chore(deps): update all non-major dependencies #17

renovate · 2024-06-10T00:50:04Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/types (source)	`^7.24.6` -> `^7.24.7`
@sxzz/eslint-config	`^3.11.0` -> `^3.12.1`
@types/node (source)	`^20.12.12` -> `^20.14.2`
ast-kit	`^0.12.1` -> `^0.12.2`
esbuild	`^0.21.4` -> `^0.21.5`
eslint (source)	`^9.3.0` -> `^9.4.0`
execa	`^9.1.0` -> `^9.2.0`
pnpm (source)	`9.1.2` -> `9.3.0`
prettier (source)	`^3.2.5` -> `^3.3.1`
tsup (source)	`^8.0.2` -> `^8.1.0`
tsx	`^4.11.0` -> `^4.15.1`
vite (source)	`^5.2.11` -> `^5.2.13`

Release Notes

babel/babel (@babel/types)

`v7.24.7`

Compare Source

🐛 Bug Fix

babel-node
- #16554 Allow extra flags in babel-node (@nicolo-ribaudo)
babel-traverse
- #16522 fix: incorrect constantViolations with destructuring (@liuxingbaoyu)
babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
- #16524 fix: Transform using in switch correctly (@liuxingbaoyu)

🏠 Internal

babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
- #16525 Delete unused array helpers (@blakewilson)

sxzz/eslint-config (@sxzz/eslint-config)

`v3.12.1`

Compare Source

🐞 Bug Fixes

Types - by @sxzz (81741)
Interop unused imports - by @sxzz (1d974)

View changes on GitHub

`v3.12.0`

Compare Source

🚀 Features

Upgrade eslint-define-config - by @sxzz (3e659)
Sort isolatedDeclarations - by @sxzz (831a2)
unicorn: Enable new rules - by @sxzz (5fa70)

🐞 Bug Fixes

deps:
- Update dependency eslint-define-config to v2 - by @renovate[bot] inhttps://github.com/sxzz/eslint-config/issues/499 (826a9)
- Update dependency eslint-plugin-unicorn to v53 - by @renovate[bot] inhttps://github.com/sxzz/eslint-config/issues/800 (fc5c3)
- Update all non-major dependencies - by @renovate[bot] inhttps://github.com/sxzz/eslint-config/issues/811 (52a3d)
- Update dependency eslint-plugin-unused-imports to v4 - by @renovate[bot] inhttps://github.com/sxzz/eslint-config/issues/822 (1a35b)

View changes on GitHub

sxzz/ast-kit (ast-kit)

`v0.12.2`

Compare Source

🚀 Features

extract: Add extractIdentifiers - by @LoTwT and @sxzz in https://github.com/sxzz/ast-kit/issues/39 (412bb)

🐞 Bug Fixes

deps:
- Update all non-major dependencies - by @renovate[bot] inhttps://github.com/sxzz/ast-kit/issues/388 (7bf98)
- Update all non-major dependencies - by @renovate[bot] (60ce0)
- Update all non-major dependencies - by @renovate[bot] (7f50a)
- Update all non-major dependencies - by @renovate[bot] (52898)
- Update all non-major dependencies - by @renovate[bot] (ad275)

View changes on GitHub

evanw/esbuild (esbuild)

`v0.21.5`

Compare Source

Fix Symbol.metadata on classes without a class decorator (#3781)

This release fixes a bug with esbuild's support for the decorator metadata proposal. Previously esbuild only added the Symbol.metadata property to decorated classes if there was a decorator on the class element itself. However, the proposal says that the Symbol.metadata property should be present on all classes that have any decorators at all, not just those with a decorator on the class element itself.
Allow unknown import attributes to be used with the copy loader (#3792)

Import attributes (the with keyword on import statements) are allowed to alter how that path is loaded. For example, esbuild cannot assume that it knows how to load ./bagel.js as type bagel:
```
// This is an error with "--bundle" without also using "--external:./bagel.js"
import tasty from "./bagel.js" with { type: "bagel" }
```
Because of that, bundling this code with esbuild is an error unless the file ./bagel.js is external to the bundle (such as with --bundle --external:./bagel.js).

However, there is an additional case where it's ok for esbuild to allow this: if the file is loaded using the copy loader. That's because the copy loader behaves similarly to --external in that the file is left external to the bundle. The difference is that the copy loader copies the file into the output folder and rewrites the import path while --external doesn't. That means the following will now work with the copy loader (such as with --bundle --loader:.bagel=copy):
```
// This is no longer an error with "--bundle" and "--loader:.bagel=copy"
import tasty from "./tasty.bagel" with { type: "bagel" }
```
Support import attributes with glob-style imports (#3797)

This release adds support for import attributes (the with option) to glob-style imports (dynamic imports with certain string literal patterns as paths). These imports previously didn't support import attributes due to an oversight. So code like this will now work correctly:
```
async function loadLocale(locale: string): Locale {
  const data = await import(`./locales/${locale}.data`, { with: { type: 'json' } })
  return unpackLocale(locale, data)
}
```
Previously this didn't work even though esbuild normally supports forcing the JSON loader using an import attribute. Attempting to do this used to result in the following error:
```
✘ [ERROR] No loader is configured for ".data" files: locales/en-US.data

    example.ts:2:28:
      2 │   const data = await import(`./locales/${locale}.data`, { with: { type: 'json' } })
        ╵                             ~~~~~~~~~~~~~~~~~~~~~~~~~~
```
In addition, this change means plugins can now access the contents of with for glob-style imports.
Support ${configDir} in tsconfig.json files (#3782)

This adds support for a new feature from the upcoming TypeScript 5.5 release. The character sequence ${configDir} is now respected at the start of baseUrl and paths values, which are used by esbuild during bundling to correctly map import paths to file system paths. This feature lets base tsconfig.json files specified via extends refer to the directory of the top-level tsconfig.json file. Here is an example:
```
{
  "compilerOptions": {
    "paths": {
      "js/*": ["${configDir}/dist/js/*"]
    }
  }
}
```
You can read more in TypeScript's blog post about their upcoming 5.5 release. Note that this feature does not make use of template literals (you need to use "${configDir}/dist/js/*" not `${configDir}/dist/js/*`). The syntax for tsconfig.json is still just JSON with comments, and JSON syntax does not allow template literals. This feature only recognizes ${configDir} in strings for certain path-like properties, and only at the beginning of the string.
Fix internal error with --supported:object-accessors=false (#3794)

This release fixes a regression in 0.21.0 where some code that was added to esbuild's internal runtime library of helper functions for JavaScript decorators fails to parse when you configure esbuild with --supported:object-accessors=false. The reason is that esbuild introduced code that does { get [name]() {} } which uses both the object-extensions feature for the [name] and the object-accessors feature for the get, but esbuild was incorrectly only checking for object-extensions and not for object-accessors. Additional tests have been added to avoid this type of issue in the future. A workaround for this issue in earlier releases is to also add --supported:object-extensions=false.

eslint/eslint (eslint)

`v9.4.0`

Compare Source

sindresorhus/execa (execa)

`v9.2.0`

Compare Source

This release includes a new set of methods to exchange messages between the current process and a Node.js subprocess, also known as "IPC". This allows passing and returning almost any message type to/from a Node.js subprocess. Also, debugging IPC is now much easier.

Moreover, a new gracefulCancel option has also been added to terminate a subprocess gracefully.

For a deeper dive-in, please check and share the release post!

Thanks @iiroj for your contribution, @SimonSiefke and @adymorz for reporting the bugs fixed in this release, and @karlhorky for improving the documentation!

Deprecations

Passing 'ipc' to the stdio option has been deprecated. It will be removed in the next major release. Instead, the ipc: true option should be used. (#1056)

- await execa('npm', ['run', 'build'], {stdio: ['pipe', 'pipe', 'pipe', 'ipc']});
+ await execa('npm', ['run', 'build'], {ipc: true});

The execaCommand() method has been deprecated. It will be removed in the next major release. If most cases, the template string syntax should be used instead.

- import {execaCommand} from 'execa';
+ import {execa} from 'execa';

- await execaCommand('npm run build');
+ await execa`npm run build`;

const taskName = 'build';
- await execaCommand(`npm run ${taskName}`);
+ await execa`npm run ${taskName}`;

const commandArguments = ['run', 'task with space'];
await execa`npm ${commandArguments}`;

If the file and/or multiple arguments are supplied as a single string, parseCommandString(command) can split that string into an array. More info. (#1054)

- import {execaCommand} from 'execa';
+ import {execa, parseCommandString} from 'execa';

const commandString = 'npm run task';
- await execaCommand(commandString);
+ const commandArray = parseCommandString(commandString); // ['npm', 'run', 'task']
+ await execa`${commandArray}`;

// Or alternatively:
const [file, ...commandArguments] = commandArray;
await execa(file, commandArguments);

Features

Add gracefulCancel option and getCancelSignal() method to terminate a subprocess gracefully. error.isGracefullyCanceled was also added. (#1109)
Add error.isForcefullyTerminated. It is true when the subprocess was terminated by the forceKillAfterDelay option. (#1111)
New methods to simplify exchanging messages between the current process and the subprocess. More info. (#1059, #1061, #1076, #1077, #1079, #1082, #1083, #1086, #1087, #1088, #1089, #1090, #1091, #1092, #1094, #1095, #1098, #1104, #1107)
- The current process sends messages with subprocess.sendMessage(message) and receives them with subprocess.getOneMessage(). subprocess.getEachMessage() listens to multiple messages.
- The subprocess uses sendMessage(message), getOneMessage() and getEachMessage() instead. Those are the same methods, but imported directly from the 'execa' module.
The ipcInput option sends an IPC message from the current process to the subprocess as it starts. This enables passing almost any input type to a Node.js subprocess. (#1068)
The result.ipcOutput array contains all the IPC messages sent by the subprocess to the current process. This enables returning almost any output type from a Node.js subprocess. (#1067, #1071, #1075)
The error message now contains every IPC message sent by the subprocess. (#1067)
The verbose: 'full' option now logs every IPC message sent by the subprocess, for debugging. More info here and there. (#1063)

Types

Add ExecaMethod, ExecaNodeMethod and ExecaScriptMethod, ExecaSyncMethod and ExecaScriptSyncMethod types. (#1066)
Export the Message type, for IPC. (#1059)
Fix type of forceKillAfterDelay: true option. (#1116)

Bug fixes

Fix passing a {file} to both the stdin and the stdout or stderr options. (#1058)
Fix multiple minor problems with the cancelSignal option. (#1108)
Fix accidental publishing of Vim backup files. (#1074)
Fix engines.node field in package.json. Supported Node.js version is ^18.19.0 or >=20.5.0. (by @iiroj) (#1101)

pnpm/pnpm (pnpm)

`v9.3.0`

Compare Source

Minor Changes

Semi-breaking. Dependency key names in the lockfile are shortened if they are longer than 1000 characters. We don't expect this change to affect many users. Affected users most probably can't run install successfully at the moment. This change is required to fix some edge cases in which installation fails with an out-of-memory error or "Invalid string length (RangeError: Invalid string length)" error. The max allowed length of the dependency key can be controlled with the peers-suffix-max-length setting #8177.

Patch Changes

Set reporter-hide-prefix to true by default for pnpm exec. In order to show prefix, the user now has to explicitly set reporter-hide-prefix=false #8174.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

`v9.2.0`

Compare Source

Minor Changes

If package-manager-strict-version is set to true, pnpm will fail if its version doesn't exactly match the version in the "packageManager" field of package.json.

Patch Changes

Update @yarnpkg/pnp to the latest version, fixing issue with node: imports #8161.
Deduplicate bin names to prevent race condition and corrupted bin scripts #7833.
pnpm doesn't fail if its version doesn't match the one specified in the "packageManager" field of package.json #8087.
exec now also streams prefixed output when --recursive or --parallel is specified just as run does #8065.

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

`v9.1.4`

Compare Source

`v9.1.3`

Compare Source

prettier/prettier (prettier)

`v3.3.1`

Compare Source

diff

Preserve empty lines in front matter (#16347 by @fisker)

<!-- Input -->
---
foo:
  - bar1

  - bar2

  - bar3
---
Markdown

<!-- Prettier 3.3.0 -->

---
foo:
  - bar1
  - bar2
  - bar3
---

Markdown

<!-- Prettier 3.3.1 -->
---
foo:
  - bar1

  - bar2

  - bar3
---

Markdown

Preserve explicit language in front matter (#16348 by @fisker)

<!-- Input -->
---yaml
title: Hello
slug: home
---

<!-- Prettier 3.3.0 -->
---
title: Hello
slug: home
---

<!-- Prettier 3.3.1 -->
---yaml
title: Hello
slug: home
---

Avoid line breaks in import attributes (#16349 by @fisker)

// Input
import something from "./some-very-very-very-very-very-very-very-very-long-path.json" with { type: "json" };

// Prettier 3.3.0
import something from "./some-very-very-very-very-very-very-very-very-long-path.json" with { type:
  "json" };

// Prettier 3.3.1
import something from "./some-very-very-very-very-very-very-very-very-long-path.json" with { type: "json" };

`v3.3.0`

Compare Source

diff

🔗 Release Notes

egoist/tsup (tsup)

`v8.1.0`

Compare Source

Features

upgrade esbuild to 0.21.4, opts-in for decorators (#1116) (796fc50)

privatenumber/tsx (tsx)

`v4.15.1`

Compare Source

`v4.15.0`

Compare Source

Features

esbuild 0.21 (#19) (6f1d305)
esbuild 0.21.3 (edbdfdf)
esbuild 0.21.4 (c67d746)

This release is also available on:

npm package (@latest dist-tag)

`v4.14.1`

Compare Source

Bug Fixes

cjs: only hide transformers when namespaced (9e647a5)

This release is also available on:

npm package (@latest dist-tag)

`v4.14.0`

Compare Source

Features

resolve .js → .ts in package.json exports & main (4503421)

This release is also available on:

npm package (@latest dist-tag)

`v4.13.3`

Compare Source

Bug Fixes

cjs: resolve directory import relative to parent (#42) (02d3856)
esm: cjs interop to support decorators (807f467)
esm: resolve .ts extension in imports map (89621bf)

This release is also available on:

npm package (@latest dist-tag)

`v4.13.2`

Compare Source

Bug Fixes

esm: ignore transforming .js files with CJS syntax (#40) (87a7683)

This release is also available on:

npm package (@latest dist-tag)

`v4.13.1`

Compare Source

Bug Fixes

esm/api: tsImport() to parse CJS exports (0a78bfd)

This release is also available on:

npm package (@latest dist-tag)

`v4.13.0`

Compare Source

Features

cjs/api: register() to support namespace (#35) (c703300)
esm/api: tsImport() to support loading CommonJS files (0eb4e91)

This release is also available on:

npm package (@latest dist-tag)

`v4.12.1`

Compare Source

Bug Fixes

esm: resolve implicit ts paths in packages (de900a1)

This release is also available on:

npm package (@latest dist-tag)

`v4.12.0`

Compare Source

Bug Fixes

cjs: make resolver chainable (585f117)
esm: named import from CommonJS file (#33) (7c85303)

Features

cjs: support query for cache busting (#37) (e1464cf)

Performance Improvements

esm: only try extensions if file path (72d0896)

This release is also available on:

npm package (@latest dist-tag)

`v4.11.2`

Compare Source

Bug Fixes

cjs: esm interop in .mjs files (#32) (aa2b639)

This release is also available on:

npm package (@latest dist-tag)

`v4.11.1`

Compare Source

Bug Fixes

cjs/api: resolve correct module and types when imported (#566) (5e70105)

This release is also available on:

npm package (@latest dist-tag)

vitejs/vite (vite)

`v5.2.13`

Compare Source

Please refer to CHANGELOG.md for details.

`v5.2.12`

Compare Source

chore: move to eslint flat config (#16743) (8f16765), closes #16743
chore(deps): remove unused deps (#17329) (5a45745), closes #17329
chore(deps): update all non-major dependencies (#16722) (b45922a), closes #16722
fix: mention build.rollupOptions.output.manualChunks instead of build.rollupOutput.manualChunks (89378c0), closes #16721
fix(build): make SystemJSWrapRE match lazy (#16633) (6583ad2), closes #16633
fix(css): avoid generating empty JS files when JS files becomes empty but has CSS files imported (#1 (95fe5a7), closes #16078
fix(css): handle lightningcss compiled css in Deno (#17301) (8e4e932), closes #17301
fix(css): only use files the current bundle contains (#16684) (15a6ebb), closes #16684
fix(css): page reload was not happening with .css?raw (#16455) (8041846), closes #16455
fix(deps): update all non-major dependencies (#16603) (6711553), closes #16603
fix(deps): update all non-major dependencies (#16660) (bf2f014), closes #16660
fix(deps): update all non-major dependencies (#17321) (4a89766), closes #17321
fix(error-logging): rollup errors weren't displaying id and codeframe (#16540) (22dc196), closes [#165

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

stackblitz · 2024-06-10T00:50:07Z

Run & review this pull request in StackBlitz Codeflow.

socket-security · 2024-06-10T00:50:27Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/[email protected]	None	`+1`	118 kB	sxzz
npm/[email protected]	None	`0`	0 B
npm/[email protected]	environment Transitive: eval, filesystem, shell	`+69`	8.26 MB	eslintbot
npm/[email protected]	None	`0`	0 B
npm/[email protected]	environment, filesystem, unsafe	`0`	8.25 MB	prettier-bot
npm/[email protected]	None	`0`	0 B

🚮 Removed packages: npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

socket-security · 2024-06-10T00:50:30Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note
Install scripts	npm/[email protected]	Install script: postinstall Source: `node install.js`
Install scripts	npm/[email protected]	Install script: postinstall Source: `node install.js`

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]

renovate bot added the dependencies label Jun 10, 2024

chore(deps): update all non-major dependencies

683dbe9

renovate bot force-pushed the renovate/all-minor-patch branch from 1d2db78 to 683dbe9 Compare June 10, 2024 14:14

renovate bot merged commit 77e4bd5 into main Jun 10, 2024
7 checks passed

renovate bot deleted the renovate/all-minor-patch branch June 10, 2024 16:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update all non-major dependencies #17

chore(deps): update all non-major dependencies #17

renovate bot commented Jun 10, 2024 •

edited

Loading

stackblitz bot commented Jun 10, 2024

socket-security bot commented Jun 10, 2024

socket-security bot commented Jun 10, 2024

chore(deps): update all non-major dependencies #17

chore(deps): update all non-major dependencies #17

Conversation

renovate bot commented Jun 10, 2024 • edited Loading

Release Notes

🐛 Bug Fix

🏠 Internal

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

🚀 Features

🐞 Bug Fixes

Deprecations

Features

Types

Bug fixes

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

Our Silver Sponsors

Preserve empty lines in front matter (#​16347 by @​fisker)

Preserve explicit language in front matter (#​16348 by @​fisker)

Avoid line breaks in import attributes (#​16349 by @​fisker)

Features

Features

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Performance Improvements

Bug Fixes

Bug Fixes

Configuration

stackblitz bot commented Jun 10, 2024

socket-security bot commented Jun 10, 2024

socket-security bot commented Jun 10, 2024

Next steps

renovate bot commented Jun 10, 2024 •

edited

Loading

Preserve empty lines in front matter (#16347 by @fisker)

Preserve explicit language in front matter (#16348 by @fisker)

Avoid line breaks in import attributes (#16349 by @fisker)