fix(deps): update js deps by renovate[bot] · Pull Request #174 · withastro/compiler-rs

renovate · 2026-09-17T05:01:05Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@napi-rs/cli (source)	`3.7.4` → `3.10.12`
@napi-rs/wasm-runtime (source)	`1.2.4` → `1.2.7`
@types/node (source)	`22.20.1` → `22.20.5`
pnpm (source)	`10.29.3` → `10.34.9`
publint (source)	`0.3.22` → `0.3.25`
sass	`1.104.0` → `1.108.2`
tsdown (source)	`^0.22.3` → `^0.23.0`
typescript (source)	`~5.5.3` → `~5.9.0`

Release Notes

napi-rs/napi-rs (@napi-rs/cli)

What's Changed

chore(deps): group @oxc-node/* updates in renovate config by @Brooooooklyn in #3579
chore(deps): update dependency oxfmt to ^0.72.0 by @renovate[bot] in #3570
docs(cli): record the design behind the threaded WASI heap sync by @Brooooooklyn in #3581
chore(deps): update oxc-node to v0.1.4 by @renovate[bot] in #3580
chore(deps): update release-plz/action action to v0.5.140 by @renovate[bot] in #3582
fix(napi): keep borrowed class args alive across AsyncTask/AsyncBlock by @Brooooooklyn in #3584
chore(deps): update oxc-node to v0.1.5 by @renovate[bot] in #3586
fix(cli): resolve zigbuild artifacts under the base target triple by @cpruijsen in #3585
chore(deps): update oxc-node to v0.1.6 by @renovate[bot] in #3589
feat(cli): support the powerpc64 FreeBSD targets by @pkubaj in #3588
fix(napi): join the Tokio runtime threads at env teardown by @Brooooooklyn in #3592
chore(deps): update release-plz/action action to v0.5.141 by @renovate[bot] in #3590
chore(deps): update dependency @types/node to v26 by @Brooooooklyn in #3598
chore(deps): override sharp and undici under miniflare to patched versions by @Brooooooklyn in #3597
chore(deps): update release-plz/action action to v0.5.142 by @renovate[bot] in #3601
chore(deps): update http-cache-semantics to v4.3.0 by @Brooooooklyn in #3596
chore(deps): update lerna to v10.1.0 to clear handlebars, js-yaml and pacote advisories by @Brooooooklyn in #3595
fix(deps): update emnapi to v2.0.0-beta.1 by @renovate[bot] in #3565
chore(deps): update dependency oxc-parser to ^0.154.0 by @renovate[bot] in #3604
fix(napi): drop unadopted class value and reset factory flag on failed conversion by @Brooooooklyn in #3603
ci: run the CLI suite in its own Windows shard (~400s) by @Brooooooklyn in #3593
chore(deps): update dependency undici to v8 by @renovate[bot] in #3599
chore(deps): update nx to v23.3.0 to clear axios, brace-expansion and smol-toml advisories by @Brooooooklyn in #3594
chore(deps): update oxc-node to v0.1.7 by @renovate[bot] in #3609
chore(deps): update dependency undici to v8 by @renovate[bot] in #3606
fix(napi): reject a value of another class on builds without type tags by @Brooooooklyn in #3610
test(napi): cover a failed napi_wrap in class constructors and factories by @Brooooooklyn in #3611
fix(napi): copy managed array inputs by @eugeniodepalo in #3607
chore(deps): update dependency oxfmt to ^0.73.0 by @renovate[bot] in #3605
fix(napi): TypedArray input leaks and compat buffer copies on wasm by @Brooooooklyn in #3612
test(async-runtime): wait for the abandoned-cleanup cancellation to settle by @Brooooooklyn in #3613
test(napi): serve the async-exit fetch from a local server by @Brooooooklyn in #3614
fix(deps): update emnapi to v2.0.0-beta.2 by @Brooooooklyn in #3617
test(napi): drop the compat-mode tests from examples/napi by @Brooooooklyn in #3615
ci: test on FreeBSD 15.1 and drop the MINGW64 job by @Brooooooklyn in #3622
test(cli): cover FreeBSD arm64 by @rodribp in #3620
fix(napi): set the custom GC aborted flag before Node closes its tsfn by @Brooooooklyn in #3626
chore(deps): update release-plz/action action to v0.5.143 by @renovate[bot] in #3627
chore(deps): update dependency oxc-parser to ^0.155.0 by @renovate[bot] in #3628
feat(napi): cancel a ReadableStream through its Reader, and fix ReadableStream::cancel by @Brooooooklyn in #3623
fix(cli): resolve null when the incarnation probe's spawn throws synchronously by @d-fay in #3619
fix(cli): take over the WASI flavor of a binding a postbuild fallback swaps in by @Brooooooklyn in #3630
chore(deps): update dependency vite to v8.3.3 [security] by @renovate[bot] in #3632
chore(deps): update dependency oxfmt to ^0.74.0 by @renovate[bot] in #3629

New Contributors

@cpruijsen made their first contribution in #3585
@pkubaj made their first contribution in #3588
@eugeniodepalo made their first contribution in #3607
@rodribp made their first contribution in #3620
@d-fay made their first contribution in #3619

Full Changelog: https://github.com/napi-rs/napi-rs/compare/napi-async-runtime-v0.2.6...@napi-rs/cli@3.10.9

`v3.10.8`

Compare Source

What's Changed

chore(deps): update dependency oxc-parser to ^0.153.0 by @renovate[bot] in #3569
fix(napi): bound serde_json::Value conversion depth at 128 levels by @Brooooooklyn in #3568
fix(napi): own NativeBorrowScope storage via NonNull to fix aliasing violation by @Brooooooklyn in #3573
fix(napi): register the wasm cleanup through the env cleanup hook by @Brooooooklyn in #3571
chore(deps): update dependency webdriverio to v10 by @renovate[bot] in #3566
fix(cli): keep WASI-managed root entry that differs from package main by @Brooooooklyn in #3572
chore(deps): update dependency @oxc-node/core to v0.1.3 by @renovate[bot] in #3564
chore(cli): recognize the aarch64-unknown-freebsd target by @samm-git in #3574

New Contributors

@samm-git made their first contribution in #3574

Full Changelog: https://github.com/napi-rs/napi-rs/compare/napi-async-runtime-v0.2.5...@napi-rs/cli@3.10.8

`v3.10.7`

Compare Source

What's Changed

feat(cli, async-runtime): preload the threaded WASI worker pool from the loader by @Brooooooklyn in #3558

New Contributors

@colinhacks made their first contribution in #3560

Full Changelog: https://github.com/napi-rs/napi-rs/compare/napi-async-runtime-v0.2.4...@napi-rs/cli@3.10.7

`v3.10.6`

Compare Source

`v3.10.5`

Compare Source

`v3.10.4`

Compare Source

`v3.10.3`

Compare Source

`v3.10.2`

Compare Source

`v3.10.1`

Compare Source

`v3.10.0`

Compare Source

`v3.9.1`

Compare Source

Patch over 3.9.0.

Fixes

WASI threads builds on current toolchains (#3492)
wasm32-wasip1-threads was failing in two ways: wasi-sdk 34 changed the futex ABI, and Rust nightly started linking crt1-reactor.o itself (duplicate _initialize). The CLI now picks the matching emnapi archive; the build crate stops double-linking _initialize.
WASI on Android / Termux (#3485)
Generated Node loaders preopened /, which Termux cannot open (UVWASI_EACCES). Android now preopens the current working directory. Other platforms are unchanged.
Generated files share one format (#3501)
JSON / TOML / YAML, .d.ts, and JS / WASI loaders now use one house style (indent, trailing newline, quotes). Regenerating bindings may produce noisy diffs with no behavior change.

Deps

js-yaml 4 → 5 (#3344) — YAML dump formatting can change; loaded values should not.

Same-day packages

Package	Version
`@napi-rs/triples`	2.1.23
`@napi-rs/wasm-runtime`	1.2.4

`v3.9.0`

Compare Source

`v3.8.6`

Compare Source

`v3.8.5`

Compare Source

`v3.8.4`

Compare Source

`v3.8.3`

Compare Source

`v3.8.2`

Compare Source

`v3.8.1`

Compare Source

`v3.8.0`

Compare Source

napi-rs/napi-rs (@napi-rs/wasm-runtime)

`v1.2.7`

Compare Source

`v1.2.6`

Compare Source

`v1.2.5`

Compare Source

pnpm/pnpm (pnpm)

`v10.34.9`: pnpm 10.34.9

Compare Source

Patch Changes

0bff20d: The pnpm version that packageManager pins now records that pin in a fresh pnpm-lock.yaml when pnpm 10 switched to it. A later pnpm install --frozen-lockfile then succeeds #17303.

Platinum Sponsors

Gold Sponsors

`v10.34.8`: pnpm 10.34.8

Compare Source

Patch Changes

7ced81e: Recompute hoisted dependencies when a frozen install removes packages, so public hoist links are handed over to retained versions #16861.
debbb4c: When pnpm removes or replaces a direct dependency, it now finishes removing the dependency's bins before it deletes the dependency's directory. Packages that declare bins through directories.bin no longer leave broken shims in node_modules/.bin #16876.
07becba: The standalone pnpm executables now embed Node.js 24.22.1. They embedded Node.js 20, which has reached end of life and still trusts the certificate authority intermediates that Node.js distrusted in October 2026.

Platinum Sponsors

Gold Sponsors

`v10.34.7`: pnpm 10.34.7

Compare Source

Patch Changes

97f550c: Switching to the pnpm version in packageManager now works through registry mirrors that strip npm's signatures or re-sign packages with their own key. pnpm then reads the signature from https://registry.npmjs.org/ and verifies it against the integrity of the downloaded pnpm #16778.
b11d7bb: The update notification now suggests the standalone install script instead of pnpm self-update when PNPM_HOME is not set, such as when another package manager installed pnpm. pnpm self-update installs into PNPM_HOME, so in that case it cannot replace the pnpm in use.

Platinum Sponsors

Gold Sponsors

`v10.34.6`

Compare Source

Patch Changes

e7888e5: pnpm self-update now resolves and verifies pnpm through registry, authentication, proxy, and TLS settings from trusted non-project configuration. Project configuration and the default project pnpmfile can no longer redirect the pnpm download or disable engine identity verification.
46bc7c9: pnpm no longer tells you to update itself with Corepack or with pnpm add -g:
- The update notification now suggests pnpm self-update, or the standalone install script when pnpm is running under Corepack. It used to suggest corepack use pnpm@<version>, or pnpm add -g pnpm / pnpm add -g @pnpm/exe when pnpm was not installed by the standalone script — but pnpm add -g refuses to install pnpm and points at pnpm self-update anyway, and @pnpm/exe is not published for pnpm v12 or newer, where the unscoped pnpm package is itself the native executable.
- pnpm self-update under Corepack now points at the standalone install script too, instead of telling you to update pnpm with Corepack.
46bc7c9: Updated adm-zip to v0.6.0, which fixes a memory-exhaustion vulnerability where a crafted ZIP file could make it allocate 4 GB of memory. adm-zip is used to extract the Node.js, Bun, and Deno archives that pnpm downloads on Windows.
Updated the embedded Node.js release keys to the current canonical nodejs/release-keys list.
Updated the embedded npm registry signing keys to the set currently advertised by npm.
702ad5f: Update the embedded Node.js release keys with the new key added to nodejs/release-keys (Stewart X Addison, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD).

Platinum Sponsors

Gold Sponsors

`v10.34.5`: pnpm 10.34.5

Compare Source

Patch Changes

78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.

Platinum Sponsors

Gold Sponsors

		[!IMPORTANT] ✂ PR body was truncated to here. Configuration 📅 Schedule: (UTC) Branch creation At any time (no schedule defined) Automerge At any time (no schedule defined) 🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied. ♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired. If you want to rebase/retry this PR, check this box This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-09-17T05:01:13Z

⚠️ No Changeset found

Latest commit: ca89ae2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

renovate Bot force-pushed the renovate/js-deps branch 6 times, most recently from 82fda34 to 3d3ad7c Compare September 23, 2026 01:49

renovate Bot force-pushed the renovate/js-deps branch 4 times, most recently from 96b2b35 to 6187156 Compare October 1, 2026 03:58

renovate Bot force-pushed the renovate/js-deps branch 3 times, most recently from 41229e6 to 9af3417 Compare October 5, 2026 18:38

renovate Bot changed the title ~~chore(deps): update js deps~~ fix(deps): update js deps Oct 5, 2026

renovate Bot force-pushed the renovate/js-deps branch 3 times, most recently from e8410f9 to f299820 Compare October 12, 2026 08:22

renovate Bot force-pushed the renovate/js-deps branch 2 times, most recently from a8fbdd2 to 8fb8c9c Compare October 16, 2026 04:22

renovate Bot force-pushed the renovate/js-deps branch 6 times, most recently from fc99147 to 3d65c8b Compare October 25, 2026 18:36

renovate Bot force-pushed the renovate/js-deps branch 4 times, most recently from 8a6209c to d6b8126 Compare October 30, 2026 22:59

renovate Bot force-pushed the renovate/js-deps branch 7 times, most recently from 2af5519 to 99fdc08 Compare November 9, 2026 12:52

renovate Bot force-pushed the renovate/js-deps branch from 99fdc08 to 48fd136 Compare November 11, 2026 04:01

fix(deps): update js deps

ca89ae2

renovate Bot force-pushed the renovate/js-deps branch from 48fd136 to ca89ae2 Compare November 11, 2026 16:57

Navigation Menu

Repository navigation

fix(deps): update js deps - #174

fix(deps): update js deps#174
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/js-deps

renovate Bot commented Sep 17, 2026 •

edited

Loading

Configuration

Uh oh!

changeset-bot Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Fixes

Deps

Same-day packages

v10.34.9: pnpm 10.34.9

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.8: pnpm 10.34.8

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.7: pnpm 10.34.7

Patch Changes

Platinum Sponsors

Gold Sponsors

Patch Changes

Platinum Sponsors

Gold Sponsors

v10.34.5: pnpm 10.34.5

Patch Changes

Platinum Sponsors

Gold Sponsors

Configuration

Uh oh!

changeset-bot Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Sep 17, 2026 •

edited

Loading

`v10.34.9`: pnpm 10.34.9

`v10.34.8`: pnpm 10.34.8

`v10.34.7`: pnpm 10.34.7

`v10.34.5`: pnpm 10.34.5

changeset-bot Bot commented Sep 17, 2026 •

edited

Loading