Bump the npm group across 1 directory with 17 updates by dependabot[bot] · Pull Request #70 · shellicar/ecosystem

dependabot · 2026-08-27T20:34:46Z

Bumps the npm group with 17 updates in the / directory:

Package	From	To
@biomejs/biome	`2.4.15`	`2.4.16`
@vitest/coverage-v8	`4.1.6`	`4.1.11`
lefthook	`2.1.6`	`2.1.12`
turbo	`2.9.14`	`2.9.18`
vitest	`4.1.6`	`4.1.11`
@azure/identity	`4.13.1`	`4.13.2`
esbuild	`0.28.1`	`0.28.2`
@nuxt/kit	`4.4.5`	`4.4.8`
@nuxt/schema	`3.21.5`	`3.21.11`
@tsconfig/node22	`22.0.5`	`22.0.6`
graphql	`16.14.0`	`16.14.2`
rollup	`4.62.2`	`4.62.5`
@tsconfig/node20	`20.1.9`	`20.1.10`
tsx	`4.22.0`	`4.22.5`
semver	`7.8.0`	`7.8.5`
@types/semver	`7.7.1`	`7.8.0`
svelte	`5.55.7`	`5.55.10`

Updates @biomejs/biome from 2.4.15 to 2.4.16

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.4.16

2.4.16

Patch Changes
#10329 ef764d5 Thanks @Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.
#10363 50aa415 Thanks @dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

Input:
ab
Output:
  a</span >bab
#10465 0c718da Thanks @dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

#10358 05c2617 Thanks @dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

#10300 950247c Thanks @dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

#9786 e71f584 Thanks @MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

#10425 1948b72 Thanks @sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

#10442 001f94f Thanks @ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

#10318 9b1577f Thanks @dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

#10319 2e37709 Thanks @dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.4.16

Patch Changes
#10329 ef764d5 Thanks @Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.
#10363 50aa415 Thanks @dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

Input:
ab
Output:
  a</span >bab
#10465 0c718da Thanks @dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

#10358 05c2617 Thanks @dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

#10300 950247c Thanks @dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

#9786 e71f584 Thanks @MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

#10425 1948b72 Thanks @sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

#10442 001f94f Thanks @ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

#10318 9b1577f Thanks @dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.
#10319 2e37709 Thanks @dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Commits

5f4ea56 ci: release (#10326)
de2a33c fix(core): regression in emitted types (#10478)
d835303 docs: remove redundant default phrase in useConsistentObjectDefinitions rul...
4f1aaf2 fix: incorrect build when using build or test (#10426)
dc73b6b refactor: make plugins opt-in via feature gate (#10418)
e71f584 feat(useDestructuring): add options for assignment/declaration and improve di...
9b1577f fix(config): support trailingCommas in overrides (#10318)
See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.6 to 4.1.11

Release notes

Sourced from @vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
db616d2 chore: release v4.1.10 (#10718)
a7a61e7 chore: release v4.1.9 (#10598)
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
See full diff in compare view

Updates lefthook from 2.1.6 to 2.1.12

Release notes

Sourced from lefthook's releases.

v2.1.12

Changelog

b8350fde604197b2422adfc4ae0af080725822b9 ci: fix npm publishing by bumping Node to 24 (#1508)

9fb290d786a0e122fe113b1b49a45bbd0ffa7d28 fix: LEFTHOOK_OUTPUT precedence (#1506)

2f0a9f37cef73e10d95043ba3754329a21850d57 fix: fail the hook when staging fixed files errors (#1484)

v2.1.11

Changelog

e5b10ac3a2645784ee2e4260620c49c31b44992a deps: bump Go to 1.26.6 (#1495)

d4a259f460b7c1d8c512dd75eedc7068310ee961 fix: inherit terminal size for PTY commands (#1498)

v2.1.10

Changelog

c0a32e900407bf3e2e97c99a7dd2e3f2864ba13a deps: July 2026 (#1463)

0b87ca6dc643dab804a1aad59c24003ef147c11a deps: June 2026 (#1447)

afce7244cf02abaf996ebe87bb557a725e46993e deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443)

fbb61b369b57a17469bd6997d1624608ce977f61 feat: AI coding agents integration (#1448)

cbfb4a5db29b46ac8bf399665cd9ada81022b848 fix: make test suite stable when NO_COLOR is set (#1449)

v2.1.9

Changelog

1d35cbabe1ebaf2a5ed4d2186caa0402de6448e2 chore: add pretty gradient (#1432)

22be6c50e1412c748f3c6b60e9c61cd056dc693b deps: May 2026 (#1415)

1bae568f03dfb88af9185031fa44e9fee285e917 fix: update hooks path after resetting (#1431)

v2.1.8

Changelog

488a5f99a5a496e5837f757f8ce3e6c6d1415792 fix: do not warn if local hooks path is equal to default hooks path (#1421)

v2.1.7

Changelog

f415a9d3fce1d4f6af62622cf96c72e04ecf7bd3 chore: go mod tidy

cf4ab9ea4580f5aeb0d4b61d4dd169533e5bb0c9 fix: always restore unstaged changes (#1416)

4c0e000d6fe9f35f42efefb9263b0b4cb5dfbd49 fix: apply stage_fixed only if it is safe (#1418)

76aa843ef5ceb6970f61cd2ff28d16dd2ec82272 fix: linter, sacrifice optimization for readability

9d53c36ed9a26d3bf66e341a9650a0ecac9b6a37 fix: separate fallback push branch from pathspecs (#1396)

22c9f773cf93b59005bd244c5b00caab2947a755 fix: try to always restore unstaged changes (#1417)

37d83986d8e6d6bf6792f57e22e7cbb1a9e28064 fix: use contrast colors (#1420)

eb1064d0b8c6248627960bea1abf6891db5a21b1 refactor: add new logger without a global state (#1385)

Changelog

Sourced from lefthook's changelog.

2.1.12 (2026-08-28)

fix: fail the hook when staging fixed files errors (#1484) by @teddytennant

fix: LEFTHOOK_OUTPUT precedence (#1506) by @Yuki9814

ci: fix npm publishing by bumping Node to 24 (#1508) by @mariokresic

2.1.11 (2026-08-21)

fix: inherit terminal size for PTY commands (#1498) by @mariokresic

docs: correct Lefthook commit message configuration (#1499) by @codersjj

docs: hide contributors regenerate tip from the site (#1500) by @MikevPeeren

docs: clarify signed-off commit example (#1492) by @nightcityblade

deps: bump Go to 1.26.6 (#1495) by @quaacxlok

docs: fix em notice by @mrexox

docs: update docmd (#1481) by @mrexox

docs: fix EM mention HTML by @mrexox

docs: clarify remote script folders (#1477) by @scop

docs: document script args (#1479) by @lntutor

docs: update em logo by @mrexox

2.1.10 (2026-07-08)

deps: July 2026 (#1463) by @mrexox

feat: AI coding agents integration (#1448) by @viralpraxis

docs: fix language (#1453) by @pflanze

fix: make test suite stable when NO_COLOR is set (#1449) by @viralpraxis

deps: June 2026 (#1447) by @mrexox

deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443) by @maguowei

docs: upgrade docmd (#1442) by @mrexox

docs: use single quotes in example to handle filepaths with $ by @mrexox

2.1.9 (2026-05-29)

fix: update hooks path after resetting (#1431) by @mrexox

deps: May 2026 (#1415) by @mrexox

2.1.8 (2026-05-19)

fix: do not warn if local hooks path is equal to default hooks path (#1421) by @mrexox

2.1.7 (2026-05-19)

fix: use contrast colors (#1420) by @mrexox

fix: apply stage_fixed only if it is safe (#1418) by @mrexox

fix: try to always restore unstaged changes (#1417) by @mrexox

fix: always restore unstaged changes (#1416) by @mrexox

refactor: add new logger without a global state (#1385) by @mrexox

fix: linter, sacrifice optimization for readability by @mrexox

fix: separate fallback push branch from pathspecs (#1396) by @lawrence3699

Commits

4ad40c3 2.1.12: fix LEFTHOOK_OUTPUT env precedence
2f0a9f3 fix: fail the hook when staging fixed files errors (#1484)
9fb290d fix: LEFTHOOK_OUTPUT precedence (#1506)
b8350fd ci: fix npm publishing by bumping Node to 24 (#1508)
c145646 2.1.11: pty terminal size fix
d4a259f fix: inherit terminal size for PTY commands (#1498)
db7ca05 docs: correct Lefthook commit message configuration (#1499)
fd88b10 docs: hide contributors regenerate tip from the site (#1500)
7ccb1d8 docs: clarify signed-off commit example (#1492)
e5b10ac deps: bump Go to 1.26.6 (#1495)
Additional commits viewable in compare view

Updates turbo from 2.9.14 to 2.9.18

Release notes

Sourced from turbo's releases.

Turborepo v2.9.18

What's Changed

Changelog

release(turborepo): 2.9.17 by @github-actions[bot] in vercel/turborepo#13047

ci: Fetch version.txt via API in docs alias failure notification by @anthonyshew in vercel/turborepo#13050

fix: Harden cache archive symlink restore by @anthonyshew in vercel/turborepo#13051

chore: Remove web UI mode by @anthonyshew in vercel/turborepo#13052

fix: Harden query server file access by @anthonyshew in vercel/turborepo#13053

fix: Confine prune patch paths by @anthonyshew in vercel/turborepo#13054

fix: Prevent git argument injection in SCM refs by @anthonyshew in vercel/turborepo#13055

fix: Strip special mode bits from cache restore by @anthonyshew in vercel/turborepo#13056

fix: Contain incremental cache outputs by @anthonyshew in vercel/turborepo#13057

fix(turborepo): Normalize Windows daemon path hash by @Balance8 in vercel/turborepo#13020

fix: Preserve vt100 cell byte counts by @anthonyshew in vercel/turborepo#13058

fix: Separate artifact signature fields by @anthonyshew in vercel/turborepo#13059

fix: Validate OidHash hex buffers by @anthonyshew in vercel/turborepo#13060

fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @anthonyshew in vercel/turborepo#13061

New Contributors

@Balance8 made their first contribution in vercel/turborepo#13020

Full Changelog: vercel/turborepo@v2.9.17...v2.9.18

Turborepo v2.9.17

What's Changed

Changelog

fix: Keep non-PTY stdin alive for persistent tasks by @anthonyshew in vercel/turborepo#12972

release(turborepo): 2.9.16 by @github-actions[bot] in vercel/turborepo#12970

release(turborepo): 2.9.17-canary.1 by @github-actions[bot] in vercel/turborepo#12973

fix: Add auth HTTP timeouts by @anthonyshew in vercel/turborepo#12976

fix: Detect affected root tasks in query by @anthonyshew in vercel/turborepo#12977

fix: Wait for Windows graceful shutdown by @anthonyshew in vercel/turborepo#12979

release(turborepo): 2.9.17-canary.2 by @github-actions[bot] in vercel/turborepo#12980

test: Skip installs for JSON output fixtures by @anthonyshew in vercel/turborepo#12981

feat: Add Rsbuild examples by @Nsttt in vercel/turborepo#12942

test: Skip installs for single package dry runs by @anthonyshew in vercel/turborepo#12982

test: Skip Corepack setup without installs by @anthonyshew in vercel/turborepo#12983

test: Skip installs for metadata-only Rust tests by @anthonyshew in vercel/turborepo#12985

test: Skip remaining unnecessary fixture installs by @anthonyshew in vercel/turborepo#12986

test: Add final hash contract snapshots by @anthonyshew in vercel/turborepo#12984

test: Trim run logging integration matrix by @anthonyshew in vercel/turborepo#12987

test: Trim affected query integration matrix by @anthonyshew in vercel/turborepo#12988

test: Narrow Windows integration test group by @anthonyshew in vercel/turborepo#12989

test: Trim task dependency integration coverage by @anthonyshew in vercel/turborepo#12990

test: Trim affected integration coverage by @anthonyshew in vercel/turborepo#12991

test: Collapse integration test matrices by @anthonyshew in vercel/turborepo#12992

... (truncated)

Commits

3bdce32 publish 2.9.18 to registry
2a76556 fix: Block self-hosted login URLs from attempting to use Vercel's SSO (#13061)
da8e348 fix: Validate OidHash hex buffers (#13060)
3018717 fix: Separate artifact signature fields (#13059)
34514e2 fix: Preserve vt100 cell byte counts (#13058)
24e2d34 fix(turborepo): Normalize Windows daemon path hash (#13020)
16dc881 fix: Contain incremental cache outputs (#13057)
92e1f8e fix: Strip special mode bits from cache restore (#13056)
f46f896 fix: Prevent git argument injection in SCM refs (#13055)
7f353ca fix: Confine prune patch paths (#13054)
Additional commits viewable in compare view

Updates vitest from 4.1.6 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
Additional commits viewable in compare view

Updates @azure/identity from 4.13.1 to 4.13.2

Changelog

Sourced from @azure/identity's changelog.

4.13.2 (2026-08-12)

Other Changes

Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39569

Replaced shell-based developer credential commands with safe, structured process execution. #39279

Migrated platform-specific module resolution to #platform/* imports. #38309

4.14.0-beta.5 (2026-08-12)

Other Changes

Bumped the minimum @azure/msal-node dependency to ^5.1.5 so installs no longer resolve older 5.1.x versions that pull in the vulnerable uuid@8.3.0 transitive dependency. #39425

Replaced shell-based developer credential commands with safe, structured process execution. #39279

4.14.0-beta.4 (2026-06-08)

Bugs Fixed

Fixed AzureDeveloperCliCredential to correctly parse error messages from Azure Developer CLI v1.23.7 and later, which previously caused raw JSON to surface in the credential error instead of the underlying error text. #38416

Fixed handleMsalError to preserve the original MSAL error via cause on AuthenticationRequiredError, allowing callers to access .claims on the underlying error. #38722

4.14.0-beta.3 (2026-04-08)

Other Changes

Reduced bundle size by optimizing imports from @azure/msal-node, e.g. achieving a ~61kb reduction (from 851kb to 790kb) when importing ClientCertificateCredential. #36942

Updated @azure/msal-node to ^5.1.0 and @azure/msal-browser to ^5.5.0. #37836

Commits

ffeacaf Migrate @azure/identity from polyfillSuffix to #platform/* imports
3ec2003 [core] Add safe child process execution
1f7253a Update package.json
4b6cf67 Update test expectation
14350c8 Format packages
4fd7288 Update all missing configuration files
8490453 [Identity] Bump @azure/msal-node to ^5.1.5 to drop vulnerable uuid transitive...
d96ae18 Identity GA 4.13.1
a46a830 [ESLint] Restore no-unassigned-vars recommended rule to error (#39460)
5316d04 [core] Add safe child process execution (#39279)
Additional commits viewable in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild shoul...
Description has been truncated

Bumps the npm group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.15` | `2.4.16` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.6` | `4.1.11` | | [lefthook](https://github.com/evilmartians/lefthook) | `2.1.6` | `2.1.12` | | [turbo](https://github.com/vercel/turborepo) | `2.9.14` | `2.9.18` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.6` | `4.1.11` | | [@azure/identity](https://github.com/Azure/azure-sdk-for-js/tree/HEAD/sdk/identity/identity) | `4.13.1` | `4.13.2` | | [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` | | [@nuxt/kit](https://github.com/nuxt/nuxt/tree/HEAD/packages/kit) | `4.4.5` | `4.4.8` | | [@nuxt/schema](https://github.com/nuxt/nuxt/tree/HEAD/packages/schema) | `3.21.5` | `3.21.11` | | [@tsconfig/node22](https://github.com/tsconfig/bases/tree/HEAD/bases) | `22.0.5` | `22.0.6` | | [graphql](https://github.com/graphql/graphql-js) | `16.14.0` | `16.14.2` | | [rollup](https://github.com/rollup/rollup) | `4.62.2` | `4.62.5` | | [@tsconfig/node20](https://github.com/tsconfig/bases/tree/HEAD/bases) | `20.1.9` | `20.1.10` | | [tsx](https://github.com/privatenumber/tsx) | `4.22.0` | `4.22.5` | | [semver](https://github.com/npm/node-semver) | `7.8.0` | `7.8.5` | | [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) | `7.7.1` | `7.8.0` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.55.7` | `5.55.10` | Updates `@biomejs/biome` from 2.4.15 to 2.4.16 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.16/packages/@biomejs/biome) Updates `@vitest/coverage-v8` from 4.1.6 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8) Updates `lefthook` from 2.1.6 to 2.1.12 - [Release notes](https://github.com/evilmartians/lefthook/releases) - [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md) - [Commits](evilmartians/lefthook@v2.1.6...v2.1.12) Updates `turbo` from 2.9.14 to 2.9.18 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.14...v2.9.18) Updates `vitest` from 4.1.6 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `@azure/identity` from 4.13.1 to 4.13.2 - [Release notes](https://github.com/Azure/azure-sdk-for-js/releases) - [Changelog](https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/identity/identity/CHANGELOG.md) - [Commits](https://github.com/Azure/azure-sdk-for-js/commits/@azure/identity_4.13.2/sdk/identity/identity) Updates `esbuild` from 0.28.1 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.28.1...v0.28.2) Updates `@nuxt/kit` from 4.4.5 to 4.4.8 - [Release notes](https://github.com/nuxt/nuxt/releases) - [Commits](https://github.com/nuxt/nuxt/commits/v4.4.8/packages/kit) Updates `@nuxt/schema` from 3.21.5 to 3.21.11 - [Release notes](https://github.com/nuxt/nuxt/releases) - [Commits](https://github.com/nuxt/nuxt/commits/v3.21.11/packages/schema) Updates `@tsconfig/node22` from 22.0.5 to 22.0.6 - [Commits](https://github.com/tsconfig/bases/commits/HEAD/bases) Updates `graphql` from 16.14.0 to 16.14.2 - [Release notes](https://github.com/graphql/graphql-js/releases) - [Commits](graphql/graphql-js@v16.14.0...v16.14.2) Updates `rollup` from 4.62.2 to 4.62.5 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.62.2...v4.62.5) Updates `@tsconfig/node20` from 20.1.9 to 20.1.10 - [Commits](https://github.com/tsconfig/bases/commits/HEAD/bases) Updates `tsx` from 4.22.0 to 4.22.5 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.22.0...v4.22.5) Updates `semver` from 7.8.0 to 7.8.5 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v7.8.0...v7.8.5) Updates `@types/semver` from 7.7.1 to 7.8.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver) Updates `svelte` from 5.55.7 to 5.55.10 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.55.10/packages/svelte) --- updated-dependencies: - dependency-name: "@azure/identity" dependency-version: 4.13.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@biomejs/biome" dependency-version: 2.4.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@nuxt/kit" dependency-version: 4.4.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@nuxt/schema" dependency-version: 3.21.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@tsconfig/node20" dependency-version: 20.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@tsconfig/node22" dependency-version: 22.0.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@types/semver" dependency-version: 7.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: graphql dependency-version: 16.14.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: lefthook dependency-version: 2.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: rollup dependency-version: 4.62.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: semver dependency-version: 7.8.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: svelte dependency-version: 5.55.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: tsx dependency-version: 4.22.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: turbo dependency-version: 2.9.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Dependency updates javascript Pull requests that update javascript code labels Aug 27, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-6955689c3b branch from 851b5ec to 0ad8922 Compare September 10, 2026 04:51

Navigation Menu

Bump the npm group across 1 directory with 17 updates - #70

Bump the npm group across 1 directory with 17 updates#70
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-6955689c3b

dependabot Bot commented on behalf of github Aug 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.4.16

2.4.16

Patch Changes

2.4.16

Patch Changes

v4.1.11

🐞 Bug Fixes

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

v2.1.12

Changelog

v2.1.11

Changelog

v2.1.10

Changelog

v2.1.9

Changelog

v2.1.8

Changelog

v2.1.7

Changelog

2.1.12 (2026-08-28)

2.1.11 (2026-08-21)

2.1.10 (2026-07-08)

2.1.9 (2026-05-29)

2.1.8 (2026-05-19)

2.1.7 (2026-05-19)

Turborepo v2.9.18

What's Changed

Changelog

New Contributors

Turborepo v2.9.17

What's Changed

Changelog

v4.1.11

🐞 Bug Fixes

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

4.13.2 (2026-08-12)

Other Changes

4.14.0-beta.5 (2026-08-12)

Other Changes

4.14.0-beta.4 (2026-06-08)

Bugs Fixed

4.14.0-beta.3 (2026-04-08)

Other Changes

v0.28.2

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 27, 2026 •

edited

Loading