Skip to content

build: update all non-major dependencies (main)#33346

Open
angular-robot wants to merge 1 commit into
angular:mainfrom
angular-robot:ng-renovate/main-all-non-major-dependencies
Open

build: update all non-major dependencies (main)#33346
angular-robot wants to merge 1 commit into
angular:mainfrom
angular-robot:ng-renovate/main-all-non-major-dependencies

Conversation

@angular-robot

@angular-robot angular-robot commented Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@rollup/wasm-node (source) 4.61.0 → 4.61.1 age adoption passing confidence
@typescript-eslint/eslint-plugin (source) 8.60.1 → 8.61.0 age adoption passing confidence
@typescript-eslint/parser (source) 8.60.1 → 8.61.0 age adoption passing confidence
algoliasearch (source) 5.53.0 → 5.54.0 age adoption passing confidence
esbuild 0.28.0 → 0.28.1 age adoption passing confidence
esbuild-wasm 0.28.0 → 0.28.1 age adoption passing confidence
eslint (source) 10.4.1 → 10.5.0 age adoption passing confidence
http-proxy-middleware 4.0.0 → 4.1.0 age adoption passing confidence
https-proxy-agent (source) 9.0.0 → 9.1.0 age adoption passing confidence
jasmine (source) ~6.2.0 → ~6.3.0 age adoption passing confidence
jasmine-core (source) ~6.2.0 → ~6.3.0 age adoption passing confidence
pacote 21.5.0 → 21.5.1 age adoption passing confidence
piscina 5.1.4 → 5.2.0 age adoption passing confidence
rolldown (source) 1.0.3 → 1.1.1 age adoption passing confidence
rollup (source) 4.61.0 → 4.61.1 age adoption passing confidence
sass 1.100.0 → 1.101.0 age adoption passing confidence
semver 7.8.1 → 7.8.4 age adoption passing confidence
undici (source) 8.3.0 → 8.4.1 age adoption passing confidence
watchpack 2.5.1 → 2.5.2 age adoption passing confidence
webpack-dev-server 5.2.4 → 5.2.5 age adoption passing confidence
  • If you want to rebase/retry this PR, check this box

Release Notes

rollup/rollup (@​rollup/wasm-node)

v4.61.1

Compare Source

2026-06-04

Bug Fixes
  • Avoid extraneous newlines when adding headers via plugins (#​6403)
  • Fix a rare issue where starting Rollup would hang on Windows (#​6404)
Pull Requests
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.61.0

Compare Source

🚀 Features
  • ast-spec: change type of UnaryExpression.prefix to always true (#​12372)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.61.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

algolia/algoliasearch-client-javascript (algoliasearch)

v5.54.0

Compare Source

evanw/esbuild (esbuild)

v0.28.1

Compare Source

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#​4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}

// Old output (with --minify)
new Resource().activate();

// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#​4461, #​4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#​4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()

// Old output
new foo()`bar`();
new (foo())?.bar();

// New output
new (foo())`bar`();
new (foo()?.bar)();

  • Fix renaming of nested var declarations (#​4471)

    This release fixes a bug where var declarations in nested scopes that are hoisted up to module scope were not correctly being renamed during bundling. That could previously lead to name collisions when minification was disabled, which could potentially cause a behavior change. The bug has been fixed so that these hoisted declarations are now considered to be module-level symbols during the name collision avoidance pass.

  • Emit var instead of const for certain TypeScript-only constructs for ES5 (#​4448)

    While esbuild doesn't generally support converting const to var for ES5 due to nested scoping rules (which is currently a build-time error), esbuild previously incorrectly converted TypeScript-only import assignment constructs into a const declaration even when targeting ES5. With this release, esbuild will now use var for this case instead:

    // Original code
import x = require('y')

// Old output (with --target=es5)
const x = require("y");

// New output (with --target=es5)
var x = require("y");
eslint/eslint (eslint)

v10.5.0

Compare Source

Features

  • 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#​20973) (Pixel998)
  • b565783 feat: report no-with violations at the with keyword (#​20971) (Pixel998)
  • 2ce032f feat: report max-lines-per-function violations at function head (#​20966) (Pixel998)
  • 732cb3e feat: report max-nested-callbacks violations at function head (#​20967) (Pixel998)
  • f9c138a feat: report max-depth violations on keywords (#​20943) (Pixel998)
  • bdb496c feat: correct max-depth handling for else-if chains (#​20944) (Pixel998)
  • c296873 feat: update error loc in max-statements to function header (#​20907) (Taejin Kim)

Documentation

  • 8ae1b5b docs: Update README (GitHub Actions Bot)
  • ca7eb90 docs: update Node.js prerequisites to include ICU support (#​20962) (Francesco Trotta)
  • f99b47a docs: Update README (GitHub Actions Bot)
  • acf03d4 docs: clarify precedence of parserOptions over languageOptions (#​20926) (sethamus)

Chores

chimurai/http-proxy-middleware (http-proxy-middleware)

v4.1.0

Compare Source

  • feat(definePlugin): helper function to create plugins
  • chore(package.json): update to httpxy@​0.5.3
  • fix(ipv6): preserve credentials when normalizing bracketed IPv6 target string
  • fix(ipv6): unspecified IPv6 target hostname (::)
  • fix(response-interceptor): reduce responseInterceptor buffer churn
  • fix(ws): handle multi-server upgrade subscription and safe proxy shutdown
  • feat(router): add 'res' and 'options' to router function
  • feat(pathRewrite): add 'res' and 'options' to custom pathRewrite function
  • fix(responseInterceptor): prevent trailer/content-length conflict
  • feat(zstd): support zstd compression in responseInterceptor and fixRequestBody
  • fix(responseInterceptor): handle bodyless responses (HEAD/1xx/204/304) with content-encoding
  • fix(router): harden proxy-table matching
TooTallNate/proxy-agents (https-proxy-agent)

v9.1.0

Compare Source

Minor Changes

  • 84e85ed: Add onProxyAuth callback and negotiate option for Kerberos/SPNEGO proxy authentication

    • Extract shared Negotiate/SPNEGO auth logic into new proxy-agent-negotiate package
    • Added optional onProxyAuth async callback to HttpsProxyAgent and HttpProxyAgent options
    • When the proxy responds with 407 Proxy-Authentication Required, the callback is invoked with the response and auth scheme
    • The callback returns headers (e.g. Proxy-Authorization) to retry the request with
    • Added negotiate: true option that uses the kerberos package for automatic Negotiate/SPNEGO auth
    • Added kerberos as an optional peer dependency of proxy-agent-negotiate
    • Extended the proxy test package to support authenticate: 'negotiate' mode for mock testing

  • 3ebf4b2: Add proxy event emission on the request object for all proxy agents. After the proxy connection is established, the request emits a proxy event with { proxy, socket } where proxy is the proxy URL string. This is useful for debugging and logging which proxy was used for a connection.

Patch Changes
  • 1852c75: Fix socket event race condition by deferring socket.resume() via setImmediate(), ensuring HTTP client machinery has time to attach data listeners before data starts flowing
  • Updated dependencies [84e85ed]
    • proxy-agent-negotiate@​1.1.0
jasmine/jasmine-npm (jasmine)

v6.3.0: 6.3.0

Compare Source

Please see the release notes.

jasmine/jasmine (jasmine-core)

v6.3.0: 6.3.0

Compare Source

Please see the release notes.

npm/pacote (pacote)

v21.5.1

Compare Source

Bug Fixes
Chores
piscinajs/piscina (piscina)

v5.2.0

Compare Source

rolldown/rolldown (rolldown)

v1.1.1

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks
❤️ New Contributors

v1.1.0

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks
❤️ New Contributors
sass/dart-sass (sass)

v1.101.0

Compare Source

  • Potentially breaking bug fix: The Node package importer now properly
    supports resolving import-only variants of Sass files declared in the
    exports, sass, and style fields of package.json. Previously, these
    files were ignored even when loaded via @import, so any code relying on
    loading module-system-only files this way may break.
npm/node-semver (semver)

v7.8.4

Compare Source

Bug Fixes

v7.8.3

Compare Source

Bug Fixes
Chores

v7.8.2

Compare Source

Bug Fixes
nodejs/undici (undici)

v8.4.1

Compare Source

What's Changed
New Contributors

Full Changelog: nodejs/undici@v8.4.0...v8.4.1

v8.4.0

Compare Source

What's Changed

✂ Note

PR body was truncated to here.

@angular-robot angular-robot added action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only] labels Jun 11, 2026
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jun 11, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates several package dependencies across multiple package.json files in the workspace, including rollup, semver, undici, http-proxy-middleware, and jasmine, to their newer versions. There are no review comments, and I have no feedback to provide.

@angular-robot angular-robot force-pushed the ng-renovate/main-all-non-major-dependencies branch 5 times, most recently from ff994ce to 8f34bd1 Compare June 12, 2026 21:22
@angular-robot angular-robot force-pushed the ng-renovate/main-all-non-major-dependencies branch 4 times, most recently from 1ef67d1 to c5c952d Compare June 13, 2026 18:50
@angular-robot
build: update all non-major dependencies
b067c51 
See associated pull request for more information.
@angular-robot angular-robot force-pushed the ng-renovate/main-all-non-major-dependencies branch from c5c952d to b067c51 Compare June 13, 2026 22:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dgp1130 dgp1130 dgp1130 approved these changes

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@angular-robot @dgp1130