Skip to content

chore(deps): (deps-dev): bump the development group across 1 directory with 9 updates#306

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-f4f20729e1
Closed

chore(deps): (deps-dev): bump the development group across 1 directory with 9 updates#306
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-f4f20729e1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development group with 9 updates in the / directory:

Package From To
@rollup/plugin-commonjs 29.0.2 29.0.3
@types/node 25.6.0 25.9.3
@vitest/coverage-v8 4.1.5 4.1.9
esbuild 0.28.0 0.28.1
lefthook 2.1.6 2.1.9
node-gyp 12.3.0 13.0.0
oxlint 1.63.0 1.70.0
rollup 4.60.3 4.62.0
vitest 4.1.5 4.1.9

Updates @rollup/plugin-commonjs from 29.0.2 to 29.0.3

Changelog

Sourced from @​rollup/plugin-commonjs's changelog.

v29.0.3

2026-05-29

Bugfixes

Commits

Updates @types/node from 25.6.0 to 25.9.3

Commits

Updates @vitest/coverage-v8 from 4.1.5 to 4.1.9

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Commits

Updates esbuild from 0.28.0 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

Updates lefthook from 2.1.6 to 2.1.9

Release notes

Sourced from lefthook's releases.

v2.1.9

Changelog

  • 1d35cbabe1ebaf2a5ed4d2186caa0402de6448e2 chore: add pretty gradient (#1432)
  • 22be6c50e1412c748f3c6b60e9c61cd056dc693b deps: May 2026 (#1415)
  • 1bae568f03dfb88af9185031fa44e9fee285e917 fix: update hooks path after resetting (#1431)

v2.1.8

Changelog

  • 488a5f99a5a496e5837f757f8ce3e6c6d1415792 fix: do not warn if local hooks path is equal to default hooks path (#1421)

v2.1.7

Changelog

  • f415a9d3fce1d4f6af62622cf96c72e04ecf7bd3 chore: go mod tidy
  • cf4ab9ea4580f5aeb0d4b61d4dd169533e5bb0c9 fix: always restore unstaged changes (#1416)
  • 4c0e000d6fe9f35f42efefb9263b0b4cb5dfbd49 fix: apply stage_fixed only if it is safe (#1418)
  • 76aa843ef5ceb6970f61cd2ff28d16dd2ec82272 fix: linter, sacrifice optimization for readability
  • 9d53c36ed9a26d3bf66e341a9650a0ecac9b6a37 fix: separate fallback push branch from pathspecs (#1396)
  • 22c9f773cf93b59005bd244c5b00caab2947a755 fix: try to always restore unstaged changes (#1417)
  • 37d83986d8e6d6bf6792f57e22e7cbb1a9e28064 fix: use contrast colors (#1420)
  • eb1064d0b8c6248627960bea1abf6891db5a21b1 refactor: add new logger without a global state (#1385)
Changelog

Sourced from lefthook's changelog.

2.1.9 (2026-05-29)

2.1.8 (2026-05-19)

  • fix: do not warn if local hooks path is equal to default hooks path (#1421) by @​mrexox

2.1.7 (2026-05-19)

Commits
  • 75f99ff 2.1.9: fix install with --reset-hooks-path
  • 1d35cba chore: add pretty gradient (#1432)
  • 1bae568 fix: update hooks path after resetting (#1431)
  • 22be6c5 deps: May 2026 (#1415)
  • 9e75b21 2.1.8: reduce warning for core.hooksPath if it matches the default
  • 488a5f9 fix: do not warn if local hooks path is equal to default hooks path (#1421)
  • b5c8310 2.1.7: restore unstaged changes when possible
  • 37d8398 fix: use contrast colors (#1420)
  • 4c0e000 fix: apply stage_fixed only if it is safe (#1418)
  • 22c9f77 fix: try to always restore unstaged changes (#1417)
  • Additional commits viewable in compare view

Updates node-gyp from 12.3.0 to 13.0.0

Release notes

Sourced from node-gyp's releases.

v13.0.0

13.0.0 (2026-06-10)

⚠ BREAKING CHANGES

  • node-gyp now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

  • bump to new node engine range (b792b8e)

Bug Fixes

Core

Miscellaneous

v12.4.0

12.4.0 (2026-05-15)

Features

Bug Fixes

Miscellaneous

... (truncated)

Changelog

Sourced from node-gyp's changelog.

13.0.0 (2026-06-10)

⚠ BREAKING CHANGES

  • node-gyp now supports node ^22.22.2 || ^24.15.0 || >=26.0.0

Features

  • bump to new node engine range (b792b8e)

Bug Fixes

Core

Miscellaneous

12.4.0 (2026-05-15)

Features

Bug Fixes

Miscellaneous

  • add workflow_dispatch trigger to tests workflow (#3299) (b2fcdcd)
Commits

Updates oxlint from 1.63.0 to 1.70.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

  • 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
  • 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
  • bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
  • 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
  • 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
  • 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
  • ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

  • 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
  • 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
  • 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
  • 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
  • a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
  • ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
  • 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
  • ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
  • e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
  • 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
  • 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
  • fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
  • ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
  • dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
  • 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
  • cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

  • 25d577e language_server: Start tools in parallel (#15500) (Sysix)
  • 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
  • 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
  • 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
  • 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
  • 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

  • 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
  • 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
  • a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
  • 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
  • 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
  • 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.70.0] - 2026-06-15

🚀 Features

  • 2e8bda4 linter/vue: Implement no-dupe-keys rule (#23350) (bab)
  • 1490a0a linter/react: Implement react-compiler rule (#23202) (Boshen)
  • dd560ae linter/unicorn: Implement no-array-fill-with-reference-type rule (#23397) (Mikhail Baev)
  • af36c2f linter: Add schema for react/jsx-curly-brace-presence (#23400) (WaterWhisperer)
  • 47d34a3 linter: Add schema for react/jsx-handler-names (#23393) (WaterWhisperer)
  • f4250d0 linter: Add schema for unicorn/import-style (#23386) (WaterWhisperer)
  • 30c74ce linter: Add schema for jsx_a11y/no-noninteractive-element-to-interactive-role (#23384) (Sysix)
  • cfbe8dc linter: Add schema for jsx_a11y/no-interactive-element-to-noninteractive-role (#23382) (WaterWhisperer)
  • d15b7ff linter: Add schema for typescript/no-restricted-types (#23381) (WaterWhisperer)
  • 028a811 linter: Add schema for jsx-a11y/media-has-caption (#23377) (Sysix)
  • b3b1038 linter: Add schema for jsx-a11y/label-has-associated-control (#23376) (Sysix)
  • 7ada6b2 linter: Add schema for jsx_a11y/no-distracting-elements (#23379) (WaterWhisperer)
  • ee3dd49 linter: Add schema for jsx-a11y/img-redundant-alt (#23374) (Sysix)
  • df5f8dd linter: Add short descriptions to most lint rules. (#23365) (Connor Shea)
  • e3fd735 linter: Add schema for jsx_a11y/alt-text (#23369) (Sysix)
  • 0f2fff4 linter: Add schema for react/exhaustive-deps (#23372) (Mikhail Baev)
  • e3e4e10 linter: Add schema for react_perf/jsx-no-new-object-as-prop (#23368) (Mikhail Baev)
  • 9366d44 linter: Add schema for unicorn/prefer-at (#23366) (WaterWhisperer)
  • f57b55d linter: Add schema for typescript/array-type (#23355) (Sysix)
  • 0dcf912 linter: Add schema for typescript/ban-ts-comment (#23354) (Sysix)
  • 51fa83e linter: Add schema for react/no-did-update-set-state (#23357) (Mikhail Baev)
  • 59db0bd linter: Add schema for consistent-generic-constructors (#23353) (Sysix)
  • c4775c0 linter: Add schema for typescript/consistent-type-assertions (#23349) (Sysix)
  • 6e516f7 linter: Add schema for typescript/consistent-type-imports (#23348) (Sysix)
  • 012134d linter: Add schema for react/jsx-no-target-blank (#23345) (WaterWhisperer)
  • 0806aae linter: Add schema for jsx_a11y/no-noninteractive-tabindex (#23337) (Mikhail Baev)
  • 0708b5a linter: Add schema for react/jsx-filename-extension (#23315) (Mikhail Baev)
  • 150bce1 linter: Add schema for typescript/no-empty-object-type (#23309) (Sysix)
  • f9e36f1 linter: Add schema for typescript/no-duplicate-type-constituents (#23308) (Sysix)
  • 937accf linter: Add schema for typescript/no-invalid-void-type (#23307) (Sysix)
  • 3e042b9 linter: Add schema for typescript/no-misused-promises (#23306) (Sysix)
  • da212d1 linter: Add schema for typescript/no-unnecessary-condition (#23305) (Sysix)
  • f8f0d38 linter: Add schema for typescript/parameter-properties (#23304) (Sysix)
  • 2275fc7 linter: Add schema for typescript/prefer-nullish-coalescing (#23302) (Sysix)
  • d353858 linter: Add schema for typescript/prefer-string-starts-ends-with (#23301) (Sysix)
  • 03060f5 linter: Add schema for typescript/triple-slash-reference (#23300) (Sysix)
  • 6619cee linter: Add schema for promise/param-names (#23298) (Sysix)
  • 8bf108e linter: Add schema for promise/catch-or-return (#23297) (Sysix)
  • 48158d0 linter: Add schema for vitest/consistent-each-for (#23294) (Sysix)
  • 7e74c98 linter: Add schema for vitest/consistent-test-filename (#23293) (Sysix)
  • ff94d4a linter: Add schema for vitest/consistent-vitest-vi (#23292) (Sysix)
  • 2409a10 linter: Add schema for vitest/prefer-import-in-mock (#23291) (Sysix)
  • 3d782b7 linter: Add schema for react/no-unstable-nested-components (#23287) (Mikhail Baev)
  • 0a0bc2f linter/jsx-a11y: Add allowedRedundantRoles option to no-redundant-roles (#22820) (bab)
  • 80758a5 linter/vue: Implement no-side-effects-in-computed-properties rule (#23282) (bab)
  • e3869ac linter: Add schema for react/no-object-type-as-default-prop (#23279) (Mikhail Baev)

... (truncated)

Commits
  • aa79b5b release(apps): oxlint v1.70.0 && oxfmt v0.55.0 (#23442)
  • 5cb8d1b fix(linter/jsx-a11y/control-has-associated-label): reject excessive label dep...
  • f682e25 docs(linter): remove manually written options doc for `eslint/prefer-arrow-ca...
  • 2e8bda4 feat(linter/vue): implement no-dupe-keys rule (#23350)
  • 64c942c docs(linter): remove manually written options doc for eslint/no-sequences (...
  • 1490a0a feat(linter/react): implement react-compiler rule (#23202)
  • 965358e refactor(linter): reuse RuleNoConfig reference for rule schema (#23390)
  • dd560ae feat(linter/unicorn): implement no-array-fill-with-reference-type rule (#23...
  • af36c2f feat(linter): add schema for react/jsx-curly-brace-presence (#23400)
  • 47d34a3 feat(linter): add schema for react/jsx-handler-names (#23393)
  • Additional commits viewable in compare view

Updates rollup from 4.60.3 to 4.62.0

Release notes

Sourced from rollup's releases.

v4.62.0

4.62.0

2026-06-13

Features

  • Ensure that shared dependencies between manual chunks and entry points receive a serparate chunk (#6374)

Pull Requests

v4.61.1

4.61.1

2026-06-04

Bug Fixes

  • Avoid extraneous newlines when adding headers via plugins (#6403)
  • Fix a rare issue where starting Rollup would hang on Windows (#6404)

Pull Requests

v4.61.0

4.61.0

2026-06-01

Features

  • Sort entry modules to make chunk hashes deterministic (#6391)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.62.0

2026-06-13

Features

  • Ensure that shared dependencies between manual chunks and entry points receive a serparate chunk (#6374)

Pull Requests

4.61.1

2026-06-04

Bug Fixes

  • Avoid extraneous newlines when adding headers via plugins (#6403)
  • Fix a rare issue where starting Rollup would hang on Windows (#6404)

Pull Requests

4.61.0

2026-06-01

Features

  • Sort entry modules to make chunk hashes deterministic (#6391)

Pull Requests

@dependabot
chore(deps): (deps-dev): bump the development group across 1 director…
d650dca 
…y with 9 updates

Bumps the development group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@rollup/plugin-commonjs](https://github.com/rollup/plugins/tree/HEAD/packages/commonjs) | `29.0.2` | `29.0.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.6.0` | `25.9.3` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.5` | `4.1.9` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.0` | `0.28.1` |
| [lefthook](https://github.com/evilmartians/lefthook) | `2.1.6` | `2.1.9` |
| [node-gyp](https://github.com/nodejs/node-gyp) | `12.3.0` | `13.0.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.63.0` | `1.70.0` |
| [rollup](https://github.com/rollup/rollup) | `4.60.3` | `4.62.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.5` | `4.1.9` |



Updates `@rollup/plugin-commonjs` from 29.0.2 to 29.0.3
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/commonjs/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/commonjs-v29.0.3/packages/commonjs)

Updates `@types/node` from 25.6.0 to 25.9.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 4.1.5 to 4.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8)

Updates `esbuild` from 0.28.0 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.0...v0.28.1)

Updates `lefthook` from 2.1.6 to 2.1.9
- [Release notes](https://github.com/evilmartians/lefthook/releases)
- [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md)
- [Commits](evilmartians/lefthook@v2.1.6...v2.1.9)

Updates `node-gyp` from 12.3.0 to 13.0.0
- [Release notes](https://github.com/nodejs/node-gyp/releases)
- [Changelog](https://github.com/nodejs/node-gyp/blob/main/CHANGELOG.md)
- [Commits](nodejs/node-gyp@v12.3.0...v13.0.0)

Updates `oxlint` from 1.63.0 to 1.70.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.70.0/npm/oxlint)

Updates `rollup` from 4.60.3 to 4.62.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.60.3...v4.62.0)

Updates `vitest` from 4.1.5 to 4.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest)

---
updated-dependencies:
- dependency-name: "@rollup/plugin-commonjs"
  dependency-version: 29.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@types/node"
  dependency-version: 25.9.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: lefthook
  dependency-version: 2.1.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: node-gyp
  dependency-version: 13.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development
- dependency-name: oxlint
  dependency-version: 1.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: rollup
  dependency-version: 4.62.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: vitest
  dependency-version: 4.1.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
...

Signed-off-by: dependabot[bot] <[email protected]>
@socket-security

socket-security Bot commented Jun 17, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedesbuild@​0.28.1911007391100
Addedvitest@​4.1.9981007999100
Added@​vitest/​coverage-v8@​4.1.9991007998100
Added@​types/​node@​25.9.31001008196100
Added@​rollup/​plugin-commonjs@​29.0.39910010091100
Addedlefthook@​2.1.99210010094100
Addedoxlint@​1.70.0991009296100
Addednode-gyp@​13.0.09910010095100
Addedrollup@​4.62.09710010099100

View full report

@dependabot @github

dependabot Bot commented on behalf of github Jun 17, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 17, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/development-f4f20729e1 branch June 17, 2026 15:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants