chore(deps): bump the production-dependencies group across 1 directory with 22 updates

Closed
DE
3d ago
+864-418

Bumps the production-dependencies group with 22 updates in the / directory:

PackageFromTo
chokidar5.0.06.0.0
esbuild-sass-plugin3.6.03.7.0
hast-util-to-html9.0.59.0.6
hast-util-to-jsx-runtime2.3.62.3.7
js-yaml5.4.25.5.0
mdast-util-find-and-replace3.0.23.0.4
minimatch10.2.611.0.4
pixi.js8.21.08.22.0
preact10.29.811.1.1
preact-render-to-string6.7.06.8.2
pretty-bytes7.1.37.2.0
satori0.19.10.63.2
sharp0.35.40.35.5
shiki4.4.34.6.0
toml5.0.05.0.1
unist-util-visit5.1.05.2.0
ws8.21.38.22.1
@types/ws8.18.18.18.2
@types/node26.6.226.6.6
@types/ws8.18.18.18.2
esbuild0.27.20.27.7
prettier3.8.13.9.10
typescript5.9.37.0.2

Updates chokidar from 5.0.0 to 6.0.0

Release notes

Sourced from chokidar's releases.

6.0.0

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

Misc

... (truncated)

Changelog

Sourced from chokidar's changelog.

6.0.0 (2026-10-19)

High-level changes

  • Rewrote the watcher around a single observation pipeline. Backend callbacks are treated as invalidations and confirmed with lstat, stat, or readdir before any event is emitted, so the final state after a burst of changes matches the filesystem.
  • Added native recursive watching through fs.watch({ recursive: true }). The default auto backend uses it on macOS and Windows and per-directory watching elsewhere.
  • Shared native handles across watchers and opened them per directory only: files no longer own handles. This fixes EBADF errors when watching many files on macOS (#1385, #1452).
  • Replaced fs.watchFile with Chokidar-owned stat polling. Poll loops are shared across watchers at the fastest requested interval.
  • Required Node.js 22.22 or later.

API changes

  • Added the backend option: 'auto' (default), 'native', 'native-recursive', or 'polling'.
    • usePolling: true remains as a deprecated alias for backend: 'polling'.
  • Renamed interval and binaryInterval to pollingInterval and pollingBinaryInterval.
    • The old names remain as deprecated aliases; the new names win when both are given.
  • Changed the atomic default to false with polling. An explicit value is preserved.
  • Made close() terminal: add() now throws once closing has started. Construct a new watcher instead.
  • Validated options in the constructor: invalid backend, atomic, depth, awaitWriteFinish, and polling intervals throw TypeError.
  • Emitted errors from add() as error events instead of unhandled rejections (#1378).
  • Made getWatched() return a null-prototype object, so a watched directory named __proto__ is listed (#1493). Use Object.hasOwn() instead of hasOwnProperty() on the result.
  • Stopped applying ignored to directories above a path passed to watch() or add(), so a missing path is still watched through its parent (#1374). Other entries in those directories are still filtered.

Fixes

  • Fixed a 100% CPU loop when the process working directory containing a relatively watched file was deleted (#1474).
  • Fixed watching a filesystem root, which emitted unlink and unlinkDir for every entry (#1184, #452).
  • Fixed UNKNOWN errors from fs.watch on macOS sockets, which prevented watching /var/run (#1391).
  • Fixed a symlink whose target passes through a regular file (ENOTDIR) disabling watching of its directory and preventing ready (#1476).
  • Fixed files created in a newly added directory between its scan and watch registration being missed (#1471).
  • Fixed watching a missing nested path stopping its parent directory's subtree from being watched (#1470).
  • Fixed false change events on Windows when many sibling files are written (#1466).
  • Fixed duplicate add events for unchanged files under directory activity (#1465).
  • Fixed replacing a watched directory with a file of the same name hanging the process (#1464).
  • Fixed persistent watching stopping after a watched directory was removed (#1463).
  • Fixed a deleted watched path not being reported when recreated: previously only a deleted file that was the sole watched path was watched for its return. Any path passed to watch() or add() is now awaited from its nearest existing parent.
  • Fixed event throttling discarding updates; the newest differing change is now replayed when the window closes (#1455).
  • Fixed relative ignored paths; relative strings now resolve against cwd or the process working directory (#1436).
  • Fixed files not being detected when their directory did not exist before watching (#1422).
  • Fixed removed files being reported as unlinkDir instead of unlink (#1421).
  • Fixed ignored files and directories still being watched in WSL (#1418).
  • Fixed change being reported for every file when one file changed under Deno (#1417).
  • Fixed changes not being detected after the second save (#1399).
  • Fixed renaming a watched directory that contains subdirectories on Windows (#1380, #1398).
  • Fixed re-watching a path not honoring ignoreInitial (#1386).
  • Fixed EISDIR errors during the initial scan of network drives (#1376).
  • Fixed watching an array of absolute file paths (#1366).
  • Fixed unwatching a deleted watched directory on Windows, contributed by @​sapphi-red in [pull request #1467](paulmillr/chokidar#1467).
  • Documented that unwatched paths stay ignored until they are added again (#1439).

... (truncated)

Commits

Updates esbuild-sass-plugin from 3.6.0 to 3.7.0

Release notes

Sourced from esbuild-sass-plugin's releases.

v3.7.0 Hasta la vista

Commits

Updates hast-util-to-html from 9.0.5 to 9.0.6

Release notes

Sourced from hast-util-to-html's releases.

9.0.6

Fix

  • b2b5a3e Fix HTML in SVG for desc, foreignObject, title
  • 233ac97 Fix p closing tag omission in custom elements

Full Changelog: https://github.com/syntax-tree/hast-util-to-html/compare/9.0.5...9.0.6

Commits

Updates hast-util-to-jsx-runtime from 2.3.6 to 2.3.7

Release notes

Sourced from hast-util-to-jsx-runtime's releases.

2.3.7

Fix

  • b29735c Fix casing of style properties, specially variables

Dependencies

  • 5fc8d17 Update style-to-js

Full Changelog: https://github.com/syntax-tree/hast-util-to-jsx-runtime/compare/2.3.6...2.3.7

Commits

Updates js-yaml from 5.4.2 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

  • Updated argparse to v3.
  • Updated development dependencies.

Fixed

  • Correct percent-encoding of shorthand and verbatim tags.
  • Reject ,, ], and } at the start of block plain scalars, #801.
  • Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

  • Fixed loading a whitespace-only block scalar followed by a less indented line, #802.
Commits
  • cb62b2d 5.5.0 released
  • 87aed90 Deps bump
  • 3aec511 Fix error positions for non-printable characters, #801
  • 11aa483 Reject flow indicators at the start of block plain scalars, #801
  • 339d8e0 Refactor tag encoder and decoder to match the YAML specification
  • 7832624 5.4.3 released
  • 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
  • 30108cc Parse the first block mapping key once (#800)
  • See full diff in compare view

Updates mdast-util-find-and-replace from 3.0.2 to 3.0.4

Release notes

Sourced from mdast-util-find-and-replace's releases.

3.0.4

  • 2870b11 Refactor to improve performance

Full Changelog: https://github.com/syntax-tree/mdast-util-find-and-replace/compare/3.0.3...3.0.4

3.0.3

  • d65a2ad Fix merging adjacent text nodes

Full Changelog: https://github.com/syntax-tree/mdast-util-find-and-replace/compare/3.0.2...3.0.3

Commits

Updates minimatch from 10.2.6 to 11.0.4

Changelog

Sourced from minimatch's changelog.

change log

11.0

  • Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.
  • Remove makeRe(), Minimatch#regexp, and the MMRegExp type.
  • Remove the AST class.
  • Remove the maxExtglobRecursion option.
  • An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.
  • Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.
  • Remove the debug option and the debug() method.
  • Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.
  • Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.
  • Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.
  • partial matching of patterns with many ** no longer takes exponential time.
  • On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.
  • On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.
  • On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....
  • At optimization level 2, throw a RangeError if splitting **/.. portions would make more than braceExpandMax patterns, or add more than 1,000,000 path portions. Before, a short pattern could take minutes to compile.
  • At optimization level 2, dedupe patterns without comparing each pair, so that a large set is deduped in about linear time. Fix {**/x,x/y}, which was deduped to **/x, so x/y did not match.
  • Match a numeric brace range of 100 or more values, such as {0..999}, as one pattern portion, in place of one pattern for each value. For a glob walk, this is one directory read, in place of a stat for each value. hasMagic() is true for these

... (truncated)

Commits
  • f24eba9 11.0.4
  • a0b9404 drop support for node 18, wasn't installable anyway
  • b0c2aa8 11.0.3
  • 293267a perf: cache matchers more aggressively by postponing creation
  • 52d2aec cache 256 patterns
  • 4380455 11.0.2
  • 322feb1 update @​isaacs/nonrecursive-glob-match
  • 96cad78 ci: exclude windows from testing node 22 and 24
  • 47afe88 11.0.1
  • 77a0f5c limit **/.. optimization pass to avoid quadratic explosion
  • Additional commits viewable in compare view

Updates pixi.js from 8.21.0 to 8.22.0

Release notes

Sourced from pixi.js's releases.

v8.22.0

💾 Download

Installation:

npm install pixi.js@8.22.0

Development Build:

Production Build:

Documentation:

Changed

https://github.com/pixijs/pixijs/compare/v8.21.0...v8.22.0

🚨 Behavior Change

  • fix: tab cannot activate the accessibility layer on a fresh page by @​synath in pixijs/pixijs#12220
    • Pressing Tab now activates the accessibility layer on a fresh page when activateOnTab is left at its default of true. This restores the documented default, which regressed in v8.14.0. To keep Tab from activating it:
    await app.init({ accessibilityOptions: { activateOnTab: false } });
    
  • fix: apply accessibleText to button and recycled accessible elements by @​synath in pixijs/pixijs#12221
    • accessibleText now applies to the default button type and to accessible elements recycled from the pool.

🎁 Added

  • feat: add a federated contextmenu event by @​Zyie in pixijs/pixijs#12250
    • Containers now receive contextmenu and contextmenucapture events, also available as the oncontextmenu handler property. The event is a FederatedPointerEvent that PixiJS hit-tests and propagates like pointerdown, and eventFeatures.click gates it.
    sprite.eventMode = 'static';
    sprite.on('contextmenu', (event) =>
    {
        event.preventDefault(); // keeps the browser menu closed
        openMenuAt(event.global);
    });
    
  • feat: sRGB view formats and transient MSAA colour on WebGPU by @​GoodBoyDigital in pixijs/pixijs#12225
    • New transient renderer option (WebGPU, with antialias) discards the canvas's multisample depth/stencil buffer at the end of each pass, and its color buffer too on GPUs that aren't tile-based.
    await app.init({ preference: 'webgpu', antialias: true, transient: true });
    
  • feat: 3D textures, storage textures and 3D mipmaps by @​GoodBoyDigital in pixijs/pixijs#12248
  • feat: partial uploads for BufferImageSource via update(start, end) by @​GoodBoyDigital in pixijs/pixijs#12227

... (truncated)

Commits
  • 5b41ee3 v8.22.0
  • 9dc976d fix: skip the unread-attribute warning when the attribute has a format (#12267)
  • 1289ab7 docs: correct TilingSprite texture, width and height defaults (#12269)
  • b96fb4e fix: nested filters crash after renderer resize (#12257)
  • 082128a fix: blend filter backdrop when every parent filter is skipped (#12263)
  • f3d96db feat: add a federated contextmenu event (#12250)
  • 8dbbeb9 feat: 3D textures, storage textures and 3D mipmaps (#12248)
  • ef0c0a7 feat: sRGB view formats and transient MSAA colour on WebGPU (#12225)
  • 27071aa fix: integer texture formats on WebGL and WebGPU (#12230)
  • 0f8983f fix: declare accessibilityOptions on the public renderer options (#12222)
  • Additional commits viewable in compare view

Updates preact from 10.29.8 to 11.1.1

Commits
  • cad3d26 Merge pull request #5340 from preactjs/release/11.1.1
  • bdf1a5f 11.1.1
  • 4e5c63c Merge pull request #5339 from preactjs/fix/template-namespace-content
  • 9ecf719 Fix template in alternative namespaces
  • 2788c12 Merge pull request #5338 from b84330808/fix/template-shadowroot-types
  • 9069f5a test: remove the type tests again
  • 4ab827e test: drop the template shadow root type tests
  • 3151183 Drop the type tests, per review
  • 39d2920 fix(types): add declarative shadow DOM attributes to <template>
  • 66b6e56 Merge pull request #5336 from preactjs/release/11.1.0
  • Additional commits viewable in compare view

Updates preact-render-to-string from 6.7.0 to 6.8.2

Release notes

Sourced from preact-render-to-string's releases.

v6.8.2

Patch Changes

v6.8.1

Patch Changes

  • #482 a4b9e49 Thanks @​JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.
Changelog

Sourced from preact-render-to-string's changelog.

6.8.2

Patch Changes

6.8.1

Patch Changes

  • #482 a4b9e49 Thanks @​JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.

6.8.0

Minor Changes

  • #472 2dff53d Thanks @​jacob-ebey! - Replaces the second context argument in our streaming functions with an options object, the context moves to the third position.

    Streaming is considered alpha so we're making this breaking change deliberately as part of a minor.

Patch Changes

Commits
  • dc7d06b Merge pull request #486 from preactjs/changeset-release/main
  • a927b46 Version Packages
  • 6d233e7 Merge pull request #489 from preactjs/harden-vnode-recognition
  • 7be3108 Harden vnode recognition
  • 1647315 Merge pull request #485 from preactjs/test/async-template-suspense
  • 2dd9a3a fix: resolve suspended children in precompiled templates
  • 0519dc8 Merge pull request #483 from preactjs/changeset-release/main
  • 7277e10 Version Packages
  • 75291f2 Merge pull request #482 from preactjs/fix/escape-coerced-attribute-values
  • a4b9e49 fix: encode attribute values after string coercion
  • Additional commits viewable in compare view

Updates pretty-bytes from 7.1.3 to 7.2.0

Release notes

Sourced from pretty-bytes's releases.

v7.2.0

  • Fix formatting edge cases and validate options 4e800a3

https://github.com/sindresorhus/pretty-bytes/compare/v7.1.3...v7.2.0

Commits

Updates satori from 0.19.1 to 0.63.2

Release notes

Sourced from satori's releases.

0.63.2

0.63.2 (2026-10-20)

Bug Fixes

  • Report invalid sizes, insets and margins like other invalid values (#950) (074f0b3)

0.63.1

0.63.1 (2026-10-20)

Bug Fixes

0.63.0

0.63.0 (2026-10-19)

Bug Fixes

  • Render variable fonts as their default instance (#946) (b9e5af5)

Features

  • Render selects and their options like Chrome (#947) (c66082d)

0.62.0

0.62.0 (2026-10-16)

Bug Fixes

  • Don't make lines of white space between blocks (#945) (7e8efab)
  • Hide closed dialogs, and draw open ones like browsers (#944) (5ae3a69)
  • Size SVGs without width and height like browsers (#942) (f725edd), closes #940 #939
  • Support -webkit-flex and -webkit-inline-flex (#941) (b7e86d9)

Features

0.61.0

0.61.0 (2026-10-16)

Bug Fixes

... (truncated)

Commits
  • 074f0b3 fix: Report invalid sizes, insets and margins like other invalid values (#950)
  • e1aa7be fix: Honor emoji and text presentation selectors (#948)
  • 5a9e32a docs(playground): Use the srcset sources browsers would use in screenshots (#...
  • c66082d feat: Render selects and their options like Chrome (#947)
  • b9e5af5 fix: Render variable fonts as their default instance (#946)
  • f725edd fix: Size SVGs without width and height like browsers (#942)
  • 7e8efab fix: Don't make lines of white space between blocks (#945)
  • 5ae3a69 fix: Hide closed dialogs, and draw open ones like browsers (#944)
  • b46e5ad feat: Render the labels of button inputs (#943)
  • b7e86d9 fix: Support -webkit-flex and -webkit-inline-flex (#941)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for satori since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract and rotate operations. #4606

  • Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

  • Add upper bounds check on length of linear and GIF delay arrays.

  • Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

  • TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

  • TypeScript: Remove non-existent named export. #4604

  • Increase accepted dimensions when extending an image. #4605

  • Improve gain map support for extract operation. #4606

... (truncated)

Commits
  • 51a990f Release v0.35.5
  • 96de105 Upgrade to sharp-libvips v1.3.4
  • 3a61390 CI: Configure Dependabot with all package.json locations
  • 4940c50 Improve gain map support for rotate/flip/flop ops
  • 20654aa Prerelease...

    Description has been truncated


    Summary by cubic

    Bumps the production-dependencies group, updating 22 packages to their latest versions. Most are patch and minor releases; this also includes several major-version upgrades with potential breaking changes.

    Migration

    • chokidar 6.0.0 requires Node.js 22.22+ and rewrites the watch pipeline; usePolling, interval, and binaryInterval remain as deprecated aliases.
    • minimatch 11.0.0 removes makeRe(), the AST class, and the debug option.
    • preact 11 and typescript 7.0.2 are major-version upgrades that may require code adjustments.