Skip to content

deps-dev: bump the dev-dependencies group with 6 updates - #155

Merged
funkadelic merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-b969017dbd
Oct 28, 2026
Merged

deps-dev: bump the dev-dependencies group with 6 updates#155
funkadelic merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-b969017dbd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 6 updates:

Package From To
chromatic 18.13.0 18.13.3
fallow 3.33.1 3.35.0
postcss 8.5.30 8.5.31
sass 1.105.2 1.106.1
typescript-eslint 8.71.2 8.72.0
vite 8.3.4 8.3.5

Updates chromatic from 18.13.0 to 18.13.3

Release notes

Sourced from chromatic's releases.

v18.13.3

Release Notes

Lower default TurboSnap lockfile parse concurrency to 1 (#1564)

TurboSnap now parses one lockfile at a time by default (previously 200), which greatly reduces peak memory in repositories with many package manifests. Wall time is unchanged, since parsing is synchronous. Set CHROMATIC_TURBOSNAP_PACKAGE_CONCURRENCY to override the default.

🐛 Bug Fix

  • Lower default TurboSnap lockfile parse concurrency to 1 #1564 (@​codykaup)
  • [TurboSnap v2] Skip generated directories under node_modules #1557 (@​codykaup)
  • Replace raceFulfilled with Promise.any and fix findChangedPackageFiles short-circuit #1556 (@​codykaup)
  • Show upload task as skipped when TurboSnap bypasses the build #1559 (@​codykaup)

Authors: 1

v18.13.2

🐛 Bug Fix

Authors: 2

v18.13.1

🐛 Bug Fix

... (truncated)

Changelog

Sourced from chromatic's changelog.

v18.13.3 (Thu Oct 22 2026)

Release Notes

Lower default TurboSnap lockfile parse concurrency to 1 (#1564)

TurboSnap now parses one lockfile at a time by default (previously 200), which greatly reduces peak memory in repositories with many package manifests. Wall time is unchanged, since parsing is synchronous. Set CHROMATIC_TURBOSNAP_PACKAGE_CONCURRENCY to override the default.

🐛 Bug Fix

  • Lower default TurboSnap lockfile parse concurrency to 1 #1564 (@​codykaup)
  • [TurboSnap v2] Skip generated directories under node_modules #1557 (@​codykaup)
  • Replace raceFulfilled with Promise.any and fix findChangedPackageFiles short-circuit #1556 (@​codykaup)
  • Show upload task as skipped when TurboSnap bypasses the build #1559 (@​codykaup)

Authors: 1

v18.13.2 (Wed Oct 21 2026)

🐛 Bug Fix

Authors: 2

v18.13.1 (Wed Oct 21 2026)

🐛 Bug Fix

... (truncated)

Commits
  • 4033b6a Bump version to: 18.13.3 [skip ci]
  • abd5591 Update CHANGELOG.md [skip ci]
  • ba52e83 Merge pull request #1564 from chromaui/codykaup/cap-5369
  • bd24fa6 Merge pull request #1557 from chromaui/cody/cap-5349
  • caa0e0d Lower default TurboSnap lockfile parse concurrency to 1
  • 10fb703 Only skip .federation under node_modules
  • 7db223e List generated node_modules directories in a set
  • 611fda9 Only skip node_modules directories seen in stats graphs
  • f696742 Lower default TurboSnap lockfile parse concurrency to 2
  • f595a8d Merge pull request #1556 from chromaui/cody/cap-5331-clean-up-promise-edge-ca...
  • Additional commits viewable in compare view

Updates fallow from 3.33.1 to 3.35.0

Release notes

Sourced from fallow's releases.

v3.35.0: worsened complexity in audit, Vite+ and Egg.js plugins, mutation progress

Features

  • fallow audit reports inherited complexity findings that got worse. A complexity finding from the base snapshot is now worsened when its cyclomatic, cognitive, CRAP or line count value is higher than at the base. CRAP counts only when both sides have a score. The line count must grow by at least 5 lines, so a short comment or a formatter rewrap keeps a finding inherited. A function that grows from 80 to 300 lines with the same complexity values is now worsened. The JSON output adds attribution to each complexity finding, worsened_metrics to each finding with a grown value, and attribution.worsened and attribution.complexity_worsened. The human, compact and markdown output add a "Worse than base" section. SARIF and CodeClimate show the values, and the GitHub summary marks each finding as worsened. The --worsened flag and the audit.worsened config key select the effect: warn (default, exit code 0), error (counts like an introduced finding) or off (only growth of an exceeded metric is worsened). The GitHub Action has a worsened input, the GitLab template has FALLOW_AUDIT_WORSENED, and the MCP audit tool has a worsened parameter.

