Skip to content

Bump the production-dependencies group across 1 directory with 11 updates - #136

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bun/production-dependencies-8c2e8db312
Closed

Bump the production-dependencies group across 1 directory with 11 updates#136
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bun/production-dependencies-8c2e8db312

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 11 updates in the / directory:

Package From To
@clack/prompts 1.5.0 1.7.0
@myriaddreamin/rehype-typst 0.7.0-rc2 0.8.0-rc3
@napi-rs/simple-git 0.1.22 1.1.0
globby 16.2.0 16.2.1
isomorphic-git 1.38.3 1.38.6
preact 10.29.2 10.29.6
sharp 0.34.5 0.35.3
workerpool 10.0.2 10.0.3
@types/node 25.9.1 26.1.1
esbuild 0.28.0 0.28.1
prettier 3.8.3 3.9.4

Updates @clack/prompts from 1.5.0 to 1.7.0

Release notes

Sourced from @​clack/prompts's releases.

@​clack/prompts@​1.7.0

Minor Changes

  • #574 8f1c380 Thanks @​dreyfus92! - Add showInstructions option to select, multiselect, and groupMultiselect. Keyboard hints remain shown by default; pass showInstructions: false to hide them.

Patch Changes

@​clack/prompts@​1.6.0

Minor Changes

  • #568 f87933f Thanks @​florian-lefebvre! - Updates default formatter of note() to note dim lines anymore

    If you want the old behavior, provide a format() function:

    import { note } from '@clack/prompts';
+import { styleText } from 'node:util';
note(
'You can edit the file src/index.jsx',
'Next steps.'

{ format: (text) => styleText('dim', text) }
);

  • #567 cc6aab5 Thanks @​dreyfus92! - Add keyboard instruction footers to select, multiselect, and groupMultiselect in the active state, matching autocomplete. No option — always shown.

    • Patch Changes

    @​clack/prompts@​1.5.1

    Patch Changes

    Changelog

    Sourced from @​clack/prompts's changelog.

    1.7.0

    Minor Changes

    • #574 8f1c380 Thanks @​dreyfus92! - Add showInstructions option to select, multiselect, and groupMultiselect. Keyboard hints remain shown by default; pass showInstructions: false to hide them.

    Patch Changes

    1.6.0

    Minor Changes

    • #568 f87933f Thanks @​florian-lefebvre! - Updates default formatter of note() to note dim lines anymore

      If you want the old behavior, provide a format() function:

      import { note } from '@clack/prompts';
+import { styleText } from 'node:util';
note(
'You can edit the file src/index.jsx',
'Next steps.'

{ format: (text) => styleText('dim', text) }
);

  • #567 cc6aab5 Thanks @​dreyfus92! - Add keyboard instruction footers to select, multiselect, and groupMultiselect in the active state, matching autocomplete. No option — always shown.

    • Patch Changes

    1.5.1

    Patch Changes

    Commits

    Updates @myriaddreamin/rehype-typst from 0.7.0-rc2 to 0.8.0-rc3

    Release notes

    Sourced from @​myriaddreamin/rehype-typst's releases.

    v0.8.0-rc3

    • Updated the Typst integration to Typst v0.15.0-rc.1 in Myriad-Dreamin/typst.ts#850
    • Fixed source span resolution by falling back to vpath when needed.

    Full Changelog: Myriad-Dreamin/typst.ts@v0.7.0...v0.8.0-rc3

    Install typst-ts 0.8.0-rc3

    Install prebuilt binaries via shell script

    curl --proto '=https' --tlsv1.2 -LsSf https://github.com/Myriad-Dreamin/typst.ts/releases/download/v0.8.0-rc3/typst-ts-installer.sh | sh

    Install prebuilt binaries via powershell script

    powershell -ExecutionPolicy Bypass -c "irm https://github.com/Myriad-Dreamin/typst.ts/releases/download/v0.8.0-rc3/typst-ts-installer.ps1 | iex"

    Download typst-ts 0.8.0-rc3

    File Platform Checksum
    typst-ts-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
    typst-ts-x86_64-apple-darwin.tar.gz Intel macOS checksum
    typst-ts-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
    typst-ts-x86_64-pc-windows-msvc.zip x64 Windows checksum
    typst-ts-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
    typst-ts-loongarch64-unknown-linux-gnu.tar.gz LoongArch64 Linux checksum
    typst-ts-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
    typst-ts-arm-unknown-linux-gnueabihf.tar.gz ARMv6 Linux (Hardfloat) checksum
    typst-ts-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
    typst-ts-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
    typst-ts-loongarch64-unknown-linux-musl.tar.gz LoongArch64 MUSL Linux checksum
    typst-ts-riscv64gc-unknown-linux-musl.tar.gz RISCV MUSL Linux checksum
    typst-ts-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
    typst-ts-arm-unknown-linux-musleabihf.tar.gz ARMv6 MUSL Linux (Hardfloat) checksum
    typst-ts-armv7-unknown-linux-musleabihf.tar.gz ARMv7 MUSL Linux checksum

    v0.8.0-rc2

    ... (truncated)

    Commits
    • e1974e5 build: bump version to v0.8.0-rc3
    • c0833b4 fix(renderer): add canvas preview hit testing support (#874)
    • 737cc5d perf(renderer): support windowed canvas rendering (#873)
    • a873538 perf(renderer): reduce canvas renderer overhead (#872)
    • 814c71f fix(renderer): prefetch canvas resources before rendering (#871)
    • c6ec830 build: bump version to v0.8.0-rc2 (#869)
    • 329e430 chore(deps): bump typst assets and tinymist (#868)
    • 00ea191 fix(renderer): support canvas gradients (#867)
    • 3cc267f fix(renderer): preserve tiling offsets in svg export (#866)
    • 6e39dbf chore(ci): upgrade cargo-dist workflow cache (#865)
    • Additional commits viewable in compare view
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for @​myriaddreamin/rehype-typst since your current version.


    Updates @napi-rs/simple-git from 0.1.22 to 1.1.0

    Release notes

    Sourced from @​napi-rs/simple-git's releases.

    v1.1.0

    What's Changed

    Full Changelog: Brooooooklyn/simple-git@v1.0.0...v1.1.0

    v1.0.0

    What's Changed

    ... (truncated)

    Commits
    • 3b8e55c 1.1.0
    • e580290 fix(deps): update void to v0.10.6 (#153)
    • 659d5ca feat: add created (first-add commit) to FileModification (#152)
    • 3ca64c5 chore(deps): update dorny/paths-filter action to v4 (#150)
    • 9b5a48b fix(deps): update dependency void to v0.10.5 (#151)
    • 723f6b3 chore: move renovate.json
    • 4ca5860 chore: fix yarn and renovate config
    • 638b632 fix(deps): update dependency @​void/react to v0.10.5 (#148)
    • 8300a3f fix(deps): update dependency @​void/md to v0.10.5 (#147)
    • 6881589 feat: simple-git.napi.rs website (landing + docs + Cloudflare deploy) (#146)
    • Additional commits viewable in compare view

    Updates globby from 16.2.0 to 16.2.1

    Release notes

    Sourced from globby's releases.

    v16.2.1

    • Fix gitignore ignoring an entire checkout under an anchored ancestor path (#277) e7bd988

    sindresorhus/globby@v16.2.0...v16.2.1

    Commits
    • 47e7f65 16.2.1
    • e7bd988 Fix gitignore ignoring an entire checkout under an anchored ancestor path (...
    • See full diff in compare view

    Updates isomorphic-git from 1.38.3 to 1.38.6

    Release notes

    Sourced from isomorphic-git's releases.

    v1.38.6

    1.38.6 (2026-06-30)

    Bug Fixes

    v1.38.5

    1.38.5 (2026-06-16)

    Bug Fixes

    • Support windows file paths in utils/join.js (#2302) (1395431)

    v1.38.4

    1.38.4 (2026-06-02)

    Bug Fixes

    • pass credential config username to auth callbacks (#2346) (d9920c5)
    Commits

    Updates preact from 10.29.2 to 10.29.6

    Release notes

    Sourced from preact's releases.

    10.29.6

    We had to revert preactjs/preact#5055 due to an incompatibility with useSignalEffect

    10.29.5

    Fixes

    10.29.4

    Fixes

    10.29.3

    Fixes

    Performance

    Types

    Maintenance

    Commits

    Updates sharp from 0.34.5 to 0.35.3

    Release notes

    Sourced from sharp's releases.

    v0.35.3

    • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

    • Improve code bundler support by resolving path to libvips binary.

    • Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

    • Emit warning about binaries provided by Electron for use on Linux.

    • Add hasAlpha property to output info. #4500

    • TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

    • Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

    • Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

    • Reject infinite values when validating numbers. #4553 @​metsw24-max

    • Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

    • Verify background colour values are numbers. #4556 @​metsw24-max

    • Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

    • Tighten recomb and affine matrix verification. #4560 @​chatman-media

    • Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

    v0.35.3-rc.2

    • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

    ... (truncated)

    Commits
    • 1018449 Release v0.35.3
    • ba303a7 Prerelease v0.35.3-rc.2
    • 4f94fc5 Upgrade to sharp-libvips v1.3.2
    • c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
    • 9a8d002 Docs: Add changelog entry and note about transferable #4520
    • 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
    • e000d0b Prerelease v0.35.3-rc.1
    • 9554ca9 Prerelease v0.35.3-rc.0
    • 6a29fd5 Emit warning about native binaries on Linux Electron
    • 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
    • Additional commits viewable in compare view

    Updates workerpool from 10.0.2 to 10.0.3

    Changelog

    Sourced from workerpool's changelog.

    2026-07-01, version 10.0.3

    Commits
    • 601124c chore: publish v10.0.3
    • c783508 chore: update babel devDependencies
    • 628a468 chore: run CI testing on Node.js 26, drop testing on v20
    • c8d5253 chore: upgrade devDependencies (most notably TypeScript 6)
    • e7db6f8 chore: fix merge conflicts
    • d2ba424 Merge remote-tracking branch 'origin/master'
    • e65007b chore(deps-dev): bump webpack-dev-server in /examples/webpack5 (#565)
    • b95c37c chore: update HISTORY.md
    • 32747db fix: #548 treat worker as busy while cleaning up canceled task (#549)
    • 44ab043 fix: cleanup spellings, and comment errors.
    • Additional commits viewable in compare view

    Updates @types/node from 25.9.1 to 26.1.1

    Commits

    Updates esbuild from 0.28.0 to 0.28.1

    Release notes

    Sourced from esbuild's releases.

    v0.28.1

    • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

      This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

      Thanks to @​dellalibera for reporting this issue.

    • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

      The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

      Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

      Thanks to @​sondt99 for reporting this issue.

    • Avoid inlining using and await using declarations (#4482)

      Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

      // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

    • Fix module evaluation when an error is thrown (#4461, #4467)

      If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

    • Fix some edge cases around the new operator (#4477)

      Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

      // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

    ... (truncated)

    Changelog

    Sourced from esbuild's changelog.

    0.28.1

    • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

      This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

      Thanks to @​dellalibera for reporting this issue.

    • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

      The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

      Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

      Thanks to @​sondt99 for reporting this issue.

    • Avoid inlining using and await using declarations (#4482)

      Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

      // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

    • Fix module evaluation when an error is thrown (#4461, #4467)

      If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

    • Fix some edge cases around the new operator (#4477)

      Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

      // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

    ... (truncated)

    Commits

    Updates prettier from 3.8.3 to 3.9.4

    Release notes

    Sourced from prettier's releases.

    3.9.4

    • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

    🔗 Changelog

    3.9.3

    @dependabot
    Bump the production-dependencies group across 1 directory with 11 upd…
    8decae4 
    …ates

Bumps the production-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.5.0` | `1.7.0` |
| [@myriaddreamin/rehype-typst](https://github.com/Myriad-Dreamin/typst.ts) | `0.7.0-rc2` | `0.8.0-rc3` |
| [@napi-rs/simple-git](https://github.com/Brooooooklyn/simple-git) | `0.1.22` | `1.1.0` |
| [globby](https://github.com/sindresorhus/globby) | `16.2.0` | `16.2.1` |
| [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.38.3` | `1.38.6` |
| [preact](https://github.com/preactjs/preact) | `10.29.2` | `10.29.6` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.3` |
| [workerpool](https://github.com/josdejong/workerpool) | `10.0.2` | `10.0.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.1` | `26.1.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.0` | `0.28.1` |
| [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.9.4` |



Updates `@clack/prompts` from 1.5.0 to 1.7.0
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.7.0/packages/prompts)

Updates `@myriaddreamin/rehype-typst` from 0.7.0-rc2 to 0.8.0-rc3
- [Release notes](https://github.com/Myriad-Dreamin/typst.ts/releases)
- [Changelog](https://github.com/Myriad-Dreamin/typst.ts/blob/main/docs/release-workflows.md)
- [Commits](Myriad-Dreamin/typst.ts@v0.7.0-rc2...v0.8.0-rc3)

Updates `@napi-rs/simple-git` from 0.1.22 to 1.1.0
- [Release notes](https://github.com/Brooooooklyn/simple-git/releases)
- [Commits](Brooooooklyn/simple-git@v0.1.22...v1.1.0)

Updates `globby` from 16.2.0 to 16.2.1
- [Release notes](https://github.com/sindresorhus/globby/releases)
- [Commits](sindresorhus/globby@v16.2.0...v16.2.1)

Updates `isomorphic-git` from 1.38.3 to 1.38.6
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.38.3...v1.38.6)

Updates `preact` from 10.29.2 to 10.29.6
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](preactjs/preact@10.29.2...10.29.6)

Updates `sharp` from 0.34.5 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.3)

Updates `workerpool` from 10.0.2 to 10.0.3
- [Changelog](https://github.com/josdejong/workerpool/blob/master/HISTORY.md)
- [Commits](josdejong/workerpool@v10.0.2...v10.0.3)

Updates `@types/node` from 25.9.1 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `esbuild` from 0.28.0 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.0...v0.28.1)

Updates `prettier` from 3.8.3 to 3.9.4
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.3...3.9.4)

---
updated-dependencies:
- dependency-name: "@clack/prompts"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@myriaddreamin/rehype-typst"
  dependency-version: 0.8.0-rc3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@napi-rs/simple-git"
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: globby
  dependency-version: 16.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: isomorphic-git
  dependency-version: 1.38.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: preact
  dependency-version: 10.29.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: workerpool
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: prettier
  dependency-version: 3.9.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 8, 2026
    @dependabot @github

    dependabot Bot commented on behalf of github Jul 15, 2026

    Copy link
    Copy Markdown
    Contributor Author

    Looks like these dependencies are updatable in another way, so this is no longer needed.

    @dependabot dependabot Bot closed this Jul 15, 2026
    @dependabot
    dependabot Bot deleted the dependabot/bun/production-dependencies-8c2e8db312 branch July 15, 2026 13:44
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    No reviews

    Assignees

    No one assigned

    Labels

    dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    0 participants