Skip to content

chore(deps-dev): bump the development-dependencies group across 1 directory with 22 updates - #2242

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/development-dependencies-af47ea8503
Closed

chore(deps-dev): bump the development-dependencies group across 1 directory with 22 updates#2242
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/development-dependencies-af47ea8503

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 21 updates in the / directory:

Package From To
@aws-sdk/client-s3 3.894.0 3.1130.0
@aws-sdk/lib-storage 3.894.0 3.1130.0
@diplodoc/page-constructor-extension 0.13.14 0.13.16
@diplodoc/yfmlint 1.9.3 1.9.4
@types/async 3.2.15 3.2.26
@types/html-escaper 3.0.0 3.0.4
@types/node 22.19.0 22.20.2
@vitest/coverage-v8 3.2.4 3.2.7
axios 1.12.2 1.20.0
esbuild 0.27.3 0.28.2
markdown-it-attrs 4.3.1 4.5.0
minimatch 9.0.3 9.0.9
node-html-parser 6.1.5 6.1.13
simple-git 3.22.0 3.36.0
slugify 1.6.5 1.6.9
strip-ansi 7.1.2 7.2.0
svgo 3.3.2 3.3.5
typescript-transform-paths 3.5.5 3.5.6
uuid 11.0.4 11.1.1
vite 6.3.6 6.4.3
vitest-when 0.6.2 0.10.2

Updates @aws-sdk/client-s3 from 3.894.0 to 3.1130.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1130.0

3.1130.0(2026-09-10)

New Features
  • clients: update client endpoints as of 2026-09-10 (96951f65)
  • client-outposts: Added fields to identify Outpost generation and rack scaling configuration on Outpost and CatalogItem resources. (d6ec7dce)
  • client-resiliencehubv2: This release adds the ListTestRunSourceEvents and ListTestRunDependencies APIs, which return the alarm state changes during a test run and the dependencies the run blocked. (b918658d)
  • client-bedrock-agent: TwelveLabs Marengo 3.0 is now an embedding model option in Amazon Bedrock Managed Knowledge Base. Create multimodal embeddings for video, audio, and image content that capture visual scenes, speech, and video cues, not just transcribed text. (2671d465)
  • client-ec2: The CreateImage API now supports a BootModeOverride parameter to explicitly set UEFI boot mode on a new AMI, overriding the source instance's inherited boot mode. (c47027fb)
  • client-sagemaker: This release adds the ability for customers to attach customer owned Elastic Network Interfaces (ENIs) to HyperPod cluster nodes. (a7414730)
  • client-rtbfabric: AWS RTB Fabric now lets you control how traffic is routed to your responder gateway across Availability Zones. Set the new clientRoutingPolicy parameter to keep traffic within the same Availability Zone or distribute traffic across all Availability Zones. (e3d270a9)

For list of updated packages, view updated-packages.md in assets-3.1130.0.zip

v3.1129.0

3.1129.0(2026-09-09)

New Features
  • client-elementalinference: This release adds contextual metadata, a feed output type that generates a descriptive summary of your media content along with IAB taxonomy and GARM suitability classifications. It also adds feed resource policies for granting cross-account access to a feed. (249639c6)
  • client-connect: Add metric configuration field to evaluation forms and ListEvaluationFormAIVersions API for retrieving AI-generated evaluation form versions (abf73c4a)
  • client-ec2: This release adds support for sharing Amazon EBS volumes across AWS accounts using AWS Resource Access Manager (RAM). Consuming accounts can view shared volume metadata and create copies of shared volumes within the same Availability Zone, with optional re-encryption using their own KMS key. (2fd8923f)
  • client-mediapackagev2: Dynamic Multiview enables viewers to watch multiple live video streams in a single combined output. Viewers can select from 6 preset tiled layouts. Create MediaPackage channels with Input Type MULTIVIEW and configure Available Layouts and Available Sources. See the API Documentation for details. (db6626ce)
  • client-pcs: This release adds support for custom Gres.conf configuration and Slurm version 26.05 in AWS PCS. Customers can now specify generic resource (GRES) settings to control how GPUs and other resources are configured and shared on their compute node groups. (dd8afaa5)
  • client-lambda: Updates documentation for lambda function timeout. (f268e066)
  • client-mediatailor: Added the AWS Service Request function type for MediaTailor Functions, enabling authenticated requests to AWS Elemental Inference for contextual ad targeting during ad insertion. (92f39ade)
  • client-medialive: MediaLive now supports Manual Style Control for vertical caption positioning in TTML, WebVTT, and Embedded captions, Contextual Metadata Enrichment via Elemental Inference, and an Output Usage field on MediaPackage v2 for Dynamic Multiview validation. (a546f70b)
  • dynamic-client: create untyped clients from Smithy JSON AST (#8270) (4334050c)

For list of updated packages, view updated-packages.md in assets-3.1129.0.zip

v3.1128.0

3.1128.0(2026-09-08)

New Features
  • clients: update client endpoints as of 2026-09-08 (bdcc40a7)
  • client-ec2: Adds the InterfaceTypes field to NetworkCardInfo in the DescribeInstanceTypes response. This field identifies the network interface types supported by each network card. (9336e689)
  • client-appflow: Amazon AppFlow now supports key pair (RSA private key) authentication for the Snowflake connector. You can provide a privateKey in SnowflakeConnectorProfileCredentials, and password is no longer required. This is a non-breaking, additive change available via the AWS SDK and CLI. (ec8753ad)
  • client-sagemaker: Add support for InstancePreferences list for multiple instance type input support on SageMaker Training and Processing (45153f6c)
  • client-cloudtrail: Adds support for the RecursiveLogging trail setting, which suppresses recursive events generated when CloudTrail delivers logs to a trail's destinations. (62a43c78)
  • client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b589875)
  • client-s3-control: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (5765b68b)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1130.0 (2026-09-10)

Note: Version bump only for package @​aws-sdk/client-s3

3.1129.0 (2026-09-09)

Note: Version bump only for package @​aws-sdk/client-s3

3.1128.0 (2026-09-08)

Features

  • client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b58987)

3.1127.0 (2026-09-04)

Note: Version bump only for package @​aws-sdk/client-s3

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/client-s3

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/client-s3

... (truncated)

Commits

Updates @aws-sdk/lib-storage from 3.894.0 to 3.1130.0

Release notes

Sourced from @​aws-sdk/lib-storage's releases.

v3.1130.0

3.1130.0(2026-09-10)

New Features
  • clients: update client endpoints as of 2026-09-10 (96951f65)
  • client-outposts: Added fields to identify Outpost generation and rack scaling configuration on Outpost and CatalogItem resources. (d6ec7dce)
  • client-resiliencehubv2: This release adds the ListTestRunSourceEvents and ListTestRunDependencies APIs, which return the alarm state changes during a test run and the dependencies the run blocked. (b918658d)
  • client-bedrock-agent: TwelveLabs Marengo 3.0 is now an embedding model option in Amazon Bedrock Managed Knowledge Base. Create multimodal embeddings for video, audio, and image content that capture visual scenes, speech, and video cues, not just transcribed text. (2671d465)
  • client-ec2: The CreateImage API now supports a BootModeOverride parameter to explicitly set UEFI boot mode on a new AMI, overriding the source instance's inherited boot mode. (c47027fb)
  • client-sagemaker: This release adds the ability for customers to attach customer owned Elastic Network Interfaces (ENIs) to HyperPod cluster nodes. (a7414730)
  • client-rtbfabric: AWS RTB Fabric now lets you control how traffic is routed to your responder gateway across Availability Zones. Set the new clientRoutingPolicy parameter to keep traffic within the same Availability Zone or distribute traffic across all Availability Zones. (e3d270a9)

For list of updated packages, view updated-packages.md in assets-3.1130.0.zip

v3.1129.0

3.1129.0(2026-09-09)

New Features
  • client-elementalinference: This release adds contextual metadata, a feed output type that generates a descriptive summary of your media content along with IAB taxonomy and GARM suitability classifications. It also adds feed resource policies for granting cross-account access to a feed. (249639c6)
  • client-connect: Add metric configuration field to evaluation forms and ListEvaluationFormAIVersions API for retrieving AI-generated evaluation form versions (abf73c4a)
  • client-ec2: This release adds support for sharing Amazon EBS volumes across AWS accounts using AWS Resource Access Manager (RAM). Consuming accounts can view shared volume metadata and create copies of shared volumes within the same Availability Zone, with optional re-encryption using their own KMS key. (2fd8923f)
  • client-mediapackagev2: Dynamic Multiview enables viewers to watch multiple live video streams in a single combined output. Viewers can select from 6 preset tiled layouts. Create MediaPackage channels with Input Type MULTIVIEW and configure Available Layouts and Available Sources. See the API Documentation for details. (db6626ce)
  • client-pcs: This release adds support for custom Gres.conf configuration and Slurm version 26.05 in AWS PCS. Customers can now specify generic resource (GRES) settings to control how GPUs and other resources are configured and shared on their compute node groups. (dd8afaa5)
  • client-lambda: Updates documentation for lambda function timeout. (f268e066)
  • client-mediatailor: Added the AWS Service Request function type for MediaTailor Functions, enabling authenticated requests to AWS Elemental Inference for contextual ad targeting during ad insertion. (92f39ade)
  • client-medialive: MediaLive now supports Manual Style Control for vertical caption positioning in TTML, WebVTT, and Embedded captions, Contextual Metadata Enrichment via Elemental Inference, and an Output Usage field on MediaPackage v2 for Dynamic Multiview validation. (a546f70b)
  • dynamic-client: create untyped clients from Smithy JSON AST (#8270) (4334050c)

For list of updated packages, view updated-packages.md in assets-3.1129.0.zip

v3.1128.0

3.1128.0(2026-09-08)

New Features
  • clients: update client endpoints as of 2026-09-08 (bdcc40a7)
  • client-ec2: Adds the InterfaceTypes field to NetworkCardInfo in the DescribeInstanceTypes response. This field identifies the network interface types supported by each network card. (9336e689)
  • client-appflow: Amazon AppFlow now supports key pair (RSA private key) authentication for the Snowflake connector. You can provide a privateKey in SnowflakeConnectorProfileCredentials, and password is no longer required. This is a non-breaking, additive change available via the AWS SDK and CLI. (ec8753ad)
  • client-sagemaker: Add support for InstancePreferences list for multiple instance type input support on SageMaker Training and Processing (45153f6c)
  • client-cloudtrail: Adds support for the RecursiveLogging trail setting, which suppresses recursive events generated when CloudTrail delivers logs to a trail's destinations. (62a43c78)
  • client-s3: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (8b589875)
  • client-s3-control: Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level. (5765b68b)

... (truncated)

Changelog

Sourced from @​aws-sdk/lib-storage's changelog.

3.1130.0 (2026-09-10)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1129.0 (2026-09-09)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1128.0 (2026-09-08)

Bug Fixes

  • lib-storage: fix symlink stream sizing and abort on part-count mismatch (#8300) (aa58831)

3.1127.0 (2026-09-04)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/lib-storage

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/lib-storage

... (truncated)

Commits

Updates @diplodoc/page-constructor-extension from 0.13.14 to 0.13.16

Release notes

Sourced from @​diplodoc/page-constructor-extension's releases.

v0.13.16

0.13.16 (2026-09-07)

Bug Fixes

  • update page constructor for React 19 (#103) (04b0fae)

v0.13.15

0.13.15 (2026-08-28)

Bug Fixes

  • page constructor theme updates (39562b7)
Changelog

Sourced from @​diplodoc/page-constructor-extension's changelog.

0.13.16 (2026-09-07)

Bug Fixes

  • update page constructor for React 19 (#103) (04b0fae)

0.13.15 (2026-08-28)

Bug Fixes

  • page constructor theme updates (39562b7)
Commits

Updates @diplodoc/yfmlint from 1.9.3 to 1.9.4

Release notes

Sourced from @​diplodoc/yfmlint's releases.

v1.9.4

1.9.4 (2026-08-27)

Bug Fixes

Changelog

Sourced from @​diplodoc/yfmlint's changelog.

1.9.4 (2026-08-27)

Bug Fixes

Commits

Updates @types/async from 3.2.15 to 3.2.26

Commits

Updates @types/html-escaper from 3.0.0 to 3.0.4

Commits

Updates @types/node from 22.19.0 to 22.20.2

Commits

Updates @vitest/coverage-v8 from 3.2.4 to 3.2.7

Release notes

Sourced from @​vitest/coverage-v8's releases.

v3.2.7

   🐞 Bug Fixes

    View changes on GitHub

v3.2.6

   🐞 Bug Fixes

    View changes on GitHub

v3.2.5

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • c0c203d chore: release v3.2.7 (#10719)
  • b6d56f8 chore: release v3.2.6
  • 16f120d fix: pin last supported vite-node version
  • 2cbad0a chore: release v3.2.5
  • 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitest/coverage-v8 since your current version.


Updates axios from 1.12.2 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

  • HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

  • Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

  • Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)
  • Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)
  • XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)
  • Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)
  • Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

  • Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)
  • Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)
  • Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)
  • CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
  • Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
  • Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
  • Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
  • Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
  • Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

... (truncated)

Commits
  • 84a9f3b chore(release): prepare release 1.20.0 (#11152)
  • e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
  • d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
  • 2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
  • d19040b fix: harden runtime option handling (#11141)
  • e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
  • d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
  • 2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
  • 76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
  • ba98559 docs: add ScrapingBee sponsor (#11137)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates esbuild from 0.27.3 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates markdown-it-attrs from 4.3.1 to 4.5.0

Release notes

Sourced from markdown-it-attrs's releases.

v4.5.0

What's Changed

  • Fix quoted attribute parsing and triage open issue re...

    Description has been truncated

@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependabot. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026
@dependabot
dependabot Bot requested review from a team and diplodoc-bot as code owners September 7, 2026 09:06
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 7, 2026
@dependabot
dependabot Bot requested review from kadymov and martyanovandrey and removed request for a team September 7, 2026 09:06
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-af47ea8503 branch from b46d3b5 to 0682d50 Compare September 10, 2026 13:22
@dependabot
chore(deps-dev): bump the development-dependencies group across 1 dir…
256e42c 
…ectory with 22 updates

Bumps the development-dependencies group with 21 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.894.0` | `3.1130.0` |
| [@aws-sdk/lib-storage](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/lib/lib-storage) | `3.894.0` | `3.1130.0` |
| [@diplodoc/page-constructor-extension](https://github.com/diplodoc-platform/page-constructor-extension) | `0.13.14` | `0.13.16` |
| [@diplodoc/yfmlint](https://github.com/diplodoc-platform/yfmlint) | `1.9.3` | `1.9.4` |
| [@types/async](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/async) | `3.2.15` | `3.2.26` |
| [@types/html-escaper](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/html-escaper) | `3.0.0` | `3.0.4` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.0` | `22.20.2` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `3.2.4` | `3.2.7` |
| [axios](https://github.com/axios/axios) | `1.12.2` | `1.20.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.3` | `0.28.2` |
| [markdown-it-attrs](https://github.com/arve0/markdown-it-attrs) | `4.3.1` | `4.5.0` |
| [minimatch](https://github.com/isaacs/minimatch) | `9.0.3` | `9.0.9` |
| [node-html-parser](https://github.com/taoqf/node-fast-html-parser) | `6.1.5` | `6.1.13` |
| [simple-git](https://github.com/steveukx/git-js/tree/HEAD/simple-git) | `3.22.0` | `3.36.0` |
| [slugify](https://github.com/simov/slugify) | `1.6.5` | `1.6.9` |
| [strip-ansi](https://github.com/chalk/strip-ansi) | `7.1.2` | `7.2.0` |
| [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.5` |
| [typescript-transform-paths](https://github.com/LeDDGroup/typescript-transform-paths) | `3.5.5` | `3.5.6` |
| [uuid](https://github.com/uuidjs/uuid) | `11.0.4` | `11.1.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.3.6` | `6.4.3` |
| [vitest-when](https://github.com/mcous/vitest-when) | `0.6.2` | `0.10.2` |



Updates `@aws-sdk/client-s3` from 3.894.0 to 3.1130.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1130.0/clients/client-s3)

Updates `@aws-sdk/lib-storage` from 3.894.0 to 3.1130.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/lib/lib-storage/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1130.0/lib/lib-storage)

Updates `@diplodoc/page-constructor-extension` from 0.13.14 to 0.13.16
- [Release notes](https://github.com/diplodoc-platform/page-constructor-extension/releases)
- [Changelog](https://github.com/diplodoc-platform/page-constructor-extension/blob/master/CHANGELOG.md)
- [Commits](diplodoc-platform/page-constructor-extension@v0.13.14...v0.13.16)

Updates `@diplodoc/yfmlint` from 1.9.3 to 1.9.4
- [Release notes](https://github.com/diplodoc-platform/yfmlint/releases)
- [Changelog](https://github.com/diplodoc-platform/yfmlint/blob/master/CHANGELOG.md)
- [Commits](diplodoc-platform/yfmlint@v1.9.3...v1.9.4)

Updates `@types/async` from 3.2.15 to 3.2.26
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/async)

Updates `@types/html-escaper` from 3.0.0 to 3.0.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/html-escaper)

Updates `@types/node` from 22.19.0 to 22.20.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 3.2.4 to 3.2.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/coverage-v8)

Updates `axios` from 1.12.2 to 1.20.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.12.2...v1.20.0)

Updates `esbuild` from 0.27.3 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.3...v0.28.2)

Updates `markdown-it-attrs` from 4.3.1 to 4.5.0
- [Release notes](https://github.com/arve0/markdown-it-attrs/releases)
- [Commits](arve0/markdown-it-attrs@v4.3.1...v4.5.0)

Updates `minimatch` from 9.0.3 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v9.0.3...v9.0.9)

Updates `node-html-parser` from 6.1.5 to 6.1.13
- [Release notes](https://github.com/taoqf/node-fast-html-parser/releases)
- [Changelog](https://github.com/taoqf/node-html-parser/blob/main/CHANGELOG.md)
- [Commits](taoqf/node-html-parser@v6.1.5...v6.1.13)

Updates `simple-git` from 3.22.0 to 3.36.0
- [Release notes](https://github.com/steveukx/git-js/releases)
- [Changelog](https://github.com/steveukx/git-js/blob/main/simple-git/CHANGELOG.md)
- [Commits](https://github.com/steveukx/git-js/commits/simple-git@3.36.0/simple-git)

Updates `slugify` from 1.6.5 to 1.6.9
- [Changelog](https://github.com/simov/slugify/blob/master/CHANGELOG.md)
- [Commits](https://github.com/simov/slugify/commits)

Updates `strip-ansi` from 7.1.2 to 7.2.0
- [Release notes](https://github.com/chalk/strip-ansi/releases)
- [Commits](chalk/strip-ansi@v7.1.2...v7.2.0)

Updates `svgo` from 3.3.2 to 3.3.5
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.2...v3.3.5)

Updates `typescript-transform-paths` from 3.5.5 to 3.5.6
- [Release notes](https://github.com/LeDDGroup/typescript-transform-paths/releases)
- [Changelog](https://github.com/LeDDGroup/typescript-transform-paths/blob/v3.5.6/CHANGELOG.md)
- [Commits](LeDDGroup/typescript-transform-paths@v3.5.5...v3.5.6)

Updates `uuid` from 11.0.4 to 11.1.1
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/v11.1.1/CHANGELOG.md)
- [Commits](uuidjs/uuid@v11.0.4...v11.1.1)

Updates `vite` from 6.3.6 to 6.4.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite)

Updates `vitest` from 3.2.4 to 3.2.7
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.7/packages/vitest)

Updates `vitest-when` from 0.6.2 to 0.10.2
- [Release notes](https://github.com/mcous/vitest-when/releases)
- [Commits](mcous/vitest-when@v0.6.2...v0.10.2)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-s3"
  dependency-version: 3.1126.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@aws-sdk/lib-storage"
  dependency-version: 3.1126.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@diplodoc/page-constructor-extension"
  dependency-version: 0.13.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: "@diplodoc/yfmlint"
  dependency-version: 1.9.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: "@types/async"
  dependency-version: 3.2.25
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: "@types/html-escaper"
  dependency-version: 3.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: "@types/node"
  dependency-version: 22.20.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 3.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: axios
  dependency-version: 1.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: markdown-it-attrs
  dependency-version: 4.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: node-html-parser
  dependency-version: 6.1.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: simple-git
  dependency-version: 3.36.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: slugify
  dependency-version: 1.6.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: strip-ansi
  dependency-version: 7.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: svgo
  dependency-version: 3.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: typescript-transform-paths
  dependency-version: 3.5.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: uuid
  dependency-version: 11.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: vite
  dependency-version: 6.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: vitest
  dependency-version: 3.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: vitest-when
  dependency-version: 0.10.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-af47ea8503 branch from 0682d50 to 256e42c Compare September 14, 2026 09:06
@dependabot @github

dependabot Bot commented on behalf of github Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 15, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development-dependencies-af47ea8503 branch September 15, 2026 10:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@diplodoc-bot diplodoc-bot Awaiting requested review from diplodoc-bot diplodoc-bot is a code owner
@kadymov kadymov Awaiting requested review from kadymov kadymov is a code owner automatically assigned from diplodoc-platform/team
@martyanovandrey martyanovandrey Awaiting requested review from martyanovandrey martyanovandrey is a code owner automatically assigned from diplodoc-platform/team

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants