Skip to content

deps: bump the dev-tooling group across 1 directory with 28 updates - #19

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-tooling-c2dd77f91e
Closed

deps: bump the dev-tooling group across 1 directory with 28 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-tooling-c2dd77f91e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the dev-tooling group with 28 updates in the / directory:

Package From To
@biomejs/biome 1.9.4 2.6.4
tsx 4.22.4 4.23.15
typescript 5.9.3 7.0.2
zod 3.25.76 4.6.7
yaml 2.9.0 2.9.1
@types/node 24.13.2 26.6.6
@modelcontextprotocol/sdk 1.29.0 1.32.2
chokidar 4.0.3 6.0.0
esbuild 0.24.2 0.28.2
astro 6.4.8 7.4.4
@astrojs/check 0.9.9 0.9.12
ws 8.21.0 8.22.1
@types/ws 8.18.1 8.18.2
@types/ws 8.18.1 8.18.2
@codemirror/lang-markdown 6.5.0 6.5.2
@tiptap/extension-link 2.27.2 3.32.2
@tiptap/pm 2.27.2 3.32.2
@tiptap/react 2.27.2 3.32.2
@tiptap/starter-kit 2.27.2 3.32.2
@uiw/react-codemirror 4.25.10 4.25.12
markdown-it 14.2.0 15.0.3
react 18.3.1 19.3.1
@types/react 18.3.31 19.3.0
react-dom 18.3.1 19.3.1
@types/react-dom 18.3.7 19.3.0
react-router-dom 6.30.4 7.18.5
@types/markdown-it 14.1.2 14.2.0
@types/react 18.3.31 19.3.0
@types/react-dom 18.3.7 19.3.0
@vitejs/plugin-react 6.0.2 6.1.2
vite 8.0.16 8.3.5

Updates @biomejs/biome from 1.9.4 to 2.6.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.4

2.6.4

Patch Changes

  • #12261 19fbfb2 Thanks @​dyc3! - Added the new nursery rule noConsoleSpaces, which reports a leading or trailing space in a console.log(), console.debug(), console.info(), console.warn(), or console.error() argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.

    console.log("abc ", "def");

  • #12469 cd716d3 Thanks @​dyc3! - Added the new nursery rule noMagicArrayFlatDepth, which reports number literals other than 1 passed as the depth of Array.prototype.flat() unless a comment inside the parentheses explains them.

    const items = array.flat(2);

  • #12470 92c9e81 Thanks @​dyc3! - Added the nursery rule noNull, which reports uses of the null literal and suggests undefined instead. Strict comparisons such as foo === null are allowed.

    let foo = null;

  • #12483 9bd3527 Thanks @​dyc3! - Added the nursery rule noReturnArrayPush, which reports code that uses the return value of push() or unshift(). These methods return the new length of the array, not the added item or the array.

    function add(item) {
  return items.push(item);
}

  • #12477 a384892 Thanks @​dyc3! - Added the nursery rule noUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.

    const foo = (bar => (bar ? bar.baz : baz))(getBar());

  • #12447 0a963e4 Thanks @​dyc3! - Added the nursery rule noUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.

    function findRoot(node) {
    if (node.parent) {
        return findRoot(node.parent);
    }
    return node;
}

  • #12554 2eddda9 Thanks @​dyc3! - Added the nursery rule noVueComputedPropertiesInData, which reports computed properties used inside the data function of a Vue component. Vue runs data before it sets up computed properties, so the value read there is undefined.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

Biome changelog

This project follows Semantic Versioning. Due to the nature of Biome as a toolchain, it can be unclear what changes are considered major, minor, or patch. Read our guidelines to categorize a change.

New entries must be placed in a section entitled Unreleased. Read our guidelines for writing a good changelog entry.

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​biomejs/biome since your current version.


Updates tsx from 4.22.4 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

  • exclude bare builtins from namespace inheritance (38e1588)
  • expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
  • make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

  • restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

  • cache: bound shared transform cache memory (#835) (28e1f12)

This release is also available on:

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

... (truncated)

Commits
  • ca66105 test: fix drive-less file URLs in ESM resolver fixtures
  • 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
  • 38e1588 fix: exclude bare builtins from namespace inheritance
  • 562c434 fix: make namespaced register() overloads portable for declaration emit
  • edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
  • 70e7828 test: upgrade tinyspy for disposable API
  • 9ed2022 ci: avoid duplicate release notifications
  • 872e77f refactor: use disposables for cleanup
  • 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
  • 28e1f12 fix(cache): bound shared transform cache memory (#835)
  • Additional commits viewable in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates zod from 3.25.76 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.


Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

  • Limit recursive merge aliases (#685, #713)
  • Simplify line unfolding during quoted string parsing (#714)
Commits

Updates @types/node from 24.13.2 to 26.6.6

Commits

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.32.2

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

... (truncated)

Commits
  • 3b73021 chore: bump version to 1.32.2 (#3089)
  • fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
  • 6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates chokidar from 4.0.3 to 6.0.0

Release notes

Sourced from chokidar's releases.

6.0.0

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

Misc

... (truncated)

Changelog

Sourced from chokidar's changelog.

6.0.0 (2026-10-19)

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chokidar since your current version.


Updates esbuild from 0.24.2 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 31, 2026
@dependabot dependabot Bot changed the title deps: bump the dev-tooling group with 28 updates deps: bump the dev-tooling group across 1 directory with 28 updates Nov 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-tooling-c2dd77f91e branch from a56e97f to ea97c82 Compare November 3, 2026 16:59
@vercel

vercel Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
agentry Ready Ready Preview Nov 3, 2026 6:23pm UTC

@dependabot
deps: bump the dev-tooling group across 1 directory with 28 updates
b02b792 
Bumps the dev-tooling group with 28 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `1.9.4` | `2.6.4` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.15` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |
| [zod](https://github.com/colinhacks/zod) | `3.25.76` | `4.6.7` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.13.2` | `26.6.6` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.32.2` |
| [chokidar](https://github.com/paulmillr/chokidar) | `4.0.3` | `6.0.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.24.2` | `0.28.2` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.4.8` | `7.4.4` |
| [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.12` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.22.1` |
| [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` |
| [@types/ws](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ws) | `8.18.1` | `8.18.2` |
| [@codemirror/lang-markdown](https://github.com/codemirror/lang-markdown) | `6.5.0` | `6.5.2` |
| [@tiptap/extension-link](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/extension-link) | `2.27.2` | `3.32.2` |
| [@tiptap/pm](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/pm) | `2.27.2` | `3.32.2` |
| [@tiptap/react](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/react) | `2.27.2` | `3.32.2` |
| [@tiptap/starter-kit](https://github.com/ueberdosis/tiptap/tree/HEAD/packages/starter-kit) | `2.27.2` | `3.32.2` |
| [@uiw/react-codemirror](https://github.com/uiwjs/react-codemirror) | `4.25.10` | `4.25.12` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.2.0` | `15.0.3` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `18.3.1` | `19.3.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `18.3.31` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `18.3.1` | `19.3.1` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `18.3.7` | `19.3.0` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `6.30.4` | `7.18.5` |
| [@types/markdown-it](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/markdown-it) | `14.1.2` | `14.2.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `18.3.31` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `18.3.7` | `19.3.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.2` | `6.1.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.16` | `8.3.5` |



Updates `@biomejs/biome` from 1.9.4 to 2.6.4
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.4/packages/@biomejs/biome)

Updates `tsx` from 4.22.4 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.4...v4.23.15)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v7.0.2)

Updates `zod` from 3.25.76 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v3.25.76...v4.6.7)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

Updates `@types/node` from 24.13.2 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.32.2
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.32.2)

Updates `chokidar` from 4.0.3 to 6.0.0
- [Release notes](https://github.com/paulmillr/chokidar/releases)
- [Changelog](https://github.com/paulmillr/chokidar/blob/main/CHANGELOG.md)
- [Commits](paulmillr/chokidar@4.0.3...6.0.0)

Updates `esbuild` from 0.24.2 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.24.2...v0.28.2)

Updates `astro` from 6.4.8 to 7.4.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.4/packages/astro)

Updates `@astrojs/check` from 0.9.9 to 0.9.12
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.12/packages/language-tools/astro-check)

Updates `ws` from 8.21.0 to 8.22.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.0...8.22.1)

Updates `@types/ws` from 8.18.1 to 8.18.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws)

Updates `@types/ws` from 8.18.1 to 8.18.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ws)

Updates `@codemirror/lang-markdown` from 6.5.0 to 6.5.2
- [Changelog](https://github.com/codemirror/lang-markdown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/lang-markdown/commits)

Updates `@tiptap/extension-link` from 2.27.2 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/extension-link)

Updates `@tiptap/pm` from 2.27.2 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/pm)

Updates `@tiptap/react` from 2.27.2 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/react)

Updates `@tiptap/starter-kit` from 2.27.2 to 3.32.2
- [Release notes](https://github.com/ueberdosis/tiptap/releases)
- [Changelog](https://github.com/ueberdosis/tiptap/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ueberdosis/tiptap/commits/HEAD/packages/starter-kit)

Updates `@uiw/react-codemirror` from 4.25.10 to 4.25.12
- [Release notes](https://github.com/uiwjs/react-codemirror/releases)
- [Commits](uiwjs/react-codemirror@v4.25.10...v4.25.12)

Updates `markdown-it` from 14.2.0 to 15.0.3
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.2.0...15.0.3)

Updates `react` from 18.3.1 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `@types/react` from 18.3.31 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 18.3.1 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@types/react-dom` from 18.3.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-router-dom` from 6.30.4 to 7.18.5
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.5/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.5/packages/react-router-dom)

Updates `@types/markdown-it` from 14.1.2 to 14.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/markdown-it)

Updates `@types/react` from 18.3.31 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 18.3.7 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.2 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `vite` from 8.0.16 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

---
updated-dependencies:
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@codemirror/lang-markdown"
  dependency-version: 6.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: "@tiptap/extension-link"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@tiptap/pm"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@tiptap/react"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@tiptap/starter-kit"
  dependency-version: 3.32.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/markdown-it"
  dependency-version: 14.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: "@types/ws"
  dependency-version: 8.18.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@types/ws"
  dependency-version: 8.18.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@uiw/react-codemirror"
  dependency-version: 4.25.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: astro
  dependency-version: 7.4.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: chokidar
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: markdown-it
  dependency-version: 15.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: react-router-dom
  dependency-version: 7.18.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dev-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-tooling-c2dd77f91e branch from ea97c82 to b02b792 Compare November 3, 2026 18:23
@dependabot @github

dependabot Bot commented on behalf of github Nov 3, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 3, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-tooling-c2dd77f91e branch November 3, 2026 18:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants