fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@node-rs/bcrypt	^1.10.7 → ^1.10.8			dependencies	patch
@shikijs/vitepress-twoslash (source)	^4.4.1 → ^4.4.3			devDependencies	patch
@sveltejs/vite-plugin-svelte (source)	^7.2.0 → ^7.3.0			devDependencies	minor
@vercel/detect-agent (source)	^1.2.3 → ^1.2.5			devDependencies	patch
@vitejs/devtools (source)	^0.4.10 → ^0.4.12			devDependencies	patch
@vitejs/release-scripts	^1.8.0 → ^1.9.1			devDependencies	minor
@vue/shared (source)	^3.5.40 → ^3.5.41			dependencies	patch
baseline-browser-mapping	^2.11.10 → ^2.11.14			devDependencies	patch
browserslist	^4.28.7 → ^4.28.8			dependencies	patch
core-js (source)	^3.49.0 → ^3.50.0			dependencies	minor
esbuild	^0.28.1 → ^0.28.2			devDependencies	patch
eslint (source)	10.8.0 → 10.8.1				patch
eslint-plugin-n	^18.2.2 → ^18.3.0			devDependencies	minor
eslint-plugin-react-refresh	0.5.3 → 0.5.4				patch
eslint-plugin-regexp	^3.1.1 → ^3.2.0			devDependencies	minor
github/codeql-action	v4.37.4 → v4.37.7			action	patch
globals	17.8.0 → 17.11.0				minor
globals	^17.8.0 → ^17.11.0			devDependencies	minor
less (source)	^4.8.1 → ^4.9.0			devDependencies	minor
magic-string	^1.1.0 → ^1.2.0			dependencies	minor
magic-string	^1.1.0 → ^1.2.0			devDependencies	minor
oxfmt (source)	^0.61.0 → ^0.63.0			devDependencies	minor
oxlint (source)	^1.76.0 → ^1.78.0			devDependencies	minor
phoenix	^1.8.9 → ^1.8.11			dependencies	patch
pnpm/action-setup	v6.0.9 → v6.0.10			action	patch
postcss (source)	^8.5.25 → ^8.5.26			dependencies	patch
postcss-import	^16.1.1 → ^16.2.0			devDependencies	minor
sass-embedded	^1.100.0 → ^1.102.0			devDependencies	minor
semgrep/semgrep	1.172.0 → 1.173.0			container	minor
svelte (source)	^5.56.8 → ^5.56.9			devDependencies	patch
svelte-check	^4.7.4 → ^4.7.6			devDependencies	patch
terser (source)	^5.49.0 → ^5.50.0			devDependencies	minor
tsx (source)	^4.23.1 → ^4.23.12			devDependencies	patch
typescript-eslint (source)	8.65.0 → 8.67.0				minor
typescript-eslint (source)	^8.65.0 → ^8.67.0			devDependencies	minor
vite (source)	^8.2.0 → ^8.2.1			devDependencies	patch
vitepress-plugin-llms	^1.13.4 → ^1.13.5			devDependencies	patch
vue (source)	^3.5.40 → ^3.5.41			dependencies	patch
vue (source)	^3.5.40 → ^3.5.41			devDependencies	patch
vue-tsc (source)	^3.3.9 → ^3.3.10			devDependencies	patch
ws	^8.21.1 → ^8.21.3			devDependencies	patch

---

Release Notes

napi-rs/node-rs (@​node-rs/bcrypt)

v1.10.8

Compare Source

shikijs/shiki (@​shikijs/vitepress-twoslash)

v4.4.3

Compare Source

   🚀 Features

• Update deps and grammar  -  by @​antfu (72f26)

   🐞 Bug Fixes

• vitepress-twoslash: Delay twoslash tooltip show by 200ms  -  by @​antfubot in #​1306 (9f2aa)

    View changes on GitHub

v4.4.2

Compare Source

   🐞 Bug Fixes

• Unbreak CI after vite 8 bump and grammar/deps updates  -  by @​antfubot in #​1300 (c5d31)

   🏎 Performance

• core: Token split performance improvements  -  by @​amadeus in #​1301 (41896)

    View changes on GitHub

sveltejs/vite-plugin-svelte (@​sveltejs/vite-plugin-svelte)

v7.3.0

Compare Source

Minor Changes

• feat: pass environment to dynamicCompileOptions (#​1386)

Patch Changes

• fix: don't log inline config when encountering unexpected options (#​1376)

vitejs/devtools (@​vitejs/devtools)

v0.4.12

Compare Source

   🚀 Features

• Add Auto/Light/Dark color mode switcher to settings  -  by @​antfubot and @​antfu in #​510 (6c992)
• Always-fresh production tarballs + Nuxt DevTools production playground  -  by @​antfubot in #​511 (afca0)
• core:
  • Render group dock accentColor on group button and popover  -  by @​antfubot in #​509 (a2d20)
  • Select and Link components for json-render  -  by @​dvcolomban in #​508 (c2158)

    View changes on GitHub

v0.4.11

Compare Source

   🚀 Features

• core:
  • Tabs component for json-render, with real per-component prop types  -  by @​dvcolomban in #​492 (0d8ee)
  • Info/success/warning/danger variants on json-render Card & Stack  -  by @​dvcolomban in #​491 (0c871)

   🐞 Bug Fixes

• Keep plugin flow timeline visible when the calls table overflows  -  by @​SaKaNa-Y in #​504 (e6b4f)
• Keep plugin flow timeline vertically scrollable  -  by @​SaKaNa-Y in #​505 (37b67)
• core:
  • Forward loading to json-render Button's underlying BaseButton  -  by @​dvcolomban in #​497 (75483)
  • Card's collapse toggle now respects defaultCollapsed, and works without a title  -  by @​dvcolomban in #​490 (6ccc1)
  • Hide dock mode commands in popup mode  -  by @​SaKaNa-Y in #​502 (ff579)
  • Rebind frame-nav adapter when iframe realm changes  -  by @​SaKaNa-Y in #​503 (3d23c)

    View changes on GitHub

vitejs/release-scripts (@​vitejs/release-scripts)

v1.9.1

Compare Source

v1.9.0

Compare Source

vuejs/core (@​vue/shared)

v3.5.41

Compare Source

Bug Fixes

• compiler-core: preserve vnode lifecycle in stable v-for (#​11682) (02421cd), closes #​9239 #​12569
• compiler-sfc: handle transformed template AST after cache invalidation (#​15136) (a4440c0), closes #​15126 #​15128
• custom-element: preserve nested async mount order (#​15154) (71f9ff5), closes #​15153
• custom-element: warn when props override native properties (#​12125) (22b53ea), closes #​12124
• runtime-core: avoid re-fetching resource props with unchanged values (#​15105) (a7513a1)
• runtime-core: restore SSR setup state when handling async setup result (#​15114) (b6191cb), closes #​15113
• scheduler: avoid stack overflow when flushing very large post cb arrays (#​15143) (c04a45d), closes #​15142
• slots: handle nullish v-bind slot props (#​15177) (2506700)
• ssr: normalize hidden states during hydration (#​13125) (4e467d7)
• transition: support transition to teleport component child (#​11959) (77061fe), closes #​11910
• types: preserve defineModel inference with factory defaults (#​15097) (0516c43), closes #​15096
• v-model: preserve text input before hydration (#​14411) (2468464), closes #​14403

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.11.14

Compare Source

v2.11.13

Compare Source

v2.11.12

Compare Source

v2.11.11

Compare Source

browserslist/browserslist (browserslist)

v4.28.8

Compare Source

• Fixed including kaios in baseline queries (by @​Jaybhade).

zloirock/core-js (core-js)

v3.50.0

Compare Source

• Changes v3.49.0...v3.50.0 (138 commits)
• Joint iteration proposal:
  • Built-ins:
    • Iterator.zip
    • Iterator.zipKeyed
  • Moved to stable ES, May 2026 TC39 meeting
  • Added es. namespace modules, /es/ and /stable/ namespace entries
• Iterator chunking proposal:
  • Built-ins:
    • Iterator.prototype.chunks
    • Iterator.prototype.windows
  • Throw a TypeError instead of RangeError on non-integer number chunkSize / windowSize, following tc39/proposal-iterator-chunking/#​30
  • Moved to stage 3, May 2026 TC39 meeting
  • Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
• Added Iterator includes stage 3 proposal:
  • Added built-in:
    • Iterator.prototype.includes
• Added Iterator join stage 3 proposal:
  • Added built-in:
    • Iterator.prototype.join
• Added Await dictionary of Promises stage 3 proposal:
  • Added built-ins:
    • Promise.allKeyed
    • Promise.allSettledKeyed
• Throw a RangeError on finite unsafe integer limit in Iterator.prototype.{ drop, take }, following tc39/ecma262/#​3776
• Use PromiseResolve semantics in Promise.try, following tc39/ecma262/#​3883
• Added detection of missed Webkit ~ Safari < 26.2 Iterator.prototype.flatMap bug case, #​1538
• Deno 2.9+ replaces Object.prototype.__proto__ instead of removing it, so the feature detection updated
• Fixed JSON.stringify polyfill with an array replacer - keys order now follows the replacer, inherited and non-enumerable properties are no longer ignored, #​1539
• Make URL / URLSearchParams parsing a little more correct (char sets, percent coding, etc)
• Ensure opaque paths always roundtrip in URL polyfill (still without adding to feature detection), whatwg/url#844
• Fix URL#toJSON when URL#toString is reassigned after core-js is imported
• Fixed possible crash on some keys in Symbol.for
• Some get-iterator / get-iterator-method fixes
• Fixed String.prototype.{ match, search } polyfills conversion order
• Added missed MAX_SAFE_INTEGER excess check in Array.from and { Map, Object }.groupBy polyfills
• Improved the way of inner iterators cleaning in iterator helpers
• Improved accuracy of Math.{ asinh, cbrt, log1p } polyfills with big and small values
• Improved performance of Uint8Array base64 methods
• Improved performance of escape
• Slight performance improvement for engines with native Array.prototype.fill on ArrayBuffer constructor and %TypedArray%.prototype.fill
• Clarify supported Node versions in package.json of some missed packages (just to satisfy publint)
• Compat data improvements:
  • Following tc39/ecma262/#​3776, Iterator.prototype.{ drop, take } properly supported from:
    • V8 ~ Chrome 150
    • Safari 27.0
    • Bun 1.4.0
  • Following tc39/ecma262/#​3883, Promise.try marked as not properly supported in all engines
  • Iterator.prototype.{ chunks, windows } marked as shipped in FF154
  • Iterator.prototype.includes marked as shipped in FF154
  • Iterator.prototype.includes marked as shipped in Bun 1.4.0
  • Iterator.prototype.join marked as shipped in FF154
  • Array.prototype.includes WebKit bug marked as fixed in:
    • Safari 27.0
    • Bun 1.3.12
  • queueMicrotask Bun bug marked as fixed in Bun 1.4.0
  • Added Node 26.0 compat data mapping
  • Added Deno 2.7.8, Deno 2.8.0, and Deno 2.9.4 compat data mapping
  • Updated Electron 42 and added 43, 44, and 45 compat data mapping
  • Added Samsung Browser 30 compat data mapping
  • Added Oculus Quest Browser 144+ compat data mapping
  • Added Opera for Android 97, 98, 99, and 100 compat data mapping

