build(deps): bump the dev-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #43 · abby-inc/abby-node

dependabot · 2026-09-07T07:08:13Z

Bumps the dev-dependencies group with 4 updates in the / directory: esbuild, lint-staged, oxlint and rollup.

Updates esbuild from 0.28.1 to 0.28.2

Release notes

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x
 bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Updates lint-staged from 17.3.0 to 17.4.1

Release notes

Sourced from lint-staged's releases.

v17.4.1

17.4.1

Patch Changes

#1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes
#1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:
// lint-staged.config.ts
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': ['prettier --check', 'eslint'],
})
#1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.
Patch Changes

#1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

#1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

Changelog

Sourced from lint-staged's changelog.

17.4.1

Patch Changes

#1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

17.4.0

Minor Changes
#1836 90ec282 - Added a new defineConfig helper for type-checking the lint-staged configuration:
// lint-staged.config.ts
import { defineConfig } from 'lint-staged/config'
export default defineConfig({
'*.js': ['prettier --check', 'eslint'],
})
#1832 510a27c - Added a new flag --all to make lint-staged include all files tracked by Git, instead of only staged.

By default lint-staged only runs tasks on files that include staged changes (hence the name). Use this flag to include all files tracked in Git version control (standard exclusions apply). Using this flag implies the --no-stash flag, disabling the automatic backup, and the --allow-empty flag so that lint-staged doesn't fail when there are no changes after running. This makes it easier to run npx lint-staged --all on a clean state, for example in CI.
Patch Changes

#1838 69bec99 - The behavior of the automatic backup stash has been improved when running lint-staged in multiple worktrees in parallel. You should still avoid running multiple instances of lint-staged in parallel in the same tree, because some of the Git operations are locking and might lead to data loss.

#1839 5e5bdd2 - Parsing of lint-staged CLI flags and Node.js API options has been rewritten to avoid inconsistent behavior between the two.

Commits

d0c1517 Merge pull request #1841 from lint-staged/changeset-release/main
f061335 chore(changeset): release
d2721af Merge pull request #1840 from lint-staged/updates
efe5b63 ci: update Changesets action because it failed to publish
cd76ce3 build: update dependencies
ea195e1 Merge pull request #1837 from lint-staged/changeset-release/main
a6a0d61 chore(changeset): release
0a09098 Merge pull request #1832 from lint-staged/add-all-flag
7fd685b fix: further fix parsing options logic
510a27c feat: add --all flag for including all files tracked by Git instead of just...
Additional commits viewable in compare view

Updates oxlint from 1.80.0 to 1.81.0

Release notes

Sourced from oxlint's releases.

oxlint v1.81.0 & oxfmt v0.66.0

Table of Contents

Oxlint v1.81.0

Oxfmt v0.66.0

Oxlint v1.81.0

🚀 Features

60b945d linter/nextjs/no-typos: Implement suggestion (#26091) (Mikhail Baev)

🐛 Bug Fixes

33ac4b0 linter/lsp: Prevent tsgolint from holding onto processes (#25570) (Adrian Schaedle)

baf4b1e linter/import/no-empty-named-blocks: Make empty value import removal a suggestion (#26155) (camc314)

77cfaec linter/eslint/object-shorthand: Preserve __proto__ semantics (#26154) (camc314)

fa3c082 linter/unicorn/prefer-set-size: Ignore shadowed Set constructors (#26153) (camc314)

e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)

d86c113 linter: Normalize reversed JS plugin locations (#26138) (camc314)

73c09b2 linter/eslint/no-use-before-define: Run on JS, JSX files (#26114) (camc314)

03ef0f2 linter/unicorn/no-useless-spread: Treat typed arrays as a distinct value hint (#26067) (Aadharsh Pannirselvam)

bd15905 linter/react/no-unstable-nested-components: Check nested component object property names (#26101) (camc314)

3910e2b linter/eslint/no-unassigned-vars: Skip Svelte and Vue files (#26042) (Hamody We)

047f7ca linter/plugins: Fix interaction between JS plugins and Vue rules (#26080) (overlookmotel)

8531b9b linter/plugins: Alter method for obtaining mutable Program when sending AST to JS plugins (#26077) (overlookmotel)

dc464ff linter/unicorn/prefer-math-min-max: Avoid unsafe autofix (#26060) (camc314)

📚 Documentation

464ddd1 linter: Support a shared short description for jest/vitest rules (#26186) (connorshea)

9db5ad3 linter: Add short description to vue/no-dupe-keys (#26183) (connorshea)

db66f58 linter: Correct export/import mismatch in bar and foo example (#25927) (billychannnnnn)

d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

Oxfmt v0.66.0

🚀 Features

1fb37b6 formatter/css: Format declaration-shaped raw-prelude rules (postcss nested config blocks) (#26194) (leaysgur)

🐛 Bug Fixes

9f81002 formatter: Re-add suppressed statement terminators per options.semi (#26220) (leaysgur)

769ffd5 formatter: Print suppressed typecast parens (#26218) (leaysgur)

5ff57f8 formatter/sort-imports: Handle custom side effect groups (#26217) (leaysgur)

2f4d759 formatter: Do not skip cast comment lookup (#26216) (leaysgur)

1213e12 formatter: Preserve comment for statement terminators and binary casts (#26213) (leaysgur)

57e8e22 formatter_css: Space a folded sign after a call in Less operations (#26134) (leaysgur)

e4298fb formatter/jsdoc: Follow CommonMark for interrupting lists and guard wrapping from creating them (#26098) (leaysgur)

a1e21c2 formatter: Apply head body policy everywhere (#26074) (leaysgur)

676b7e1 formatter: Keep comments in their for-head slot, before an empty-statement body and do-while (#26073) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.81.0] - 2026-08-31

📚 Documentation

d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)

aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)

36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)

beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)

4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)

285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)

4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)

d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)

5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

[1.76.0] - 2026-07-27

🚀 Features

8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)

7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)

... (truncated)

Commits

0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
63bc313 chore(npm): update funding URL (#26066)
See full diff in compare view

Updates rollup from 4.63.0 to 4.63.1

Release notes

Sourced from rollup's releases.

v4.63.1

4.63.1

2026-08-28

Bug Fixes

Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

#6489: fix(deps): update minor/patch updates (@renovate[bot])

#6490: Revert improve function return value tracking (@lukastaegert)

Changelog

Sourced from rollup's changelog.

4.63.1

2026-08-28

Bug Fixes

Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

#6489: fix(deps): update minor/patch updates (@renovate[bot])

#6490: Revert improve function return value tracking (@lukastaegert)

Commits

78bfef0 4.63.1
be6b835 Revert improve function return value tracking (#6490)
db15922 fix(deps): update minor/patch updates (#6489)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…4 updates Bumps the dev-dependencies group with 4 updates in the / directory: [esbuild](https://github.com/evanw/esbuild), [lint-staged](https://github.com/lint-staged/lint-staged), [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) and [rollup](https://github.com/rollup/rollup). Updates `esbuild` from 0.28.1 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.28.1...v0.28.2) Updates `lint-staged` from 17.3.0 to 17.4.1 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.3.0...v17.4.1) Updates `oxlint` from 1.80.0 to 1.81.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.81.0/npm/oxlint) Updates `rollup` from 4.63.0 to 4.63.1 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.63.0...v4.63.1) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: lint-staged dependency-version: 17.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: oxlint dependency-version: 1.81.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: rollup dependency-version: 4.63.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-07T07:08:14Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

codecov · 2026-09-07T07:08:43Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@           Coverage Diff           @@
##           master      #43   +/-   ##
=======================================
  Coverage   90.75%   90.75%           
=======================================
  Files           1        1           
  Lines         119      119           
  Branches       30       30           
=======================================
  Hits          108      108           
  Misses         11       11

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

dependabot Bot added the automated Opened by github-actions label Sep 7, 2026

Navigation Menu

Uh oh!

build(deps): bump the dev-dependencies group across 1 directory with 4 updates - #43

build(deps): bump the dev-dependencies group across 1 directory with 4 updates#43
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/dev-dependencies-b20ab311f8

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

codecov Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

v0.28.2

0.28.2

v17.4.1

17.4.1

Patch Changes

17.4.0

Minor Changes

Patch Changes

17.4.1

Patch Changes

17.4.0

Minor Changes

Patch Changes

oxlint v1.81.0 & oxfmt v0.66.0

Table of Contents

Oxlint v1.81.0

🚀 Features

🐛 Bug Fixes

📚 Documentation

Oxfmt v0.66.0

🚀 Features

🐛 Bug Fixes

[1.81.0] - 2026-08-31

📚 Documentation

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

🐛 Bug Fixes

[1.78.0] - 2026-08-10

🚀 Features

🐛 Bug Fixes

[1.77.0] - 2026-08-03

🐛 Bug Fixes

📚 Documentation

[1.76.0] - 2026-07-27

🚀 Features

v4.63.1

4.63.1

Bug Fixes

Pull Requests

4.63.1

Bug Fixes

Pull Requests

Uh oh!

dependabot Bot commented on behalf of github Sep 7, 2026

Labels

Uh oh!

codecov Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

codecov Bot commented Sep 7, 2026 •

edited

Loading