IC3P3/hcss-website
Watch
1
0
Fork
You've already forked hcss-website
 0
Code Issues 1 Pull requests 6 Packages 1 Activity Actions

Update Non-major updates #69

Merged
renovate-bot merged 1 commit from renovate/non-major-updates into dev 2026-08-17 21:01:22 +02:00
Conversation 0 Commits 1 Files changed 4 +445 -170
renovate-bot commented 2026-08-17 19:02:05 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
@sveltejs/vite-plugin-svelte (source) 7.2.0 → 7.3.0 age confidence
esbuild 0.28.1 → 0.28.2 age confidence
eslint (source) 10.8.0 → 10.8.1 age confidence
npm:pnpm (source) 11.20.0 → 11.21.0 age confidence
pnpm (source) 11.20.0 → 11.21.0 age confidence
svelte-check 4.7.4 → 4.7.5 age confidence
typescript-eslint (source) 8.66.0 → 8.67.0 age confidence

Release Notes

sveltejs/vite-plugin-svelte (@​sveltejs/vite-plugin-svelte)

v7.3.0

Compare Source

Minor Changes
  • feat: pass environment to dynamicCompileOptions (#​1386)
Patch Changes
  • fix: don't log inline config when encountering unexpected options (#​1376)
evanw/esbuild (esbuild)

v0.28.2

Compare Source

  • Fix tree shaking bug due to TypeScript import alias (#​4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#​4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}

/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}

/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#​4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#​4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#​4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})
}

// Old output (with --minify-syntax --target=es6)
function foo() {
  bar(void 0 || (x = {}));
}

// New output (with --minify-syntax --target=es6)
function foo() {
  let x;
  bar(x || (x = {}));
}

  • Fix a potential deadlock when the JavaScript API is used incorrectly (#​4503, #​4506)

    The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

    Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

    This fix was submitted by @​ZuBB.

  • Handle target collisions (#​4509)

    It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.

  • Force .mp3 files to use the audio/mpeg MIME type (#​4485)

    MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

  • Add a new TypeScript syntax warning

    TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

    ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]

    example.ts:1:28:
      1 │ console.log(1 + 2 as number * 3)
        ╵                             ^

  This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
  precedence in this case. Surround the inner expression in parentheses to silence this warning:

    example.ts:1:12:
      1 │ console.log(1 + 2 as number * 3)
        │             ~~~~~~~~~~~~~~~
        ╵             (             )

    See microsoft/TypeScript#63527 for more information.

  • Add support for formatting errors for Visual Studio (#​4460)

    Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

    With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:

    $ esbuild example.ts --log-style=visualstudio
/Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator

    This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.

  • Fix a bug with CSS gamut mapping (#​4488)

    Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

    This fix was submitted by @​chatman-media.

eslint/eslint (eslint)

v10.8.1

Compare Source

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

pnpm/pnpm (npm:pnpm)

v11.21.0: pnpm 11.21

Compare Source

Minor Changes

  • Added interactive group selection to pnpm update --global --interactive.

  • Running pnpm setup, pnpm self-update, or a command that modifies the global installation (such as pnpm add --global) through sudo now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with ERR_PNPM_SUDO_NOT_SUPPORTED in pnpm v12. Read-only global commands (such as pnpm bin --global) are unaffected.

Patch Changes

  • Fixed pnpm failing to start under asynchronous Node.js module loaders when no .pnpmfile.mjs exists pnpm/pnpm#11701.

  • Fixed minimumReleaseAge fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target.

  • Removing a dependency from package.json and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from pnpm-lock.yaml, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune.

  • Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in pnpm-lock.yaml directly, reusing the same check the pnpm.overrides fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions.

  • Fixed a CI regression where github:owner/repo dependencies (and other shorthand Git specifiers) would fail to install with Permission denied (publickey) on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. git+ssh:// or git@host:...):

    • The repository visibility probe (an HTTP HEAD request) now retries transient failures such as 429 Too Many Requests, so host throttling of CI runners is no longer mistaken for a private repository.
    • For non-SSH specifiers, anonymous HTTPS git ls-remote access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured.
    • When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL.
    • A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. codeload.github.com, which would fail to download for a private repository); it stays a regular git resolution so installs can use ambient Git credentials such as credential helpers and tokens.

    Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL.

    Fixes pnpm/pnpm#13276.

  • ng build and nuxt build now work under the global virtual store: pnpm's built-in compatibility extensions add the tslib dependency that @angular/build uses without declaring and the unplugin dependency that @nuxt/vite-builder v4 uses without declaring.

  • Fixed link: dependencies under enableGlobalVirtualStore so linked children are materialized and slots remain isolated by their resolved link targets.

  • An install that skips resolution because pnpm-lock.yaml is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and pendingBuilds entries for removed packages are dropped instead of staying pending forever.

  • The held-back-update warning printed by pnpm update no longer fires when minimumReleaseAge is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See #​13071.

  • Checking whether ignoredOptionalDependencies is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an ! exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored.

  • Changing autoInstallPeers, dedupePeers, peersSuffixMaxLength, excludeLinksFromLockfile, or injectWorkspacePackages no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in pnpm-lock.yaml and the install proceeds from the existing resolution. Every other case still falls back to a full resolution.

  • Adding, editing, or removing an entry in patchedDependencies no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in pnpm-lock.yaml and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while allowUnusedPatches is off, so ERR_PNPM_UNUSED_PATCH is still reported.

  • Resolving a private git repository no longer blocks on an interactive credential prompt: git ls-remote now fails fast with an authentication error when git has no credentials for the repository #​13522.

  • Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same ERR_PNPM_NO_OFFLINE_META condition used by offline resolution.

  • POSIX shell shims now follow symbolic links before computing basedir, preventing execution failures when a shim is invoked via an external symlink on PATH #​13405.

  • The automatic packageManager version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command #​13619.

  • Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip dist.signatures) no longer break the automatic packageManager version switch and pnpm self-update #​13147. When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from registry.npmjs.org and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a shasum), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch.

  • pnpm fetch, and any install run with virtualStoreOnly, no longer writes a .pnp.cjs loader under nodeLinker: pnp. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and node_modules/.package-map.json were already skipped; the PnP loader now follows the same rule.

  • Prevent pnpm from removing project files when modulesDir resolves to the project root.

  • Speed up installs after adding ignoredOptionalDependencies patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again.

  • When a failed install re-copies a bin script from the store, rerunning pnpm install now reapplies the executable bit to the bin instead of leaving it non-executable #​12742.

  • pnpm root -g and pnpm bin -g now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with --global in a project that pins a package manager (e.g. via the packageManager field) printed a warning like [WARN] Using --global skips the package manager check for this project ahead of the path, breaking programs that capture the output as a path #​13672.

    In pnpm 12, pnpm root -g and pnpm prefix -g are now supported (they previously failed with ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED / ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED), and the reporter output of dlx, create, config, sbom, with, store, prefix, root, and bin goes to stderr, matching pnpm 11.

  • pnpm setup no longer makes Node.js print a MODULE_TYPELESS_PACKAGE_JSON warning about dist/worker.js on every command. The package.json it writes next to a standalone executable now declares "type": "module".

  • pnpm update without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or --latest resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next pnpm install --frozen-lockfile rejected with ERR_PNPM_OUTDATED_LOCKFILE #​12764.

  • pnpm version -r --json now outputs [] instead of human-readable text when no pending changes exist pnpm/pnpm#13217.

Platinum Sponsors
Bit
OpenAI
Gold Sponsors
Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
sveltejs/language-tools (svelte-check)

v4.7.5

Compare Source

Patch Changes
typescript-eslint/typescript-eslint (typescript-eslint)