evanw/esbuild (esbuild)

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#​4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#​4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#​4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#​4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#​4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})
  }
  
  // Old output (with --minify-syntax --target=es6)
  function foo() {
    bar(void 0 || (x = {}));
  }
  
  // New output (with --minify-syntax --target=es6)
  function foo() {
    let x;
    bar(x || (x = {}));
  }

• Fix a potential deadlock when the JavaScript API is used incorrectly (#​4503, #​4506)

  The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

  Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

  This fix was submitted by @​ZuBB.

• Handle target collisions (#​4509)

  It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.

• Force .mp3 files to use the audio/mpeg MIME type (#​4485)

  MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

• Add a new TypeScript syntax warning

  TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

  ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]
  
      example.ts:1:28:
        1 │ console.log(1 + 2 as number * 3)
          ╵                             ^
  
    This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
    precedence in this case. Surround the inner expression in parentheses to silence this warning:
  
      example.ts:1:12:
        1 │ console.log(1 + 2 as number * 3)
          │             ~~~~~~~~~~~~~~~
          ╵             (             )

  See microsoft/TypeScript#63527 for more information.

• Add support for formatting errors for Visual Studio (#​4460)

  Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

  With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:

  $ esbuild example.ts --log-style=visualstudio
  /Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator
  

  This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.

• Fix a bug with CSS gamut mapping (#​4488)

  Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

  This fix was submitted by @​chatman-media.

eslint/eslint (eslint)

v10.8.1

Compare Source

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#​21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#​21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#​21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#​20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#​21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#​21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#​21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#​21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#​21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#​21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#​21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#​21151) (JIYEON)
• d086293 test: add error locations to no-undef (#​21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#​21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#​21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#​21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#​21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#​21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#​21138) (dongkyu lee)

eslint-community/eslint-plugin-n (eslint-plugin-n)

v18.3.0

Compare Source

🌟 Features

• add prefer-process-get-builtin-module rule (#​554) (8d9bd05)
• implement prefer-import/assert-strict rule (#​553) (d7afbed)

🩹 Fixes

• handle import.meta paths in no-path-concat (#​559) (a6b3ce2)
• no-unsupported-features: classify util.styleText as experimental (#​560) (b8e39c5)
• support brace expansion and extglobs in package files (#​558) (8cae1af)

📚 Documentation

• add eslint-plugin-node migration guide (#​561) (4138d4e)
• update outdated http links to https in docs/rules (#​562) (a6cd6a5)

🧹 Chores

• rename default export n (#​556) (d499fc1)

ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)

v0.5.4

Compare Source

• Add instant to allowExportNames in Next config #​112

ota-meshi/eslint-plugin-regexp (eslint-plugin-regexp)

v3.2.0

Compare Source

Minor Changes

• fix(deps): update dependency jsdoc-type-pratt-parser to v9 (#​1014)

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v4.37.5

Compare Source

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #​4061

sindresorhus/globals (globals)

v17.11.0

Compare Source

v17.10.0

Compare Source

v17.9.0

[Compare Source](https://redirect.git

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.