Skip to content

fix(deps): update npm packages (minor and patch) - #338

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-minor-patch
Open

fix(deps): update npm packages (minor and patch)#338
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Nov 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@datum-cloud/datum-ui 3.4.0 → 3.11.0 age confidence
@rollup/plugin-commonjs (source) 29.0.2 → 29.0.3 age confidence
autoprefixer 10.4.27 → 10.6.2 age confidence
date-fns 4.1.0 → 4.4.0 age confidence
esbuild ^0.25.0 → ^0.28.0 age confidence
isbot (source) 5.1.36 → 5.2.3 age confidence
lightningcss 1.32.0 → 1.33.0 age confidence
monaco-editor ^0.52.0 || ^0.55.0 → ^0.52.0 || ^0.55.0 || ^0.57.0 age confidence
monaco-editor ^0.55.0 → ^0.57.0 age confidence
motion 13.2.0 → 13.5.1 age confidence
pnpm (source) 10.34.5 → 10.34.9 age confidence
postcss (source) 8.5.23 → 8.5.32 age confidence
react-day-picker (source) 10.0.1 → 10.0.2 age confidence
rollup (source) 4.60.0 → 4.68.2 age confidence
tslib (source) 2.8.1 → 2.9.1 age confidence
vite (source) 6.4.5 → 6.4.6 age confidence

Release Notes

datum-cloud/datum-ui (@​datum-cloud/datum-ui)

v3.11.0

Compare Source

Minor Changes
  • 184265b: Logs.Root takes isFetching for requests made while earlier results are still showing (filter, search or range changes, refreshes). The explorer keeps those results, dims the rows, spins the Refresh icon and shows a progress bar under the toolbar instead of swapping to skeletons, which are now only for the first load (isLoading). No bar shows while Live is on. While a request is in flight, Logs.Root also keeps the last facets that had options, so filters don't blank out on each click.
Patch Changes
  • 47524ff: Logs.Filters opens every filter group by default instead of only the first, so all options show at once and the list no longer collapses when it replaces the loading skeleton.
  • b796868: Picker triggers no longer nest a <button> for the clear X. The browser closed the trigger early on server-rendered pages, so the X showed below the field until hydration. The X is now a focusable role="button" element that Enter and Space activate.

v3.10.0

Compare Source

Minor Changes
  • 696413a: Logs.Filters keeps ticked values listed even when the facet data stops including them, so a selection can always be cleared. Previously, if a host built facets from rows already narrowed by the selection, the other options and sometimes the ticked one disappeared. New buildLogFacetCountQuery and facetFromLokiCounts helpers let hosts fetch each facet's full option list and counts for the time range from Loki, independent of what is ticked.
  • 696413a: New useLogsUrlState() hook in @datum-cloud/datum-ui/logs keeps the log explorer's time range, filters, search, live toggle and open row in the query string, so a refresh or a shared link reopens the same view. Spread its result onto Logs.Root. It uses the History API by default, or takes React Router's useSearchParams() pair. parseLogsUrlState and writeLogsUrlState do the same conversion without React.
Patch Changes
  • 7874f9e: Select, Autocomplete, MultiSelect, the date/time pickers and ButtonGroupText now share one trigger style, so they line up when they sit side by side in a toolbar. Each one uses 12px inline padding, text-sm at regular weight, the Input placeholder colour, and 16px muted icons with an 8px gap, so every chevron or clear icon ends 12px from the right border. Before this change, SelectTrigger was medium weight with a faded chevron. The picker trigger used px-4 with Button colours and a hover fill. MultiSelect's chevron sat about 24px in, and ButtonGroupText was medium weight with px-4. A new Storybook page, Foundations / Field Alignment, shows the triggers together. Trigger icons (chevrons, calendar, clear) now use the Icon wrapper's 1px stroke instead of lucide's heavier default, the clear X is 14px so it doesn't outweigh the chevron next to it, and MultiSelect keeps px-3 on the left when it shows chips. The logs toolbar search box is now h-9, matching the Live, Refresh and Export buttons beside it.

v3.8.0

Compare Source

Minor Changes

  • 4103463: Animate Checkbox, RadioGroup, Switch, Collapsible, copy buttons and chips with Motion, and redraw the spinner.

    • Checkbox: the check mark draws on when ticked and fades out quickly when cleared, and the box presses in slightly on click. The indeterminate state now shows a dash on a filled box instead of a tick on an empty one.
    • RadioGroupItem: the dot pops in from half size with a small spring and fades out when another option is chosen.
    • Switch: the thumb slides on a light spring, stretches toward its destination while the pointer is held, and the on/off glyphs cross-fade.
    • Spinner and SpinnerIcon: a faint track with an arc that fades from a transparent tail to a solid head, turning once every 0.8s. The rotation runs through the Web Animations API, so it stays smooth while the main thread is busy. The track now follows the arc colour by default (trackClassName still overrides it), and Spinner takes its colour from className, defaulting to text-primary.
    • CollapsibleContent: height and opacity animate open and closed, and reverse smoothly when toggled mid-way. The content stays mounted (inert while closed, hidden once the close finishes) instead of being unmounted. className now goes on an inner wrapper, so padding no longer holds a closed panel open. AppNavigation keeps its own collapse animation.
    • Copy buttons in Form.CopyBox, the logs detail panel and assistant messages: the copy icon cross-fades into a check while the copied state lasts. Each logs copy button now tracks its own state, so only the one clicked changes.
    • TagsInput and MultiSelect chips: chips fade and scale in when added; when one is removed it fades out and the chips after it slide into the gap.

    Under reduced motion the controls keep their fades but drop the movement; the spinner keeps turning.

    motion is now a required peer dependency. It was optional, but Tabs and the root entry already imported it.

v3.7.1

Compare Source

Patch Changes
  • AssistantPlanCard keeps its own clock, so a waiting plan turns expired at its expiresAt even while nothing else redraws the conversation; before, an idle card kept Approve enabled after its plan ran out. A data-plan part with no id now shows as itself with Approve disabled, instead of reading as replaced once another plan exists.
  • 095fa99: Update runtime dependencies.

v3.7.0

Compare Source

Minor Changes

  • dfbd0d0: Rework the assistant's density="compact" to match the inline Patch mock on the project home page. The conversation now fills the host's width with 1.75rem side padding instead of a centered 42rem column, body text is back at text-sm with relaxed line height, the avatar is a filled brand circle, user bubbles use bg-muted with even corners, inline code is plain mono text that wraps anywhere, and the copy and download actions are left out (a host's own messageActions still render). PromptCard takes a new density prop: compact is a one-row field with an outline send button. The default density renders exactly as before.

    Add AssistantChoiceChips, a pick-one question drawn as a row of buttons. AssistantMessage renders a data-choices part (CHOICES_PART_TYPE, with AssistantChoicesData) with it, and Conversation and AssistantWorkspace take an onChoose(messageId, option) callback. Only the latest turn's question can be answered, and only once it has finished streaming. A picked option stays marked with a check and the others fade.

v3.6.0

Compare Source

Minor Changes
  • c0a3857: Add an opt-in density="compact" to the assistant's Conversation (also accepted by AssistantMessage and UserMessage) for a conversation embedded in another page: the assistant avatar sits beside each assistant turn, user turns stay right-aligned bubbles, the column narrows to 42rem (composer included), body text drops one step, and markdown spacing tightens with headings at body size. Exports a ConversationDensity type. The default density renders exactly as before.

v3.5.0

Compare Source

Minor Changes
  • f515b27: Export the bundled font files at @datum-cloud/datum-ui/fonts/*, so apps can preload the same file the stylesheets load.
  • 22be738: Add a @datum-cloud/datum-ui/rich-text-content entry that exports RichTextContent without the editor, so apps that only display rich text don't download tiptap and prosemirror.

v3.4.1

Compare Source

Patch Changes
  • e4e4db8: Remove the border from light badges, and use a readable gray for the muted light badge in light mode.
rollup/plugins (@​rollup/plugin-commonjs)

v29.0.3

2026-05-29

Bugfixes
postcss/autoprefixer (autoprefixer)

v10.6.2

Compare Source

  • Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
  • Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
  • Fixed selector duplicates on multiple Autoprefixer runs.
  • Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
  • Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
  • Fixed source maps for Grid prefixes (by @​dualfroz).

v10.6.1

Compare Source

  • Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

v10.6.0

Compare Source

v10.5.6

Compare Source

v10.5.5

Compare Source

v10.5.4

Compare Source

v10.5.3

Compare Source

v10.5.2

Compare Source

  • Moved -webkit-fill-available before -moz-available, so Firefox
    will use -webkit- version which is closer to stretch.

v10.5.1

Compare Source

v10.5.0

Compare Source

  • Added mask-position-x and mask-position-y support (by @​toporek).
date-fns/date-fns (date-fns)

v4.4.0

Compare Source

This release revisits the approach to CDN usage and introduces a new package, @date-fns/cdn and deprecates the date-fns CDN scripts. It allowed reducing the zipped package size from 5.83 MB down to 3.96 MB without introducing any breaking changes.

In v5.0.0-alpha.0 where CDN scripts are completely removed from date-fns the change is more significant and brings the zipped package size down to 2.89 MB.

It is just the first step in optimizing the package size. Expect further size reduction in the future v4 and v5 versions.

Changed

  • DEPRECATED: The date-fns CDN scripts are now deprecated and will be removed in the next major release. Please switch to the new @date-fns/cdn package for CDN usage.

  • Removed CDN source maps to reduce the package size. If you rely on them, please switch to the new @date-fns/cdn package that still includes them.

v4.3.0

Compare Source

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

v4.2.1

Compare Source

Fixed
  • Fixed type definitions missing in v4.2.0 due to TypeScript misconfiguration.

v4.2.0

Compare Source

This is a minor release in all senses, it only includes documentation updates (first of many) that points to the new You Don't Need date-fns* page.

* Not really

Changed
  • Added Temporal API references to the JSDoc annotations of add, addBusinessDays, and addDays.
evanw/esbuild (esbuild)

v0.28.2

Compare Source

  • Fix tree shaking bug due to TypeScript import alias (#​4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#​4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}

/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}

/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#​4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#​4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#​4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})
}

// Old output (with --minify-syntax --target=es6)
function foo() {
  bar(void 0 || (x = {}));
}

// New output (with --minify-syntax --target=es6)
function foo() {
  let x;
  bar(x || (x = {}));
}

  • Fix a potential deadlock when the JavaScript API is used incorrectly (#​4503, #​4506)

    The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

    Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

    This fix was submitted by @​ZuBB.

  • Handle target collisions (#​4509)

    It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.

  • Force .mp3 files to use the audio/mpeg MIME type (#​4485)

    MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

  • Add a new TypeScript syntax warning

    TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

    ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]

    example.ts:1:28:
      1 │ console.log(1 + 2 as number * 3)
        ╵                             ^

  This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
  precedence in this case. Surround the inner expression in parentheses to silence this warning:

    example.ts:1:12:
      1 │ console.log(1 + 2 as number * 3)
        │             ~~~~~~~~~~~~~~~
        ╵             (             )

    See microsoft/TypeScript#63527 for more information.

  • Add support for formatting errors for Visual Studio (#​4460)

    Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

    With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:

    $ esbuild example.ts --log-style=visualstudio
/Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator

    This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.

  • Fix a bug with CSS gamut mapping (#​4488)

    Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

    This fix was submitted by @​chatman-media.

v0.28.1

Compare Source

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#​4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}

// Old output (with --minify)
new Resource().activate();

// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#​4461, #​4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#​4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()

// Old output
new foo()`bar`();
new (foo())?.bar();

// New output
new (foo())`bar`();
new (foo()?.bar)();

  • Fix renaming of nested var declarations (#​4471)

    This release fixes a bug where var declarations in nested scopes that are hoisted up to module scope were not correctly being renamed during bundling. That could previously lead to name collisions when minification was disabled, which could potentially cause a behavior change. The bug has been fixed so that these hoisted declarations are now considered to be module-level symbols during the name collision avoidance pass.

  • Emit var instead of const for certain TypeScript-only constructs for ES5 (#​4448)

    While esbuild doesn't generally support converting const to var for ES5 due to nested scoping rules (which is currently a build-time error), esbuild previously incorrectly converted TypeScript-only import assignment constructs into a const declaration even when targeting ES5. With this release, esbuild will now use var for this case instead:

    // Original code
import x = require('y')

// Old output (with --target=es5)
const x = require("y");

// New output (with --target=es5)
var x = require("y");

v0.28.0

Compare Source

  • Add support for with { type: 'text' } imports (#​4435)

    The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

    import string from './example.txt' with { type: 'text' }
console.log(string)

  • Add integrity checks to fallback download path (#​4343)

    Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

    This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

  • Update the Go compiler from 1.25.7 to 1.26.1

    This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

    • It now uses the new garbage collector that comes with Go 1.26.
    • The Go compiler is now more aggressive with allocating memory on the stack.
    • The executable format that the Go linker uses has undergone several changes.
    • The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

    You can read the Go 1.26 release notes for more information.

v0.27.7

Compare Source

  • Fix lowering of define semantics for TypeScript parameter properties (#​4421)

    The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:

    // Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}

// Old output (with --loader=ts --target=es2021)
class Foo {
  constructor(x = 1) {
    this.x = x;
    __publicField(this, "y", 2);
  }
  x;
}

// New output (with --loader=ts --target=es2021)
class Foo {
  constructor(x = 1) {
    __publicField(this, "x", x);
    __publicField(this, "y", 2);
  }
}

v0.27.5

Compare Source

  • Fix for an async generator edge case (#​4401, #​4417)

    Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code:

    async function* inner() { yield 1; yield 2 }
async function* outer() { yield* inner() }
let gen = outer()
for await (let x of [gen.next(), gen.next()]) console.log(x)

    Previously esbuild's output of the above code behaved incorrectly when async generators were transformed (such as with --supported:async-generator=false). The transformation should be fixed starting with this release.

    This fix was contributed by @​2767mr.

  • Fix a regression when metafile is enabled (#​4420, #​4418)

    This release fixes a regression introduced by the previous release. When metafile: true was enabled in esbuild's JavaScript API, builds with build errors were incorrectly throwing an error about an empty JSON string instead of an object containing the build errors.

  • Use define semantics for TypeScript parameter properties (#​4421)

    Parameter properties are a TypeScript-specific code generation feature that converts constructor parameters into class fields when they are prefixed by certain keywords. When "useDefineForClassFields": true is present in tsconfig.json, the TypeScript compiler automatically generates class field declarations for parameter properties. Previously esbuild didn't do this, but esbuild will now do this starting with this release:

    // Original code
class Foo {
  constructor(public x: number) {}
}

// Old output (with --loader=ts)
class Foo {
  constructor(x) {
    this.x = x;
  }
}

// New output (with --loader=ts)
class Foo {
  constructor(x) {
    this.x = x;
  }
  x;
}

  • Allow es2025 as a target in tsconfig.json (#​4432)

    TypeScript recently added es2025 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2025"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

v0.27.4

Compare Source

  • Fix a regression with CSS media queries (#​4395, #​4405, #​4406)

    Version 0.25.11 of esbuild introduced support for parsing media queries. This unintentionally introduced a regression with printing media queries that use the <media-type> and <media-condition-without-or> grammar. Specifically, esbuild was failing to wrap an or clause with parentheses when inside <media-condition-without-or>. This release fixes the regression.

    Here is an example:

    /* Original code */
@media only screen and ((min-width: 10px) or (min-height: 10px)) {
  a { color: red }
}

/* Old output (incorrect) */
@media only screen and (min-width: 10px) or (min-height: 10px) {
  a {
    color: red;
  }
}

/* New output (correct) */
@media only screen and ((min-width: 10px) or (min-height: 10px)) {
  a {
    color: red;
  }
}

  • Fix an edge case with the inject feature (#​4407)

    This release fixes an edge case where esbuild's inject feature could not be used with arbitrary module namespace names exported using an export {} from statement with bundling disabled and a target environment where arbitrary module namespace names is unsupported.

    With the fix, the following inject file:

    import jquery from 'jquery';
export { jquery as 'window.jQuery' };

    Can now always be rewritten as this without esbuild sometimes incorrectly generating an error:

    export { default as 'window.jQuery' } from 'jquery';

  • Attempt to improve API handling of huge metafiles (#​4329, #​4415)

    This release contains a few changes that attempt to improve the behavior of esbuild's JavaScript API with huge metafiles (esbuild's name for the build metadata, formatted as a JSON object). The JavaScript API is designed to return the metafile JSON as a JavaScript object in memory, which makes it easy to access from within a JavaScript-based plugin. Multiple people have encountered issues where this API breaks down with a pathologically-large metafile.

    The primary issue is that V8 has an implementation-specific maximum string length, so using the JSON.parse API with large enough strings is impossible. This release will now attempt to use a fallback JavaScript-based JSON parser that operates directly on the UTF8-encoded JSON bytes instead of using JSON.parse when the JSON metafile is too big to fit in a JavaScript string. The new fallback path has not yet been heavily-tested. The metafile will also now be generated with whitespace removed if the bundle is significantly large, which will reduce the size of the metafile JSON slightly.

    However, hitting this case is potentially a sign that something else is wrong. Ideally you wouldn't be building something so enormous that the build metadata can't even fit inside a JavaScript string. You may want to consider optimizing your project, or breaking up your project into multiple parts that are built independently. Another option could potentially be to use esbuild's command-line API instead of its JavaScript API, which is more efficient (although of course then you can't use JavaScript plugins, so it may not be an option).

v0.27.3

Compare Source

  • Preserve URL fragments in data URLs (#​4370)

    Consider the following HTML, CSS, and SVG:

    • index.html:

      <!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>

    • icons.css:

      .triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}

    • triangle.svg:

      <svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>

    The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:

    /* icons.css */
.triangle {
  width: 10px;
  height: 10px;

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label Nov 3, 2026
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch 6 times, most recently from ba612fe to 029879c Compare November 9, 2026 17:04
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from 029879c to 84aeb0f Compare November 11, 2026 13:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants