Skip to content

build: update all non-major dependencies (main)#33346

Open
angular-robot wants to merge 1 commit into
angular:mainfrom
angular-robot:ng-renovate/main-all-non-major-dependencies
Open

build: update all non-major dependencies (main)#33346
angular-robot wants to merge 1 commit into
angular:mainfrom
angular-robot:ng-renovate/main-all-non-major-dependencies

Conversation

@angular-robot

@angular-robot angular-robot commented Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@rollup/wasm-node (source) 4.61.0 → 4.61.1 age adoption passing confidence
@typescript-eslint/eslint-plugin (source) 8.60.1 → 8.61.0 age adoption passing confidence
@typescript-eslint/parser (source) 8.60.1 → 8.61.0 age adoption passing confidence
algoliasearch (source) 5.53.0 → 5.54.0 age adoption passing confidence
esbuild 0.28.0 → 0.28.1 age adoption passing confidence
esbuild-wasm 0.28.0 → 0.28.1 age adoption passing confidence
http-proxy-middleware 4.0.0 → 4.1.0 age adoption passing confidence
https-proxy-agent (source) 9.0.0 → 9.1.0 age adoption passing confidence
jasmine (source) ~6.2.0 → ~6.3.0 age adoption passing confidence
jasmine-core (source) ~6.2.0 → ~6.3.0 age adoption passing confidence
pacote 21.5.0 → 21.5.1 age adoption passing confidence
rolldown (source) 1.0.3 → 1.1.1 age adoption passing confidence
rollup (source) 4.61.0 → 4.61.1 age adoption passing confidence
sass 1.100.0 → 1.101.0 age adoption passing confidence
semver 7.8.1 → 7.8.4 age adoption passing confidence
undici (source) 8.3.0 → 8.4.1 age adoption passing confidence
watchpack 2.5.1 → 2.5.2 age adoption passing confidence
  • If you want to rebase/retry this PR, check this box

Release Notes

rollup/rollup (@​rollup/wasm-node)

v4.61.1

Compare Source

2026-06-04

Bug Fixes
  • Avoid extraneous newlines when adding headers via plugins (#​6403)
  • Fix a rare issue where starting Rollup would hang on Windows (#​6404)
Pull Requests
typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v8.61.0

Compare Source

🚀 Features
  • ast-spec: change type of UnaryExpression.prefix to always true (#​12372)
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v8.61.0

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

algolia/algoliasearch-client-javascript (algoliasearch)

v5.54.0

Compare Source

evanw/esbuild (esbuild)

v0.28.1

Compare Source

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#​4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}

// Old output (with --minify)
new Resource().activate();

// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#​4461, #​4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#​4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()

// Old output
new foo()`bar`();
new (foo())?.bar();

// New output
new (foo())`bar`();
new (foo()?.bar)();

  • Fix renaming of nested var declarations (#​4471)

    This release fixes a bug where var declarations in nested scopes that are hoisted up to module scope were not correctly being renamed during bundling. That could previously lead to name collisions when minification was disabled, which could potentially cause a behavior change. The bug has been fixed so that these hoisted declarations are now considered to be module-level symbols during the name collision avoidance pass.

  • Emit var instead of const for certain TypeScript-only constructs for ES5 (#​4448)

    While esbuild doesn't generally support converting const to var for ES5 due to nested scoping rules (which is currently a build-time error), esbuild previously incorrectly converted TypeScript-only import assignment constructs into a const declaration even when targeting ES5. With this release, esbuild will now use var for this case instead:

    // Original code
import x = require('y')

// Old output (with --target=es5)
const x = require("y");

// New output (with --target=es5)
var x = require("y");
chimurai/http-proxy-middleware (http-proxy-middleware)

v4.1.0

Compare Source

  • feat(definePlugin): helper function to create plugins
  • chore(package.json): update to httpxy@​0.5.3
  • fix(ipv6): preserve credentials when normalizing bracketed IPv6 target string
  • fix(ipv6): unspecified IPv6 target hostname (::)
  • fix(response-interceptor): reduce responseInterceptor buffer churn
  • fix(ws): handle multi-server upgrade subscription and safe proxy shutdown
  • feat(router): add 'res' and 'options' to router function
  • feat(pathRewrite): add 'res' and 'options' to custom pathRewrite function
  • fix(responseInterceptor): prevent trailer/content-length conflict
  • feat(zstd): support zstd compression in responseInterceptor and fixRequestBody
  • fix(responseInterceptor): handle bodyless responses (HEAD/1xx/204/304) with content-encoding
  • fix(router): harden proxy-table matching
TooTallNate/proxy-agents (https-proxy-agent)

v9.1.0

Compare Source

Minor Changes

  • 84e85ed: Add onProxyAuth callback and negotiate option for Kerberos/SPNEGO proxy authentication

    • Extract shared Negotiate/SPNEGO auth logic into new proxy-agent-negotiate package
    • Added optional onProxyAuth async callback to HttpsProxyAgent and HttpProxyAgent options
    • When the proxy responds with 407 Proxy-Authentication Required, the callback is invoked with the response and auth scheme
    • The callback returns headers (e.g. Proxy-Authorization) to retry the request with
    • Added negotiate: true option that uses the kerberos package for automatic Negotiate/SPNEGO auth
    • Added kerberos as an optional peer dependency of proxy-agent-negotiate
    • Extended the proxy test package to support authenticate: 'negotiate' mode for mock testing

  • 3ebf4b2: Add proxy event emission on the request object for all proxy agents. After the proxy connection is established, the request emits a proxy event with { proxy, socket } where proxy is the proxy URL string. This is useful for debugging and logging which proxy was used for a connection.

Patch Changes
  • 1852c75: Fix socket event race condition by deferring socket.resume() via setImmediate(), ensuring HTTP client machinery has time to attach data listeners before data starts flowing
  • Updated dependencies [84e85ed]
    • proxy-agent-negotiate@​1.1.0
jasmine/jasmine-npm (jasmine)

v6.3.0: 6.3.0

Compare Source

Please see the release notes.

jasmine/jasmine (jasmine-core)

v6.3.0: 6.3.0

Compare Source

Please see the release notes.

npm/pacote (pacote)

v21.5.1

Compare Source

Bug Fixes
Chores
rolldown/rolldown (rolldown)

v1.1.1

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks
❤️ New Contributors

v1.1.0

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks
❤️ New Contributors
sass/dart-sass (sass)

v1.101.0

Compare Source

  • Potentially breaking bug fix: The Node package importer now properly
    supports resolving import-only variants of Sass files declared in the
    exports, sass, and style fields of package.json. Previously, these
    files were ignored even when loaded via @import, so any code relying on
    loading module-system-only files this way may break.
npm/node-semver (semver)

v7.8.4

Compare Source

Bug Fixes

v7.8.3

Compare Source

Bug Fixes
Chores

v7.8.2

Compare Source

Bug Fixes
nodejs/undici (undici)

v8.4.1

Compare Source

What's Changed
New Contributors

Full Changelog: nodejs/undici@v8.4.0...v8.4.1

v8.4.0

Compare Source

What's Changed
New Contributors

Full Changelog: nodejs/undici@v8.3.0...v8.4.0

webpack/watchpack (watchpack)

v2.5.2

Compare Source

Patch Changes

  • fix: retry fs.lstat on transient EBUSY errors instead of emitting a spurious remove event (fixes #​223, #​44). The retry count is controlled by the WATCHPACK_RETRIES environment variable (default: 3; set to 0 or "false" to disable retrying). (by @​alexander-akait in #​293)

  • Improve perfomance for ignored and improve perfomance for reduce plan. (by @​alexander-akait in #​289)

  • perf: speed up ignored matchers (~35–45% faster on POSIX paths) and reducePlan (~20–40% faster on medium and large plans). Also adds a tinybench suite under bench/ and a CodSpeed GitHub Actions workflow to catch future regressions. (by @​alexander-akait in #​287)

  • fix: don't log "Watchpack Error (initial scan)" for unreadable entries inside a watched parent directory, e.g. pagefile.sys on WSL or /efi on Linux (fixes #​187). EACCES / ENODEV (and EINVAL on Windows) errors are now handled like EPERM / ENOENT / EBUSY: the entry is recorded as missing and the scan continues silently. (by [@​alexander-akait](https://redirect.gi

✂ Note

PR body was truncated to here.

@angular-robot angular-robot added action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only] labels Jun 11, 2026
gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jun 11, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates several package dependencies across multiple package.json files in the workspace, including rollup, semver, undici, http-proxy-middleware, and jasmine, to their newer versions. There are no review comments, and I have no feedback to provide.

@angular-robot angular-robot force-pushed the ng-renovate/main-all-non-major-dependencies branch 5 times, most recently from ff994ce to 8f34bd1 Compare June 12, 2026 21:22
@angular-robot angular-robot force-pushed the ng-renovate/main-all-non-major-dependencies branch from 8f34bd1 to a9ca58d Compare June 12, 2026 22:19
@angular-robot
build: update all non-major dependencies
d8b2217 
See associated pull request for more information.
@angular-robot angular-robot force-pushed the ng-renovate/main-all-non-major-dependencies branch from a9ca58d to d8b2217 Compare June 12, 2026 22:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dgp1130 dgp1130 dgp1130 approved these changes

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

action: merge The PR is ready for merge by the caretaker area: build & ci Related the build and CI infrastructure of the project target: automation This PR is targeted to only merge into the branch defined in Github [bot use only]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@angular-robot @dgp1130