chore(deps): update all non-major dependencies

[github-actions]

This PR contains the following updates:

Package Updates Summary

Type	Count
📦 NPM Packages	14
Total	14

📦 npm Dependencies

14 packages will be updated

Package	Change	Age	Adoption	Passing	Confidence
esbuild (source)	0.27.7 -> 0.28.1
oxc-parser (source)	0.121.0 -> 0.143.0
oxc-transform (source)	0.121.0 -> 0.143.0
webpack (source)	5.106.2 -> 5.109.2
@stacksjs/bumpx (source)	0.2.6 -> 0.2.14
@stacksjs/bunpress (source)	0.1.4 -> 0.1.21
@stacksjs/clapp (source)	0.2.7 -> 0.2.12
@stacksjs/gitlint (source)	0.1.5 -> 0.1.7
@stacksjs/logsmith (source)	0.2.1 -> 0.2.11
@types/bun (source)	1.3.13 -> 1.3.14
buddy-bot (source)	0.9.19 -> 0.9.25
bun-git-hooks (source)	0.3.1 -> 0.3.2
bunfig (source)	0.15.11 -> 0.15.17
pickier (source)	0.1.28 -> 0.1.45

---

Release Notes

evanw/esbuild (esbuild)

0.27.7 -> 0.28.1

v0.28.1

Compare Source

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to [dellalibera](https://github.com/dellalibera) for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if ...

[View full release notes]

Released by github-actions[bot] on 6/11/2026

v0.28.0

Compare Source

• Add support for with { type: 'text' } imports (#4435)

  The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

  import string from './example.txt' with { type: 'text' }
  console.log(string)

• Add integrity checks to fallback download path (#4343)

  Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the re...

[View full release notes]

Released by github-actions[bot] on 4/2/2026

oxc-project/oxc (oxc-parser)

0.121.0 -> 0.143.0

apps_v1.77.0

Compare Source

Table of Contents

• Oxlint v1.77.0
• Oxfmt v0.62.0

Oxlint v1.77.0

💥 BREAKING CHANGES

• 4120da0 semantic: [BREAKING] Return borrowed JSDoc so the parse cache works (#25186) (Connor Shea)
• 067da8c ast: [BREAKING] Store single parameter in TSIndexSignature::parameter (#25154) (camc314)
• 1bdedd1 ast: [BREAKING] Introduce ExportDeclaration, ExportFromDeclaration (#25095) (camc314)
• c917f20 ast: [BREAKING] Introduce ArrowFunctionBody enum (#24987) (camc314)

🚀 Features

• 0b9f83c linter/oxc/bad-char-at-comparison: Expand coverage (#25001) (Mikhail Baev)
• 1fb3d70 oxlint: Show file:line:col in github format annotation messages (#25020) (Faris Tristan Fabian)

🐛 Bug Fixes

• a64b65d linter/unicorn/new-for-builtins: Detect parenthesized member expression object (#25249) (tanakalucky)
• 9d4592c linter: Reject duplicate JS plugin names (#25243) (camc314)
• 3213e7a linter: Ignore unsigned shifts...

[View full release notes]

Released by github-actions[bot] on 8/3/2026

crates_v0.142.0

Compare Source

💥 BREAKING CHANGES

• 1ac5ac7 ast: [BREAKING] Tighten bound on AstBuild trait (#24925) (overlookmotel)

🚀 Features

• c7c5696 minifier: Fold parenthesized boolean ternary tests (#24968) (Dunqing)
• 82c5806 minifier: Fold sequence branches in boolean ternaries (#24943) (Dunqing)
• cc623d9 ast_visit: Add VisitJsMut visitor (#24828) (Boshen)
• b31713a minifier: Add new IsTerminated trait and use it in exit-point optimization (#24950) (Armano)
• e9e0f24 minifier: Shorten integer zero comparisons (#24933) (Dunqing)
• 34f5559 minifier: Convert switch with one case to if statement (#24611) (Armano)
• 9107e74 str: Add static_str! macro (#24887) (overlookmotel)
• 4d6f623 parser: Emit error for type args in JS files (#24896) (camc314)
• ec08afc ast: Re-export Ident from oxc_ast crate (#24861) (overlookmotel)
• 73cfdfa oxc: Re-export oxc_str types from oxc crate (#24860) (overlookmotel)
• 11f5d1f ast_visit: Add `Utf8ToUtf16::convert_program_and_comm...

[View full release notes]

Released by github-actions[bot] on 7/27/2026

apps_v1.76.0

Compare Source

Table of Contents

• Oxlint v1.76.0
• Oxfmt v0.61.0

Oxlint v1.76.0

🚀 Features

• 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)
• 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)
• 016cf2a linter/oxc: Add bad-match-all-arg rule (#24900) (camc314)
• cdc941e linter/n: Implement exports-style rule (#24087) (Mikhail Baev)
• 1ad6f6c linter/eslint: Implement id-denylist rule (#24632) (Mikhail Baev)
• 678bbb5 linter/typescript-eslint: Implement suggestion for class-literal-property-style rule (#24766) (Mikhail Baev)

🐛 Bug Fixes

• a5f3a0e linter: Mark missing suggestions as pending (#24956) (Mikhail Baev)
• a065946 oxlint: Absolutize explicit CLI paths even with --no-ignore (#24646) (Bez Sahara)
• 17688bb linter/jsx-a11y/interactive-supports-focus: Match eslint behavior for custom components (#24780) (Cole Ellison)
• 0aef19e linter/ty...

[View full release notes]

Released by github-actions[bot] on 7/27/2026

oxc-project/oxc (oxc-transform)

0.121.0 -> 0.143.0

apps_v1.77.0

Compare Source

Table of Contents

• Oxlint v1.77.0
• Oxfmt v0.62.0

Oxlint v1.77.0

💥 BREAKING CHANGES

• 4120da0 semantic: [BREAKING] Return borrowed JSDoc so the parse cache works (#25186) (Connor Shea)
• 067da8c ast: [BREAKING] Store single parameter in TSIndexSignature::parameter (#25154) (camc314)
• 1bdedd1 ast: [BREAKING] Introduce ExportDeclaration, ExportFromDeclaration (#25095) (camc314)
• c917f20 ast: [BREAKING] Introduce ArrowFunctionBody enum (#24987) (camc314)

🚀 Features

• 0b9f83c linter/oxc/bad-char-at-comparison: Expand coverage (#25001) (Mikhail Baev)
• 1fb3d70 oxlint: Show file:line:col in github format annotation messages (#25020) (Faris Tristan Fabian)

🐛 Bug Fixes

• a64b65d linter/unicorn/new-for-builtins: Detect parenthesized member expression object (#25249) (tanakalucky)
• 9d4592c linter: Reject duplicate JS plugin names (#25243) (camc314)
• 3213e7a linter: Ignore unsigned shifts...

[View full release notes]

Released by github-actions[bot] on 8/3/2026

crates_v0.142.0

Compare Source

💥 BREAKING CHANGES

• 1ac5ac7 ast: [BREAKING] Tighten bound on AstBuild trait (#24925) (overlookmotel)

🚀 Features

• c7c5696 minifier: Fold parenthesized boolean ternary tests (#24968) (Dunqing)
• 82c5806 minifier: Fold sequence branches in boolean ternaries (#24943) (Dunqing)
• cc623d9 ast_visit: Add VisitJsMut visitor (#24828) (Boshen)
• b31713a minifier: Add new IsTerminated trait and use it in exit-point optimization (#24950) (Armano)
• e9e0f24 minifier: Shorten integer zero comparisons (#24933) (Dunqing)
• 34f5559 minifier: Convert switch with one case to if statement (#24611) (Armano)
• 9107e74 str: Add static_str! macro (#24887) (overlookmotel)
• 4d6f623 parser: Emit error for type args in JS files (#24896) (camc314)
• ec08afc ast: Re-export Ident from oxc_ast crate (#24861) (overlookmotel)
• 73cfdfa oxc: Re-export oxc_str types from oxc crate (#24860) (overlookmotel)
• 11f5d1f ast_visit: Add `Utf8ToUtf16::convert_program_and_comm...

[View full release notes]

Released by github-actions[bot] on 7/27/2026

apps_v1.76.0

Compare Source

Table of Contents

• Oxlint v1.76.0
• Oxfmt v0.61.0

Oxlint v1.76.0

🚀 Features

• 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)
• 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)
• 016cf2a linter/oxc: Add bad-match-all-arg rule (#24900) (camc314)
• cdc941e linter/n: Implement exports-style rule (#24087) (Mikhail Baev)
• 1ad6f6c linter/eslint: Implement id-denylist rule (#24632) (Mikhail Baev)
• 678bbb5 linter/typescript-eslint: Implement suggestion for class-literal-property-style rule (#24766) (Mikhail Baev)

🐛 Bug Fixes

• a5f3a0e linter: Mark missing suggestions as pending (#24956) (Mikhail Baev)
• a065946 oxlint: Absolutize explicit CLI paths even with --no-ignore (#24646) (Bez Sahara)
• 17688bb linter/jsx-a11y/interactive-supports-focus: Match eslint behavior for custom components (#24780) (Cole Ellison)
• 0aef19e linter/ty...

[View full release notes]

Released by github-actions[bot] on 7/27/2026

webpack/webpack (webpack)

5.106.2 -> 5.109.2

v5.109.2

Compare Source

Patch Changes

• Resolve aliases pointing at a package directory whose name ends with .js again. (by [alexander-akait](https://github.com/alexander-akait) in #21542)

• Name CSS sources in source maps by their resource path, without the css prefix. (by [bjohansebas](https://github.com/bjohansebas) in #21536)

• Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by [bjohansebas](https://github.com/bjohansebas) in #21528)

• Report "universal" as the loader context target for the universal target. (by [alexander-akait](https://github.com/alexander-akait) in [#21540](`w...

[View full release notes]

Released by github-actions[bot] on 7/28/2026

v5.109.1

Compare Source

Patch Changes

• Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by [alexander-akait](https://github.com/alexander-akait) in #21533)

• Make require(esm) module.exports re-export analysis independent of module processing order. (by [alexander-akait](https://github.com/alexander-akait) in #21521)

• Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by [alexander-akait](https://github.com/alexander-akait) in #21521)

• Name the failing key when DefinePlugin fails to evaluate a typeof value. (by [alexander-akait](https://github.com/alexander-akait) in #21503)

• Improve Deno compatibility: guard setNoDelay and ...

[View full release notes]

Released by github-actions[bot] on 7/27/2026

v5.109.0

Compare Source

Minor Changes

• Default experiments.typescript to "auto", enabling built-in TypeScript support on Node.js >= 22.6 when no TypeScript loader is registered. (by [alexander-akait](https://github.com/alexander-akait) in #21477)

• Default experiments.css, experiments.html and experiments.asyncWebAssembly to "auto", enabling built-in support unless a loader is registered for those files; modules with inline or hook-injected loaders (e.g. html-webpack-plugin templates) keep being parsed as JavaScript. (by [alexander-akait](https://github.com/alexander-akait) in #21477)

• Add output.resourceHints to emit resource hints (preload/prefetch/modulepreload/preconnect), on by default for ESM output, plus module.parser.<type>.urlHints, css.fontPreload and javascript.dynamicImportCssPreload. (by [[alexander-akait](https://github.com/ale...

[View full release notes]

Released by github-actions[bot] on 7/23/2026

stacksjs/bumpx (@stacksjs/bumpx)

0.2.6 -> 0.2.14

v0.2.14

Compare Source

Released by github-actions[bot] on 7/24/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 7/22/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 7/22/2026

stacksjs/bunpress (@stacksjs/bunpress)

0.1.4 -> 0.1.21

v0.1.21

Compare Source

Released by github-actions[bot] on 7/26/2026

v0.1.6

Compare Source

Released by github-actions[bot] on 5/24/2026

v0.1.5

Compare Source

Released by github-actions[bot] on 5/10/2026

stacksjs/clapp (@stacksjs/clapp)

0.2.7 -> 0.2.12

v0.2.12

Compare Source

Released by github-actions[bot] on 7/21/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 5/11/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 5/6/2026

stacksjs/gitlint (@stacksjs/gitlint)

0.1.5 -> 0.1.7

v0.1.7

Compare Source

Released by github-actions[bot] on 7/22/2026

v0.x.x

Compare Source

Released by github-actions[bot] on 5/8/2026

stacksjs/logsmith (@stacksjs/logsmith)

0.2.1 -> 0.2.11

v0.2.11

Compare Source

Released by github-actions[bot] on 7/28/2026

v0.2.10

Compare Source

Released by github-actions[bot] on 7/28/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 7/26/2026

DefinitelyTyped/DefinitelyTyped (@types/bun)

1.3.13 -> 1.3.14

Compare Source

TypeScript definitions for bun

📖 View Release Notes

🔗 View Changelog

Release Notes

Changelog

stacksjs/buddy-bot (buddy-bot)

0.9.19 -> 0.9.25

v0.9.25

Compare Source

Released by github-actions[bot] on 7/28/2026

v0.9.24

Compare Source

Released by github-actions[bot] on 7/24/2026

v0.9.23

Compare Source

Released by github-actions[bot] on 7/24/2026

stacksjs/bun-git-hooks (bun-git-hooks)

0.3.1 -> 0.3.2

v0.3.2

Compare Source

Released by github-actions[bot] on 5/14/2026

stacksjs/bunfig (bunfig)

0.15.11 -> 0.15.17

v0.15.17

Compare Source

Released by github-actions[bot] on 7/31/2026

v0.15.16

Compare Source

Released by github-actions[bot] on 7/31/2026

v0.15.15

Compare Source

Released by github-actions[bot] on 7/16/2026

pickier/pickier (pickier)

0.1.28 -> 0.1.45

v0.1.45

Compare Source

Released by github-actions[bot] on 8/2/2026

v0.1.44

Compare Source

Released by github-actions[bot] on 7/27/2026

v0.1.43

Compare Source

Released by github-actions[bot] on 7/27/2026

---

📊 Package Statistics

• esbuild: 260,233,457 weekly downloads
• oxc-parser: 40,002,912 weekly downloads
• oxc-transform: 4,494,786 weekly downloads
• webpack: 55,759,928 weekly downloads
• @stacksjs/bumpx: 55,743 weekly downloads
• @stacksjs/bunpress: 52,978 weekly downloads
• @stacksjs/clapp: 70,337 weekly downloads
• @stacksjs/gitlint: 49,007 weekly downloads
• @stacksjs/logsmith: 51,633 weekly downloads
• @types/bun: 9,326,621 weekly downloads
• buddy-bot: 50,007 weekly downloads
• bun-git-hooks: 47,384 weekly downloads
• bunfig: 68,306 weekly downloads
• pickier: 57,663 weekly downloads

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Buddy 🤖

[netlify]

❌ Deploy Preview for dtsx failed. Why did it fail? →

Name	Link
🔨 Latest commit	9f35b2d
🔍 Latest deploy log	https://app.netlify.com/projects/dtsx/deploys/6a70a9aa76fc0c0008b4cd37