fix(deps): update all non-major dependencies - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/generator (source)	^7.28.0 -> ^7.28.3
@babel/parser (source)	^7.28.0 -> ^7.28.3
@babel/types (source)	^7.28.1 -> ^7.28.2
@sxzz/eslint-config	^7.0.6 -> ^7.1.2
@types/node (source)	^24.0.14 -> ^24.3.0
ast-kit	^2.1.1 -> ^2.1.2
bumpp	^10.2.0 -> ^10.2.3
eslint (source)	^9.31.0 -> ^9.33.0
magic-string-ast	^1.0.0 -> ^1.0.2
pnpm (source)	10.13.1 -> 10.14.0
rollup (source)	^4.45.1 -> ^4.46.2
tsdown	^0.12.9 -> ^0.14.1
tsx (source)	^4.20.3 -> ^4.20.4
typescript (source)	^5.8.3 -> ^5.9.2
unplugin (source)	^2.3.5 -> ^2.3.6
vite (source)	^7.0.5 -> ^7.1.2

---

Release Notes

babel/babel (@​babel/generator)

v7.28.3

Compare Source

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

babel/babel (@​babel/parser)

v7.28.3

Compare Source

v7.28.3 (2025-08-14)

👓 Spec Compliance

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators, babel-plugin-transform-class-static-block, babel-preset-env
  • #​17443 [static blocks] Do not inject new static fields after static code (@​nicolo-ribaudo)

🐛 Bug Fix

• babel-parser
  • #​17465 fix(parser/typescript): parse import("./a", {with:{},}) (@​easrng)
  • #​17478 fix(parser): stop subscript parsing on async arrow (@​JLHwung)

💅 Polish

• babel-plugin-transform-regenerator, babel-plugin-transform-runtime
  • #​17363 Do not save last yield in call in temp var (@​nicolo-ribaudo)

📝 Documentation

• #​17448 move eslint-{parser,plugin} docs to the website (@​JLHwung)

🏠 Internal

• #​17454 Enable type checking for scripts and babel-worker.cjs (@​JLHwung)

🔬 Output optimization

• babel-plugin-proposal-destructuring-private, babel-plugin-proposal-do-expressions
  • #​17444 Optimize do expression output (@​JLHwung)

Committers: 5

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Jam Balaya (@​JamBalaya56562)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• easrng (@​easrng)

sxzz/eslint-config (@​sxzz/eslint-config)

v7.1.2

Compare Source

   🚀 Features

• Sort erasableSyntaxOnly  -  by @​sxzz (59bb1)

    View changes on GitHub

v7.1.1

Compare Source

   🐞 Bug Fixes

• Disable unicorn/require-module-specifiers  -  by @​sxzz (1e14f)

    View changes on GitHub

v7.1.0

Compare Source

   🚀 Features

• Enable more unicorn rules  -  by @​sxzz (692bb)

    View changes on GitHub

sxzz/ast-kit (ast-kit)

v2.1.2

Compare Source

   🐞 Bug Fixes

• deps: Update all non-major dependencies  -  in https://github.com/sxzz/ast-kit/issues/115 (c3ebc)

    View changes on GitHub

antfu-collective/bumpp (bumpp)

v10.2.3

Compare Source

   🐞 Bug Fixes

• Add missing -a alias support for --all  -  by @​kingyue737 in https://github.com/antfu-collective/bumpp/issues/93 (7c0bb)

    View changes on GitHub

v10.2.2

Compare Source

   🐞 Bug Fixes

• Improve workspace handling in normalizeOptions #​90  -  by @​Vanisper in https://github.com/antfu-collective/bumpp/issues/91 and https://github.com/antfu-collective/bumpp/issues/90 (5dc8c)

    View changes on GitHub

v10.2.1

Compare Source

   🐞 Bug Fixes

• Respect custom cwd, close #​87  -  by @​pot-code in https://github.com/antfu-collective/bumpp/issues/89 and https://github.com/antfu-collective/bumpp/issues/87 (08137)

    View changes on GitHub

eslint/eslint (eslint)

v9.33.0

Compare Source

v9.32.0

Compare Source

sxzz/magic-string-ast (magic-string-ast)

v1.0.2

Compare Source

No significant changes

    View changes on GitHub

v1.0.1

Compare Source

No significant changes

    View changes on GitHub

pnpm/pnpm (pnpm)

v10.14.0

Compare Source

Minor Changes

• Added support for JavaScript runtime resolution

  Declare Node.js, Deno, or Bun in devEngines.runtime (inside package.json) and let pnpm download and pin it automatically.

  Usage example:

  {
    "devEngines": {
      "runtime": {
        "name": "node",
        "version": "^24.4.0",
        "onFail": "download" (we only support the "download" value for now)
      }
    }
  }

  How it works:

  1. pnpm install resolves your specified range to the latest matching runtime version.
  2. The exact version (and checksum) is saved in the lockfile.
  3. Scripts use the local runtime, ensuring consistency across environments.

  Why this is better:

  1. This new setting supports also Deno and Bun (vs. our Node-only settings useNodeVersion and executionEnv.nodeVersion)
  2. Supports version ranges (not just a fixed version).
  3. The resolved version is stored in the pnpm lockfile, along with an integrity checksum for future validation of the Node.js content's validity.
  4. It can be used on any workspace project (like executionEnv.nodeVersion). So, different projects in a workspace can use different runtimes.
  5. For now devEngines.runtime setting will install the runtime locally, which we will improve in future versions of pnpm by using a shared location on the computer.

  Related PR: #​9755.

• Add --cpu, --libc, and --os to pnpm install, pnpm add, and pnpm dlx to customize supportedArchitectures via the CLI #​7510.

Patch Changes

• Fix a bug in which pnpm add downloads packages whose libc differ from pnpm.supportedArchitectures.libc.
• The integrities of the downloaded Node.js artifacts are verified #​9750.
• Allow dlx to parse CLI flags and options between the dlx command and the command to run or between the dlx command and -- #​9719.
• pnpm install --prod should removing hoisted dev dependencies #​9782.
• Fix an edge case bug causing local tarballs to not re-link into the virtual store. This bug would happen when changing the contents of the tarball without renaming the file and running a filtered install.
• Fix a bug causing pnpm install to incorrectly assume the lockfile is up to date after changing a local tarball that has peers dependencies.

rollup/rollup (rollup)

v4.46.2

Compare Source

2025-07-29

Bug Fixes

• Fix in-operator handling for external namespace and when the left side cannot be analyzed (#​6041)

Pull Requests

• #​6041: Correct the logic of include in BinaryExpression and don't optimize external references away (@​TrickyPi, @​cyyynthia, @​lukastaegert)

v4.46.1

Compare Source

2025-07-28

Bug Fixes

• Do not fail when using the in operator on external namespaces (#​6036)

Pull Requests

• #​6036: disables optimization for external namespace when using the in operator (@​TrickyPi)

v4.46.0

Compare Source

2025-07-27

Features

• Optimize in checks on namespaces to keep them treeshake-able (#​6029)

Pull Requests

• #​5991: feat: update linux-loongarch64-gnu (@​wojiushixiaobai, @​lukastaegert)
• #​6029: feat: optimize in checks on namespaces to keep them treeshake-able (@​cyyynthia, @​lukastaegert)
• #​6033: fix(deps): update swc monorepo (major) (@​renovate[bot], @​lukastaegert)

v4.45.3

Compare Source

2025-07-26

Bug Fixes

• Do not fail build if a const is reassigned but warn instead (#​6020)
• Fail with a helpful error message if an exported binding is not defined (#​6023)

Pull Requests

• #​6014: chore(deps): update dependency @​vue/language-server to v3 (@​renovate[bot])
• #​6015: chore(deps): update dependency vue-tsc to v3 (@​renovate[bot], @​lukastaegert)
• #​6016: fix(deps): update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #​6017: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)
• #​6020: Make const reassignments only a warning (@​lukastaegert)
• #​6023: Throw descriptive error message for used export is not defined (@​TrickyPi)
• #​6027: feat: upgrade to NAPI-RS 3 stable (@​Brooooooklyn)
• #​6028: Update eslint-plugin-unicorn to resolve vulnerability (@​lukastaegert)
• #​6034: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)

rolldown/tsdown (tsdown)

v0.14.1

Compare Source

   🐞 Bug Fixes

• Remove expandDirectories  -  by @​Debbl in https://github.com/rolldown/tsdown/issues/427 (fb2d1)

    View changes on GitHub

v0.14.0

Compare Source

   🚨 Breaking Changes

• Disable expandDirectories for matching fast-glob's behavior  -  by @​sxzz (8171b)

    View changes on GitHub

v0.13.5

Compare Source

   🐞 Bug Fixes

• Use latest rolldown  -  by @​sxzz (8ae72)

    View changes on GitHub

v0.13.4

Compare Source

   🚀 Features

• Add failOnWarn option  -  by @​Gugustinette in https://github.com/rolldown/tsdown/issues/411 (d7d49)
• Add cjsDefault option  -  by @​sxzz (f503f)

   🐞 Bug Fixes

• Suppress mixed export warnings if cjsDefault is enabled  -  by @​sxzz (3ffa9)

    View changes on GitHub

v0.13.3

Compare Source

   🚨 Minor Breaking Changes

• dts.build option should be enable manually for tsc -b  -  by @​sxzz (13146)

   🚀 Features

• Add logLevel & customLogger option  -  by @​sxzz (724d1)
• Add warnOnce to logger  -  by @​sxzz (eb4fb)
• Allow regex for ignoreWatch  -  by @​sxzz (91f9f)
• Warn user if config includes cjs format  -  by @​Gugustinette and @​sxzz in https://github.com/rolldown/tsdown/issues/403 (bd42e)

   🐞 Bug Fixes

• Resolve ignoreWatch  -  by @​sxzz (d0e31)

    View changes on GitHub

v0.13.2

Compare Source

   🚨 Upstream Breaking Changes

• Rename dts.isolatedDeclarations to dts.oxc  -  by @​sxzz (5bdb9)

   🚀 Features

• Support silent as programmatic usage  -  by @​Gugustinette and @​sxzz in https://github.com/rolldown/tsdown/issues/404 (6d4b4)

   🐞 Bug Fixes

• Invalidate tsc before rebuild  -  by @​sxzz (0c7ab)
• Silent for resolved options  -  by @​sxzz (4566c)

    View changes on GitHub

v0.13.1

Compare Source

   🚀 Features

• Exports with dir index  -  by @​Debbl in https://github.com/rolldown/tsdown/issues/393 (dd6c7)

   🐞 Bug Fixes

• Clean outDir on rebuilds in watch mode  -  by @​ekzhang in https://github.com/rolldown/tsdown/issues/398 (7308f)
• Overload defineConfig  -  by @​sxzz (7c32a)
• Kill sub-process for onSuccess  -  by @​sxzz (bd9d8)

    View changes on GitHub

v0.13.0

Compare Source

   🚨 Breaking Changes

• Drop node 18, require node 20.19+  -  by @​sxzz (d80f7)
• Reuse generated dts by default  -  by @​sxzz (81f21)

   🚀 Features

• Add banner & footer options  -  by @​gwansikk and @​sxzz in https://github.com/rolldown/tsdown/issues/338 (54e21)
• Add cjsDts to input/output options context  -  by @​sxzz (3c4b3)
• Export types  -  by @​sxzz (f13bc)

   🐞 Bug Fixes

• Don't external shim file  -  by @​sxzz (8ee20)
• report: Path separator  -  by @​sxzz (6e11a)
• types: Keep type of options  -  by @​posva in https://github.com/rolldown/tsdown/issues/381 (00b5d)
• workspace: Normalize windows path  -  by @​RSS1102 in https://github.com/rolldown/tsdown/issues/376 (375d9)

    View changes on GitHub

privatenumber/tsx (tsx)

v4.20.4

Compare Source

microsoft/TypeScript (typescript)

v5.9.2

Compare Source

unjs/unplugin (unplugin)

v2.3.6

Compare Source

   🐞 Bug Fixes

• Exact optional property types  -  by @​iwoplaza in https://github.com/unjs/unplugin/issues/500 (97f20)

    View changes on GitHub

vitejs/vite (vite)

v7.1.2

Compare Source

Bug Fixes

• client: add [vite] prefixes to debug logs (#​20595) (7cdef61)
• config: make debugger work with bundle loader (#​20573) (c583927)
• deps: update all non-major dependencies (#​20587) (20d4817)
• don't consider ids with npm: prefix as a built-in module (#​20558) (ab33803)
• hmr: watch non-inlined assets referenced by CSS (#​20581) (b7d494b)
• module-runner: prevent crash when sourceMappingURL pattern appears in string literals (#​20554) (2770478)

Miscellaneous Chores

• deps: migrate to @jridgewell/remapping from @ampproject/remapping (#​20577) (0a6048a)
• deps: update rolldown-related dependencies (#​20586) (77632c5)

v7.1.1

Compare Source

Bug Fixes

• deps: update launch-editor-middleware (#​20569) (826b394)

Miscellaneous Chores

• fix changelog beta links (#​20561) (2e0c21a)
• update 7.1 changelog (#​20560) (d8869b8)

v7.1.0

Compare Source

Features

• support files with more than 1000 lines by generateCodeFrame (#​20508) (e7d0b2a)

Bug Fixes

• css: avoid warnings for image-set containing __VITE_ASSET__ (#​20520) (f1a2635)
• css: empty CSS entry points should generate CSS files, not JS files (#​20518) (bac9f3e)
• dev: denied request stalled when requested concurrently (#​20503) (64a52e7)
• manifest: initialize entryCssAssetFileNames as an empty Set (#​20542) (6a46cda)
• skip prepareOutDirPlugin in workers (#​20556) (97d5111)

Tests

• detect ts support via process.features (#​20544) (856d3f0)
• fix unimportant errors in test-unit (#​20545) (1f23554)

v7.0.6

Compare Source

Bug Fixes

• deps: update all non-major dependencies (#​20442) (e49f505)
• dev: incorrect sourcemap when optimized CJS is imported (#​20458) (ead2dec)
• module-runner: normalize file:// on windows (#​20449) (1c9cb49)
• respond with correct headers and status code for HEAD requests (#​20421) (23d04fc)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#​20441) (f689d61)
• remove some files from prettier ignore (#​20459) (8403f69)

Code Refactoring

• use environment transform request (#​20430) (24e6a0c)

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​babel/​generator@​7.28.0 ⏵ 7.28.3	+1			+4
	@​babel/​parser@​7.28.0 ⏵ 7.28.3	+1		+1	+4
	@​babel/​types@​7.28.1 ⏵ 7.28.2	+1		+1
	@​types/​node@​24.0.14 ⏵ 24.3.0	+1		+1
	tsx@​4.20.3 ⏵ 4.20.4			+1
	bumpp@​10.2.0 ⏵ 10.2.3	+1		+1
	@​sxzz/​eslint-config@​7.0.6 ⏵ 7.1.2			+1	+1
	vite@​7.0.5 ⏵ 7.1.2				+2
	ast-kit@​2.1.1 ⏵ 2.1.2	-7			+6
	unplugin@​2.3.5 ⏵ 2.3.6
	magic-string-ast@​1.0.0 ⏵ 1.0.2	-9			+8
	tsdown@​0.12.9 ⏵ 0.14.1	-6		+1	+1
	typescript@​5.8.3 ⏵ 5.9.2	+1		+1
	eslint@​9.31.0 ⏵ 9.33.0	+1			-1
	rollup@​4.45.1 ⏵ 4.46.2	+1			+1

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/unplugin-ast@101

commit: 086a8ba