Skip to content

Bump the development-dependencies group across 1 directory with 6 updates - #13

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-1b716a9375
Closed

Bump the development-dependencies group across 1 directory with 6 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-1b716a9375

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 6 updates in the / directory:

Package From To
@cyclonedx/cyclonedx-npm 6.0.0 6.0.1
@types/node 26.1.2 26.2.0
electron 43.2.0 43.4.1
esbuild 0.28.1 0.28.2
tsx 4.23.1 4.23.12
vitest 4.1.10 4.1.11

Updates @cyclonedx/cyclonedx-npm from 6.0.0 to 6.0.1

Release notes

Sourced from @​cyclonedx/cyclonedx-npm's releases.

6.0.1

Maintenance release.

What's Changed

Full Changelog: CycloneDX/cyclonedx-node-npm@v6.0.0...v6.0.1

6.0.1-rc.0

testing during CycloneDX/cyclonedx-node-npm#1507

Changelog

Sourced from @​cyclonedx/cyclonedx-npm's changelog.

6.0.1 - 2026-08-11

Maintenance release.

Commits

Updates @types/node from 26.1.2 to 26.2.0

Commits

Updates electron from 43.2.0 to 43.4.1

Release notes

Sourced from electron's releases.

electron v43.4.1

Release Notes for v43.4.1

Fixes

  • Fixed DevTools popup and context menus not appearing when DevTools is hosted in a custom window via webContents.setDevToolsWebContents(). #52937 (Also in 44)
  • Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle. #52853 (Also in 41, 42, 44)
  • Fixed a WebContentsView staying blank after its window is shown when setBackgroundThrottling(false) was called while the window was hidden. #52864 (Also in 42, 44)
  • Fixed a crash in systemPreferences.promptTouchID(reason) when an invalid reason value is passed. #52782 (Also in 42, 44)
  • Fixed a crash when resolving a path inside a malformed ASAR archive that contains cyclic link entries. #52857 (Also in 42, 44)
  • Fixed a crash with app.setLoginItemSettings if a non-UTF8 service name is used. #52944 (Also in 44)
  • Fixed a memory leak when creating BrowserWindows. #52892 (Also in 42, 44)
  • Fixed a possible crash (SIGABRT) during process exit when the process had loaded tls/https shortly before exiting, affecting app.exit() before ready and short-lived ELECTRON_RUN_AS_NODE / child_process.fork() scripts. #52870 (Also in 44)
  • Fixed a possible main process crash at quit when a session was created from JavaScript that runs during shutdown. #52925 (Also in 44)
  • Fixed a potential crash in contentTracing.stopRecording() when the trace file could not be written to the requested path. #52795 (Also in 42, 44)
  • Fixed a rare crash in the main process when DevTools were opened and a garbage collection ran before the DevTools frontend finished loading. #52903 (Also in 44)
  • Fixed a regression preventing from transparent frameless windows from being resized on Linux. #52947 (Also in 44)
  • Fixed an npm install failure with no recovery path when the OS blocked the native zip extractor from loading (for example, Windows Smart App Control). #52845 (Also in 44)
  • Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52897 (Also in 41, 44)
  • Fixed crash in sharedTexture module when GPU context becomes unavailable. #52938 (Also in 44)
  • Fixed custom V8 snapshots (electron-mksnapshot, and the loadBrowserProcessSpecificV8Snapshot fuse) having no effect in the main process on macOS arm64, Linux x64 and Windows x64. #52877 (Also in 42, 44)
  • Fixed downloading files that live inside an asar archive, including saving a packed PDF from the built-in PDF viewer. #52826 (Also in 42, 44)
  • Fixed the built-in PDF viewer not rendering documents in in-memory sessions (partitions without the persist: prefix). #52835 (Also in 44)
  • Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions. #52848 (Also in 41, 42, 44)
  • <webview> and window.open now inherit nodeIntegrationInWorker from the embedder, consistent with the other Node and sandbox preferences. #52830 (Also in 41, 42, 44)

Other Changes

  • Backported fix for 524628213. #52868
  • Backported fixes for 542224257, 542025190. #52842
  • Backported fixes from upstream Chromium and V8. #52778
  • Fixed Tray icons not appearing (and their menus not opening) on Linux desktops that address the StatusNotifierItem by its unique D-Bus name or via the org.freedesktop.StatusNotifierItem interface, such as GNOME with the AppIndicator extension, Cinnamon and XFCE. #52952
  • Fixed an issue on macOS where a page's first use of speechSynthesis could block the main process for several hundred milliseconds. #52814
  • Reduced idle main-process CPU wakeups caused by Node.js timers and immediates. #52905 (Also in 44)

electron v43.4.0

Release Notes for v43.4.0

Features

  • Added webFrameMain.printToPDF() to allow printing individual frames to PDF from the main process. #52627 (Also in 42, 44)
  • Fixed an issue where getDisplayMedia({ audio: { restrictOwnAudio: true } }) was ignored in setDisplayMediaRequestHandler, causing loopback audio to include local app playback. #52533 (Also in 44)

Fixes

  • Fixed a browser process crash that could occur during Windows logoff, shutdown, or restart. #52620 (Also in 42, 44)
  • Fixed a crash report when the X server or Wayland compositor exits while an app is running. #52685 (Also in 42, 44)
  • Fixed a crash when quickly switching menus while the app is under heavy load. #52673 (Also in 42, 44)
  • Fixed a potential crash when notifying user activation before the primary main frame was live. #52697 (Also in 42, 44)
  • Fixed an issue where a JavaScript out-of-memory crash could be reported from inside the crash-key handler instead of at the out-of-memory site. #52725 (Also in 42, 44)
  • Fixed the Linux system accent color intermittently not being applied (systemPreferences.getAccentColor() returning an empty string on some launches). #52575

Other Changes

... (truncated)

Commits
  • 340bae1 ci: fix generating ffmpeg (#52961)
  • 5d74fe3 fix: show DevTools popup menus for setDevToolsWebContents() frontends (#52937)
  • 7bb1b8f refactor: SimpleURLLoaderWrapper managed by cppgc (#52934)
  • ce2dc12 fix: prevent crash when GPU context unavailable in sharedTexture (#52938)
  • d1afd78 chore: cleanup includes of Win32 headers (#52945)
  • bfc9c62 chore: cherry-pick 3a02de271fd3 and 726eafecc145 from chromium (#52952)
  • 524a3df fix: dangling rawptr NativeWindow::primary_web_contents_view_ (#52939)
  • a2e9e45 ci: log Datadog upload failure instead of failing job (#52936)
  • d593366 fix: transparent windows can be resized on Linux (#52947)
  • 4a04028 fix: don't crash on non-UTF8 serviceName in app.setLoginItemSettings (#52944)
  • Additional commits viewable in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

This release is also available on:

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

  • map Node test locations (2f55884)
  • support data URLs in tsImport (b94f46f)

This release is also available on:

v4.23.8

... (truncated)

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • 2f55884 fix: map Node test locations
  • de935d5 docs: document Node source-map stack formatting
  • b94f46f fix: support data URLs in tsImport
  • Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the development-dependencies group across 1 directory with 6 upd…
545fed9 
…ates

Bumps the development-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm) | `6.0.0` | `6.0.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |



Updates `@cyclonedx/cyclonedx-npm` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md)
- [Commits](CycloneDX/cyclonedx-node-npm@v6.0.0...v6.0.1)

Updates `@types/node` from 26.1.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `electron` from 43.2.0 to 43.4.1
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v43.2.0...v43.4.1)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `tsx` from 4.23.1 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.12)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cyclonedx-npm"
  dependency-version: 6.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: electron
  dependency-version: 43.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 26, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development-dependencies-1b716a9375 branch September 2, 2026 06:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants