chore(deps): bump the minor-and-patch group across 1 directory with 5 updates by dependabot[bot] · Pull Request #20 · thaw-app/platform

dependabot · 2026-09-14T16:55:43Z

Bumps the minor-and-patch group with 5 updates in the / directory:

Package	From	To
@pulumi/pulumi	`3.257.0`	`3.262.0`
es-toolkit	`1.50.0`	`1.52.0`
valibot	`1.4.2`	`1.5.0`
@biomejs/biome	`2.5.8`	`2.5.13`
@types/bun	`1.3.14`	`1.4.2`

Updates @pulumi/pulumi from 3.257.0 to 3.262.0

Release notes

Sourced from @pulumi/pulumi's releases.

v3.262.0

3.262.0 (2026-09-10)

Features

[engine] Support importing a pulumi:index:Stash resource. The stash adopts the given id and holds a null value, and the program's configured input then applies as an update #24544

Bug Fixes

[auto/go] Match wrapped errors in the Automation API error predicates, and unwrap the underlying cause #24197

[cli/deployment] Stop pulumi deployment settings edit clearing settings it was not asked to change, let --branch and --commit replace one another rather than be combined, and reject --oidc-*-clear=false instead of ignoring it #24525

[cli] Re-validate an agent account claim marked unavailable instead of trusting the stale marker forever #24495

[cli] Verify TLS certificates when downloading a template from a URL outside the configured service #24504

[engine] Propagate --target-dependents and --exclude-dependents through resources read with .get() #24538

[engine] Run state migrations for aliased remote components #24545

[engine] Sort resources deterministically when repairing a snapshot #24551

[engine] Fix state migration ordering for components interleaved with other resources #24552

[sdk] Allow Automation API project settings to use any language runtime #24559

[engine] Redact secret property values in violates plan error messages unless --show-secrets is passed #24567

[cli] Treat a resource provider attached through PULUMI_DEBUG_PROVIDERS as installed, so package installation does not try to download it #24572

[cli] Install the packages a local plugin directory requires before the plugin is installed and run #24576

[engine] Avoid a deadlock when a resource provider asks the engine to load another plugin while it boots #24571

[engine] Allow component state migrations to split managed state using compatible existing resource identities #24582

[sdk/go] Allow outputs and prompt values to be marshalled into fields typed as input interfaces, such as pulumi.StringInput #24577

[backend/diy] Make sure disableSSL doesn't override explicitly specified protocols #24593

[cli] Fix pulumi install for a project that requires a resource provider attached through PULUMI_DEBUG_PROVIDERS #24604

[cli] Resolve a project's relative plugin and package paths against the project directory when a plugin starts from a subdirectory of the project #24596

[sdk/go] Report the source position of the user code that calls a generated resource getter instead of the getter body #24602

[engine] Normalize successor references between chained component state migration callbacks #24598

[cli/new] Error out on ambiguous template names instead of failing silently #24607

Improvements

[cli/plugin] Correct pulumi plugin rm help text to note that the CLI re-downloads removed plugins automatically #24618

[cli] Add --filter to pulumi api list to filter endpoints by keyword #24594

[cli/new] Warn in interactive pulumi new when cloud credentials are missing or invalid for providers that opt in via the new validateCredentialsOnNew and configurationDocsUrl schema fields #24456

[sdk/nodejs] Add helper methods to transform ResourceOptions to InvokeOptions #24534

[cli] Read stack outputs for stack references through the Pulumi Cloud stack outputs endpoint when the service advertises it, instead of exporting the whole deployment #24554

[sdkgen/python] Replace parver with packaging in generated Python SDKs #24585

[ci] Skip the unconsumed release-binary rebuild on pull requests #24595

[engine] Run provider configuration as part of provider create steps so errors are returned associated with the provider resource, not the first resource that uses it #24556

[backend/service] Improve error messages if default org is invalid #24605

Miscellaneous

[sdk/dotnet] Upgrade dotnet to v3.113.2 #24590

[java] Upgrade java to v1.37.0 #24590

[hcl] Upgrade hcl to v0.17.0 #24590

v3.261.0

... (truncated)

Changelog

Sourced from @pulumi/pulumi's changelog.

3.262.0 (2026-09-10)

Features

[engine] Support importing a pulumi:index:Stash resource. The stash adopts the given id and holds a null value, and the program's configured input then applies as an update #24544

Bug Fixes

[auto/go] Match wrapped errors in the Automation API error predicates, and unwrap the underlying cause #24197

[cli/deployment] Stop pulumi deployment settings edit clearing settings it was not asked to change, let --branch and --commit replace one another rather than be combined, and reject --oidc-*-clear=false instead of ignoring it #24525

[cli] Re-validate an agent account claim marked unavailable instead of trusting the stale marker forever #24495

[cli] Verify TLS certificates when downloading a template from a URL outside the configured service #24504

[engine] Propagate --target-dependents and --exclude-dependents through resources read with .get() #24538

[engine] Run state migrations for aliased remote components #24545

[engine] Sort resources deterministically when repairing a snapshot #24551

[engine] Fix state migration ordering for components interleaved with other resources #24552

[sdk] Allow Automation API project settings to use any language runtime #24559

[engine] Redact secret property values in violates plan error messages unless --show-secrets is passed #24567

[cli] Treat a resource provider attached through PULUMI_DEBUG_PROVIDERS as installed, so package installation does not try to download it #24572

[cli] Install the packages a local plugin directory requires before the plugin is installed and run #24576

[engine] Avoid a deadlock when a resource provider asks the engine to load another plugin while it boots #24571

[engine] Allow component state migrations to split managed state using compatible existing resource identities #24582

[sdk/go] Allow outputs and prompt values to be marshalled into fields typed as input interfaces, such as pulumi.StringInput #24577

[backend/diy] Make sure disableSSL doesn't override explicitly specified protocols #24593

[cli] Fix pulumi install for a project that requires a resource provider attached through PULUMI_DEBUG_PROVIDERS #24604

[cli] Resolve a project's relative plugin and package paths against the project directory when a plugin starts from a subdirectory of the project #24596

[sdk/go] Report the source position of the user code that calls a generated resource getter instead of the getter body #24602

[engine] Normalize successor references between chained component state migration callbacks #24598

[cli/new] Error out on ambiguous template names instead of failing silently #24607

Improvements

[cli/plugin] Correct pulumi plugin rm help text to note that the CLI re-downloads removed plugins automatically #24618

[cli] Add --filter to pulumi api list to filter endpoints by keyword #24594

[cli/new] Warn in interactive pulumi new when cloud credentials are missing or invalid for providers that opt in via the new validateCredentialsOnNew and configurationDocsUrl schema fields #24456

[sdk/nodejs] Add helper methods to transform ResourceOptions to InvokeOptions #24534

[cli] Read stack outputs for stack references through the Pulumi Cloud stack outputs endpoint when the service advertises it, instead of exporting the whole deployment #24554

[sdkgen/python] Replace parver with packaging in generated Python SDKs #24585

[ci] Skip the unconsumed release-binary rebuild on pull requests #24595

[engine] Run provider configuration as part of provider create steps so errors are returned associated with the provider resource, not the first resource that uses it #24556

[backend/service] Improve error messages if default org is invalid #24605

Miscellaneous

[sdk/dotnet] Upgrade dotnet to v3.113.2 #24590

[java] Upgrade java to v1.37.0 #24590

[hcl] Upgrade hcl to v0.17.0 #24590

3.261.0 (2026-09-02)

Features

... (truncated)

Commits

73fb177 Allow Automation API project settings to use any language runtime (#24559)
c088515 nodejs: add helper methods to transform ResourceOptions to InvokeOptions (#24...
d941fb0 Changelog and go.mod updates for v3.261.0 (#24548)
f4055a9 Freeze 3.261.0 (#24543)
f05eae6 Send OldOutputs to provider Check (#24524)
ecabf85 Preserve secret marker when serializing unknown Outputs (#24500)
0bf1a89 avoid hanging when policy pack start fails (#24492)
ab71b3d Add l2-secret-unknown conformance test (#24496)
bb09c97 [pcl] Handle integer constant properties when binding schemas (#24480)
22df62f Changelog and go.mod updates for v3.260.0 (#24490)
Additional commits viewable in compare view

Updates es-toolkit from 1.50.0 to 1.52.0

Release notes

Sourced from es-toolkit's releases.

v1.52.0

Released on August 28th, 2026.

Added the es-toolkit/iterator entrypoint, a lazy iterator module with chunk, count, dropWhile, head, iterate, partition, range, scan, takeWhile, uniqBy, and zip ([#1815]), plus cartesianProduct ([#2031]). The same functions are also available from es-toolkit/fp/iterator.

Added defer and deferAsync to es-toolkit/util. ([#2032])

Added flowAsync to es-toolkit/fp, a promise-aware left-to-right composition. ([#2033])

Added the EmptyObject, IsEqual, JSONValue, Primitive, SetOptional, SetRequired, and UnknownRecord types. ([#2044])

Fixed merge to infer the deep merged return type, and exported the Merge type. ([#1959])

Fixed omitBy and pickBy to type numeric callback keys as strings, and exported the ObjectKeys type. ([#2037])

Fixed attempt and attemptAsync to default their error type parameter to unknown. ([#2052])

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected edge cases now matches Lodash, so results may differ if you relied on the previous output.

Fixed compat/debounce to skip the maxWait invocation when both leading and trailing are false. ([#1678])

Fixed compat/toString to convert objects with a custom valueOf. ([#2034])

Fixed compat/mergeWith to assign null values in array sources. ([#1929])

Fixed compat/has and compat/hasIn to normalize the -0 path key. ([#2035])

Fixed compat/differenceWith and compat/without to normalize -0 to 0. ([#2049])

Fixed compat/findLastIndex to convert fromIndex to an integer. ([#2047])

Fixed compat/xorWith to match Lodash when no comparator is given. ([#2057])

Covered the new iterator entrypoints in the dist and browser compatibility checks. ([#2030])

Made the agent skills portable when installed on their own. ([#2054])

Fixed documentation typos and the Deno install commands. ([#2062])

v1.51.0

Released on August 17th, 2026.

Added the es-toolkit/bigint entrypoint: bigint counterparts of the math functions (sum, sumBy, max, min, maxBy, minBy, clamp, inRange, median, medianBy, percentile, range, rangeRight), kept separate so the number implementations stay unchanged. ([#1966])

Added dedent, which removes common leading whitespace from template strings. ([#1679])

Added deepFreeze for recursively freezing objects. ([#1680])

Added mapValuesAsync and mapKeysAsync. ([#1544])

... (truncated)

Changelog

Sourced from es-toolkit's changelog.

Version v1.52.0

Released on August 28th, 2026.

Added the es-toolkit/iterator entrypoint, a lazy iterator module with chunk, count, dropWhile, head, iterate, partition, range, scan, takeWhile, uniqBy, and zip (#1815), plus cartesianProduct (#2031). The same functions are also available from es-toolkit/fp/iterator.

Added defer and deferAsync to es-toolkit/util. (#2032)

Added flowAsync to es-toolkit/fp, a promise-aware left-to-right composition. (#2033)

Added the EmptyObject, IsEqual, JSONValue, Primitive, SetOptional, SetRequired, and UnknownRecord types. (#2044)

Fixed merge to infer the deep merged return type, and exported the Merge type. (#1959)

Fixed omitBy and pickBy to type numeric callback keys as strings, and exported the ObjectKeys type. (#2037)

Fixed attempt and attemptAsync to default their error type parameter to unknown. (#2052)

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected edge cases now matches Lodash, so results may differ if you relied on the previous output.

Fixed compat/debounce to skip the maxWait invocation when both leading and trailing are false. (#1678)

Fixed compat/toString to convert objects with a custom valueOf. (#2034)

Fixed compat/mergeWith to assign null values in array sources. (#1929)

Fixed compat/has and compat/hasIn to normalize the -0 path key. (#2035)

Fixed compat/differenceWith and compat/without to normalize -0 to 0. (#2049)

Fixed compat/findLastIndex to convert fromIndex to an integer. (#2047)

Fixed compat/xorWith to match Lodash when no comparator is given. (#2057)

Covered the new iterator entrypoints in the dist and browser compatibility checks. (#2030)

Made the agent skills portable when installed on their own. (#2054)

Fixed documentation typos and the Deno install commands. (#2062)

Version v1.51.0

Released on August 17th, 2026.

Added the es-toolkit/bigint entrypoint: bigint counterparts of the math functions (sum, sumBy, max, min, maxBy, minBy, clamp, inRange, median, medianBy, percentile, range, rangeRight), kept separate so the number implementations stay unchanged. (#1966)

Added dedent, which removes common leading whitespace from template strings. (#1679)

Added deepFreeze for recursively freezing objects. (#1680)

Added mapValuesAsync and mapKeysAsync. (#1544)

Added toPascalCaseKeys, toKebabCaseKeys, and toConstantCaseKeys, completing the object key casing family. (#1984)

Exported the ToCamelCaseKeys, ToPascalCaseKeys, ToSnakeCaseKeys, ToKebabCaseKeys, and ToConstantCaseKeys types. (#1651)

... (truncated)

Commits

32f4c8f chore: release v1.52.0 (#2066)
2bb189c refactor(types): rename JsonValue to JSONValue (#2065)
159d0ce fix(plugin): make skills portable when installed individually (#2054)
5330c38 build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.8 (#2059)
ce32074 build(deps): bump github/codeql-action/upload-sarif (#2060)
34f8b71 build(deps): bump github/codeql-action/init from 4.37.7 to 4.37.8 (#2061)
df05716 fix(compat/xorWith): match lodash when no comparator is given (#2057)
4c51da7 docs: fix typos and Deno install commands (#2062)
0949c8b fix[attempt, attemptAsync]: default error type parameter to unknown (#2052)
2714363 feat(types): add seven compile-time type utilities (#2044)
Additional commits viewable in compare view

Updates valibot from 1.4.2 to 1.5.0

Release notes

Sourced from valibot's releases.

v1.5.0

Many thanks to @tats-u, @idleberg, @yslpn, @francisjohnjohnston-web, @MaxFreedomPollard, @mahirhir, @ItzXynx, @LeSingh1, @maxtaran2010, @ysknsid25, @cyyynthia, @spokodev and @sanjibani for contributing to this release.

Add codePoints, maxCodePoints, minCodePoints and notCodePoints validation actions to validate the number of Unicode code points (pull request #888)

Add ksuid validation action to validate KSUIDs (pull request #1370)

Change Standard Schema properties to use eager initialization for faster schema construction and replace internal _getStandardProps utility with _standardSchema (pull request #1534)

Change url action to use URL.canParse when available to avoid constructing URL objects (pull request #1608)

Fix stringifyJson action to preserve the dataset value when JSON.stringify returns undefined (pull request #1476)

Fix literal schema and value, values, notValue and notValues actions to treat NaN as equal to itself (pull request #1573)

Fix intersect schema to merge matching NaN values and invalid dates (pull request #1573)

Fix cache and cacheAsync methods to clone the issues of a cached dataset, preventing parent schemas from adding their path item to the same issue on every cache hit (pull request #1620)

Fix strictObject, looseObject, objectWithRest and their async variants to correctly handle unknown input keys that collide with Object.prototype members (pull request #1523)

Fix intersect and intersectAsync schemas to ignore inherited properties when merging objects and preserve own properties without invoking inherited setters or changing the output prototype (pull request #1621)

Fix ulid action to reject ULIDs that exceed the maximum 128-bit value (pull request #1498)

Fix email action to reject non-ASCII characters accepted by Unicode case folding (pull request #1075)

v1.5.0 (to-json-schema)

Add support for JSON Schema draft-2020-12 and OpenAPI 3.0 Schema Object format

Add propertyNames support to record schemas for key validation constraints

Add support for toBigint, toBoolean, toDate, toNumber and toString actions for typeMode: 'input'

Add new toStandardJsonSchema function to convert Valibot schemas to Standard JSON Schema format

Change return type from JSONSchema7 to a custom JsonSchema type

Commits

5016198 chore: prepare Valibot v1.5.0 release (#1627)
1ffb038 fix(intersect): skip inherited prototype props in _merge (#1621)
1c4983f fix(ulid): restrict first character to 0-7 per ULID spec (#1498)
5e449cd perf(url): use URL.canParse for validation (#1608)
4acda1b Make sure that email validators don't match unintentional non-ASCII local par...
95943ab fix: handle object keys that collide with Object.prototype in object schemas ...
d65438c fix(cache): clone cached issues to stop issue paths from accumulating (#1620)
3ed804a dependabot: bump the github-actions group across 1 directory with 2 updates (...
0681f43 fix: use SameValueZero equality for special numeric values (#1573)
98ef8b4 Improve perf by changing ~standard implementation (#1534)
Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.8 to 2.5.13

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes
#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
/* Invalid */
@import 'foo.css';
.my-style {
color: red;
}
/* Valid */
@import 'foo.css' layer(base);
@layer base {
.my-style {
color: red;
}
}
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.13

Patch Changes
#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
/* Invalid */
@import 'foo.css';
.my-style {
color: red;
}
/* Valid */
@import 'foo.css' layer(base);
@layer base {
.my-style {
color: red;
}
}
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
const kibibyte = 2 ^ 10; // 8, not 1024
#11670 4969ee1 Thanks @ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

810ea56 ci: release (#11614)
e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
c23e4c7 feat: noUnsafeIframeSandbox (#11622)
a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
611767f chore: update depot logo (#11602)
0a31d7c ci: release (#11530)
a20f44a feat: noBunModules (#11597)
Additional commits viewable in compare view

Updates @types/bun from 1.3.14 to 1.4.2

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

… updates Bumps the minor-and-patch group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@pulumi/pulumi](https://github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs) | `3.257.0` | `3.262.0` | | [es-toolkit](https://github.com/toss/es-toolkit) | `1.50.0` | `1.52.0` | | [valibot](https://github.com/open-circle/valibot) | `1.4.2` | `1.5.0` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.8` | `2.5.13` | | [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.3.14` | `1.4.2` | Updates `@pulumi/pulumi` from 3.257.0 to 3.262.0 - [Release notes](https://github.com/pulumi/pulumi/releases) - [Changelog](https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md) - [Commits](https://github.com/pulumi/pulumi/commits/v3.262.0/sdk/nodejs) Updates `es-toolkit` from 1.50.0 to 1.52.0 - [Release notes](https://github.com/toss/es-toolkit/releases) - [Changelog](https://github.com/toss/es-toolkit/blob/main/CHANGELOG.md) - [Commits](toss/es-toolkit@v1.50.0...v1.52.0) Updates `valibot` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/open-circle/valibot/releases) - [Commits](open-circle/valibot@v1.4.2...v1.5.0) Updates `@biomejs/biome` from 2.5.8 to 2.5.13 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.13/packages/@biomejs/biome) Updates `@types/bun` from 1.3.14 to 1.4.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) --- updated-dependencies: - dependency-name: "@pulumi/pulumi" dependency-version: 3.262.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: es-toolkit dependency-version: 1.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: valibot dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@biomejs/biome" dependency-version: 2.5.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/bun" dependency-version: 1.4.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-14T16:56:05Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 87753027-2e33-48e9-8340-fa0ae3875039

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot · 2026-09-21T16:54:35Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026

dependabot Bot closed this Sep 21, 2026

dependabot Bot deleted the dependabot/bun/minor-and-patch-a58bd42451 branch September 21, 2026 16:54

Navigation Menu

chore(deps): bump the minor-and-patch group across 1 directory with 5 updates - #20

chore(deps): bump the minor-and-patch group across 1 directory with 5 updates#20
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-a58bd42451

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 14, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.262.0

3.262.0 (2026-09-10)

Features

Bug Fixes

Improvements

Miscellaneous

v3.261.0

3.262.0 (2026-09-10)

Features

Bug Fixes

Improvements

Miscellaneous

3.261.0 (2026-09-02)

Features

v1.52.0

v1.51.0

Version v1.52.0

Version v1.51.0

v1.5.0

v1.5.0 (to-json-schema)

Biome CLI v2.5.13

2.5.13

Patch Changes

2.5.13

Patch Changes

Uh oh!

coderabbitai Bot commented Sep 14, 2026

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited

Loading