Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 7 updates - #48

Closed
dependabot[bot] wants to merge 1 commit into
v5from
dependabot/npm_and_yarn/production-dependencies-7e2a8be477
Closed

chore(deps): bump the production-dependencies group across 1 directory with 7 updates#48
dependabot[bot] wants to merge 1 commit into
v5from
dependabot/npm_and_yarn/production-dependencies-7e2a8be477

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 7 updates in the / directory:

Package From To
@clack/prompts 0.11.0 1.7.0
@myriaddreamin/rehype-typst 0.6.0 0.7.0
@napi-rs/simple-git 0.1.22 1.1.0
sharp 0.34.5 0.35.3
@types/node 25.9.5 26.1.1
esbuild 0.27.7 0.28.1
typescript 5.9.3 7.0.2

Updates @clack/prompts from 0.11.0 to 1.7.0

Release notes

Sourced from @​clack/prompts's releases.

@​clack/prompts@​1.7.0

Minor Changes

  • #574 8f1c380 Thanks @​dreyfus92! - Add showInstructions option to select, multiselect, and groupMultiselect. Keyboard hints remain shown by default; pass showInstructions: false to hide them.

Patch Changes

@​clack/prompts@​1.6.0

Minor Changes

  • #568 f87933f Thanks @​florian-lefebvre! - Updates default formatter of note() to note dim lines anymore

    If you want the old behavior, provide a format() function:

    import { note } from '@clack/prompts';
+import { styleText } from 'node:util';
note(
'You can edit the file src/index.jsx',
'Next steps.'

{ format: (text) => styleText('dim', text) }
);

  • #567 cc6aab5 Thanks @​dreyfus92! - Add keyboard instruction footers to select, multiselect, and groupMultiselect in the active state, matching autocomplete. No option — always shown.

    • Patch Changes

    @​clack/prompts@​1.5.1

    Patch Changes

    @​clack/prompts@​1.5.0

    Minor Changes

    ... (truncated)

    Changelog

    Sourced from @​clack/prompts's changelog.

    1.7.0

    Minor Changes

    • #574 8f1c380 Thanks @​dreyfus92! - Add showInstructions option to select, multiselect, and groupMultiselect. Keyboard hints remain shown by default; pass showInstructions: false to hide them.

    Patch Changes

    1.6.0

    Minor Changes

    • #568 f87933f Thanks @​florian-lefebvre! - Updates default formatter of note() to note dim lines anymore

      If you want the old behavior, provide a format() function:

      import { note } from '@clack/prompts';
+import { styleText } from 'node:util';
note(
'You can edit the file src/index.jsx',
'Next steps.'

{ format: (text) => styleText('dim', text) }
);

  • #567 cc6aab5 Thanks @​dreyfus92! - Add keyboard instruction footers to select, multiselect, and groupMultiselect in the active state, matching autocomplete. No option — always shown.

    • Patch Changes

    1.5.1

    Patch Changes

    ... (truncated)

    Commits
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for @​clack/prompts since your current version.


    Updates @myriaddreamin/rehype-typst from 0.6.0 to 0.7.0

    Release notes

    Sourced from @​myriaddreamin/rehype-typst's releases.

    v0.7.0

    Packages

    Compiler

    rustdoc-typst-demo (New)

    Package: typst.ts

    Package: typst.react

    Package: typst.vue3

    Package: typst.svelte (New)

    ... (truncated)

    Commits
    Maintainer changes

    This version was pushed to npm by GitHub Actions, a new releaser for @​myriaddreamin/rehype-typst since your current version.


    Updates @napi-rs/simple-git from 0.1.22 to 1.1.0

    Release notes

    Sourced from @​napi-rs/simple-git's releases.

    v1.1.0

    What's Changed

    Full Changelog: Brooooooklyn/simple-git@v1.0.0...v1.1.0

    v1.0.0

    What's Changed

    ... (truncated)

    Commits
    • 3b8e55c 1.1.0
    • e580290 fix(deps): update void to v0.10.6 (#153)
    • 659d5ca feat: add created (first-add commit) to FileModification (#152)
    • 3ca64c5 chore(deps): update dorny/paths-filter action to v4 (#150)
    • 9b5a48b fix(deps): update dependency void to v0.10.5 (#151)
    • 723f6b3 chore: move renovate.json
    • 4ca5860 chore: fix yarn and renovate config
    • 638b632 fix(deps): update dependency @​void/react to v0.10.5 (#148)
    • 8300a3f fix(deps): update dependency @​void/md to v0.10.5 (#147)
    • 6881589 feat: simple-git.napi.rs website (landing + docs + Cloudflare deploy) (#146)
    • Additional commits viewable in compare view

    Updates sharp from 0.34.5 to 0.35.3

    Release notes

    Sourced from sharp's releases.

    v0.35.3

    • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

    • Improve code bundler support by resolving path to libvips binary.

    • Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

    • Emit warning about binaries provided by Electron for use on Linux.

    • Add hasAlpha property to output info. #4500

    • TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

    • Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

    • Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

    • Reject infinite values when validating numbers. #4553 @​metsw24-max

    • Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

    • Verify background colour values are numbers. #4556 @​metsw24-max

    • Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

    • Tighten recomb and affine matrix verification. #4560 @​chatman-media

    • Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

    v0.35.3-rc.2

    • Tighten verification of text dimensions, TIFF tile dimensions and extend values.

    ... (truncated)

    Commits
    • 1018449 Release v0.35.3
    • ba303a7 Prerelease v0.35.3-rc.2
    • 4f94fc5 Upgrade to sharp-libvips v1.3.2
    • c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
    • 9a8d002 Docs: Add changelog entry and note about transferable #4520
    • 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
    • e000d0b Prerelease v0.35.3-rc.1
    • 9554ca9 Prerelease v0.35.3-rc.0
    • 6a29fd5 Emit warning about native binaries on Linux Electron
    • 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
    • Additional commits viewable in compare view

    Updates @types/node from 25.9.5 to 26.1.1

    Commits

    Updates esbuild from 0.27.7 to 0.28.1

    Release notes

    Sourced from esbuild's releases.

    v0.28.1

    • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

      This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

      Thanks to @​dellalibera for reporting this issue.

    • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

      The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

      Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

      Thanks to @​sondt99 for reporting this issue.

    • Avoid inlining using and await using declarations (#4482)

      Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

      // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

    • Fix module evaluation when an error is thrown (#4461, #4467)

      If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

    • Fix some edge cases around the new operator (#4477)

      Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

      // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

    ... (truncated)

    Changelog

    Sourced from esbuild's changelog.

    0.28.1

    • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

      This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

      Thanks to @​dellalibera for reporting this issue.

    • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

      The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

      Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

      Thanks to @​sondt99 for reporting this issue.

    • Avoid inlining using and await using declarations (#4482)

      Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

      // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

    • Fix module evaluation when an error is thrown (#4461, #4467)

      If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

    • Fix some edge cases around the new operator (#4477)

      Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

      // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

    ... (truncated)

    Commits

    Updates typescript from 5.9.3 to 7.0.2

    Release notes

    Sourced from typescript's releases.

    TypeScript 6.0.3

    For release notes, check out the release announcement blog post.

    Downloads are available on:

    TypeScript 6.0

    For release notes, check out the release announcement blog post.

    Downloads are available on:

    TypeScript 6.0 Beta

    For release notes, check out the release announcement.

    Downloads are available on:

    Commits
    Maintainer changes

    This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

    @dependabot
    chore(deps): bump the production-dependencies group across 1 director…
    2d24837 
    …y with 7 updates

Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `0.11.0` | `1.7.0` |
| [@myriaddreamin/rehype-typst](https://github.com/Myriad-Dreamin/typst.ts) | `0.6.0` | `0.7.0` |
| [@napi-rs/simple-git](https://github.com/Brooooooklyn/simple-git) | `0.1.22` | `1.1.0` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.5` | `26.1.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.7` | `0.28.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `7.0.2` |



Updates `@clack/prompts` from 0.11.0 to 1.7.0
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.7.0/packages/prompts)

Updates `@myriaddreamin/rehype-typst` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/Myriad-Dreamin/typst.ts/releases)
- [Changelog](https://github.com/Myriad-Dreamin/typst.ts/blob/main/docs/release-workflows.md)
- [Commits](Myriad-Dreamin/typst.ts@v0.6.0...v0.7.0)

Updates `@napi-rs/simple-git` from 0.1.22 to 1.1.0
- [Release notes](https://github.com/Brooooooklyn/simple-git/releases)
- [Commits](Brooooooklyn/simple-git@v0.1.22...v1.1.0)

Updates `sharp` from 0.34.5 to 0.35.3
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.3)

Updates `@types/node` from 25.9.5 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `esbuild` from 0.27.7 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.7...v0.28.1)

Updates `typescript` from 5.9.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: "@clack/prompts"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: "@myriaddreamin/rehype-typst"
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@napi-rs/simple-git"
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
    @dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 23, 2026
    @dependabot @github

    dependabot Bot commented on behalf of github Jul 29, 2026

    Copy link
    Copy Markdown
    Contributor Author

    Looks like these dependencies are updatable in another way, so this is no longer needed.

    @dependabot dependabot Bot closed this Jul 29, 2026
    @dependabot
    dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-7e2a8be477 branch July 29, 2026 18:45
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Reviewers

    No reviews

    Assignees

    No one assigned

    Labels

    dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

    Projects

    None yet

    Milestone

    No milestone

    Development

    Successfully merging this pull request may close these issues.

    0 participants