

  • Allow import path specifiers starting with #/ (#4361)

    Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

    This change was contributed by @​hybrist.

  • Automatically add the -webkit-mask prefix (#4357, #4358)

    This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

    /* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}

    This change was contributed by @​BPJEnnova.

  • Additional minification of switch statements (#4176, #4359)

    This release contains additional minification patterns for reducing switch statements. Here is an example:

    // Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.


Updates rollup from 4.62.4 to 4.63.1

Release notes

Sourced from rollup's releases.

v4.63.1

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

v4.63.0

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

v4.62.5

4.62.5

2026-08-20

Bug Fixes

  • Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

4.62.5

2026-08-20

Bug Fixes

  • Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

Commits

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • See full diff in compare view

Updates webpack from 5.109.2 to 5.110.1

Release notes

Sourced from webpack's releases.

v5.110.1

Patch Changes

v5.110.0

Minor Changes

  • Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

  • Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

  • Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

  • Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

  • Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

  • Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

  • Give externals the original request of a context module element. (by @​alexander-akait in #21780)

  • Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

  • Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

  • Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

  • Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

  • Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

  • Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

  • Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

  • Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

  • Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

  • Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

  • Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

  • Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #21841)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.1

Patch Changes

5.110.0

Minor Changes

  • Wrap co...

    Description has been truncated

@dependabot
deps(node): bump the js-dev-dependencies group across 1 directory wit…
d4fb406 
…h 8 updates

Bumps the js-dev-dependencies group with 7 updates in the /src/bindings/nodejs directory:

| Package | From | To |
| --- | --- | --- |
| [@napi-rs/cli](https://github.com/napi-rs/napi-rs) | `3.8.2` | `3.8.6` |
| [@rspack/core](https://github.com/web-infra-dev/rspack/tree/HEAD/packages/rspack) | `2.1.7` | `2.2.1` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.6` | `7.2.9` |
| [esbuild](https://github.com/evanw/esbuild) | `0.25.12` | `0.28.2` |
| [rollup](https://github.com/rollup/rollup) | `4.62.4` | `4.63.1` |
| [webpack](https://github.com/webpack/webpack) | `5.109.2` | `5.110.1` |



Updates `@napi-rs/cli` from 3.8.2 to 3.8.6
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](https://github.com/napi-rs/napi-rs/compare/@napi-rs/cli@3.8.2...@napi-rs/cli@3.8.6)

Updates `@rspack/core` from 2.1.7 to 2.2.1
- [Release notes](https://github.com/web-infra-dev/rspack/releases)
- [Commits](https://github.com/web-infra-dev/rspack/commits/v2.2.1/packages/rspack)

Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `astro` from 7.1.6 to 7.2.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.9/packages/astro)

Updates `esbuild` from 0.25.12 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.25.12...v0.28.2)

Updates `rollup` from 4.62.4 to 4.63.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.62.4...v4.63.1)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `webpack` from 5.109.2 to 5.110.1
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.2...v5.110.1)

---
updated-dependencies:
- dependency-name: "@napi-rs/cli"
  dependency-version: 3.8.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-dev-dependencies
- dependency-name: "@rspack/core"
  dependency-version: 2.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-dev-dependencies
- dependency-name: astro
  dependency-version: 7.2.9
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: rollup
  dependency-version: 4.63.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-dev-dependencies
- dependency-name: webpack
  dependency-version: 5.110.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@dependabot
dependabot Bot requested a review from GriffinCanCode as a code owner August 31, 2026 13:37
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Aug 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@GriffinCanCode GriffinCanCode Awaiting requested review from GriffinCanCode GriffinCanCode is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants