chore(deps): update external fixes #53

renovate · 2025-05-19T13:55:27Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	`4.20250510.0` -> `4.20251210.0`
dotenv	`17.0.1` -> `17.2.3`
esbuild	`0.25.4` -> `0.27.1`
eslint-plugin-import	`2.31.0` -> `2.32.0`
lint-staged	`16.0.0` -> `16.2.7`
mocha (source)	`11.2.2` -> `11.7.5`
semantic-release	`24.2.3` -> `24.2.9`
wrangler (source)	`4.14.4` -> `4.53.0`

Release Notes

cloudflare/workerd (@cloudflare/workers-types)

motdotla/dotenv (dotenv)

`v17.2.3`

Compare Source

Changed

Fixed typescript error definition (#912)

`v17.2.2`

Compare Source

Added

🙏 A big thank you to new sponsor Tuple.app - the premier screen sharing app for developers on macOS and Windows. Go check them out. It's wonderful and generous of them to give back to open source by sponsoring dotenv. Give them some love back.

`v17.2.1`

Compare Source

Changed

Fix clickable tip links by removing parentheses (#897)

`v17.2.0`

Compare Source

Added

Optionally specify DOTENV_CONFIG_QUIET=true in your environment or .env file to quiet the runtime log (#889)
Just like dotenv any DOTENV_CONFIG_ environment variables take precedence over any code set options like ({quiet: false})

`v17.1.0`

Compare Source

Added

Add additional security and configuration tips to the runtime log (#884)
Dim the tips text from the main injection information text

const TIPS = [
  '🔐 encrypt with dotenvx: https://dotenvx.com',
  '🔐 prevent committing .env to code: https://dotenvx.com/precommit',
  '🔐 prevent building .env in docker: https://dotenvx.com/prebuild',
  '🛠️  run anywhere with `dotenvx run -- yourcommand`',
  '⚙️  specify custom .env file path with { path: \'/custom/path/.env\' }',
  '⚙️  enable debug logging with { debug: true }',
  '⚙️  override existing env vars with { override: true }',
  '⚙️  suppress all logs with { quiet: true }',
  '⚙️  write to custom object with { processEnv: myObject }',
  '⚙️  load multiple .env files with { path: [\'.env.local\', \'.env\'] }'
]

evanw/esbuild (esbuild)

`v0.27.1`

Compare Source

Fix bundler bug with var nested inside if (#4348)

This release fixes a bug with the bundler that happens when importing an ES module using require (which causes it to be wrapped) and there's a top-level var inside an if statement without being wrapped in a { ... } block (and a few other conditions). The bundling transform needed to hoist these var declarations outside of the lazy ES module wrapper for correctness. See the issue for details.
Fix minifier bug with for inside try inside label (#4351)

This fixes an old regression from version v0.21.4. Some code was introduced to move the label inside the try statement to address a problem with transforming labeled for await loops to avoid the await (the transformation involves converting the for await loop into a for loop and wrapping it in a try statement). However, it introduces problems for cross-compiled JVM code that uses all three of these features heavily. This release restricts this transform to only apply to for loops that esbuild itself generates internally as part of the for await transform. Here is an example of some affected code:
```
// Original code
d: {
  e: {
    try {
      while (1) { break d }
    } catch { break e; }
  }
}

// Old output (with --minify)
a:try{e:for(;;)break a}catch{break e}

// New output (with --minify)
a:e:try{for(;;)break a}catch{break e}
```

Inline IIFEs containing a single expression (#4354)

Previously inlining of IIFEs (immediately-invoked function expressions) only worked if the body contained a single return statement. Now it should also work if the body contains a single expression statement instead:

// Original code
const foo = () => {
  const cb = () => {
    console.log(x())
  }
  return cb()
}

// Old output (with --minify)
const foo=()=>(()=>{console.log(x())})();

// New output (with --minify)
const foo=()=>{console.log(x())};

The minifier now strips empty finally clauses (#4353)

This improvement means that finally clauses containing dead code can potentially cause the associated try statement to be removed from the output entirely in minified builds:

// Original code
function foo(callback) {
  if (DEBUG) stack.push(callback.name);
  try {
    callback();
  } finally {
    if (DEBUG) stack.pop();
  }
}

// Old output (with --minify --define:DEBUG=false)
function foo(a){try{a()}finally{}}

// New output (with --minify --define:DEBUG=false)
function foo(a){a()}

Allow tree-shaking of the Symbol constructor

With this release, calling Symbol is now considered to be side-effect free when the argument is known to be a primitive value. This means esbuild can now tree-shake module-level symbol variables:

// Original code
const a = Symbol('foo')
const b = Symbol(bar)

// Old output (with --tree-shaking=true)
const a = Symbol("foo");
const b = Symbol(bar);

// New output (with --tree-shaking=true)
const b = Symbol(bar);

`v0.27.0`

Compare Source

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information.

Use Uint8Array.fromBase64 if available (#4286)

With this release, esbuild's binary loader will now use the new Uint8Array.fromBase64 function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specify target when using this feature with Node (for example --target=node22) unless you're using Node v25+.
Update the Go compiler from v1.23.12 to v1.25.4 (#4208, #4311)

This raises the operating system requirements for running esbuild:
- Linux: now requires a kernel version of 3.2 or later
- macOS: now requires macOS 12 (Monterey) or later

`v0.26.0`

Compare Source

Enable trusted publishing (#4281)

GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

`v0.25.12`

Compare Source

Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:
- Atomics
- SharedArrayBuffer
From ES2020:
- BigInt64Array
- BigUint64Array
From ES2021:
- FinalizationRegistry
- WeakRef
From ES2025:
- Float16Array
- Iterator
Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
```
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
```
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
```
/* Original code */
@&#8203;view-transition {
  navigation: auto;
  types: check;
}

/* Old output */
@&#8203;view-transition { navigation: auto; types: check; }

/* New output */
@&#8203;view-transition {
  navigation: auto;
  types: check;
}
```
The new view transition feature provides a mechanism for creating animated transitions between documents in a multi-page app. You can read more about view transition rules here.

This change was contributed by @yisibl.
Trim CSS rules that will never match

The CSS minifier will now remove rules whose selectors contain :is() and :where() as those selectors will never match. These selectors can currently be automatically generated by esbuild when you give esbuild nonsensical input such as the following:
```
/* Original code */
div:before {
  color: green;
  &.foo {
    color: red;
  }
}

/* Old output (with --supported:nesting=false --minify) */
div:before{color:green}:is().foo{color:red}

/* New output (with --supported:nesting=false --minify) */
div:before{color:green}
```
This input is nonsensical because CSS nesting is (unfortunately) not supported inside of pseudo-elements such as :before. Currently esbuild generates a rule containing :is() in this case when you tell esbuild to transform nested CSS into non-nested CSS. I think it's reasonable to do that as it sort of helps explain what's going on (or at least indicates that something is wrong in the output). It shouldn't be present in minified code, however, so this release now strips it out.

`v0.25.11`

Compare Source

Add support for with { type: 'bytes' } imports (#4292)

The import bytes proposal has reached stage 2.7 in the TC39 process, which means that although it isn't quite recommended for implementation, it's generally approved and ready for validation. Furthermore it has already been implemented by Deno and Webpack. So with this release, esbuild will also add support for this. It behaves exactly the same as esbuild's existing binary loader. Here's an example:
```
import data from './image.png' with { type: 'bytes' }
const view = new DataView(data.buffer, 0, 24)
const width = view.getInt32(16)
const height = view.getInt32(20)
console.log('size:', width + '\xD7' + height)
```
Lower CSS media query range syntax (#3748, #4293)

With this release, esbuild will now transform CSS media query range syntax into equivalent syntax using min-/max- prefixes for older browsers. For example, the following CSS:
```
@&#8203;media (640px <= width <= 960px) {
  main {
    display: flex;
  }
}
```
will be transformed like this with a target such as --target=chrome100 (or more specifically with --supported:media-range=false if desired):
```
@&#8203;media (min-width: 640px) and (max-width: 960px) {
  main {
    display: flex;
  }
}
```

`v0.25.10`

Compare Source

Fix a panic in a minification edge case (#4287)

This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):
```
function identity(x) { return x }
identity({ y: identity(123) })
```
Fix @supports nested inside pseudo-element (#4265)

When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '

Configuration

📅 Schedule: Branch creation - "after 2pm on Monday" in timezone Europe/Zurich, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate-approve bot approved these changes May 19, 2025

View reviewed changes

renovate bot force-pushed the renovate-external-fixes branch 10 times, most recently from ff9a059 to 665fccc Compare May 25, 2025 04:25

renovate bot force-pushed the renovate-external-fixes branch 9 times, most recently from 6460df8 to d4e9706 Compare June 3, 2025 03:23

renovate bot force-pushed the renovate-external-fixes branch 9 times, most recently from 056a5cc to a76afb5 Compare June 10, 2025 10:48

renovate bot force-pushed the renovate-external-fixes branch from a76afb5 to 507bcf8 Compare June 11, 2025 14:55

renovate bot force-pushed the renovate-external-fixes branch 7 times, most recently from 71f362a to 3807610 Compare November 27, 2025 19:30

renovate bot force-pushed the renovate-external-fixes branch 10 times, most recently from a500656 to 6ed6c37 Compare December 5, 2025 05:57

renovate bot force-pushed the renovate-external-fixes branch 5 times, most recently from b767896 to 486b0f6 Compare December 12, 2025 05:09

renovate bot force-pushed the renovate-external-fixes branch 6 times, most recently from d11d884 to f060702 Compare December 23, 2025 02:42

chore(deps): update external fixes

1e9cb20

renovate bot force-pushed the renovate-external-fixes branch from f060702 to 1e9cb20 Compare December 24, 2025 10:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update external fixes #53

chore(deps): update external fixes #53

Uh oh!

renovate bot commented May 19, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): update external fixes #53

Are you sure you want to change the base?

chore(deps): update external fixes #53

Uh oh!

Conversation

renovate bot commented May 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Changed

Added

Changed

Added

Added

Configuration

Uh oh!

Reviewers

renovate bot commented May 19, 2025 •

edited

Loading