chore(deps-dev): bump the development-dependencies group across 1 directory with 20 updates by dependabot[bot] · Pull Request #2165 · diplodoc-platform/cli

dependabot · 2026-08-07T10:06:33Z

Bumps the development-dependencies group with 19 updates in the / directory:

Package	From	To
@aws-sdk/client-s3	`3.894.0`	`3.1116.0`
@aws-sdk/lib-storage	`3.894.0`	`3.1116.0`
@types/async	`3.2.15`	`3.2.25`
@types/html-escaper	`3.0.0`	`3.0.4`
@types/node	`22.19.0`	`22.20.1`
@vitest/coverage-v8	`3.2.4`	`3.2.7`
axios	`1.12.2`	`1.19.0`
esbuild	`0.27.3`	`0.28.2`
markdown-it-attrs	`4.3.1`	`4.5.0`
minimatch	`9.0.3`	`9.0.9`
node-html-parser	`6.1.5`	`6.1.13`
simple-git	`3.22.0`	`3.36.0`
slugify	`1.6.5`	`1.6.9`
strip-ansi	`7.1.2`	`7.2.0`
svgo	`3.3.2`	`3.3.5`
typescript-transform-paths	`3.5.5`	`3.5.6`
uuid	`11.0.4`	`11.1.1`
vite	`6.3.6`	`6.4.3`
vitest-when	`0.6.2`	`0.10.0`

Updates @aws-sdk/client-s3 from 3.894.0 to 3.1116.0

Release notes

Sourced from @aws-sdk/client-s3's releases.

v3.1116.0

3.1116.0(2026-08-21)

Chores

codegen:

bump smithyVersion to 1.73.0 (#8273) (64f21cd0)

update to sync with the latest smithy-ts (#8272) (8369ada7)

Documentation Changes

client-backup: Updating CLI Docs for Backup Audit Manager List Job Summaries APIs. (98f47ffe)

client-wafv2: DataProtectionConfig field Key Documentation Update (a8f1fb90)

New Features

client-cloudwatch: Allows customers to specify an initial warm up period to wait for metrics to arrive when creating metric or log alarms (e354f162)

client-device-farm: Added support to CreateRemoveAccessSession for selecting a server version on the mobile WebDriver endpoint. (d91e09c8)

client-bedrock-agentcore: Increase spans count from 1k to 20k (e83264aa)

client-kinesis: Generate account endpoint for Kinesis Data Streams requests when the account ID is available (ed9966e2)

client-bedrock-agentcore-control: Update Dataset schema to THIRDPARTYEVALUATIONV1 (f0fe8db3)

For list of updated packages, view updated-packages.md in assets-3.1116.0.zip

v3.1115.0

3.1115.0(2026-08-20)

Documentation Changes

client-pricing-plan-manager: Documentation update for the CreateSubscription API to correct the default value of the approval mode parameter. The default value for paid subscriptions is MANUAL, not IMMEDIATE as previously documented. The default value remains IMMEDIATE for FREE tier subscriptions. (50d16ae3)

New Features

client-sesv2: Amazon SES now supports per-message tracking overrides. You can use the new ConfigurationOverrides parameter in SendEmail and SendBulkEmail to enable or disable open and click tracking for individual messages without changing your account-level or configuration set settings. (da56caa5)

client-arc-region-switch: Adds support for Rds switchover read replica for Oracle databases in Region switch plans (85ffb20a)

client-ec2: EC2 marks UEFI instance metadata field as sensitive. (c232746a)

client-direct-connect: This release adds custom route prefix pool allocations for Direct Connect. You can set IPv4 and IPv6 route prefix counts on private and transit virtual interfaces, and view pool size and unallocated counts on connections and LAGs, plus direct connect gateway attachment prefix allocation totals. (a94fb978)

client-amplify: Increased the maximum allowed length from 255 to 4,096 characters to support longer access tokens. (f7f8ecd1)

client-batch: AWS Batch now supports a new compute environment type that provides fully managed EC2 capacity with broader compute flexibility than Fargate, including GPU instances, bare metal, and specific instance type selection, without infrastructure management overhead. (9c559a73)

client-sagemaker: Added IAM Identity Center (IdC) support to CreatePartnerApp and UpdatePartnerApp APIs. Added Customer Managed Key (CMK) support to CreateMlflowApp and DescribeMlflowApp. (55485887)

client-lambda: Adds support for full JSON resource-based policies, enabling customers to create, retrieve, update, and delete function resource policies as complete JSON documents. (72573a2a)

client-cloudfront: Added SigV4a as a supported signing protocol for Origin Access Control (OAC), enabling CloudFront to sign requests to Amazon S3 Multi-Region Access Point (S3-MRAP) origins. (95476293)

For list of updated packages, view updated-packages.md in assets-3.1115.0.zip

... (truncated)

Changelog

Sourced from @aws-sdk/client-s3's changelog.

3.1116.0 (2026-08-21)

Note: Version bump only for package @aws-sdk/client-s3

3.1115.0 (2026-08-20)

Note: Version bump only for package @aws-sdk/client-s3

3.1114.0 (2026-08-19)

Note: Version bump only for package @aws-sdk/client-s3

3.1113.0 (2026-08-18)

Note: Version bump only for package @aws-sdk/client-s3

3.1112.0 (2026-08-17)

Note: Version bump only for package @aws-sdk/client-s3

3.1111.0 (2026-08-14)

Note: Version bump only for package @aws-sdk/client-s3

3.1110.0 (2026-08-13)

... (truncated)

Commits

d760a00 Publish v3.1116.0
8369ada chore(codegen): update to sync with the latest smithy-ts (#8272)
efc86fc Publish v3.1115.0
5318b44 Publish v3.1114.0
73a06d2 Publish v3.1113.0
cb4ae76 Publish v3.1112.0
c41e9a9 Publish v3.1111.0
ca81fbb chore: upgrade to typescript 7 (#8264)
4efe5bc Publish v3.1110.0
d2ee371 Publish v3.1109.0
Additional commits viewable in compare view

Updates @aws-sdk/lib-storage from 3.894.0 to 3.1116.0

Release notes

Sourced from @aws-sdk/lib-storage's releases.

v3.1116.0

3.1116.0(2026-08-21)

Chores

codegen:

bump smithyVersion to 1.73.0 (#8273) (64f21cd0)

update to sync with the latest smithy-ts (#8272) (8369ada7)

Documentation Changes

client-backup: Updating CLI Docs for Backup Audit Manager List Job Summaries APIs. (98f47ffe)

client-wafv2: DataProtectionConfig field Key Documentation Update (a8f1fb90)

New Features

client-cloudwatch: Allows customers to specify an initial warm up period to wait for metrics to arrive when creating metric or log alarms (e354f162)

client-device-farm: Added support to CreateRemoveAccessSession for selecting a server version on the mobile WebDriver endpoint. (d91e09c8)

client-bedrock-agentcore: Increase spans count from 1k to 20k (e83264aa)

client-kinesis: Generate account endpoint for Kinesis Data Streams requests when the account ID is available (ed9966e2)

client-bedrock-agentcore-control: Update Dataset schema to THIRDPARTYEVALUATIONV1 (f0fe8db3)

For list of updated packages, view updated-packages.md in assets-3.1116.0.zip

v3.1115.0

3.1115.0(2026-08-20)

Documentation Changes

client-pricing-plan-manager: Documentation update for the CreateSubscription API to correct the default value of the approval mode parameter. The default value for paid subscriptions is MANUAL, not IMMEDIATE as previously documented. The default value remains IMMEDIATE for FREE tier subscriptions. (50d16ae3)

New Features

client-sesv2: Amazon SES now supports per-message tracking overrides. You can use the new ConfigurationOverrides parameter in SendEmail and SendBulkEmail to enable or disable open and click tracking for individual messages without changing your account-level or configuration set settings. (da56caa5)

client-arc-region-switch: Adds support for Rds switchover read replica for Oracle databases in Region switch plans (85ffb20a)

client-ec2: EC2 marks UEFI instance metadata field as sensitive. (c232746a)

client-direct-connect: This release adds custom route prefix pool allocations for Direct Connect. You can set IPv4 and IPv6 route prefix counts on private and transit virtual interfaces, and view pool size and unallocated counts on connections and LAGs, plus direct connect gateway attachment prefix allocation totals. (a94fb978)

client-amplify: Increased the maximum allowed length from 255 to 4,096 characters to support longer access tokens. (f7f8ecd1)

client-batch: AWS Batch now supports a new compute environment type that provides fully managed EC2 capacity with broader compute flexibility than Fargate, including GPU instances, bare metal, and specific instance type selection, without infrastructure management overhead. (9c559a73)

client-sagemaker: Added IAM Identity Center (IdC) support to CreatePartnerApp and UpdatePartnerApp APIs. Added Customer Managed Key (CMK) support to CreateMlflowApp and DescribeMlflowApp. (55485887)

client-lambda: Adds support for full JSON resource-based policies, enabling customers to create, retrieve, update, and delete function resource policies as complete JSON documents. (72573a2a)

client-cloudfront: Added SigV4a as a supported signing protocol for Origin Access Control (OAC), enabling CloudFront to sign requests to Amazon S3 Multi-Region Access Point (S3-MRAP) origins. (95476293)

For list of updated packages, view updated-packages.md in assets-3.1115.0.zip

... (truncated)

Changelog

Sourced from @aws-sdk/lib-storage's changelog.

3.1116.0 (2026-08-21)

Note: Version bump only for package @aws-sdk/lib-storage

3.1115.0 (2026-08-20)

Note: Version bump only for package @aws-sdk/lib-storage

3.1114.0 (2026-08-19)

Note: Version bump only for package @aws-sdk/lib-storage

3.1113.0 (2026-08-18)

Note: Version bump only for package @aws-sdk/lib-storage

3.1112.0 (2026-08-17)

Note: Version bump only for package @aws-sdk/lib-storage

3.1111.0 (2026-08-14)

Note: Version bump only for package @aws-sdk/lib-storage

3.1110.0 (2026-08-13)

... (truncated)

Commits

d760a00 Publish v3.1116.0
8369ada chore(codegen): update to sync with the latest smithy-ts (#8272)
efc86fc Publish v3.1115.0
5318b44 Publish v3.1114.0
73a06d2 Publish v3.1113.0
cb4ae76 Publish v3.1112.0
c41e9a9 Publish v3.1111.0
ca81fbb chore: upgrade to typescript 7 (#8264)
3a88aad chore: remove jest, use vitest for remaining test suites (#8263)
4efe5bc Publish v3.1110.0
Additional commits viewable in compare view

Updates @types/async from 3.2.15 to 3.2.25

Commits

See full diff in compare view

Updates @types/html-escaper from 3.0.0 to 3.0.4

Commits

See full diff in compare view

Updates @types/node from 22.19.0 to 22.20.1

Commits

See full diff in compare view

Updates @vitest/coverage-v8 from 3.2.4 to 3.2.7

Release notes

Sourced from @vitest/coverage-v8's releases.

v3.2.7

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v3] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10679 (b795e)

    View changes on GitHub

v3.2.6

   🐞 Bug Fixes

Pin last supported vite-node version - by @sheremet-va (16f12)

    View changes on GitHub

v3.2.5

   🚀 Features

api: Add allowWrite and allowExec options to api [backport to v3] - by @hi-ogawa and Codex in vitest-dev/vitest#10445 (af88b)

   🐞 Bug Fixes

browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3] - by @hi-ogawa and Codex in vitest-dev/vitest#10456 (385a1)

    View changes on GitHub

Commits

c0c203d chore: release v3.2.7 (#10719)
b6d56f8 chore: release v3.2.6
16f120d fix: pin last supported vite-node version
2cbad0a chore: release v3.2.5
385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @vitest/coverage-v8 since your current version.

Updates axios from 1.12.2 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

@andrewkernel (#11053)

@Sagargupta16 (#11059)

@Rpaudel379 (#11078)

... (truncated)

Changelog

Sourced from axios's changelog.

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

@andrewkernel (#11053)

@Sagargupta16 (#11059)

... (truncated)

Commits

311fcc5 chore(release): prepare release 1.19.0 (#11095)
cb4fd74 chore(deps): bump axios from 1.16.1 to 1.18.1 in /docs (#11088)
004c93a chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 in the github-action...
122edde chore(deps-dev): bump the development_dependencies group with 3 updates (#11089)
c44f8d0 ci: use bundled npm for v1 publish (#11083)
878bb29 fix(sandbox): resolve TypeError on constant variable path assignment (#11073)
a092bae fix(core): synchronous interceptors swallow errors and proceed with request (...
3041b8f feat(HttpStatusCode): add missing 520 status code (#11067)
58b16c8 refactor(helpers): extract duplicated setFormDataHeaders into a shared helper...
3077e62 feat(types): Allow the Params property to be typed, instead of any (#11081)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates esbuild from 0.27.3 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x
 bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Updates markdown-it-attrs from 4.3.1 to 4.5.0

Release notes

Sourced from markdown-it-attrs's releases.

v4.5.0

What's Changed

Fix quoted attribute parsing and triage open issue reproducibility by @Copilot in arve0/markdown-it-attrs#168

Add bundled TypeScript type definitions to fix MarkdownIt type incompatibility by @Copilot in arve0/markdown-it-attrs#170

Add regression coverage for markdown-it-container attribute propagation edge case by @Copilot in arve0/markdown-it-attrs#171

CI workflow cleanup: Linux-only Node matrix, non-duplicating PR triggers, and action version bumps by @Copilot in arve0/markdown-it-attrs#174

Fix "end of block" attrs pattern to handle trailing navigation tokens in headings by @Copilot in arve0/markdown-it-attrs#173

Full Changelog: arve0/markdown-it-attrs@v4.4.0...v4.5.0

v4.4.0

What's Changed

feat: add ability to filter attribute values by @treardon17 in arve0/markdown-it-attrs#160

Fix attribute adding to avoid duplicates by @cgm616 in arve0/markdown-it-attrs#157

New Contributors

@treardon17 made their first contribution in arve0/markdown-it-attrs#160

@cgm616 made their first contribution in arve0/markdown-it-attrs#157

Full Changelog: arve0/markdown-it-attrs@v4.3.2...v4.4.0

v4.3.2

What's Changed

fix: handle null meta on tbody_open for headerless tables (issue #161) by @Copilot in arve0/markdown-it-attrs#167

New Contributors

@Copilot made their first contribution in arve0/markdown-it-attrs#167

Full Changelog: arve0/markdown-it-attrs@v4.3.1...v4.3.2

Commits

4f2a6b4 4.5.0
038f2f2 Address code review: add depth comment, rename hash to anchorSymbol
61a4c64 Fix end-of-block pattern to handle heading attrs with trailing navigation tokens
a244fd3 Initial plan for fixing heading attrs with trailing navigation tokens
6d3c7f3 Update CI triggers and bump workflow actions
2a2c8e0 Add minimal GITHUB_TOKEN permissions to CI workflow
8a9f96f Update CI matrix to Linux and Node 22/24/26
3089651 test: reproducible for issue #111
43b35cd Add first-party TypeScript type definitions and test
e5eef3e initial plan
Additional commits viewable in compare view

Updates minimatch from 9.0.3 to 9.0.9

Commits

8a10e47 9.0.9
c6f1806 brace-expansion@2
446cfa3 9.0.8
8fa151a docs: add warning about ReDoS
71b78a2 fix partial matching of globstar patterns
2de496f 9.0.7
0d4616d limit nested extglob recursion, flatten extglobs
7117ef3 9.0.6
2418458 update deps, do not checkin dist
1d1f531 update deps
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates node-html-parser from 6.1.5 to 6.1.13

Release notes

Sourced from node-html-parser's releases.

v6.1.13

6.1.13 (2024-03-29)

Bug Fixes

add rawTagName #269 #270 (9ac642d)

v6.1.12

6.1.12 (2023-12-25)

Bug Fixes

Description has been truncated

dependabot · 2026-08-07T10:06:34Z

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…ectory with 20 updates Bumps the development-dependencies group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.894.0` | `3.1116.0` | | [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.894.0` | `3.1116.0` | | [@types/async](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/async) | `3.2.15` | `3.2.25` | | [@types/html-escaper](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/html-escaper) | `3.0.0` | `3.0.4` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.0` | `22.20.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `3.2.4` | `3.2.7` | | [axios](https://github.com/axios/axios) | `1.12.2` | `1.19.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.3` | `0.28.2` | | [markdown-it-attrs](https://github.com/arve0/markdown-it-attrs) | `4.3.1` | `4.5.0` | | [minimatch](https://github.com/isaacs/minimatch) | `9.0.3` | `9.0.9` | | [node-html-parser](https://github.com/taoqf/node-fast-html-parser) | `6.1.5` | `6.1.13` | | [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git) | `3.22.0` | `3.36.0` | | [slugify](https://github.com/simov/slugify) | `1.6.5` | `1.6.9` | | [strip-ansi](https://github.com/chalk/strip-ansi) | `7.1.2` | `7.2.0` | | [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.5` | | [typescript-transform-paths](https://github.com/LeDDGroup/typescript-transform-paths) | `3.5.5` | `3.5.6` | | [uuid](https://github.com/uuidjs/uuid) | `11.0.4` | `11.1.1` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.3.6` | `6.4.3` | | [vitest-when](https://github.com/mcous/vitest-when) | `0.6.2` | `0.10.0` | Updates `@aws-sdk/client-s3` from 3.894.0 to 3.1116.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1116.0/clients/client-s3) Updates `@aws-sdk/lib-storage` from 3.894.0 to 3.1116.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1116.0/lib/lib-storage) Updates `@types/async` from 3.2.15 to 3.2.25 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/async) Updates `@types/html-escaper` from 3.0.0 to 3.0.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/html-escaper) Updates `@types/node` from 22.19.0 to 22.20.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitest/coverage-v8` from 3.2.4 to 3.2.7 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/coverage-v8) Updates `axios` from 1.12.2 to 1.19.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.12.2...v1.19.0) Updates `esbuild` from 0.27.3 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.28.2) Updates `markdown-it-attrs` from 4.3.1 to 4.5.0 - [Release notes](https://github.com/arve0/markdown-it-attrs/releases) - [Commits](arve0/markdown-it-attrs@v4.3.1...v4.5.0) Updates `minimatch` from 9.0.3 to 9.0.9 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v9.0.3...v9.0.9) Updates `node-html-parser` from 6.1.5 to 6.1.13 - [Release notes](https://github.com/taoqf/node-fast-html-parser/releases) - [Changelog](https://github.com/taoqf/node-html-parser/blob/main/CHANGELOG.md) - [Commits](taoqf/node-html-parser@v6.1.5...v6.1.13) Updates `simple-git` from 3.22.0 to 3.36.0 - [Release notes](https://github.com/steveukx/git-js/releases) - [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md) - [Commits](https://github.com/steveukx/git-js/commits/simple-git@3.36.0/simple-git) Updates `slugify` from 1.6.5 to 1.6.9 - [Changelog](https://github.com/simov/slugify/blob/master/CHANGELOG.md) - [Commits](https://github.com/simov/slugify/commits) Updates `strip-ansi` from 7.1.2 to 7.2.0 - [Release notes](https://github.com/chalk/strip-ansi/releases) - [Commits](chalk/strip-ansi@v7.1.2...v7.2.0) Updates `svgo` from 3.3.2 to 3.3.5 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.5) Updates `typescript-transform-paths` from 3.5.5 to 3.5.6 - [Release notes](https://github.com/LeDDGroup/typescript-transform-paths/releases) - [Changelog](https://github.com/LeDDGroup/typescript-transform-paths/blob/v3.5.6/CHANGELOG.md) - [Commits](LeDDGroup/typescript-transform-paths@v3.5.5...v3.5.6) Updates `uuid` from 11.0.4 to 11.1.1 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/v11.1.1/CHANGELOG.md) - [Commits](uuidjs/uuid@v11.0.4...v11.1.1) Updates `vite` from 6.3.6 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `vitest` from 3.2.4 to 3.2.7 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/vitest) Updates `vitest-when` from 0.6.2 to 0.10.0 - [Release notes](https://github.com/mcous/vitest-when/releases) - [Commits](mcous/vitest-when@v0.6.2...v0.10.0) --- updated-dependencies: - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1102.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@aws-sdk/lib-storage" dependency-version: 3.1102.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@types/async" dependency-version: 3.2.25 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@types/html-escaper" dependency-version: 3.0.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@types/node" dependency-version: 22.20.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@vitest/coverage-v8" dependency-version: 3.2.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: axios dependency-version: 1.19.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: markdown-it-attrs dependency-version: 4.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: minimatch dependency-version: 9.0.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: node-html-parser dependency-version: 6.1.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: simple-git dependency-version: 3.36.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: slugify dependency-version: 1.6.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: strip-ansi dependency-version: 7.2.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: svgo dependency-version: 3.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: typescript-transform-paths dependency-version: 3.5.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: uuid dependency-version: 11.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: vitest dependency-version: 3.2.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vitest-when dependency-version: 0.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 7, 2026

dependabot Bot requested review from a team and diplodoc-bot as code owners August 7, 2026 10:06

dependabot Bot requested review from reazy015 and removed request for a team August 7, 2026 10:06

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 7, 2026

dependabot Bot requested a review from martyanovandrey August 7, 2026 10:06

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-bedbe73a8b branch 2 times, most recently from f692efb to 54c05e6 Compare August 13, 2026 10:33

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-bedbe73a8b branch 2 times, most recently from 084f9ab to 4ca8de5 Compare August 20, 2026 14:09

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-bedbe73a8b branch 2 times, most recently from b0b3d50 to ba98db0 Compare August 27, 2026 07:46

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-bedbe73a8b branch from ba98db0 to 949f0f5 Compare August 27, 2026 14:40

Navigation Menu

Uh oh!

chore(deps-dev): bump the development-dependencies group across 1 directory with 20 updates - #2165

chore(deps-dev): bump the development-dependencies group across 1 directory with 20 updates#2165
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/development-dependencies-bedbe73a8b

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.1116.0

3.1116.0(2026-08-21)

Chores

Documentation Changes

New Features

v3.1115.0

3.1115.0(2026-08-20)

Documentation Changes

New Features

3.1116.0 (2026-08-21)

3.1115.0 (2026-08-20)

3.1114.0 (2026-08-19)

3.1113.0 (2026-08-18)

3.1112.0 (2026-08-17)

3.1111.0 (2026-08-14)

3.1110.0 (2026-08-13)

v3.1116.0

3.1116.0(2026-08-21)

Chores

Documentation Changes

New Features

v3.1115.0

3.1115.0(2026-08-20)

Documentation Changes

New Features

3.1116.0 (2026-08-21)

3.1115.0 (2026-08-20)

3.1114.0 (2026-08-19)

3.1113.0 (2026-08-18)

3.1112.0 (2026-08-17)

3.1111.0 (2026-08-14)

3.1110.0 (2026-08-13)

v3.2.7

🐞 Bug Fixes

View changes on GitHub

v3.2.6

🐞 Bug Fixes

View changes on GitHub

v3.2.5

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v1.19.0 - July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v0.28.2

0.28.2

v4.5.0

What's Changed

v4.4.0

What's Changed

New Contributors

v4.3.2

What's Changed

New Contributors

v6.1.13

6.1.13 (2024-03-29)

Bug Fixes

v6.1.12

6.1.12 (2023-12-25)

Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github Aug 7, 2026

Labels

Uh oh!

Reviewers

Assignees

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading