Skip to content

deps(node): bump the js-dev-dependencies group across 1 directory with 6 updates - #23

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/bindings/nodejs/js-dev-dependencies-4530a4a261
Open

deps(node): bump the js-dev-dependencies group across 1 directory with 6 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/bindings/nodejs/js-dev-dependencies-4530a4a261

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown

Bumps the js-dev-dependencies group with 6 updates in the /src/bindings/nodejs directory:

Package From To
@napi-rs/cli 3.8.2 3.9.0
@rspack/core 2.1.7 2.2.2
astro 7.1.6 7.3.1
esbuild 0.25.12 0.28.2
rollup 4.62.4 4.63.1
webpack 5.109.2 5.110.3

Updates @napi-rs/cli from 3.8.2 to 3.9.0

Commits
  • f4cbe8d chore(release): publish
  • 9c23c8c chore(deps): update dependency oxc-parser to ^0.148.0 (#3475)
  • a472725 chore(napi): keep anyhow error cause when converting (#3477)
  • 2d40a52 feat(cli): add explicit build module format (#3463)
  • 56c1cce perf(napi): outline threadsafe callback dispatch (#3465)
  • 57826b9 perf(napi): outline class instance construction (#3464)
  • a80018e fix(napi): catch panics in closure trampolines instead of aborting (#3473)
  • cfc2a9c perf(sys): deduplicate dynamic symbol loading (#3466)
  • 9b24b06 chore(deps): update cross-platform-actions/action action to v1.5.0 (#3471)
  • b494acc fix(deps): update rust crate convert_case to 0.12 (#3469)
  • Additional commits viewable in compare view

Updates @rspack/core from 2.1.7 to 2.2.2

Release notes

Sourced from @​rspack/core's releases.

v2.2.2

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

Refactor 🔨

Document 📖

Other Changes

... (truncated)

Commits
  • b4dd1a0 chore(release): release 2.2.2
  • 2a15028 fix: downgrade eval source maps for modern-module (#15404)
  • 2856c50 feat(javascript): add JavascriptModulesPlugin.getChunkFilenameTemplate (#15280)
  • dea4103 fix(types): support all EnvironmentPlugin default values (#15382)
  • a338733 fix(core): align module need_build and FileSystemInfo with webpack (#15374)
  • 0546033 refactor(loader): reuse filesystem snapshots for cache dependencies (#15366)
  • 0634efc feat(cache): add intrastructure logging to the new cache (#15338)
  • e8ecb52 chore(release):2.2.1 (#15359)
  • 22dda99 fix(rsc): store server compiler ID in native coordinator (#15307)
  • 99a1394 fix(ids): correct compact hashed API names (#15356)
  • Additional commits viewable in compare view

Updates astro from 7.1.6 to 7.3.1

Release notes

Sourced from astro's releases.

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.1

Patch Changes

7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize "${transform.src}". Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

... (truncated)

Commits

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

  • Allow import path specifiers starting with #/ (#4361)

    Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

    This change was contributed by @​hybrist.

  • Automatically add the -webkit-mask prefix (#4357, #4358)

    This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

    /* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}

    This change was contributed by @​BPJEnnova.

  • Additional minification of switch statements (#4176, #4359)

    This release contains additional minification patterns for reducing switch statements. Here is an example:

    // Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.


Updates rollup from 4.62.4 to 4.63.1

Release notes

Sourced from rollup's releases.

v4.63.1

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

v4.63.0

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

v4.62.5

4.62.5

2026-08-20

Bug Fixes

  • Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

4.62.5

2026-08-20

Bug Fixes

  • Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

Commits

Updates webpack from 5.109.2 to 5.110.3

Release notes

Sourced from webpack's releases.

v5.110.3

Patch Changes

v5.110.2

Patch Changes

v5.110.1

Patch Changes

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.3

Patch Changes

5.110.2

Patch Changes

5.110.1

Patch Changes

... (truncated)

Commits
  • a2d7b9c chore(release): new release (#21868)
  • d6e86c0 test(test262): assert two more errors webpack reports at build time (#21906)
  • 6a963fe fix: keep require() into a concatenation substituted and unmangled (#21905)
  • e1eb099 fix: concatenated require() in require.ensure callback or computed reques...
  • 8d1ab53 chore: escape literal NUL bytes in Compilation.js (#21904)
  • 5e6c4d7 fix(defer): evaluate async dependencies where the deferred import sits (#21902)
  • 7ea4fa3 fix: handle audited correctness edge cases (#21901)
  • c50713c fix: keep code generation data per result instead of per NormalModule (#21900)
  • ebd3be4 docs: document the post-minor stabilization week and out-of-band releases (#2...
  • 80be700 fix(config): keep the resolved optimization.minimize a boolean (#21886)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(node): bump the js-dev-dependencies group across 1 directory wit…
39c1b80 
…h 6 updates

Bumps the js-dev-dependencies group with 6 updates in the /src/bindings/nodejs directory:

| Package | From | To |
| --- | --- | --- |
| [@napi-rs/cli](https://github.com/napi-rs/napi-rs) | `3.8.2` | `3.9.0` |
| [@rspack/core](https://github.com/web-infra-dev/rspack/tree/HEAD/packages/rspack) | `2.1.7` | `2.2.2` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.6` | `7.3.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.25.12` | `0.28.2` |
| [rollup](https://github.com/rollup/rollup) | `4.62.4` | `4.63.1` |
| [webpack](https://github.com/webpack/webpack) | `5.109.2` | `5.110.3` |



Updates `@napi-rs/cli` from 3.8.2 to 3.9.0
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](https://github.com/napi-rs/napi-rs/compare/@napi-rs/cli@3.8.2...@napi-rs/cli@3.9.0)

Updates `@rspack/core` from 2.1.7 to 2.2.2
- [Release notes](https://github.com/web-infra-dev/rspack/releases)
- [Commits](https://github.com/web-infra-dev/rspack/commits/v2.2.2/packages/rspack)

Updates `astro` from 7.1.6 to 7.3.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.1/packages/astro)

Updates `esbuild` from 0.25.12 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.25.12...v0.28.2)

Updates `rollup` from 4.62.4 to 4.63.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.62.4...v4.63.1)

Updates `webpack` from 5.109.2 to 5.110.3
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.2...v5.110.3)

---
updated-dependencies:
- dependency-name: "@napi-rs/cli"
  dependency-version: 3.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: "@rspack/core"
  dependency-version: 2.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: astro
  dependency-version: 7.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: rollup
  dependency-version: 4.63.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: webpack
  dependency-version: 5.110.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
@dependabot
dependabot Bot requested a review from GriffinCanCode as a code owner September 7, 2026 13:37
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@GriffinCanCode GriffinCanCode Awaiting requested review from GriffinCanCode GriffinCanCode is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants