Skip to content

Bump the production-dependencies group across 1 directory with 9 updates - #134

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bun/production-dependencies-9bc0ce17da
Closed

Bump the production-dependencies group across 1 directory with 9 updates#134
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bun/production-dependencies-9bc0ce17da

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 9 updates in the / directory:

Package From To
@clack/prompts 1.5.0 1.6.0
@myriaddreamin/rehype-typst 0.7.0-rc2 0.8.0-rc3
isomorphic-git 1.38.3 1.38.6
preact 10.29.2 10.29.3
sharp 0.34.5 0.35.3
workerpool 10.0.2 10.0.3
@types/node 25.9.1 26.1.0
esbuild 0.28.0 0.28.1
prettier 3.8.3 3.9.4

Updates @clack/prompts from 1.5.0 to 1.6.0

Release notes

Sourced from @​clack/prompts's releases.

@​clack/prompts@​1.6.0

Minor Changes

  • #568 f87933f Thanks @​florian-lefebvre! - Updates default formatter of note() to note dim lines anymore

    If you want the old behavior, provide a format() function:

    import { note } from '@clack/prompts';
+import { styleText } from 'node:util';
note(
'You can edit the file src/index.jsx',
'Next steps.'

{ format: (text) => styleText('dim', text) }
);

  • #567 cc6aab5 Thanks @​dreyfus92! - Add keyboard instruction footers to select, multiselect, and groupMultiselect in the active state, matching autocomplete. No option — always shown.

    • Patch Changes

    @​clack/prompts@​1.5.1

    Patch Changes

    Changelog

    Sourced from @​clack/prompts's changelog.

    1.6.0

    Minor Changes

    • #568 f87933f Thanks @​florian-lefebvre! - Updates default formatter of note() to note dim lines anymore

      If you want the old behavior, provide a format() function:

      import { note } from '@clack/prompts';
+import { styleText } from 'node:util';
note(
'You can edit the file src/index.jsx',
'Next steps.'

{ format: (text) => styleText('dim', text) }
);

  • #567 cc6aab5 Thanks @​dreyfus92! - Add keyboard instruction footers to select, multiselect, and groupMultiselect in the active state, matching autocomplete. No option — always shown.

    • Patch Changes

    1.5.1

    Patch Changes

    Commits

    Updates @myriaddreamin/rehype-typst from 0.7.0-rc2 to 0.8.0-rc3

    Release notes

    Sourced from @​myriaddreamin/rehype-typst's releases.

    v0.8.0-rc3

    • Updated the Typst integration to Typst v0.15.0-rc.1 in Myriad-Dreamin/typst.ts#850
    • Fixed source span resolution by falling back to vpath when needed.

    Full Changelog: Myriad-Dreamin/typst.ts@v0.7.0...v0.8.0-rc3

    Install typst-ts 0.8.0-rc3

    Install prebuilt binaries via shell script

    curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Myriad-Dreamin/typst.ts/releases/download/v0.8.0-rc3/typst-ts-installer.sh | sh

    Install prebuilt binaries via powershell script

    powershell -ExecutionPolicy Bypass -c "irm https://github.com/Myriad-Dreamin/typst.ts/releases/download/v0.8.0-rc3/typst-ts-installer.ps1 | iex"

    Download typst-ts 0.8.0-rc3

    File Platform Checksum
    typst-ts-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
    typst-ts-x86_64-apple-darwin.tar.gz Intel macOS checksum
    typst-ts-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
    typst-ts-x86_64-pc-windows-msvc.zip x64 Windows checksum
    typst-ts-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
    typst-ts-loongarch64-unknown-linux-gnu.tar.gz LoongArch64 Linux checksum
    typst-ts-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
    typst-ts-arm-unknown-linux-gnueabihf.tar.gz ARMv6 Linux (Hardfloat) checksum
    typst-ts-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
    typst-ts-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
    typst-ts-loongarch64-unknown-linux-musl.tar.gz LoongArch64 MUSL Linux checksum
    typst-ts-riscv64gc-unknown-linux-musl.tar.gz RISCV MUSL Linux checksum
    typst-ts-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
    typst-ts-arm-unknown-linux-musleabihf.tar.gz ARMv6 MUSL Linux (Hardfloat) checksum
    typst-ts-armv7-unknown-linux-musleabihf.tar.gz ARMv7 MUSL Linux checksum

    v0.8.0-rc2

    ... (truncated)

    Commits
    • e1974e5 build: bump version to v0.8.0-rc3
    • c0833b4 fix(renderer): add canvas preview hit testing support (#874)
    • 737cc5d perf(renderer): support windowed canvas rendering (#873)
    • a873538 perf(renderer): reduce canvas renderer overhead (#872)
    • 814c71f fix(renderer): prefetch canvas resources before rendering (#871)
    • c6ec830 build: bump version to v0.8.0-rc2 (#869)
    • 329e430 chore(deps): bump typst assets and tinymist (#868)
    • 00ea191 fix(renderer): support canvas gradients (#867)
    • 3cc267f fix(renderer): preserve tiling offsets in svg export (#866)
    • 6e39dbf chore(ci): upgrade cargo-dist workflow cache (#865)
    • Additional commits viewable in compare view
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for @​myriaddreamin/rehype-typst since your current version.


    Updates isomorphic-git from 1.38.3 to 1.38.6

    Release notes

    Sourced from isomorphic-git's releases.

    v1.38.6

    1.38.6 (2026-06-30)

    Bug Fixes

    v1.38.5

    1.38.5 (2026-06-16)

    Bug Fixes

    • Support windows file paths in utils/join.js (#2302) (1395431)

    v1.38.4

    1.38.4 (2026-06-02)

    Bug Fixes

    • pass credential config username to auth callbacks (#2346) (d9920c5)
    Commits

    Updates preact from 10.29.2 to 10.29.3

    Release notes

    Sourced from preact's releases.

    10.29.3

    Fixes

    Performance

    Types

    Maintenance

    Commits

    Updates sharp from 0.34.5 to 0.35.3

    Release notes

    Sourced from sharp's releases.

    v0.35.3

    • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

    • Improve code bundler support by resolving path to libvips binary.

    • Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

    • Emit warning about binaries provided by Electron for use on Linux.

    • Add hasAlpha property to output info. #4500

    • TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

    • Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

    • Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

    • Reject infinite values when validating numbers. #4553 @​metsw24-max

    • Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

    • Verify background colour values are numbers. #4556 @​metsw24-max

    • Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

    • Tighten recomb and affine matrix verification. #4560 @​chatman-media

    • Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

    v0.35.3-rc.2

    • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

    ... (truncated)

    Commits
    • 1018449 Release v0.35.3
    • ba303a7 Prerelease v0.35.3-rc.2
    • 4f94fc5 Upgrade to sharp-libvips v1.3.2
    • c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
    • 9a8d002 Docs: Add changelog entry and note about transferable #4520
    • 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
    • e000d0b Prerelease v0.35.3-rc.1
    • 9554ca9 Prerelease v0.35.3-rc.0
    • 6a29fd5 Emit warning about native binaries on Linux Electron
    • 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
    • Additional commits viewable in compare view

    Updates workerpool from 10.0.2 to 10.0.3

    Changelog

    Sourced from workerpool's changelog.

    2026-07-01, version 10.0.3

    Commits
    • 601124c chore: publish v10.0.3
    • c783508 chore: update babel devDependencies
    • 628a468 chore: run CI testing on Node.js 26, drop testing on v20
    • c8d5253 chore: upgrade devDependencies (most notably TypeScript 6)
    • e7db6f8 chore: fix merge conflicts
    • d2ba424 Merge remote-tracking branch 'origin/master'
    • e65007b chore(deps-dev): bump webpack-dev-server in /examples/webpack5 (#565)
    • b95c37c chore: update HISTORY.md
    • 32747db fix: #548 treat worker as busy while cleaning up canceled task (#549)
    • 44ab043 fix: cleanup spellings, and comment errors.
    • Additional commits viewable in compare view

    Updates @types/node from 25.9.1 to 26.1.0

    Commits

    Updates esbuild from 0.28.0 to 0.28.1

    Release notes

    Sourced from esbuild's releases.

    v0.28.1

    • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

      This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

      Thanks to @​dellalibera for reporting this issue.

    • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

      The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

      Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

      Thanks to @​sondt99 for reporting this issue.

    • Avoid inlining using and await using declarations (#4482)

      Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

      // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

    • Fix module evaluation when an error is thrown (#4461, #4467)

      If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

    • Fix some edge cases around the new operator (#4477)

      Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

      // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

    ... (truncated)

    Changelog

    Sourced from esbuild's changelog.

    0.28.1

    • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

      This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

      Thanks to @​dellalibera for reporting this issue.

    • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

      The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

      Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

      Thanks to @​sondt99 for reporting this issue.

    • Avoid inlining using and await using declarations (#4482)

      Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

      // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

    • Fix module evaluation when an error is thrown (#4461, #4467)

      If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

    • Fix some edge cases around the new operator (#4477)

      Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

      // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

    ... (truncated)

    Commits

    Updates prettier from 3.8.3 to 3.9.4

    Release notes

    Sourced from prettier's releases.

    3.9.4

    • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

    🔗 Changelog

    3.9.3

    🔗 Changelog

    3.9.1

    🔗 Changelog

    3.9.0

    diff

    🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

    3.8.5

    🔗 Changelog

    3.8.4

    🔗 Changelog

    Changelog

    Sourced from prettier's changelog.

    3.9.4

    diff

    Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

    <!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
@​content(icon) {
<span>Icon!</span>
}
@​content(description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
@​content (icon) {
<span>Icon!</span>
}
@​content (description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>

    3.9.3

    diff

    Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @​seiyab)

    </tr></table>

    ... (truncated)

    Commits
    • b693cb2 Release 3.9.4
    • 2e92ac0 Angular: Format @content(name) -> @content (name) to align with other blo...
    • abed2c2 Bump Prettier dependency to 3.9.3
    • 6cfbc00 Clean changelog_unreleased
    • 3732e1d Release 3.9.3
    • a74a7b0 Allow decorators to be used with declare on class fields (#19492)
    • bd9e11a Correct text identification in liquid syntax (#19489)
    • 269eee3 Bump Prettier dependency to 3.9.1
    • ec7ccd1 Clean changelog_unreleased
    • c47654c Release 3.9.1
    • Additional commits viewable in compare view

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

    @dependabot
    Bump the production-dependencies group across 1 directory with 9 updates
    d2ba586 
    Bumps the production-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.5.0` | `1.6.0` |
| [@myriaddreamin/rehype-typst](https://github.com/Myriad-Dreamin/typst.ts) | `0.7.0-rc2` | `0.8.0-rc3` |
| [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.38.3` | `1.38.6` |
| [preact](https://github.com/preactjs/preact) | `10.29.2` | `10.29.3` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.3` |
| [workerpool](https://github.com/josdejong/workerpool) | `10.0.2` | `10.0.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.1` | `26.1.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.0` | `0.28.1` |
| [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.4` |



Updates `@clack/prompts` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.6.0/packages/prompts)

Updates `@myriaddreamin/rehype-typst` from 0.7.0-rc2 to 0.8.0-rc3
- [Release notes](https://github.com/Myriad-Dreamin/typst.ts/releases)
- [Changelog](https://github.com/Myriad-Dreamin/typst.ts/blob/main/docs/release-workflows.md)
- [Commits](Myriad-Dreamin/typst.ts@v0.7.0-rc2...v0.8.0-rc3)

Updates `isomorphic-git` from 1.38.3 to 1.38.6
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.38.3...v1.38.6)

Updates `preact` from 10.29.2 to 10.29.3
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](preactjs/preact@10.29.2...10.29.3)

Updates `sharp` from 0.34.5 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.3)

Updates `workerpool` from 10.0.2 to 10.0.3
- [Changelog](https://github.com/josdejong/workerpool/blob/master/HISTORY.md)
- [Commits](josdejong/workerpool@v10.0.2...v10.0.3)

Updates `@types/node` from 25.9.1 to 26.1.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `esbuild` from 0.28.0 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.0...v0.28.1)

Updates `prettier` from 3.8.3 to 3.9.4
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.3...3.9.4)

---
updated-dependencies:
- dependency-name: "@clack/prompts"
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@myriaddreamin/rehype-typst"
  dependency-version: 0.8.0-rc3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: isomorphic-git
  dependency-version: 1.38.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: preact
  dependency-version: 10.29.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: workerpool
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: prettier
  dependency-version: 3.9.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 1, 2026
    @dependabot @github

    dependabot Bot commented on behalf of github Jul 8, 2026

    Copy link
    Copy Markdown
    Contributor Author

    Looks like these dependencies are updatable in another way, so this is no longer needed.

    @dependabot dependabot Bot closed this Jul 8, 2026
    @dependabot
    dependabot Bot deleted the dependabot/bun/production-dependencies-9bc0ce17da branch July 8, 2026 13:44
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    No reviews

    Assignees

    No one assigned

    Labels

    dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    0 participants