chore(deps): bump the production-dependencies group across 1 directory with 19 updates

Closed
DE
10d ago
+823-375

Bumps the production-dependencies group with 19 updates in the / directory:

PackageFromTo
chokidar5.0.06.0.0
esbuild-sass-plugin3.6.03.7.0
js-yaml5.4.25.5.0
mdast-util-find-and-replace3.0.23.0.4
pixi.js8.21.08.22.0
preact10.29.811.0.2
preact-render-to-string6.7.06.8.1
pretty-bytes7.1.37.2.0
satori0.19.10.63.2
sharp0.35.40.35.5
shiki4.4.34.5.0
toml5.0.05.0.1
unist-util-visit5.1.05.2.0
ws8.21.38.22.0
@types/ws8.18.18.18.2
@types/node26.6.226.6.5
@types/ws8.18.18.18.2
esbuild0.27.20.27.7
prettier3.8.13.9.10
typescript5.9.37.0.2

Updates chokidar from 5.0.0 to 6.0.0

Release notes

Sourced from chokidar's releases.

6.0.0

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

Misc

... (truncated)

Changelog

Sourced from chokidar's changelog.

6.0.0 (2026-10-19)

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

... (truncated)

Commits

Updates esbuild-sass-plugin from 3.6.0 to 3.7.0

Release notes

Sourced from esbuild-sass-plugin's releases.

v3.7.0 Hasta la vista

Commits

Updates js-yaml from 5.4.2 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

  • Updated argparse to v3.
  • Updated development dependencies.

Fixed

  • Correct percent-encoding of shorthand and verbatim tags.
  • Reject ,, ], and } at the start of block plain scalars, #801.
  • Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

  • Fixed loading a whitespace-only block scalar followed by a less indented line, #802.
Commits
  • cb62b2d 5.5.0 released
  • 87aed90 Deps bump
  • 3aec511 Fix error positions for non-printable characters, #801
  • 11aa483 Reject flow indicators at the start of block plain scalars, #801
  • 339d8e0 Refactor tag encoder and decoder to match the YAML specification
  • 7832624 5.4.3 released
  • 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
  • 30108cc Parse the first block mapping key once (#800)
  • See full diff in compare view

Updates mdast-util-find-and-replace from 3.0.2 to 3.0.4

Release notes

Sourced from mdast-util-find-and-replace's releases.

3.0.4

  • 2870b11 Refactor to improve performance

Full Changelog: https://github.com/syntax-tree/mdast-util-find-and-replace/compare/3.0.3...3.0.4

3.0.3

  • d65a2ad Fix merging adjacent text nodes

Full Changelog: https://github.com/syntax-tree/mdast-util-find-and-replace/compare/3.0.2...3.0.3

Commits

Updates pixi.js from 8.21.0 to 8.22.0

Release notes

Sourced from pixi.js's releases.

v8.22.0

💾 Download

Installation:

npm install pixi.js@8.22.0

Development Build:

Production Build:

Documentation:

Changed

https://github.com/pixijs/pixijs/compare/v8.21.0...v8.22.0

🚨 Behavior Change

  • fix: tab cannot activate the accessibility layer on a fresh page by @​synath in pixijs/pixijs#12220
    • Pressing Tab now activates the accessibility layer on a fresh page when activateOnTab is left at its default of true. This restores the documented default, which regressed in v8.14.0. To keep Tab from activating it:
    await app.init({ accessibilityOptions: { activateOnTab: false } });
  • fix: apply accessibleText to button and recycled accessible elements by @​synath in pixijs/pixijs#12221
    • accessibleText now applies to the default button type and to accessible elements recycled from the pool.

🎁 Added

  • feat: add a federated contextmenu event by @​Zyie in pixijs/pixijs#12250
    • Containers now receive contextmenu and contextmenucapture events, also available as the oncontextmenu handler property. The event is a FederatedPointerEvent that PixiJS hit-tests and propagates like pointerdown, and eventFeatures.click gates it.
    sprite.eventMode = 'static';
sprite.on('contextmenu', (event) =>
{
    event.preventDefault(); // keeps the browser menu closed
    openMenuAt(event.global);
});
  • feat: sRGB view formats and transient MSAA colour on WebGPU by @​GoodBoyDigital in pixijs/pixijs#12225
    • New transient renderer option (WebGPU, with antialias) discards the canvas's multisample depth/stencil buffer at the end of each pass, and its color buffer too on GPUs that aren't tile-based.
    await app.init({ preference: 'webgpu', antialias: true, transient: true });
  • feat: 3D textures, storage textures and 3D mipmaps by @​GoodBoyDigital in pixijs/pixijs#12248
  • feat: partial uploads for BufferImageSource via update(start, end) by @​GoodBoyDigital in pixijs/pixijs#12227

... (truncated)

Commits
  • 5b41ee3 v8.22.0
  • 9dc976d fix: skip the unread-attribute warning when the attribute has a format (#12267)
  • 1289ab7 docs: correct TilingSprite texture, width and height defaults (#12269)
  • b96fb4e fix: nested filters crash after renderer resize (#12257)
  • 082128a fix: blend filter backdrop when every parent filter is skipped (#12263)
  • f3d96db feat: add a federated contextmenu event (#12250)
  • 8dbbeb9 feat: 3D textures, storage textures and 3D mipmaps (#12248)
  • ef0c0a7 feat: sRGB view formats and transient MSAA colour on WebGPU (#12225)
  • 27071aa fix: integer texture formats on WebGL and WebGPU (#12230)
  • 0f8983f fix: declare accessibilityOptions on the public renderer options (#12222)
  • Additional commits viewable in compare view

Updates preact from 10.29.8 to 11.0.2

Release notes

Sourced from preact's releases.

11.0.2

Fixes

Types

Performance

Maintenance

11.0.1

Fixes

DX

Performance

Maintenance

11.0.0

https://preactjs.com/blog/preact-11

Read the upgrade-guide over at https://preactjs.com/guide/v11/upgrade-guide

... (truncated)

Commits
  • 7c23627 Merge pull request #5329 from preactjs/release/11.0.2
  • b1fffe6 11.0.2
  • 1a07083 Merge pull request #5328 from brevin-aq/fix/render-error-duplicate-children
  • 8ab86ea fix: keep LIS candidacy separate from old vnode matching
  • 82d8c66 fix: don't leave MATCHED on new vnodes when a child throws
  • 1dde7a8 fix: correct type of createRef (#5326)
  • 74df25e Merge pull request #5319 from preactjs/JoviDeCroock/golf-preact-core
  • b8e0ad9 Or isHydrating into the suspended flags
  • 1324976 Test newProps !== oldProps first in the cWRP guard
  • ba2598a Let setStyle default removed style values
  • Additional commits viewable in compare view

Updates preact-render-to-string from 6.7.0 to 6.8.1

Release notes

Sourced from preact-render-to-string's releases.

v6.8.1

Patch Changes

  • #482 a4b9e49 Thanks @​JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.
Changelog

Sourced from preact-render-to-string's changelog.

6.8.1

Patch Changes

  • #482 a4b9e49 Thanks @​JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.

6.8.0

Minor Changes

  • #472 2dff53d Thanks @​jacob-ebey! - Replaces the second context argument in our streaming functions with an options object, the context moves to the third position.

    Streaming is considered alpha so we're making this breaking change deliberately as part of a minor.

Patch Changes

Commits
  • 0519dc8 Merge pull request #483 from preactjs/changeset-release/main
  • 7277e10 Version Packages
  • 75291f2 Merge pull request #482 from preactjs/fix/escape-coerced-attribute-values
  • a4b9e49 fix: encode attribute values after string coercion
  • 55804f3 Merge pull request #481 from preactjs/fix/release-tag-git-identity
  • 085ec2e fix: don't create a local git tag when staging a release
  • 601e6c8 Merge pull request #465 from preactjs/changeset-release/main
  • 1c9c381 Version Packages
  • f26bd8c Merge pull request #479 from preactjs/fix/changesets-format
  • 3ecaa75 Fix Changesets release formatting
  • Additional commits viewable in compare view

Updates pretty-bytes from 7.1.3 to 7.2.0

Release notes

Sourced from pretty-bytes's releases.

v7.2.0

  • Fix formatting edge cases and validate options 4e800a3

https://github.com/sindresorhus/pretty-bytes/compare/v7.1.3...v7.2.0

Commits

Updates satori from 0.19.1 to 0.63.2

Release notes

Sourced from satori's releases.

0.63.2

0.63.2 (2026-10-20)

Bug Fixes

  • Report invalid sizes, insets and margins like other invalid values (#950) (074f0b3)

0.63.1

0.63.1 (2026-10-20)

Bug Fixes

0.63.0

0.63.0 (2026-10-19)

Bug Fixes

  • Render variable fonts as their default instance (#946) (b9e5af5)

Features

  • Render selects and their options like Chrome (#947) (c66082d)

0.62.0

0.62.0 (2026-10-16)

Bug Fixes

  • Don't make lines of white space between blocks (#945) (7e8efab)
  • Hide closed dialogs, and draw open ones like browsers (#944) (5ae3a69)
  • Size SVGs without width and height like browsers (#942) (f725edd), closes #940 #939
  • Support -webkit-flex and -webkit-inline-flex (#941) (b7e86d9)

Features

0.61.0

0.61.0 (2026-10-16)

Bug Fixes

... (truncated)

Commits
  • 074f0b3 fix: Report invalid sizes, insets and margins like other invalid values (#950)
  • e1aa7be fix: Honor emoji and text presentation selectors (#948)
  • 5a9e32a docs(playground): Use the srcset sources browsers would use in screenshots (#...
  • c66082d feat: Render selects and their options like Chrome (#947)
  • b9e5af5 fix: Render variable fonts as their default instance (#946)
  • f725edd fix: Size SVGs without width and height like browsers (#942)
  • 7e8efab fix: Don't make lines of white space between blocks (#945)
  • 5ae3a69 fix: Hide closed dialogs, and draw open ones like browsers (#944)
  • b46e5ad feat: Render the labels of button inputs (#943)
  • b7e86d9 fix: Support -webkit-flex and -webkit-inline-flex (#941)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for satori since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease v0.35.5-rc.1
  • ef4f934 CI: Upgrade to Ubuntu 26.04
  • 358df95 Upgrade to libvips v8.18.7
  • 49f4903 Improve gain map support for rotate-then-extract #4606
  • 0e2e55e Silence a couple of compiler/static analysis warnings
  • cef3b8c Improve gain map support for extract operation #4606
  • Additional commits viewable in compare view

Updates shiki from 4.4.3 to 4.5.0

Release notes

Sourced from shiki's releases.

v4.5.0

   🚀 Features

   🐞 Bug Fixes

   🏎 Performance

  • engine-js: Reuse each regex's last search while tokenizing a line  -  by @​issacgerges and @​antfu in shikijs/shiki#1314 (2ef5e)
  • stream: Gro...

    Description has been truncated

    Summary by cubic

    Updates 19 production dependencies in the production-dependencies group. Several packages include major version bumps: chokidar 6.0.0, preact 11.0.2, and typescript 7.0.2, plus a large jump for satori from 0.19.1 to 0.63.2.

    Migration

    • Verify chokidar usage against 6.0.0 API changes; it now requires Node 22.22+.
    • Review the preact 11 upgrade guide for breaking changes.
    • Confirm TypeScript 7 compiles the codebase cleanly.
    • Check preact-render-to-string streaming option changes introduced in 6.8.0.
    • Validate rendered output after the satori version jump.