Skip to content

build(deps-dev): bump the dev-dependencies group with 6 updates - #4

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-db7ca7660a
Closed

build(deps-dev): bump the dev-dependencies group with 6 updates#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-db7ca7660a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the dev-dependencies group with 6 updates:

Package From To
@medusajs/eslint-plugin 2.16.0 2.18.0
turbo 2.10.5 2.10.7
@medusajs/test-utils 2.17.2 2.18.0
@swc/core 1.15.43 1.15.46
@medusajs/types 2.17.2 2.18.0
postcss 8.5.19 8.5.23

Updates @medusajs/eslint-plugin from 2.16.0 to 2.18.0

Release notes

Sourced from @​medusajs/eslint-plugin's releases.

v2.18.0

Highlights

This release comes with new features, bug fixes, and dependency updates for better security.

Medusa MCP users can update their project using the following prompt:

Update my Medusa project to v2.18.0

Balanced Query Load Strategy by Default

🚧 Breaking change

The default database load strategy has changed from SELECT_IN to BALANCED, matching MikroORM v7's intended default. MikroORM picks between a joined and a select-in approach per relation, which improves query performance in most cases. Because it changes how relations are loaded, review query-heavy paths and any snapshot or query-count assertions in your tests after upgrading.

Return Value of Generated Internal Service's delete Method Changed

🚧 Breaking change

This affects usages of generated internal services. They do not impact methods generated by MedusaService such as deletePosts.

The return value of the delete method of a generated internal service has been changed to cater for composite primary keys:

// before
delete(idOrSelector: string, sharedContext?: Context): Promise<string[]>
delete(idOrSelector: string[], sharedContext?: Context): Promise<string[]>
delete(idOrSelector: object, sharedContext?: Context): Promise<string[]>
delete(idOrSelector: object[], sharedContext?: Context): Promise<string[]>
delete(
  idOrSelector: {
    selector: FilterQuery<any> | BaseFilterable<FilterQuery<any>>
  },
  sharedContext?: Context
): Promise<string[]>
// after
delete(
idOrSelector: string,
sharedContext?: Context
): Promise<string[] | Record<string, any>[]>
delete(
idOrSelector: string[],
sharedContext?: Context
): Promise<string[] | Record<string, any>[]>
delete(
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/eslint-plugin's changelog.

2.18.0

Patch Changes

  • 598020c157cec9b9905f7817c3cded4aa44ece94 - fix(eslint-plugin): normalize Windows paths in cross-module relationship rule

  • fdf80069f11c23b6ec458119934251db5e6fce85 - feat(eslint-plugin): add a rule for wildcard + specific field selections in query

  • 8df11805fc51f4818647da433021c4fa7f6004f1 - Remove the use-query-context-utility rule. It required wrapping the entire query.graph / query.index context object with QueryContext(...), but the correct placement is query-specific: pricing queries wrap the calculated_price leaf (context: { variants: { calculated_price: QueryContext(...) } }), while others (such as shipping options) wrap the whole context. As written, the rule flagged correct pricing code and autofixed it into a runtime error (Trying to query by not existing property Product.context), contradicting the official docs and the framework's own usage. Correct placement cannot be determined generically, so the rule is removed. Fixes #15821.

2.17.2

Patch Changes

2.17.1

2.17.0

Patch Changes

Commits
Attestation changes

This version has no provenance attestation, while the previous version (2.16.0) was attested. Review the package versions before updating.


Updates turbo from 2.10.5 to 2.10.7

Release notes

Sourced from turbo's releases.

Turborepo v2.10.7-canary.1

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.6-canary.5...v2.10.7-canary.1

Turborepo v2.10.6

What's Changed

Changelog

... (truncated)

Commits

Updates @medusajs/test-utils from 2.17.2 to 2.18.0

Release notes

Sourced from @​medusajs/test-utils's releases.

v2.18.0

Highlights

This release comes with new features, bug fixes, and dependency updates for better security.

Medusa MCP users can update their project using the following prompt:

Update my Medusa project to v2.18.0

Balanced Query Load Strategy by Default

🚧 Breaking change

The default database load strategy has changed from SELECT_IN to BALANCED, matching MikroORM v7's intended default. MikroORM picks between a joined and a select-in approach per relation, which improves query performance in most cases. Because it changes how relations are loaded, review query-heavy paths and any snapshot or query-count assertions in your tests after upgrading.

Return Value of Generated Internal Service's delete Method Changed

🚧 Breaking change

This affects usages of generated internal services. They do not impact methods generated by MedusaService such as deletePosts.

The return value of the delete method of a generated internal service has been changed to cater for composite primary keys:

// before
delete(idOrSelector: string, sharedContext?: Context): Promise<string[]>
delete(idOrSelector: string[], sharedContext?: Context): Promise<string[]>
delete(idOrSelector: object, sharedContext?: Context): Promise<string[]>
delete(idOrSelector: object[], sharedContext?: Context): Promise<string[]>
delete(
  idOrSelector: {
    selector: FilterQuery<any> | BaseFilterable<FilterQuery<any>>
  },
  sharedContext?: Context
): Promise<string[]>
// after
delete(
idOrSelector: string,
sharedContext?: Context
): Promise<string[] | Record<string, any>[]>
delete(
idOrSelector: string[],
sharedContext?: Context
): Promise<string[] | Record<string, any>[]>
delete(
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/test-utils's changelog.

2.18.0

Patch Changes

Commits

Updates @swc/core from 1.15.43 to 1.15.46

Changelog

Sourced from @​swc/core's changelog.

[1.15.46] - 2026-07-19

Bug Fixes

  • (deps) Update crossbeam-epoch to 0.9.20 (#12004) (fababa1)

  • (es/fixer) Normalize for-head ident patterns (#11968) (af681bc)

  • (es/fixer) Preserve parens around PURE-annotated receivers (#12022) (73d8941)

  • (es/hygiene) Ignore eval in default hygiene pass (#12003) (dd43ad6)

  • (es/minifier) Eliminate unused classes with cyclic references (#11963) (63a94b9)

  • (es/minifier) Preserve switch fallthrough termination (#11971) (a5d19ae)

  • (es/minifier) Check last case (#11972) (060c7ac)

  • (es/minifier) Disable IIFE invoke when there's eval (#11984) (eabe4be)

  • (es/minifier) Invoke IIFE when has eval (#11987) (457df11)

  • (es/minifier) Make Infect Collect collect every used ident (#11998) (fb9ebee)

  • (es/minifier) Measure number length precisely (#12026) (54d139a)

  • (es/module) Rewrite .tsx imports to .js unless JSX is preserved (#11995) (c341d9c)

  • (es/module) Rewrite SystemJS transform (#11996) (2f47530)

  • (es/modules) Resolve relative symlinked inputs from cwd (#11883) (01e857d)

  • (es/react) Emit jsxdev source for fragments (#11993) (a70ce24)

... (truncated)

Commits
  • 9383162 chore: Publish 1.15.46 with swc_core v74.0.1
  • 035084a chore: Publish 1.15.46-nightly-20260719.1 with swc_core v74.0.1
  • 42d599f chore: Publish 1.15.45-nightly-20260719.1 with swc_core v74.0.1
  • 715eab8 chore: Publish 1.15.44-nightly-20260718.1 with swc_core v74.0.0
  • d6833cc refactor(es/lexer): remove smartstring dependency (#12013)
  • 5761a2b refactor: remove direct rkyv dependencies (#12010)
  • f36e4b6 refactor(es/helpers): Generate inline helpers from canonical ESM sources (#12...
  • 2f47530 fix(es/module): Rewrite SystemJS transform (#11996)
  • 26d8a28 build: Remove vergen dependency (#11976)
  • See full diff in compare view

Updates @medusajs/types from 2.17.2 to 2.18.0

Release notes

Sourced from @​medusajs/types's releases.

v2.18.0

Highlights

This release comes with new features, bug fixes, and dependency updates for better security.

Medusa MCP users can update their project using the following prompt:

Update my Medusa project to v2.18.0

Balanced Query Load Strategy by Default

🚧 Breaking change

The default database load strategy has changed from SELECT_IN to BALANCED, matching MikroORM v7's intended default. MikroORM picks between a joined and a select-in approach per relation, which improves query performance in most cases. Because it changes how relations are loaded, review query-heavy paths and any snapshot or query-count assertions in your tests after upgrading.

Return Value of Generated Internal Service's delete Method Changed

🚧 Breaking change

This affects usages of generated internal services. They do not impact methods generated by MedusaService such as deletePosts.

The return value of the delete method of a generated internal service has been changed to cater for composite primary keys:

// before
delete(idOrSelector: string, sharedContext?: Context): Promise<string[]>
delete(idOrSelector: string[], sharedContext?: Context): Promise<string[]>
delete(idOrSelector: object, sharedContext?: Context): Promise<string[]>
delete(idOrSelector: object[], sharedContext?: Context): Promise<string[]>
delete(
  idOrSelector: {
    selector: FilterQuery<any> | BaseFilterable<FilterQuery<any>>
  },
  sharedContext?: Context
): Promise<string[]>
// after
delete(
idOrSelector: string,
sharedContext?: Context
): Promise<string[] | Record<string, any>[]>
delete(
idOrSelector: string[],
sharedContext?: Context
): Promise<string[] | Record<string, any>[]>
delete(
</tr></table>

... (truncated)

Changelog

Sourced from @​medusajs/types's changelog.

2.18.0

Minor Changes

Patch Changes

Commits
  • 0685952 chore: update tsdocs of the settings module (#16168)
  • 4720350 Chore: Release (#15916)
  • 1637951 docs: add TSDocs for "implement configurable data tables end to end in admin ...
  • e61285a feat(dashboard,settings,ui,types): implement configurable data tables end to ...
  • dd5b3ee fix(core-flows): refresh cart tax lines on any tax-relevant shipping address ...
  • 3bf2b51 fix(framework, types, medusa): add disallowed query config to restrict retrie...
  • 88ab916 docs: add TSDocs for "Implement support for cross-module joins (#15979)" (#16...
  • 643d903 feat: Implement support for cross-module joins (#15979)
  • 0d54021 chore: improve tsdocs of shipping option price type and related methods (#16057)
  • 8f97e3f feat(dashboard,admin-vite-plugin,admin-shared,ui,settings,js-sdk,types): view...
  • Additional commits viewable in compare view

Updates postcss from 8.5.19 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

Changelog

Sourced from postcss's changelog.

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the dev-dependencies group with 6 updates
514cc6f 
Bumps the dev-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@medusajs/eslint-plugin](https://github.com/medusajs/medusa/tree/HEAD/packages/eslint-plugin) | `2.16.0` | `2.18.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.5` | `2.10.7` |
| [@medusajs/test-utils](https://github.com/medusajs/medusa/tree/HEAD/packages/medusa-test-utils) | `2.17.2` | `2.18.0` |
| [@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core) | `1.15.43` | `1.15.46` |
| [@medusajs/types](https://github.com/medusajs/medusa/tree/HEAD/packages/core/types) | `2.17.2` | `2.18.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.19` | `8.5.23` |


Updates `@medusajs/eslint-plugin` from 2.16.0 to 2.18.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.18.0/packages/eslint-plugin)

Updates `turbo` from 2.10.5 to 2.10.7
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](https://github.com/vercel/turborepo/commits)

Updates `@medusajs/test-utils` from 2.17.2 to 2.18.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/medusa-test-utils/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.18.0/packages/medusa-test-utils)

Updates `@swc/core` from 1.15.43 to 1.15.46
- [Release notes](https://github.com/swc-project/swc/releases)
- [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/swc-project/swc/commits/v1.15.46/packages/core)

Updates `@medusajs/types` from 2.17.2 to 2.18.0
- [Release notes](https://github.com/medusajs/medusa/releases)
- [Changelog](https://github.com/medusajs/medusa/blob/develop/packages/core/types/CHANGELOG.md)
- [Commits](https://github.com/medusajs/medusa/commits/v2.18.0/packages/core/types)

Updates `postcss` from 8.5.19 to 8.5.23
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.19...8.5.23)

---
updated-dependencies:
- dependency-name: "@medusajs/eslint-plugin"
  dependency-version: 2.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: turbo
  dependency-version: 2.10.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@medusajs/test-utils"
  dependency-version: 2.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@swc/core"
  dependency-version: 1.15.46
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@medusajs/types"
  dependency-version: 2.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: postcss
  dependency-version: 8.5.23
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 3, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-db7ca7660a branch August 3, 2026 07:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants