Skip to content

deps(node): bump the js-dev-dependencies group across 1 directory with 7 updates - #29

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/bindings/nodejs/js-dev-dependencies-320cbeb5b7
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/bindings/nodejs/js-dev-dependencies-320cbeb5b7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown

Bumps the js-dev-dependencies group with 7 updates in the /src/bindings/nodejs directory:

Package From To
@napi-rs/cli 3.8.2 3.9.1
@rspack/core 2.1.7 2.2.3
astro 7.1.6 7.3.2
esbuild 0.25.12 0.28.2
fast-check 4.9.0 4.10.0
rollup 4.62.4 4.63.1
webpack 5.109.2 5.110.3

Updates @napi-rs/cli from 3.8.2 to 3.9.1

Release notes

Sourced from @​napi-rs/cli's releases.

@​napi-rs/cli@​3.9.1

Patch over 3.9.0.

Fixes

  • WASI threads builds on current toolchains (#3492) wasm32-wasip1-threads was failing in two ways: wasi-sdk 34 changed the futex ABI, and Rust nightly started linking crt1-reactor.o itself (duplicate _initialize). The CLI now picks the matching emnapi archive; the build crate stops double-linking _initialize.

  • WASI on Android / Termux (#3485) Generated Node loaders preopened /, which Termux cannot open (UVWASI_EACCES). Android now preopens the current working directory. Other platforms are unchanged.

  • Generated files share one format (#3501) JSON / TOML / YAML, .d.ts, and JS / WASI loaders now use one house style (indent, trailing newline, quotes). Regenerating bindings may produce noisy diffs with no behavior change.

Deps

  • js-yaml 4 → 5 (#3344) — YAML dump formatting can change; loaded values should not.

Same-day packages

Package Version
@napi-rs/triples 2.1.23
@napi-rs/wasm-runtime 1.2.4
Commits
  • 7e3f293 chore(release): publish
  • f772ee0 fix(cli): align generated file formats (#3501)
  • 1cf5ec5 fix(cli): use accessible WASI preopen root on Android (#3485)
  • cf9245d chore(deps): update vitest monorepo to v5 (#3481)
  • 78fa3ad fix(macro): recognize fully-qualified napi::Env as the special Env parameter ...
  • 37283c7 chore(deps): lock file maintenance (#3474)
  • 1932d2f chore(deps): update release-plz/action action to v0.5.135 (#3500)
  • 0238e8b fix(deps): update dependency js-yaml to v5 (#3344)
  • 9ed9d35 chore(deps): update dependency electron to v44 (#3468)
  • 58fb862 chore(deps): upgrade oxlint, fix warnings (#3487)
  • Additional commits viewable in compare view

Updates @rspack/core from 2.1.7 to 2.2.3

Release notes

Sourced from @​rspack/core's releases.

v2.2.3

Highlights

CSS Import and Asset URL Externals

Rspack now supports asset, asset-url, and css-import external types, allowing CSS to reference stylesheets and assets hosted elsewhere. External @import statements preserve layer, supports, and media conditions, so conditional styles stay conditional in the emitted CSS. #15431, #15522.

More Flexible and Reliable Native Watching

With experiments.nativeWatcher enabled, watchOptions.ignored now accepts a function, making it easier to reuse existing ignore rules when switching to the native watcher. File event processing has also been improved to reduce event loss during large bursts of changes on Linux. #15254.

Lower Resolution Overhead for TypeScript Projects

Relative imports such as ./utils and ../shared no longer trigger unnecessary tsconfig loading or tracking of its project-reference tree. This reduces configuration reads and dependency tracking, especially in large TypeScript projects with many project references. #15492.

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

... (truncated)

Commits
  • 62bd14f Merge branch 'main' into chore/release-2026-09-08
  • a704ff0 fix: support Windows DOS device paths (#15507)
  • 256145a chore(release): release 2.2.3
  • 8e0da07 fix: preserve diagnostics returned by importModule (#15496)
  • f9abfc0 fix: prevent recursive module federation shared compilation (#15494)
  • 7bdd2bf feat(css): support CSS import and asset URL externals (#15431)
  • 9021d03 fix: revert afterOptimizeChunkIds and renderContent hooks (#15471)
  • 7b15edd feat(cache): port webpack persistent module cache (#15380)
  • 8e7ee31 fix(esm): remove empty chunks except for facade chunks (#15424)
  • 9e0ffd4 feat(watcher): support a function for the native watcher ignored option (#1...
  • Additional commits viewable in compare view

Updates astro from 7.1.6 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

  • #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

  • #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

  • #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

  • #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

  • Updated dependencies [a548223]:

    • @​astrojs/markdown-satteri@​0.4.1

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
    const service: LocalImageService = {
    // ...
    async transform(inputBuffer, transform, imageConfig, logger) {
    logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
    return { data: inputBuffer, format: 'png' };
    },
    };

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
    const provider: CacheProvider = {

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

  • #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

  • #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

  • #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

  • #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

  • Updated dependencies [a548223]:

    • @​astrojs/markdown-satteri@​0.4.1

7.3.1

Patch Changes

7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
    const service: LocalImageService = {
    // ...
    async transform(inputBuffer, transform, imageConfig, logger) {
    logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
    return { data: inputBuffer, format: 'png' };
    },
    };

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

... (truncated)

Commits

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
    import Alias = Base.SomeType;
  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
    .a .b {
      & .b:not(& .c) {
        color: red;
      }
    }
    /* Old output (with --minify) */
    .a .b{.b:not(& .c){color:red}}
    /* New output (with --minify) */
    .a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
    function foo() {
      let x
      bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

  • Allow import path specifiers starting with #/ (#4361)

    Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

    This change was contributed by @​hybrist.

  • Automatically add the -webkit-mask prefix (#4357, #4358)

    This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

    /* Original code */
    main {
      mask: url(x.png) center/5rem no-repeat
    }
    /* Old output (with --target=chrome110) */
    main {
    mask: url(x.png) center/5rem no-repeat;
    }
    /* New output (with --target=chrome110) */
    main {
    -webkit-mask: url(x.png) center/5rem no-repeat;
    mask: url(x.png) center/5rem no-repeat;
    }

    This change was contributed by @​BPJEnnova.

  • Additional minification of switch statements (#4176, #4359)

    This release contains additional minification patterns for reducing switch statements. Here is an example:

    // Original code
    switch (x) {
      case 0:
        foo()
        break
      case 1:
      default:
        bar()
    }

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.


Updates fast-check from 4.9.0 to 4.10.0

Release notes

Sourced from fast-check's releases.

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0
  • (PR#7226) Doc: Fix admonition titles on the website
  • (PR#7246) Doc: Add jkomyno as code contributor
  • (PR#7251) Performance: Single timer for interruptAfterTimeLimit

Changelog

Sourced from fast-check's changelog.

4.10.0

New plugin API and deprecations ahead of v5 [Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0
  • (PR#7226) Doc: Fix admonition titles on the website
  • (PR#7246) Doc: Add jkomyno as code contributor
  • (PR#7251) Performance: Single timer for interruptAfterTimeLimit

Commits
  • 4fba17d 🔖 Update CHANGELOG.md for fast-check@4.10.0, @​fast-check/jest@​2.3.0, @​fast-ch...
  • a433d8b ⬆️ Update dependency @​types/node to ^24.13.4 (#7263)
  • 8470c46 ⬆️ Update dependency @​microsoft/api-extractor to ^7.59.1 (#7255)
  • 5382221 🗑️ Deprecate v5 removals (#7261)
  • 3cc3696 🗑️ Deprecate parameters superseded by plugins (#7260)
  • a93374d ✨ Add the unbiased plugin to generate without bias (#7231)
  • 0f1bf99 ✨ Add ability to decorate generate via Plugins (#7259)
  • 917a447 ✨ Add plugins to drop runs on already covered cases (#7230)
  • 32daf74 ⚡️ Single timer for interruptAfterTimeLimit (#7251)
  • 485f337 👥 Add jkomyno as code contributor (#7246)
  • Additional commits viewable in compare view

Updates rollup from 4.62.4 to 4.63.1

Release notes

Sourced from rollup's releases.

v4.63.1

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

v4.63.0

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

v4.62.5

4.62.5

2026-08-20

Bug Fixes

  • Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

4.62.5

2026-08-20

Bug Fixes

  • Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

Commits

Updates webpack from 5.109.2 to 5.110.3

Release notes

Sourced from webpack's releases.

v5.110.3

Patch Changes

v5.110.2

Patch Changes

  • Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by

…h 7 updates

Bumps the js-dev-dependencies group with 7 updates in the /src/bindings/nodejs directory:

| Package | From | To |
| --- | --- | --- |
| [@napi-rs/cli](https://github.com/napi-rs/napi-rs) | `3.8.2` | `3.9.1` |
| [@rspack/core](https://github.com/web-infra-dev/rspack/tree/HEAD/packages/rspack) | `2.1.7` | `2.2.3` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.6` | `7.3.2` |
| [esbuild](https://github.com/evanw/esbuild) | `0.25.12` | `0.28.2` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.0` |
| [rollup](https://github.com/rollup/rollup) | `4.62.4` | `4.63.1` |
| [webpack](https://github.com/webpack/webpack) | `5.109.2` | `5.110.3` |



Updates `@napi-rs/cli` from 3.8.2 to 3.9.1
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](https://github.com/napi-rs/napi-rs/compare/@napi-rs/cli@3.8.2...@napi-rs/cli@3.9.1)

Updates `@rspack/core` from 2.1.7 to 2.2.3
- [Release notes](https://github.com/web-infra-dev/rspack/releases)
- [Commits](https://github.com/web-infra-dev/rspack/commits/v2.2.3/packages/rspack)

Updates `astro` from 7.1.6 to 7.3.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.2/packages/astro)

Updates `esbuild` from 0.25.12 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.25.12...v0.28.2)

Updates `fast-check` from 4.9.0 to 4.10.0
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.0/packages/fast-check)

Updates `rollup` from 4.62.4 to 4.63.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.62.4...v4.63.1)

Updates `webpack` from 5.109.2 to 5.110.3
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.2...v5.110.3)

---
updated-dependencies:
- dependency-name: "@napi-rs/cli"
  dependency-version: 3.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: "@rspack/core"
  dependency-version: 2.2.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: astro
  dependency-version: 7.3.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: fast-check
  dependency-version: 4.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: rollup
  dependency-version: 4.63.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
- dependency-name: webpack
  dependency-version: 5.110.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants