Repository navigation
build: update all non-major dependencies (main) - #34548
Merged
alan-agius4 merged 1 commit intoOct 28, 2026
Merged
alan-agius4 merged 1 commit into
alan-agius4 merged 1 commit into
Conversation
See associated pull request for more information.
angular-robot
added
action: merge
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates various third-party dependency and package manager versions across multiple package.json files in the workspace, including updates to pnpm, @babel/core, magic-string, rollup, webpack, sass, and oxc-parser. There are no review comments, and I have no feedback to provide.
alan-agius4
approved these changes
Oct 28, 2026
Collaborator
|
This PR was merged into the repository. The changes were merged into the following branches:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
8.0.7→8.0.98.0.7→8.0.86.3.4→6.3.58.7.4→8.7.52.3.1→2.4.00.155.0→0.156.00.155.0→0.156.04.64.12→4.65.18.72.0→8.72.18.72.0→8.72.110.6.1→10.6.24.2.0→4.2.13.5.8→3.5.91.4.3→1.4.50.155.0→0.156.012.14.0→12.15.08.5.31→8.5.3225.15.0→25.16.01.2.14→1.2.154.64.12→4.65.11.106.0→1.106.11.106.0→1.106.16.10.6→6.11.15.112.0→5.112.2Release Notes
babel/babel (@babel/core)
v8.0.9Compare Source
v8.0.9 (2026-10-23)
This release contains no changes. It is needed only to update the repo (which is based on
@babel/core's last release) in Node.js's CITGM.babel/babel (@babel/runtime)
v8.0.8Compare Source
👓 Spec Compliance
babel-parsernewcallee andawaitoperand (@JLHwung)evalandargumentsas class names (@JLHwung)🐛 Bug Fix
babel-parser/=regex (@JLHwung)export default fromwithoutexportDefaultFrom(@JLHwung)babel-helpers,babel-plugin-transform-destructuring,babel-plugin-transform-modules-commonjs,babel-runtime-corejs3,babel-runtime_arrayWithHolesbypassing customSymbol.iteratoron array-backed Proxies (@webdevelopersrinu)babel-plugin-transform-typescript,babel-typesbabel-plugin-transform-block-scoping🏠 Internal
babel-plugin-transform-classesloosein class transform (@nicolo-ribaudo)🔬 Output optimization
babel-plugin-transform-spreadarrayLikeToArrayfor spreading literals (@nicolo-ribaudo)SBoudrias/Inquirer.js (@inquirer/confirm)
v6.3.5Compare Source
modelcontextprotocol/typescript-sdk (@modelcontextprotocol/server)
v2.4.0Compare Source
Minor Changes
#3057
c05225aThanks @steipete! -ServerEventtakes optionalparams, which thesubscriptions/listenrouter delivers with its own subscription ID, so a gateway can forward change notifications with their_metaand extension params.#3047
46d9c99Thanks @KKonstantinov, @tobi-oye, @mattzcarey! - Add the Skills extension (SEP-2640), reachable through newext/skillssubpaths; package root exports are unchanged.@modelcontextprotocol/server/ext/skills:SkillsExtension(attach(server)servesskills/list,skills/get,resources/directory/readand askill://{+path}resource template),SkillsExtension.load(files)returning aSkillCatalogwithentriesandreload(), theSkillFilesstorage adapter withmemorySkillFiles,SkillSourcefor generated catalogs,skillEntry, andSkillCatalogError. Invalid skills are skipped with a warning (onWarning), or fail understrict. A file whose bytes are valid UTF-8 is served astext, whatever its MIME type; any other file as a base64blob.@modelcontextprotocol/server/ext/skills/node:loadSkills(folder)andnodeSkillFiles(folder).@modelcontextprotocol/client/ext/skills:SkillsClientwithlist()(throws on an invalid entry;skipInvalid: truekeeps the valid ones and returns the rest ininvalid),get(),read(skill, path?)(size, digest andSKILL.mdfrontmatter verified,SkillVerificationErroron a mismatch; a copy from the response cache that fails a check is fetched once more withcacheMode: 'refresh'first) andreadDirectory().@modelcontextprotocol/core/ext/skills: schemas, types and constants, includingSKILL_LIMITS. The result schemas follow the stable spec, sottlMsandcacheScopeare required.SkillsExtension.attachis@experimental: how an extension is wired to a server may change in a minor release. The rest of the Skills API is stable.Works on 2025-11-25 and 2026-07-28. On 2026-07-28 only, the server sends the caching fields (
ttlMs,cacheScope), andSkillsClientrequires them and returns them fromlist(),get()andreadDirectory().Patch Changes
#3083
ef38c67Thanks @claude! - The bundled Ajv validator is now built with fast-uri 3.1.8 (was 3.1.0). fast-uri 3.1.6 and later reject a$idor$refwhose text before the first colon is not a valid URI scheme (my_tool:output), or whose URN namespace is not valid (urn:my_tool:output): a schema that uses one no longer compiles, and a tool that carries it fails with an invalid-schema error. An underscore without a colon (my_tool_output) and a$refinto#/$defs/...or#/definitions/...are not affected.#2960
43c45f4Thanks @claude! - A server whose tool putsx-mcp-headeron anumber-typed parameter keeps checking that tool'sMcp-Param-*headers ontools/call, as 2.3.0 does: a header that is missing for a value in the body, or that disagrees with the body, is answered400with JSON-RPC error-32020. Clients on a 2026-07-28 connection other than stdio no longer list such a tool and send noMcp-Param-*headers for it, so a call that carries a value for a declared parameter is rejected the same way; the server logs a warning each time tools are listed. Use an integer (z.int()) or remove the annotation.#3081
5820f79Thanks @claude! - A tooloutputSchemawhose root is a$refto atype: "object"entry of its own$defsordefinitions(what zod writes forz.object({...}).meta({ id })), or a union of such refs, is now treated as an object schema. On 2025-era connections the tool's schema andstructuredContentare no longer wrapped in{ result: ... }, so a 2025-era client that readstructuredContent.resultfor such a tool now readsstructuredContent. On every era the advertised schema gainstype: "object"at its root.#3057
c05225aThanks @steipete! - Connecting aServerorMcpServerto aPerRequestHTTPServerTransportclassified at a modern revision thatsupportedProtocolVersionslists and the SDK implements now binds that revision, instead of answering-32022.#3005
b381559Thanks @chaeyn! - Reflect resource and resource templateupdate({ title })changes in list responses. Preserve other metadata and individual resource titles when a template supplies list entries.#3002
895007fThanks @Hugo-DDT! -createMcpHandlernow sendsAllow: POSTon every405it answers to a non-POST request, withlegacy: 'stateless'(the default) and withlegacy: 'reject'.#2762
b022522Thanks @pcarleton! -x-mcp-headeron anumber-typed tool parameter is now rejected, matching the 2026-07-28 spec ("Parameters with typenumberare not permitted"; clients MUST exclude such tools fromtools/list). Previouslynumberwas accepted only to satisfy an older conformance fixture that has since been corrected.integer,stringandbooleanare unaffected.Updated dependencies [
46d9c99]:rollup/rollup (@rollup/wasm-node)
v4.65.1Compare Source
2026-10-26
Bug Fixes
Symbol.disposefor async disposal (#6556)Pull Requests
b725eda(@renovate[bot])v4.65.0Compare Source
2026-10-22
Features
Configuration and setting up pnpm
Registry credentials and TLS settings passed with
--config, such as--config.//registry.example.com/:_authToken=<token>, are now applied. They take precedence over the same settings in.npmrcfiles.pnpm now reads only the settings it needs to decide whether to switch to the pnpm version a project pins. A setting outside them can no longer fail that decision or change its outcome. For example,
pnpm --versionno longer fails in a pinned project whosepnpm-workspace.yamlhas a setting this pnpm cannot read. Projects that pin neither pnpm nor a runtime skip this check without reading any settings.When pnpm switches to the version a project pins, an option only the pinned pnpm knows now reaches that pnpm when it comes immediately before the command name, as in
pnpm --new-flag install. When switching forpnpm --versionor an unrecognized command line, pnpm also honors--color,--no-color,--reporter, and--loglevelwherever they appear on the command line.pnpm self-updatenow updates the project's pnpm pin when Homebrew installed pnpm or Corepack runs it, leaving the global pnpm alone #17001. Run inside a workspace package,pnpm self-updateupdates the pin in the workspace root's manifest, including inpackage.yamlorpackage.json5.pnpm setupnow completes when Windows registry environment values cannot be read or written. It prints PowerShell commands to configurePNPM_HOMEandPATHwithout registry access #17167.pnpm setupnow succeeds when it cannot tell which shell configuration file to update, for example in a container whereSHELLis not set. It installs pnpm and prints thePNPM_HOMEandPATHlines to add yourself. Previously it failed withERR_PNPM_UNKNOWN_SHELL, and so did the installer script at get.pnpm.io #16973.In StackBlitz WebContainers,
pnpmno longer crashes intermittently withParking not supported on this platform, and running a command that does not exist now reports that the command was not found. Previously it sometimes failed with a generic error.Platinum Sponsors
Gold Sponsors
postcss/postcss (postcss)
v8.5.32Compare Source
Input#origin()withoutopts.from(by @wleeaf).startinWarning#toString()(by @Don-Yin).Promisesemantics inLazyResult#finally()(by @Don-Yin).puppeteer/puppeteer (puppeteer)
v25.16.0: puppeteer: v25.16.0Compare Source
🎉 Features
Dependencies
rolldown/rolldown (rolldown)
v1.2.15Compare Source
🚀 Features
isBundledto pick the browser-external stub format (#11260) by @h-a-n-a// <id>comments instead of#regionpairs (#11235) by @IWANABETHATGUY🐛 Bug Fixes
this.resolverecursion between plugins withskipSelf: true(#11181) by @anzal1requireforssr.target: 'webworker'(#11205) by @sapphi-red🧪 Testing
⚙️ Miscellaneous Tasks
❤️ New Contributors
sass/dart-sass (sass)
v1.106.1Compare Source
Fix a bug where an attribute selector with an empty value (such as
[class=""]) would crash when serializing.Don't crash when serializing a number with an empty unit. This is only
possible through the JavaScript and Dart APIs or the embedded protocol.
Embedded Dart Sass
PARAMSerrors.sass/embedded-host-node (sass-embedded)
v1.106.1Compare Source
Fix a bug where an attribute selector with an empty value (such as
[class=""]) would crash when serializing.Don't crash when serializing a number with an empty unit. This is only
possible through the JavaScript and Dart APIs or the embedded protocol.
Embedded Dart Sass
PARAMSerrors.verdaccio/verdaccio (verdaccio)
v6.11.1Compare Source
Patch Changes
62d8556: Update verdaccio dependencies to thelatestnpm dist-tag (@verdaccio/ui-themetracksnext-9):@verdaccio/ui-theme:9.0.0-next-9.39→9.0.0-next-9.40v6.11.0Compare Source
Minor Changes
93010b3:web.showSearch: falsenow also disables the web search endpoint.Until now the option only hid the search box in the header, while
/-/verdaccio/data/searchkept answering. WithshowSearch: falsethe endpoint is no longer registered and answers 404, the same wayweb.login: falseremoves the web login endpoints. The npm search API used bynpm search(/-/v1/search) is not affected, and nothing changes for registries that leaveshowSearchunset or set it totrue.Patch Changes
a3a664b: Releases are published with npm provenance again.verdaccio 6.10.5, 6.10.6 and 6.10.7 reached the npm registry without a provenance attestation, while every release from 6.9.0 to 6.10.4 had one. The release pipeline switched from
npm publishtoyarn npm publish, and yarn ignored the setting that requested provenance, so those versions were published through trusted publishing but without a signed SLSA statement. The package contents were not affected.Package managers that compare trust evidence between versions, such as pnpm with
trustPolicy: no-downgrade, refuse to install those three versions withERR_PNPM_TRUST_DOWNGRADE. This release carries provenance again, so upgrading to it, or pinning 6.10.4 or earlier, installs cleanly; nothing else needs to change on the operator side.90fde27: Update the bundled@verdaccio/*modules to their latest releases, which forward the new web UI options to the UI and fix a denial-of-service in request body parsing.The web UI options
web.footer,web.poweredBy,web.helpandweb.showPackageListToolbarnow reach the UI (@verdaccio/ui-theme9.0.0-next-9.39); before this update the server dropped them.showPackageListToolbardefaults tofalse, so the home page looks the same after upgrading unless you turn it on, andbunis now listed among the default package managers shown on a package page.body-parsermoves to1.20.9, fixing a denial of service where trailing bytes after a compressed request body could tie up the server (GHSA-27r3-jxmh-p828). All 6.x releases that useexpress4.22.3 are affected; no configuration change is needed.v6.10.7Compare Source
Patch Changes
7bd480a: The Docker image no longer trusts certificates issued through the compromised eMudhra (emSign) intermediate CAs.In October 2026, eMudhra disclosed that the private keys of several of its intermediate certificate authorities had been compromised. Anyone holding those keys can issue a TLS certificate that a client trusting the eMudhra chain accepts as valid, for any host. Verdaccio connects to its uplinks (such as registry.npmjs.org) over HTTPS, so an attacker able to intercept that traffic could impersonate an uplink and serve tampered metadata or tarballs, which Verdaccio would then cache.
The image is now built on
node:24.22.1-alpineinstead ofnode:24.15.0-alpine. Node.js 24.22.1 updates its bundled root certificates to NSS 3.131.1, which removesemSign ECC Root CA - G3, and rejects chains that contain the compromised public keys. Node.js uses that bundled store for outgoing HTTPS by default. The image also upgrades Alpine'sca-certificatespackage at build time. That package matters only if you make Node.js read the system store, for example withNODE_EXTRA_CA_CERTSor--use-system-ca.Every earlier
verdaccio/verdaccio6.x image is affected. To get the fix, pull the new image. If you install Verdaccio from npm instead of Docker, upgrade Node.js to 22.23.4, 24.22.1, 26.12.1 or later.webpack/webpack (webpack)
v5.112.2Compare Source
Patch Changes
Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)
Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)
Return the value of every module type loaded with
importModule(). (by @alexander-akait in #22869)v5.112.1Compare Source
Patch Changes
Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @aryanraj45 in #22699)
Rebuild under
cacheUnaffecteda module whose re-export target goes or returns. (by @aryanraj45 in #22749)Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @alexander-akait in #22791)
Fix
exportType: "style"CSS modules throwing outside the runtime chunk. (by @lazerg in #22833)Fix crash when a CSS module with
exportType: "style"imports an ignored stylesheet. (by @codeXsidd in #22846)Keep empty process environment variables that
.envfiles don't define inDotenvPlugin. (by @alexander-akait in #22794)Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @alexander-akait in #22804)
Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @dependabot in #22811)
Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @alexander-akait in #22733)
Await asynchronous modules that
ProvidePlugininjects into ES modules. (by @alexander-akait in #22728)Keep a resolve that ends after the compiler closed from throwing. (by @alexander-akait in #22795)
Preserve string names passed to SharedWorker constructors. (by @bjohansebas in #22770)
Preserve string contents when extracting source map comments. (by @bjohansebas in #22768)
Scope strict-mode, async and generator block function declarations to their block. (by @alexander-akait in #22800)
Preserve raw dotenv values when reusing cached environment files. (by @Eshiv-Pandey in #22787)
Preserve assigned or patched built-ins, conversions and pattern targets. (by @aryanraj45 in #22761)
Keep globals a
globalThiswrite replaces, andsliceon a patched array. (by @alexander-akait in #22862)Skip HTML script tags for shared chunks that emit no JavaScript. (by @bjohansebas in #22779)
Keep the digits Firefox lays out a minified CSS percentage with. (by @alexander-akait in #22718)
Reject a second
srcsetdescriptor after a0xdensity descriptor. (by @alexander-akait in #22741)Minify JavaScript faster, folding string methods on constants and
x -= 1. (by @alexander-akait in #22823)Shorten minified JavaScript, and keep it running like its source. (by @alexander-akait in #22717)
Drop more unused functions, arguments, calls, global reads and variable copies when minifying JavaScript. (by @alexander-akait in #22789)
Minify JavaScript smaller where swc does, and fold a function's
lengthright. (by @alexander-akait in #22826)Reduce JavaScript output size where oxc or swc produce smaller output. (by @alexander-akait in #22829)
Update watchpack to 2.6.3 and rebuild on a
node_modulescreated mid-build. (by @alexander-akait in #22743)Support
concatenateModuleswithcacheUnaffected. (by @alexander-akait in #22746)Update schema-utils to 4.8.1. (by @alexander-akait in #22774)
Keep CSS fallbacks, vendor overrides,
oklch()hues and HTML elements. (by @alexander-akait in #22753)Validate
CleanPluginandDotenvPluginoptions with a precompiled check, so valid options no longer compile their schema at startup. (by @alexander-akait in #22758)Speed up startup and CSS minification, sharing the compile cache with workers. (by @xiaoxiaojx in #22706)
Use precise, generic types for modules, parsers, generators, stats and loaders. (by @alexander-akait in #22731)