v8.67.0

Compare Source

🚀 Features
  • typescript-eslint: export basic globs for using tseslint (#​12105)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "after 11pm every weekday,before 5am every weekday,every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte) ([source](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte)) | [`7.2.0` → `7.3.0`](https://renovatebot.com/diffs/npm/@sveltejs%2fvite-plugin-svelte/7.2.0/7.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@sveltejs%2fvite-plugin-svelte/7.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@sveltejs%2fvite-plugin-svelte/7.2.0/7.3.0?slim=true) | | [esbuild](https://github.com/evanw/esbuild) | [`0.28.1` → `0.28.2`](https://renovatebot.com/diffs/npm/esbuild/0.28.1/0.28.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/esbuild/0.28.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/esbuild/0.28.1/0.28.2?slim=true) | | [eslint](https://eslint.org) ([source](https://github.com/eslint/eslint)) | [`10.8.0` → `10.8.1`](https://renovatebot.com/diffs/npm/eslint/10.8.0/10.8.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/eslint/10.8.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/eslint/10.8.0/10.8.1?slim=true) | | [npm:pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | `11.20.0` → `11.21.0` | ![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.21.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.20.0/11.21.0?slim=true) | | [pnpm](https://pnpm.io) ([source](https://github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | `11.20.0` → `11.21.0` | ![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.21.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.20.0/11.21.0?slim=true) | | [svelte-check](https://github.com/sveltejs/language-tools) | [`4.7.4` → `4.7.5`](https://renovatebot.com/diffs/npm/svelte-check/4.7.4/4.7.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/svelte-check/4.7.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/svelte-check/4.7.4/4.7.5?slim=true) | | [typescript-eslint](https://typescript-eslint.io/packages/typescript-eslint) ([source](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint)) | [`8.66.0` → `8.67.0`](https://renovatebot.com/diffs/npm/typescript-eslint/8.66.0/8.67.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/typescript-eslint/8.67.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/typescript-eslint/8.66.0/8.67.0?slim=true) | --- ### Release Notes <details> <summary>sveltejs/vite-plugin-svelte (@&#8203;sveltejs/vite-plugin-svelte)</summary> ### [`v7.3.0`](https://github.com/sveltejs/vite-plugin-svelte/blob/HEAD/packages/vite-plugin-svelte/CHANGELOG.md#730) [Compare Source](https://github.com/sveltejs/vite-plugin-svelte/compare/@sveltejs/vite-plugin-svelte@7.2.0...@sveltejs/vite-plugin-svelte@7.3.0) ##### Minor Changes - feat: pass environment to `dynamicCompileOptions` ([#&#8203;1386](https://github.com/sveltejs/vite-plugin-svelte/pull/1386)) ##### Patch Changes - fix: don't log inline config when encountering unexpected options ([#&#8203;1376](https://github.com/sveltejs/vite-plugin-svelte/pull/1376)) </details> <details> <summary>evanw/esbuild (esbuild)</summary> ### [`v0.28.2`](https://github.com/evanw/esbuild/blob/HEAD/CHANGELOG.md#0282) [Compare Source](https://github.com/evanw/esbuild/compare/v0.28.1...v0.28.2) - Fix tree shaking bug due to TypeScript import alias ([#&#8203;4507](https://github.com/evanw/esbuild/issues/4507)) This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific `import` assignment and looks something like this: ```ts import Base from './dep.js'; import Alias = Base.SomeType; ``` - Fix CSS minification bug involving `&` ([#&#8203;4497](https://github.com/evanw/esbuild/issues/4497)) This release fixes a bug where esbuild's CSS minifier incorrectly removed a `&` when it was unsafe to do so. Here is an example: ```css /* Original code */ .a .b { & .b:not(& .c) { color: red; } } /* Old output (with --minify) */ .a .b{.b:not(& .c){color:red}} /* New output (with --minify) */ .a .b{& .b:not(& .c){color:red}} ``` This should match `<span class="a"><span class="b"><span class="b">yes</span></span></span>` but not `<span class="a"><span class="b">no</span></span>`. The old output incorrectly matched both. - Avoid overwriting input files without `--allow-overwrite` ([#&#8203;4484](https://github.com/evanw/esbuild/issues/4484)) For example: `esbuild input.js --outfile=input.js` tells esbuild to overwrite `input.js` with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops. This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless `--allow-overwrite` is explicitly present. This is done by not writing out any files when a build error is encountered. - Fix incorrect code generated when using top-level await ([#&#8203;4498](https://github.com/evanw/esbuild/issues/4498)) Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing `async` on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an `async` module wrapper. - Fix a minification bug with lowered logical assignment operators ([#&#8203;4508](https://github.com/evanw/esbuild/issues/4508)) This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed: ```js // Original code function foo() { let x bar(x ||= {}) } // Old output (with --minify-syntax --target=es6) function foo() { bar(void 0 || (x = {})); } // New output (with --minify-syntax --target=es6) function foo() { let x; bar(x || (x = {})); } ``` - Fix a potential deadlock when the JavaScript API is used incorrectly ([#&#8203;4503](https://github.com/evanw/esbuild/issues/4503), [#&#8203;4506](https://github.com/evanw/esbuild/pull/4506)) The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed. Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug. This fix was submitted by [@&#8203;ZuBB](https://github.com/ZuBB). - Handle target collisions ([#&#8203;4509](https://github.com/evanw/esbuild/issues/4509)) It's possible to specify the same target engine multiple times, such as with `--target=chrome1,chrome99`. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so `chrome99` in this case instead of `chrome1`). With this release, esbuild will now pick the minimum version between all duplicated target engines. - Force `.mp3` files to use the `audio/mpeg` MIME type ([#&#8203;4485](https://github.com/evanw/esbuild/issues/4485)) MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the [MIME sniffing standard](https://mimesniff.spec.whatwg.org/). This works correctly for MP3 files that start with the byte sequence `ID3`, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with `ID3`, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some `.mp3` files incorrectly using the `application/octet-stream` MIME type instead of `audio/mpeg`. With this release, esbuild will now always use the `audio/mpeg` MIME type for files ending in `.mp3`. - Add a new TypeScript syntax warning TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts `1 + 2 as number * 3` as valid syntax but confusingly converts it to `(1 + 2) * 3` instead of the more intuitive conversion to `1 + (2 * 3)`. This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax: ```ts ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast] example.ts:1:28: 1 │ console.log(1 + 2 as number * 3) ╵ ^ This is a syntax error in newer versions of TypeScript because the type cast has unintuitive precedence in this case. Surround the inner expression in parentheses to silence this warning: example.ts:1:12: 1 │ console.log(1 + 2 as number * 3) │ ~~~~~~~~~~~~~~~ ╵ ( ) ``` See [microsoft/TypeScript#63527](https://github.com/microsoft/TypeScript/issues/63527) for more information. - Add support for formatting errors for Visual Studio ([#&#8203;4460](https://github.com/evanw/esbuild/issues/4460)) Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style. With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with `--log-style=visualstudio`. Here is an example log message in this style: ``` $ esbuild example.ts --log-style=visualstudio /Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator ``` This log style is also available via the JS and Go APIs, and can now be used with the existing `formatMessages` API. - Fix a bug with CSS gamut mapping ([#&#8203;4488](https://github.com/evanw/esbuild/pull/4488)) Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm. This fix was submitted by [@&#8203;chatman-media](https://github.com/chatman-media). </details> <details> <summary>eslint/eslint (eslint)</summary> ### [`v10.8.1`](https://github.com/eslint/eslint/releases/tag/v10.8.1) [Compare Source](https://github.com/eslint/eslint/compare/v10.8.0...v10.8.1) #### Bug Fixes - [`18eb0a7`](https://github.com/eslint/eslint/commit/18eb0a7e787b9fac3049ef3dad0e845d2bd940a4) fix: prevent ASI hazard in `no-unused-labels` autofix ([#&#8203;21173](https://github.com/eslint/eslint/issues/21173)) (dongkyu lee) - [`151ba3f`](https://github.com/eslint/eslint/commit/151ba3f5834a0909e8b9b1736f4889ac694c0104) fix: false positives in `getter-return` and `accessor-pairs` ([#&#8203;21163](https://github.com/eslint/eslint/issues/21163)) (Grit) - [`6898df9`](https://github.com/eslint/eslint/commit/6898df9364639ee64b9448a4cb6b08a30c16bd37) fix: ignore meta-property names in `id-denylist` ([#&#8203;21166](https://github.com/eslint/eslint/issues/21166)) (Pixel) - [`4d7db66`](https://github.com/eslint/eslint/commit/4d7db6628e2badf0857cb88734fe641c3874bce9) fix: ignore meta-property names in `id-match` ([#&#8203;21167](https://github.com/eslint/eslint/issues/21167)) (Pixel) - [`677214e`](https://github.com/eslint/eslint/commit/677214e7eea83d8bc6e4b79eea871577e1369d5f) fix: handle ASI hazards in no-unused-vars removeVar suggestion ([#&#8203;20935](https://github.com/eslint/eslint/issues/20935)) (kuldeep kumar) #### Documentation - [`7d0cbf8`](https://github.com/eslint/eslint/commit/7d0cbf81cfdb7526b5c4cb7b222ddc7f257db560) docs: Update README (GitHub Actions Bot) - [`0a05812`](https://github.com/eslint/eslint/commit/0a05812adb12598b32e85297b98df5ad14501d60) docs: add missing backticks to `no-duplicate-imports.js` ([#&#8203;21183](https://github.com/eslint/eslint/issues/21183)) (Lee Daeun) - [`678c90b`](https://github.com/eslint/eslint/commit/678c90b55da2889d4400cbf6e2584ab683faf202) docs: Update README (GitHub Actions Bot) - [`8a10424`](https://github.com/eslint/eslint/commit/8a104242e8e1c5614940fab7324346974cff7d26) docs: Update README (GitHub Actions Bot) - [`69bb948`](https://github.com/eslint/eslint/commit/69bb948061105426dbe6e3c931fcda783286e020) docs: Update README (GitHub Actions Bot) #### Chores - [`0a14800`](https://github.com/eslint/eslint/commit/0a148005051fded2ef1d14cc228ae505251b4b10) chore: update github/codeql-action action to v4.37.4 ([#&#8203;21196](https://github.com/eslint/eslint/issues/21196)) (renovate\[bot]) - [`05adcb1`](https://github.com/eslint/eslint/commit/05adcb13542061dc7fadde5cd58d23d405a96d93) test: fix failing ecosystem test for `eslint-plugin-unicorn` ([#&#8203;21191](https://github.com/eslint/eslint/issues/21191)) (Lazizbek Ergashev) - [`5611035`](https://github.com/eslint/eslint/commit/56110356652dd614b3cf0933538abb551fc6bd6f) test: add error locations info to `no-void` ([#&#8203;21185](https://github.com/eslint/eslint/issues/21185)) (Lee Daeun) - [`ee47333`](https://github.com/eslint/eslint/commit/ee47333aa681cfc3cb54df08c38f211ea219cc2a) ci: bump github/codeql-action from 4 to 4.37.3 ([#&#8203;21176](https://github.com/eslint/eslint/issues/21176)) (dependabot\[bot]) - [`f131c03`](https://github.com/eslint/eslint/commit/f131c034ad91bbf06bcbb6b5e931447a8e419a46) chore: improve ecosystem test failure reporting ([#&#8203;20937](https://github.com/eslint/eslint/issues/20937)) (crimsonjay0) - [`1f6edde`](https://github.com/eslint/eslint/commit/1f6eddee609b369b50993eab08d437dda4700991) chore: update ecosystem plugins ([#&#8203;21182](https://github.com/eslint/eslint/issues/21182)) (ESLint Bot) - [`d3266fb`](https://github.com/eslint/eslint/commit/d3266fb26c719c6b90a6cbe54bb120c9335ad19c) chore: unpin `webpack` dependency ([#&#8203;21172](https://github.com/eslint/eslint/issues/21172)) (Francesco Trotta) - [`65a6519`](https://github.com/eslint/eslint/commit/65a6519cc8733b4688558a8611397cf9d01dd55d) chore: add allowScripts field to package.json ([#&#8203;21092](https://github.com/eslint/eslint/issues/21092)) (GiHoon Noh) - [`22e5256`](https://github.com/eslint/eslint/commit/22e52568536e0009d4493dc888736bc163220c4b) ci: add `triage:no` label to Dependabot PRs ([#&#8203;21141](https://github.com/eslint/eslint/issues/21141)) (lumir) - [`55c9038`](https://github.com/eslint/eslint/commit/55c9038836c91b6bd5617f0c97bea2274c9cc0bf) ci: bump actions/labeler from 6 to 7 ([#&#8203;21159](https://github.com/eslint/eslint/issues/21159)) (dependabot\[bot]) - [`7280e78`](https://github.com/eslint/eslint/commit/7280e78183d4711a49916b6a49ba5efaa651a991) chore: update dependency prettier to v3.9.6 ([#&#8203;21162](https://github.com/eslint/eslint/issues/21162)) (renovate\[bot]) - [`eddbad6`](https://github.com/eslint/eslint/commit/eddbad60158d8cda86830fbe934a9d2282273b32) test: fix failing ecosystem test for `eslint-plugin-unicorn` ([#&#8203;21156](https://github.com/eslint/eslint/issues/21156)) (Francesco Trotta) - [`60a178d`](https://github.com/eslint/eslint/commit/60a178d5ef1b0c471be0831031ed7347f8f81dc2) chore: update ecosystem plugins ([#&#8203;21150](https://github.com/eslint/eslint/issues/21150)) (ESLint Bot) - [`f9f61dc`](https://github.com/eslint/eslint/commit/f9f61dc6112836f46a58a410c38b8c2faf10973f) test: add error locations to `no-unreachable` ([#&#8203;21151](https://github.com/eslint/eslint/issues/21151)) (JIYEON) - [`d086293`](https://github.com/eslint/eslint/commit/d08629382b0a6aaa042823b796e5100e60053b54) test: add error locations to `no-undef` ([#&#8203;21147](https://github.com/eslint/eslint/issues/21147)) (JIYEON) - [`cc01b67`](https://github.com/eslint/eslint/commit/cc01b67061bbf558aa25746883ea1cad847f7cf2) test: add error locations to `no-useless-catch` ([#&#8203;21144](https://github.com/eslint/eslint/issues/21144)) (devoil) - [`688e75e`](https://github.com/eslint/eslint/commit/688e75ede01b295d51f2f86c9d82da020a4c887e) chore: add missing backticks in JSDoc ([#&#8203;21143](https://github.com/eslint/eslint/issues/21143)) (Bo Hyun Kim) - [`7c1e175`](https://github.com/eslint/eslint/commit/7c1e17543ad396f50f65b003cf9142d43d3c63b0) test: add error locations to `require-await` ([#&#8203;21145](https://github.com/eslint/eslint/issues/21145)) (Grit) - [`588a26d`](https://github.com/eslint/eslint/commit/588a26ddce3c5a20f5b3f3d51ba1353cce7b4b0c) test: add error locations to `no-extra-label` ([#&#8203;21139](https://github.com/eslint/eslint/issues/21139)) (dongkyu lee) - [`059aa89`](https://github.com/eslint/eslint/commit/059aa895743639e3ab53d14f9d944ff4be042233) test: add error locations to `no-useless-concat` ([#&#8203;21140](https://github.com/eslint/eslint/issues/21140)) (dongkyu lee) - [`5a452a8`](https://github.com/eslint/eslint/commit/5a452a8ba53917d65c9d83c3959ed35c2f890613) test: add error locations to `no-const-assign` ([#&#8203;21138](https://github.com/eslint/eslint/issues/21138)) (dongkyu lee) </details> <details> <summary>pnpm/pnpm (npm:pnpm)</summary> ### [`v11.21.0`](https://github.com/pnpm/pnpm/releases/tag/v11.21.0): pnpm 11.21 [Compare Source](https://github.com/pnpm/pnpm/compare/v11.20.0...v11.21.0) ##### Minor Changes - Added interactive group selection to `pnpm update --global --interactive`. - Running `pnpm setup`, `pnpm self-update`, or a command that modifies the global installation (such as `pnpm add --global`) through `sudo` now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with `ERR_PNPM_SUDO_NOT_SUPPORTED` in pnpm v12. Read-only global commands (such as `pnpm bin --global`) are unaffected. ##### Patch Changes - Fixed pnpm failing to start under asynchronous Node.js module loaders when no `.pnpmfile.mjs` exists [pnpm/pnpm#11701](https://github.com/pnpm/pnpm/issues/11701). - Fixed `minimumReleaseAge` fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target. - Removing a dependency from `package.json` and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from `pnpm-lock.yaml`, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune. - Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in `pnpm-lock.yaml` directly, reusing the same check the `pnpm.overrides` fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions. - Fixed a CI regression where `github:owner/repo` dependencies (and other shorthand Git specifiers) would fail to install with `Permission denied (publickey)` on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. `git+ssh://` or `git@host:...`): - The repository visibility probe (an HTTP HEAD request) now retries transient failures such as `429 Too Many Requests`, so host throttling of CI runners is no longer mistaken for a private repository. - For non-SSH specifiers, anonymous HTTPS `git ls-remote` access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured. - When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL. - A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. `codeload.github.com`, which would fail to download for a private repository); it stays a regular `git` resolution so installs can use ambient Git credentials such as credential helpers and tokens. Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL. Fixes [pnpm/pnpm#13276](https://github.com/pnpm/pnpm/issues/13276). <!-- cspell:ignore publickey --> - `ng build` and `nuxt build` now work under the global virtual store: pnpm's built-in compatibility extensions add the `tslib` dependency that `@angular/build` uses without declaring and the `unplugin` dependency that `@nuxt/vite-builder` v4 uses without declaring. - Fixed `link:` dependencies under `enableGlobalVirtualStore` so linked children are materialized and slots remain isolated by their resolved link targets. - An install that skips resolution because `pnpm-lock.yaml` is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and `pendingBuilds` entries for removed packages are dropped instead of staying pending forever. - The held-back-update warning printed by `pnpm update` no longer fires when `minimumReleaseAge` is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See [#&#8203;13071](https://github.com/pnpm/pnpm/issues/13071). - Checking whether `ignoredOptionalDependencies` is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an `!` exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored. - Changing `autoInstallPeers`, `dedupePeers`, `peersSuffixMaxLength`, `excludeLinksFromLockfile`, or `injectWorkspacePackages` no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in `pnpm-lock.yaml` and the install proceeds from the existing resolution. Every other case still falls back to a full resolution. - Adding, editing, or removing an entry in `patchedDependencies` no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in `pnpm-lock.yaml` and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while `allowUnusedPatches` is off, so `ERR_PNPM_UNUSED_PATCH` is still reported. - Resolving a private git repository no longer blocks on an interactive credential prompt: `git ls-remote` now fails fast with an authentication error when git has no credentials for the repository [#&#8203;13522](https://github.com/pnpm/pnpm/issues/13522). - Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same `ERR_PNPM_NO_OFFLINE_META` condition used by offline resolution. - POSIX shell shims now follow symbolic links before computing `basedir`, preventing execution failures when a shim is invoked via an external symlink on `PATH` [#&#8203;13405](https://github.com/pnpm/pnpm/issues/13405). - The automatic `packageManager` version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command [#&#8203;13619](https://github.com/pnpm/pnpm/issues/13619). - Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip `dist.signatures`) no longer break the automatic `packageManager` version switch and `pnpm self-update` [#&#8203;13147](https://github.com/pnpm/pnpm/issues/13147). When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from `registry.npmjs.org` and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a `shasum`), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch. - `pnpm fetch`, and any install run with `virtualStoreOnly`, no longer writes a `.pnp.cjs` loader under `nodeLinker: pnp`. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and `node_modules/.package-map.json` were already skipped; the PnP loader now follows the same rule. - Prevent pnpm from removing project files when `modulesDir` resolves to the project root. - Speed up installs after adding `ignoredOptionalDependencies` patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again. - When a failed install re-copies a bin script from the store, rerunning `pnpm install` now reapplies the executable bit to the bin instead of leaving it non-executable [#&#8203;12742](https://github.com/pnpm/pnpm/issues/12742). - `pnpm root -g` and `pnpm bin -g` now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with `--global` in a project that pins a package manager (e.g. via the `packageManager` field) printed a warning like `[WARN] Using --global skips the package manager check for this project` ahead of the path, breaking programs that capture the output as a path [#&#8203;13672](https://github.com/pnpm/pnpm/issues/13672). In pnpm 12, `pnpm root -g` and `pnpm prefix -g` are now supported (they previously failed with `ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED` / `ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED`), and the reporter output of `dlx`, `create`, `config`, `sbom`, `with`, `store`, `prefix`, `root`, and `bin` goes to stderr, matching pnpm 11. - `pnpm setup` no longer makes Node.js print a `MODULE_TYPELESS_PACKAGE_JSON` warning about `dist/worker.js` on every command. The `package.json` it writes next to a standalone executable now declares `"type": "module"`. - `pnpm update` without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or `--latest` resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next `pnpm install --frozen-lockfile` rejected with `ERR_PNPM_OUTDATED_LOCKFILE` [#&#8203;12764](https://github.com/pnpm/pnpm/issues/12764). - `pnpm version -r --json` now outputs `[]` instead of human-readable text when no pending changes exist [`pnpm/pnpm#13217`](https://github.com/pnpm/pnpm/issues/13217). <!-- sponsors --> ##### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> ##### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> </details> <details> <summary>sveltejs/language-tools (svelte-check)</summary> ### [`v4.7.5`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.5) [Compare Source](https://github.com/sveltejs/language-tools/compare/svelte-check@4.7.4...svelte-check@4.7.5) ##### Patch Changes - fix: prevent silent error during start-up caused by unhandled promise ([#&#8203;3096](https://github.com/sveltejs/language-tools/pull/3096)) - Updated dependencies \[[`1df53d8`](https://github.com/sveltejs/language-tools/commit/1df53d83049135e5789daf68416334a6f1b6b2c8)]: - [@&#8203;sveltejs/load-config](https://github.com/sveltejs/load-config)@&#8203;0.2.2 </details> <details> <summary>typescript-eslint/typescript-eslint (typescript-eslint)</summary> ### [`v8.67.0`](https://github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/typescript-eslint/CHANGELOG.md#8670-2026-08-10) [Compare Source](https://github.com/typescript-eslint/typescript-eslint/compare/v8.66.0...v8.67.0) ##### 🚀 Features - **typescript-eslint:** export basic globs for using tseslint ([#&#8203;12105](https://github.com/typescript-eslint/typescript-eslint/pull/12105)) ##### ❤️ Thank You - Claude Sonnet 5 - Evyatar Daud [@&#8203;StyleShit](https://github.com/StyleShit) - Josh Goldberg - Josh Goldberg ✨ - Kirk Waiblinger [@&#8203;kirkwaiblinger](https://github.com/kirkwaiblinger) See [GitHub Releases](https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.67.0) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - "after 11pm every weekday,before 5am every weekday,every weekend" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](undefined) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzQuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIzNC4wIiwidGFyZ2V0QnJhbmNoIjoiZGV2IiwibGFiZWxzIjpbXX0=-->
Update Non-major updates
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Details
CI / test (pull_request) Failing after 3s
Details
CI / build (pull_request) Has been skipped
Details
CI / deploy-dev (pull_request) Has been skipped
Details
CI / deploy-prod (pull_request) Has been skipped
Details
512ae8fb84
renovate-bot scheduled this pull request to auto merge when all checks succeed 2026-08-17 19:02:06 +02:00
renovate-bot force-pushed renovate/non-major-updates from 512ae8fb84
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Details
CI / test (pull_request) Failing after 3s
Details
CI / build (pull_request) Has been skipped
Details
CI / deploy-dev (pull_request) Has been skipped
Details
CI / deploy-prod (pull_request) Has been skipped
Details
to a1546af844
Some checks failed
CI / test (pull_request) Failing after 4s
Details
CI / build (pull_request) Has been skipped
Details
CI / deploy-dev (pull_request) Has been skipped
Details
CI / deploy-prod (pull_request) Has been skipped
Details
renovate/stability-days Updates have met minimum release age requirement
Details
2026-08-17 21:01:18 +02:00 Compare
renovate-bot deleted branch renovate/non-major-updates 2026-08-17 21:01:23 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Priority
Critical
 The priority is critical

  
Priority
High
 The priority is high

  
Priority
Low
 The priority is low

  
Priority
Medium
 The priority is medium

  
Reviewed
Confirmed
 Issue has been confirmed

  
Reviewed
Duplicate
 This issue or pull request already exists

  
Reviewed
Invalid
 Invalid issue

  
Reviewed
Won't Fix
 This issue won't be fixed

  
Status
Abandoned
 Somebody has started to work on this but abandoned work

  
Status
Blocked
 Something is blocking this issue or pull request

  
Status
Need More Info
 Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
IC3P3/hcss-website!69
No description provided.