Skip to content

build(deps): bump the minor-and-patch group with 8 updates - #200

Merged
uhyo merged 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-03a3307bca
Nov 4, 2026
Merged

build(deps): bump the minor-and-patch group with 8 updates#200
uhyo merged 1 commit into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-03a3307bca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 8 updates:

Package From To
oxlint 1.88.0 1.90.0
turbo 2.11.8 2.11.10
wrangler 4.151.0 4.155.0
srvx 1.0.5 1.0.8
tsdown 0.23.1 0.23.3
vitest 5.0.4 5.0.5
@types/node 26.6.5 26.6.6
vite 8.3.4 8.3.5

Updates oxlint from 1.88.0 to 1.90.0

Release notes

Sourced from oxlint's releases.

oxlint v1.90.0

🚀 Features

  • cf34678 oxlint: Export Oxlintrc type (#28132) (Sysix)
  • 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
  • d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
  • 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

🐛 Bug Fixes

  • 7f3c908 linter/eslint/array-callback-return: Check callbacks passed with extra arguments (#28133) (sarankumar)
  • 53be530 linter: Filter by type aware rules when looking up tsgolint rule severity (#28138) (NavpreetSSidhu)
  • e0f8937 react-compiler: Compile a try whose catch is unreachable instead of panicking (#28066) (Dunqing)
  • f5b625f linter/eslint/no-useless-concat: See through parenthesized expressions (#27984) (Rahul Kashyap)
  • 4629bb2 linter/jest/no-conditional-expect: Check function expression callbacks (#28055) (camc314)
  • 5c84098 semantic,linter: Report names with lone surrogates in enum and lint checks (#27991) (Dunqing)
  • f3705a9 linter/eslint/prefer-const: Skip fixers if any declarator is reassigned (#28008) (Prince Jain)
  • 4c0fa90 minifier,linter: Keep delete of constant members and later JSX keys (#27990) (Dunqing)
  • 0298062 linter/arrow-body-style: Keep type assertions when adding a block body (#27978) (Yan Almeida)

oxlint v1.89.0

💥 BREAKING CHANGES

  • e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
  • a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

  • 770ada4 linter: Mark vue 3 rules as recommended (#27717) (Cam McHenry)
  • ba38c1d linter: Mark react/react-hooks rules as recommended (#27701) (Cam McHenry)
  • d85a3ba linter: Mark promise rules as recommended (#27693) (Cam McHenry)
  • e71c88a linter: Mark node rule as recommended (#27692) (Cam McHenry)
  • 7213f61 linter: Mark nextjs rules as recommended (#27691) (Cam McHenry)
  • d7c6b26 linter: Mark jsx-a11y rules as recommended (#27690) (Cam McHenry)
  • 199dfdc linter: Mark jsdoc rules as recommended (#27689) (Cam McHenry)
  • 780bff3 linter: Mark jest/vitest rules as recommended (#27672) (Cam McHenry)
  • 6ae6859 linter: Mark import rules as recommended (#27671) (Cam McHenry)
  • b7a1df3 linter: Mark unicorn rules as recommended (#27670) (Cam McHenry)
  • c44a355 linter: Mark typescript rules as recommended from upstream (#27634) (Cam McHenry)
  • 6b49dba linter: Mark eslint rules as recommended from upstream (#27632) (Cam McHenry)

🐛 Bug Fixes

  • 7c47246 linter: Check module specifiers and string values that contain lone surrogates (#26717) (Dunqing)
  • 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
  • 326904f linter/unicorn/no-useless-undefined: Allow undefined in React.useRef (#25027) (Chris Dokurno)
  • f9cf165 linter/unicorn/prefer-spread: Ignore super method calls (#27868) (camc314)
  • 00484e1 linter/eslint/prefer-const: Report destructuring assignments inside blocks (#27856) (camc314)
  • 9c35461 linter/eslint/sort-vars: Report every out-of-order declaration (#27767) (camc314)
  • 01e1c5e linter/unicorn/prefer-string-replace-all: Resolve regex variables (#27769) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.90.0] - 2026-10-27

🚀 Features

  • 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
  • d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
  • 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

[1.89.0] - 2026-10-19

🐛 Bug Fixes

  • 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)
Commits
  • 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
  • 831cdf1 feat(oxlint): require mininum oxlint-tsgolint version v7.0.2005 (#28118)
  • d1b00f4 feat(linter/typescript): implement no-unsafe-enum-assignment rule (#28117)
  • 165c91f feat(linter/typescript/await-thenable): support allowMixedPromiseArrays opt...
  • 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
  • 9a424c2 fix(oxlint,oxfmt): correct Node.js TypeScript support range (#27699)
  • See full diff in compare view

Updates turbo from 2.11.8 to 2.11.10

Release notes

Sourced from turbo's releases.

Turborepo v2.11.10

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.11.9...v2.11.10

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • e521641 publish 2.11.10 to registry
  • aaf5a3a fix: Distrust compromised eMudhra intermediate certificates (#14876)
  • 9816503 fix: Exit quietly when turbo ls output is piped to a closed reader (#14868)
  • af866e5 feat: Enable WebMCP for Turborepo docs (#14828)
  • b42cc68 chore: Remove CODEOWNERS file (#14810)
  • 921155f fix: Restore cached symlinks when outputs are already on disk (#14807)
  • 9330903 docs: Generate the sitemap from Geistdocs sources (#14865)
  • 6048038 fix: Keep task env vars in the hash when globalEnv excludes inferred vars (#1...
  • 57ecce3 fix: Parse pnpm 8 single-project lockfiles (#14806)
  • d926d6a fix: Match package configuration files and directory inputs in task-level aff...
  • Additional commits viewable in compare view

Updates wrangler from 4.151.0 to 4.155.0

Release notes

Sourced from wrangler's releases.

wrangler@4.155.0

Minor Changes

  • #16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

    Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

    {
  "analytics_engine_datasets": [
    {
      "binding": "EVENTS",
      "dataset": "my-dataset",
      "remote": true
    }
  ]
}

Patch Changes

  • #16526 dba0e81 Thanks @​petebacondarwin! - Render terminal control characters as visible text in tail output

    Pretty tail and remote-preview output now escape control characters in log strings, exceptions and event metadata. Unicode, tabs and multiline logs remain readable, and JSON output keeps the original structured values.

  • #16489 fc57bc0 Thanks @​akshitsinha! - Keep Flagship flag metadata when updating flags

    wrangler flagship flags commands that update an existing flag, such as enable, set, rollout, split, and rules, no longer clear the flag's metadata. wrangler flagship flags pull now copies metadata into the local flag store.

  • #16521 ec6eddd Thanks @​petebacondarwin! - Validate .assetsignore encoding before building asset manifests

    Asset uploads and local development now stop with an actionable user error when .assetsignore is not valid UTF-8 or contains null characters, instead of silently losing its patterns. This also applies to standalone Miniflare and the Wrangler, Vite and Vitest development integrations. Save the file as UTF-8 to continue; UTF-8 files with a byte order mark and intentionally empty files remain supported.

  • Updated dependencies [a95d647, c7a3373, c7a3373, c7a3373]:

wrangler@4.154.0

Minor Changes

  • #16494 0968b08 Thanks @​petebacondarwin! - Enable Miniflare's development registry by default and centralize path resolution

    In Miniflare v5 beta, resolve the registry from CLOUDFLARE_DEV_REGISTRY_PATH, then the unsafeDevRegistryPath constructor option, then <Cloudflare config directory>/dev-registry/v5. The default is independent of legacy Wrangler directories and is scoped to the Miniflare major version. The Vite v2 beta plugin follows this new default, while current Wrangler and getPlatformProxy() retain Wrangler's legacy default for compatibility with existing Wrangler sessions. Vite v2 and Wrangler therefore require the same CLOUDFLARE_DEV_REGISTRY_PATH to discover each other; set it for both processes when mixing these tools.

    Add enableDevRegistry: false to disable registration and discovery explicitly. Shared storage now uses the resolved default without requiring an explicit path. As before, shared storage requires an enabled registry to elect a storage owner, so combining unsafeEnableSharedStorage: true with enableDevRegistry: false is rejected. Miniflare no longer reads MINIFLARE_REGISTRY_PATH; use CLOUDFLARE_DEV_REGISTRY_PATH instead. Expose resolveDevRegistryPath() for integrations that also read registry files. Wrangler uses the effective path for its runtime configuration, initial bindings display, and Flagship active-session check, so the canonical override cannot bypass that check. An explicitly disabled Wrangler registry remains disabled.

Patch Changes

  • #16499 f3c13b3 Thanks @​dinasaur404! - Preserve binding error codes and names in local development

    Errors from remote bindings and from Node.js binding proxies (getPlatformProxy() and Miniflare#getBindings()) now keep their machine-readable properties, such as Artifacts' code and numericCode. Previously these properties were dropped and the error name was folded into the message (for example "ArtifactsError: Repository not found"), so code could only branch on error text during local development.

... (truncated)

Commits

Updates srvx from 1.0.5 to 1.0.8

Release notes

Sourced from srvx's releases.

v1.0.8

compare changes

🩹 Fixes

  • node: Don't expose derived content-length on materialized FastResponse headers (#337)
  • node: Send the head for stream bodies that end without data (#339)

v1.0.7

compare changes

🩹 Fixes

  • node: Scope FastResponse subclass instanceof and avoid nesting as global Response (#330)
  • node: Keep derived content-length when FastResponse materializes (#335)
  • node: Resolve native Request/Response by base class to support globals patched by other servers (#331)

v1.0.6

compare changes

🩹 Fixes

  • node: Omit default port/host when node.path is set (19b33f9)
  • generic: Keep an existing request.waitUntil (#309)
  • node: Read a pre-set rawBody from every body method (#312)

🏡 Chore

🤖 CI

  • Update github actions (3cf7b25)
  • Restore workflow formatting (e59e62a)

❤️ Contributors

  • Pooya Parsa
  • Nitedani
  • Kaan Çelebi
Changelog

Sourced from srvx's changelog.

v1.0.8

compare changes

🩹 Fixes

  • node: Don't expose derived content-length on materialized FastResponse headers (#337)
  • node: Send the head for stream bodies that end without data (#339)

🏡 Chore

🤖 CI

  • Run deno vitest via npm specifier to bypass pnpm 12 bin shim (f0ef09c)

❤️ Contributors

v1.0.7

compare changes

🩹 Fixes

  • node: Scope FastResponse subclass instanceof and avoid nesting as global Response (#330)
  • node: Keep derived content-length when FastResponse materializes (#335)
  • node: Resolve native Request/Response by base class to support globals patched by other servers (#331)

❤️ Contributors

v1.0.6

compare changes

🩹 Fixes

  • node: Omit default port/host when node.path is set (19b33f9)
  • generic: Keep an existing request.waitUntil (#309)
  • node: Read a pre-set rawBody from every body method (#312)

🏡 Chore

... (truncated)

Commits
  • a961c16 chore(release): v1.0.8
  • f0ef09c ci: run deno vitest via npm specifier to bypass pnpm 12 bin shim
  • 3806369 chore: update deps
  • 2af7a1b fix(node): send the head for stream bodies that end without data (#339)
  • 30fb59a fix(node): don't expose derived content-length on materialized FastResponse h...
  • a9a0754 chore(release): v1.0.7
  • a327007 fix(node): resolve native Request/Response by base class to support globa...
  • f0c13e0 fix(node): keep derived content-length when FastResponse materializes (#335)
  • 008a954 fix(node): scope FastResponse subclass instanceof and avoid nesting as gl...
  • cc446f5 chore(release): v1.0.6
  • Additional commits viewable in compare view

Updates tsdown from 0.23.1 to 0.23.3

Release notes

Sourced from tsdown's releases.

v0.23.3

   🐞 Bug Fixes

    View changes on GitHub

v0.23.2

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 53638e8 chore: release v0.23.3
  • 0344c4f fix: downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support ...
  • 3c0c854 chore: release v0.23.2
  • 76fbfbf chore: upgrade deps
  • 490ecd6 fix(css): respect Lightning CSS modules options (#1103)
  • 2410ef3 feat: add JSON schema for config (#1074)
  • c626e4a chore: upgrade deps
  • 3b5f4ee chore(deps): update dependency void to v1 (#1102)
  • b46c0d4 test: prune redundant utils tests and fold lookup tables (#1099)
  • 3a51daa chore(deps): update pnpm to v12.11.2 (#1081)
  • Additional commits viewable in compare view

Updates vitest from 5.0.4 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates @types/node from 26.6.5 to 26.6.6

Commits

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)
Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • Description has been truncated

@dependabot
build(deps): bump the minor-and-patch group with 8 updates
2a231e3 
Bumps the minor-and-patch group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.88.0` | `1.90.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.11.8` | `2.11.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.151.0` | `4.155.0` |
| [srvx](https://github.com/h3js/srvx) | `1.0.5` | `1.0.8` |
| [tsdown](https://github.com/rolldown/tsdown) | `0.23.1` | `0.23.3` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.4` | `5.0.5` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.4` | `8.3.5` |


Updates `oxlint` from 1.88.0 to 1.90.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.90.0/npm/oxlint)

Updates `turbo` from 2.11.8 to 2.11.10
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.11.8...v2.11.10)

Updates `wrangler` from 4.151.0 to 4.155.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.155.0/packages/wrangler)

Updates `srvx` from 1.0.5 to 1.0.8
- [Release notes](https://github.com/h3js/srvx/releases)
- [Changelog](https://github.com/h3js/srvx/blob/main/CHANGELOG.md)
- [Commits](h3js/srvx@v1.0.5...v1.0.8)

Updates `tsdown` from 0.23.1 to 0.23.3
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.23.1...v0.23.3)

Updates `vitest` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vite` from 8.3.4 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

---
updated-dependencies:
- dependency-name: oxlint
  dependency-version: 1.90.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: turbo
  dependency-version: 2.11.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.155.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: srvx
  dependency-version: 1.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tsdown
  dependency-version: 0.23.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@uhyo
uhyo merged commit 2a8d536 into master Nov 4, 2026
2 checks passed
@uhyo
uhyo deleted the dependabot/npm_and_yarn/minor-and-patch-03a3307bca branch November 4, 2026 12:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@uhyo