  • The VS Code extension has a fallow.audit.worsened setting. The values are warn, error and off, the same as fallow audit --worsened. The default auto uses audit.worsened from the project config. The extension sends the flag only to a CLI that supports it. With an older CLI, the audit runs without the flag and the output channel shows a note.

  • A human fallow mutation run shows phase progress on stderr. The lines name the runner setup, the baseline run and the mutant runs with done and total counts. They also name the retries, the final worktree check and the report. A long phase prints a line at a fixed interval, also in non-TTY output, so a slow run does not look stalled. --quiet and --format json print no progress lines, and stdout does not change. The programmatic API has run_mutation_with_progress with MutationProgress events. (#3599)

  • fallow mutation --runner-config <path> selects the Vitest config of a run. A project that keeps its integration, UI or browser tests in a separate Vitest config can now run mutants against those tests. The mutation.runnerConfig config key sets the same file, and the flag wins. The file must exist inside the project root, and only the Vitest runner accepts it. A static test file that the selected config does not include stays visible as a test-files-not-discovered error. --config still selects the Fallow config. (#3598)

  • Mutation JSON shows the edit of each mutant and the history of each retry. Each mutant in the mutation report and the mutation-plan document has a change object, for example {"from": "??", "to": "&&"}. The values come from a fixed vocabulary of operator tokens, literals and placeholders, so the report still holds no source text (#3658). A retried mutant has a new attempts array with the status, the duration and the killing test, failure kind or runtime-error reason of each run. You can now see if a flaky result was timeout -> survived or survived -> killed (#3656).

  • fallow mutation mutates fluent chains in module-level const initializers. The new removed-chain-link operator removes one call link of a chain. For example, z.number().int().positive() gives a mutant without .int() and a mutant without .positive(). A validation schema with no literal or operator now has mutants. The operator is on by default, and --operators and mutation.operators accept its name. (#3662)

  • Fallow reads Vite+ projects. A vite-plus dependency, or a root vite.config.* that imports vite-plus, enables the new vite-plus plugin. The pack.entry values are entry points, and the lint.jsPlugins, lint.overrides[].jsPlugins and lint.extends packages count as used. The vite-plus dependency also enables the Vitest plugin. The vp, vpr and vpx binaries credit vite-plus. Fallow reads vp test -c <file>, vp exec <binary> and vp run <task>. It also reads the commands of the staged and run.tasks blocks and the .vite-hooks/ scripts. The file targets of vp lint and vp fmt are not entry points. A vi.mock call through vite-plus/test counts as a Vitest mock.

  • Fallow detects Egg.js and tegg projects. The new egg plugin activates on egg, @eggjs/core or @eggjs/tegg, or on an egg, eggPlugin or eggModule key in package.json. Entry points are the files that the Egg loader loads by convention: app.js, agent.js, the router, controllers, services, middleware, extensions, schedules and config files, also in nested example and test fixture apps. Every file of a tegg module is an entry point. The plugin credits the packages that config/plugin.* names, the egg.framework package and the default egg framework to the package.json that owns the app.

  • Fallow reads the entry files of a JavaScript GitHub Action. When action.yml or action.yaml sets runs.using to a node runtime, the runs.pre, runs.main and runs.post files are entry points. A path in dist/ maps to its source file, with the same rules as a package.json main field. A composite or Docker action adds no entry points.

  • A dead-code baseline records if node_modules existed. A --save-baseline run writes analysis_identity.node_modules as present or missing. A later run in the other install state adds a baseline-install-state-mismatch entry to workspace_diagnostics and prints a warning, also under --quiet. Findings that need installed packages can differ between the two states, so such a run can report baseline findings as new.

  • External plugins can opt a config pattern out of the default export credit. List the pattern in configDefaultExportOptOut when the tool reads named exports, or when the pattern also matches ordinary source files.

  • Fallow reports a missing workspace directory and analyzes nested pnpm projects. A positive workspace pattern whose directory does not exist now gets the workspace-pattern-dir-missing diagnostic, with degrades_analysis: true. While such a pattern exists, the run does not report unused-catalog-entries for any catalog, because the missing packages can use catalog entries. This also applies to a pattern for a directory that does not exist yet, such as packages/* in a template. A directory that exists but holds no package does not turn off the check. Create the directory before the run or remove the pattern to get the check back. A directory with its own package.json and pnpm-workspace.yaml that no root pattern declares is an independent pnpm project. Fallow analyzes it as a workspace and reports the information-only nested-project-root diagnostic. (#3710)

  • Each release publishes a CycloneDX SBOM for every target. The files are named fallow-<target>.cdx.json. .vex/openvex.json states why fallow is not affected by each advisory that the repository ignores. SECURITY.md lists the supported versions and the code scanning policy.

Changed

  • fallow audit --gate new-only reports growth of an already exceeded complexity metric as worsened. Before, such a finding was introduced. A function that exceeded a threshold on the base and grows a little in the PR no longer fails the audit by default. With the default audit.worsened: warn, the verdict is warn and the exit code is 0. The finding stays introduced when the growth moves it to a higher severity tier. It also stays introduced when it now exceeds a metric that it did not exceed on the base, and that metric grew. The exceeded flags and the tier come from the base run. A threshold override in the same PR does not make an old finding introduced.

  • fallow audit --gate new-only no longer fails on a CRAP score from estimated coverage alone. Without a coverage map, fallow estimates CRAP from static test reachability, and this estimate does not measure the change. A finding that exceeds only the CRAP threshold with estimated coverage now has effective_severity: warn and SARIF level warning. A finding that also exceeds the cyclomatic or cognitive threshold still gates. CRAP from measured coverage still gates, and --gate all does not change.

  • fallow audit no longer fails on a complexity finding in a test file. A long it(...) or describe(...) callback often exceeds the cognitive threshold. Such a finding now has effective_severity: warn and the new field gate_exemption: "test-file", with a verdict of at least warn and exit code 0. This applies to --gate new-only and --gate all. The human, markdown and compact views list these findings under "Test files, not gated". fallow health does not change. (#3753)

  • The GitHub Action requests the branded token only when it posts. The token step now runs only on a pull_request event with comment: true or review-comments: true. The branded-token input now defaults to auto. auto posts as the Fallow app when the workflow grants id-token: write. Without that permission, it falls back to github-token without a log line. An explicit branded-token: true keeps one short fallback line, and false behaves as before. (#3755)

  • --type-aware class-member refinement is faster on large projects. The symbol-use scan now checks the name first and keeps one alias answer for each symbol. On a large TypeScript project, the scan takes 4 to 12 s instead of 35 to 70 s, with the same decisions. The scan now also sends only the names that a query can reach to the checker for TypeScript files. JavaScript files keep the full scan, because require bindings also create aliases. (#3765)

  • fallow mutation with Vitest isolate: false no longer repeats the setup of unrelated test files. Each static mutant runs in a new runner process, and that process now dry-runs only the test files that cover the mutant. A covering test that fails its dry run is still a baseline failure. (#3650)

  • The fallow skill shows the review loop that fallow checks. One short example runs fallow audit, reads the walkthrough guide, writes a judgment, and validates it with --walkthrough-file. The example saves the guide and the judgment in the temporary folder, because a new file in the project tree makes the judgment stale.

Bug fixes

  • fallow mutation makes fewer equivalent mutants. No test can kill these mutants, so they no longer appear:
    • an empty-string or swapped-boolean case label with the same body as default, only when all labels are literals and both bodies exit unconditionally (#3639);
    • i != N for the test of a counted for loop with an integer let counter and no other write (#3649);

... (truncated)

Commits
  • 1f5a08d chore: release v3.35.0
  • 96c3b10 chore(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /editors/vscode i...
  • e950d68 chore(deps-dev): bump follow-redirects (#3726)
  • d2d3671 ci: skip the pull request title lint for bot pull requests (#3774)
  • d6e6fb7 ci: check Dependabot merge list fields before a merge (#3773)
  • d01e42c ci: keep Dependabot squash subjects within 100 characters (#3772)
  • ab193e8 perf(type-aware): send only reachable identifiers to the checker (#3765)
  • cb91b1e docs: name plugin_credits in the skill and the entry export credit for plugin...
  • a0a15ce docs: note that config discovery probes ancestor directories (#3769)
  • 6aa0d63 ci: drop sign-off trailers from Dependabot repair commits (#3768)
  • Additional commits viewable in compare view

Updates postcss from 8.5.30 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

Changelog

Sourced from postcss's changelog.

8.5.31

Commits

Updates sass from 1.105.2 to 1.106.1

Release notes

Sourced from sass's releases.

Dart Sass 1.106.1

To install Sass 1.106.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Fix a bug where an attribute selector with an empty value (such as [class=""]) would crash when serializing.

  • Don't crash when serializing a number with an empty unit. This is only possible through the JavaScript and Dart APIs or the embedded protocol.

Embedded Dart Sass

  • More robustly convert invalid value errors into PARAMS errors.

See the full changelog for changes in earlier releases.

Dart Sass 1.106.0

To install Sass 1.106.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Don't normalize CSS escapes in statement contexts that can contain interpolation. For example, @f\6Fo is now emitted as written rather than normalized to @foo.

  • Fix a bug where quotes would be removed from attribute selector values that contained backslashes.

  • Fix invalid source spans that could cause crashes when encountering a syntax error in selectors or media queries that also contain escape sequences.

  • Fix a bug where the indented syntax parser would crash when parsing a file where the first statement was indented and appeared after the first line.

  • Fix a bug that could cause crashes when encountering errors or warnings in interpolations that contain patterns like // */.

  • Potentially breaking compatibility fix: CSS escape codes whose values are 0, for Unicode surrogates, or greater than the maximum allowed code point are now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression contexts. Previously, in some cases these were instead normalized to the normalized form of the original escape sequence, which violates the principle that all escape sequences for identical values should be normalized the same way. In other cases, these would simply throw errors.

    As a special case, \0 on its own will continue to be normalized to \0 to support historical CSS hacks.

  • Potentially breaking bug fix: Throw an error for mixins and functions that have rest parameters which are the same as normal parameters. Previously, the positional parameters wouldn't be accessible and calling such a mixin or function with a named argument would crash the compiler.

  • Potentially breaking bug fix: Fix various cases where using a CSS escape code at the beginning of an identifier would change parsing behavior versus using the character directly.

  • Potentially breaking bug fix: When a number's unit is ambiguous with a numeric exponent, the unit is now serialized as an escape code rather than a literal e to avoid being interpreted as an exponent by CSS.

  • Potentially breaking bug fix: Don't parse a CSS escape code for U+45 LATIN CAPITAL LETTER E or U+65 LATIN LOWERCASE LETTER E as an exponent in @keyframes percentage selectors.

  • Potentially breaking bug fix: Properly normalize underscores written as CSS escape codes in variable, mixin, and function names.

... (truncated)

Changelog

Sourced from sass's changelog.

1.106.1

  • Fix a bug where an attribute selector with an empty value (such as [class=""]) would crash when serializing.

  • Don't crash when serializing a number with an empty unit. This is only possible through the JavaScript and Dart APIs or the embedded protocol.

Embedded Dart Sass

  • More robustly convert invalid value errors into PARAMS errors.

1.106.0

  • Don't normalize CSS escapes in statement contexts that can contain interpolation. For example, @f\6Fo is now emitted as written rather than normalized to @foo.

  • Fix a bug where quotes would be removed from attribute selector values that contained backslashes.

  • Fix invalid source spans that could cause crashes when encountering a syntax error in selectors or media queries that also contain escape sequences.

  • Fix a bug where the indented syntax parser would crash when parsing a file where the first statement was indented and appeared after the first line.

  • Fix a bug that could cause crashes when encountering errors or warnings in interpolations that contain patterns like // */.

  • Potentially breaking compatibility fix: CSS escape codes whose values are 0, for Unicode surrogates, or greater than the maximum allowed code point are now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression contexts. Previously, in some cases these were instead normalized to the normalized form of the original escape sequence, which violates the principle that all escape sequences for identical values should be normalized the same way. In other cases, these would simply throw errors.

    As a special case, \0 on its own will continue to be normalized to \0 to support historical CSS hacks.

  • Potentially breaking bug fix: Throw an error for mixins and functions that have rest parameters which are the same as normal parameters. Previously, the positional parameters wouldn't be accessible and calling such a mixin or function with a named argument would crash the compiler.

  • Potentially breaking bug fix: Fix various cases where using a CSS escape code at the beginning of an identifier would change parsing behavior versus using the character directly.

... (truncated)

Commits
  • 811ecc6 Pull the version back to 1.106.1 (#2893)
  • b10205e Fix serializing a number with an empty-string unit (#2892)
  • e79f8a7 Fix serializing an attribute selector with an empty value (#2891)
  • 2ea4fc0 Merge pull request #2883 from sass/fuzz
  • a113995 Bump postcss from 8.5.28 to 8.5.30 in /pkg/sass-parser (#2886)
  • 2d2e76c Try using the SassBot GitHub token when auto-merging dependabot PRs (#2885)
  • 5660824 Improve the accuracy of FileSpan.trimLeft() and .trimRight()
  • 09e4024 Throw an error for duplicate rest and non-rest parameter names
  • 34c8e6b Fix check for an indented first statement
  • a05866c Make _expandInterpolationLeft resilient to commented-out comments
  • Additional commits viewable in compare view

Updates typescript-eslint from 8.71.2 to 8.72.0

Release notes

Sourced from typescript-eslint's releases.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

  • eslint-plugin: lazy load rules (#13010)
  • eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
  • typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

  • ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
  • eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
  • eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
  • eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
  • eslint-plugin: [require-array-sort-compare] check tuples (#13058)
  • eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
  • type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
  • typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)
Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)
Commits
  • 981f07f release: v8.3.5 (#23856)
  • 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
  • 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
  • 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
  • 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
  • 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
  • df7b40e refactor(dev): consolidate mo...

    Description has been truncated

    Summary by cubic

    Bumps six dev dependencies to their latest patch and minor releases.

    Notes

    • sass 1.106.0 includes potentially breaking compatibility fixes for CSS escape normalization and duplicate rest parameter errors.
    • vite 8.3.5 pulls in updated rolldown and @oxc-project/types versions transitively.

    Written for commit 83c7cce. Summary will update on new commits.

    View guided diff Turn on auto-fix

@dependabot
deps-dev: bump the dev-dependencies group with 6 updates
83c7cce 
Bumps the dev-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [chromatic](https://github.com/chromaui/chromatic-cli) | `18.13.0` | `18.13.3` |
| [fallow](https://github.com/fallow-rs/fallow) | `3.33.1` | `3.35.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.30` | `8.5.31` |
| [sass](https://github.com/sass/dart-sass) | `1.105.2` | `1.106.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.2` | `8.72.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.4` | `8.3.5` |


Updates `chromatic` from 18.13.0 to 18.13.3
- [Release notes](https://github.com/chromaui/chromatic-cli/releases)
- [Changelog](https://github.com/chromaui/chromatic-cli/blob/main/CHANGELOG.md)
- [Commits](chromaui/chromatic-cli@v18.13.0...v18.13.3)

Updates `fallow` from 3.33.1 to 3.35.0
- [Release notes](https://github.com/fallow-rs/fallow/releases)
- [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml)
- [Commits](fallow-rs/fallow@v3.33.1...v3.35.0)

Updates `postcss` from 8.5.30 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.30...8.5.31)

Updates `sass` from 1.105.2 to 1.106.1
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.105.2...1.106.1)

Updates `typescript-eslint` from 8.71.2 to 8.72.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.0/packages/typescript-eslint)

Updates `vite` from 8.3.4 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

---
updated-dependencies:
- dependency-name: chromatic
  dependency-version: 18.13.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: fallow
  dependency-version: 3.35.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: sass
  dependency-version: 1.106.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.72.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 28, 2026
@dependabot
dependabot Bot requested a review from funkadelic as a code owner October 28, 2026 03:16
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Oct 28, 2026
@codspeed

codspeed Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Merging this PR will not alter performance

1 warning

⚠️ 4 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 26 untouched benchmarks

Comparing dependabot/npm_and_yarn/dev-dependencies-b969017dbd (83c7cce) with main (2e2db25)

Open in CodSpeed

@funkadelic
funkadelic merged commit e82b8db into main Oct 28, 2026
8 checks passed
@funkadelic
funkadelic deleted the dependabot/npm_and_yarn/dev-dependencies-b969017dbd branch October 28, 2026 18:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@funkadelic funkadelic funkadelic approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@funkadelic