[dependabot]

Bumps the npm-minor-patch group with 23 updates in the / directory:

Package	From	To
@larksuiteoapi/node-sdk	1.73.3	1.74.0
cron-parser	5.5.0	5.10.1
dockerode	5.0.0	5.0.1
express-rate-limit	8.5.2	8.7.0
ipaddr.js	2.4.0	2.5.0
multer	2.3.0	2.4.0
@types/multer	2.1.0	2.3.0
socket.io	4.8.3	4.8.4
tar-fs	3.1.2	3.1.3
@google/genai	2.17.1	2.26.0
@types/multer	2.1.0	2.3.0
autoprefixer	10.5.0	10.6.1
esbuild	0.25.12	0.28.2
i18next	26.3.6	26.4.2
react	19.2.8	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.4	19.3.0
react-i18next	17.0.11	17.0.15
react-router-dom	7.18.2	7.18.4
socket.io-client	4.8.3	4.8.4
tailwind-merge	3.6.0	3.7.0
tsx	4.22.3	4.23.15
typescript-eslint	8.67.0	8.71.0
typebox	1.3.7	1.3.34

Updates @larksuiteoapi/node-sdk from 1.73.3 to 1.74.0

Commits

• See full diff in compare view

Updates cron-parser from 5.5.0 to 5.10.1

Release notes

Sourced from cron-parser's releases.

v5.10.1

What's Changed

• fix: reject duplicate zero values in field validation by @​harrisiirak in harrisiirak/cron-parser#445
• fix: bound field value expansion at parse time by @​harrisiirak in harrisiirak/cron-parser#450

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

• fix: pad short expressions from the leading field slot by @​harrisiirak in harrisiirak/cron-parser#443

Full Changelog: harrisiirak/cron-parser@v5.9.0...v5.10.0

v5.9.0

What's Changed

• fix: keep explicit range bounds when stringifying stepped fields (#279) by @​harrisiirak in harrisiirak/cron-parser#440
• fix: compensate DST transitions wider than one hour by @​aniket-3001 in harrisiirak/cron-parser#435
• fix: keep a hashed step wider than its range from emptying the field by @​Jaybhade in harrisiirak/cron-parser#437

New Contributors

• @​aniket-3001 made their first contribution in harrisiirak/cron-parser#435
• @​Jaybhade made their first contribution in harrisiirak/cron-parser#437

Full Changelog: harrisiirak/cron-parser@v5.8.1...v5.9.0

v5.8.1

What's Changed

• ci: automate releases by @​harrisiirak in harrisiirak/cron-parser#439

Full Changelog: harrisiirak/cron-parser@v5.8.0...v5.8.1

v5.8.0

What's Changed

• chore: report coverage and benchmark on every PR commit by @​harrisiirak in harrisiirak/cron-parser#430
• docs: document benchmark environment variables by @​harrisiirak in harrisiirak/cron-parser#431
• docs: add security policy and code of conduct by @​harrisiirak in harrisiirak/cron-parser#432
• fix: drop day of month values the month does not have by @​harrisiirak in harrisiirak/cron-parser#433
• fix: keep day fields that cover their whole range out of the wildcard form by @​harrisiirak in harrisiirak/cron-parser#434
• fix: round the current date to whole seconds so occurrences on the end date are returned by @​harrisiirak in harrisiirak/cron-parser#436
• fix: keep a day-of-week step from adding Sunday when it never reaches 7 by @​spokodev in harrisiirak/cron-parser#438

Full Changelog: harrisiirak/cron-parser@v5.7.0...v5.8.0

v5.7.0

What's Changed

• fix: enforce iteration loop limit so unsatisfiable expressions throw instead of returning a bogus date by @​spokodev in harrisiirak/cron-parser#415

... (truncated)

Changelog

Sourced from cron-parser's changelog.

v5.10.1 - 2026-09-12

What's Changed

• fix: reject duplicate zero values in field validation by @​harrisiirak in harrisiirak/cron-parser#445
• fix: bound field value expansion at parse time by @​harrisiirak in harrisiirak/cron-parser#450

Full Changelog: harrisiirak/cron-parser@v5.10.0...v5.10.1

v5.10.0 - 2026-08-14

What's Changed

• fix: pad short expressions from the leading field slot by @​harrisiirak in harrisiirak/cron-parser#443

Full Changelog: harrisiirak/cron-parser@v5.9.0...v5.10.0

v5.9.0 - 2026-08-13

What's Changed

• fix: keep explicit range bounds when stringifying stepped fields (#279) by @​harrisiirak in harrisiirak/cron-parser#440
• fix: compensate DST transitions wider than one hour by @​aniket-3001 in harrisiirak/cron-parser#435
• fix: keep a hashed step wider than its range from emptying the field by @​Jaybhade in harrisiirak/cron-parser#437

New Contributors

• @​aniket-3001 made their first contribution in harrisiirak/cron-parser#435
• @​Jaybhade made their first contribution in harrisiirak/cron-parser#437

Full Changelog: harrisiirak/cron-parser@v5.8.1...v5.9.0

v5.8.1 - 2026-08-09

What's Changed

• ci: automate releases by @​harrisiirak in harrisiirak/cron-parser#439

Full Changelog: harrisiirak/cron-parser@v5.8.0...v5.8.1

v5.8.0 - 2026-08-09

What's Changed

• chore: report coverage and benchmark on every PR commit by @​harrisiirak in harrisiirak/cron-parser#430
• docs: document benchmark environment variables by @​harrisiirak in harrisiirak/cron-parser#431
• docs: add security policy and code of conduct by @​harrisiirak in harrisiirak/cron-parser#432
• fix: drop day of month values the month does not have by @​harrisiirak in harrisiirak/cron-parser#433
• fix: keep day fields that cover their whole range out of the wildcard form by @​harrisiirak in harrisiirak/cron-parser#434
• fix: round the current date to whole seconds so occurrences on the end date are returned by @​harrisiirak in harrisiirak/cron-parser#436
• fix: keep a day-of-week step from adding Sunday when it never reaches 7 by @​spokodev in harrisiirak/cron-parser#438

... (truncated)

Commits

• 5b08cdf chore: bump version
• 1d5867c chore: update dev deps
• 95bac55 fix: bound field value expansion at parse time (#450)
• 7b3a0ad chore: add more funding sources to FUNDING.yml
• fc5ca7b chore: add Patreon username for funding support
• 03444a8 chore: update dev deps
• 4fd8809 fix: reject duplicate zero values in field validation (#445)
• 609feef chore: bump version
• 0bf36c8 fix: pad short expressions from the leading field slot (#443)
• 85f3644 fix: anchor the worktree ignore patterns to the project root
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cron-parser since your current version.

Updates dockerode from 5.0.0 to 5.0.1

Release notes

Sourced from dockerode's releases.

v5.0.1

What's Changed

• build(deps): bump @​protobufjs/utf8 from 1.1.0 to 1.1.1 by @​dependabot[bot] in apocas/dockerode#832
• build(deps): bump protobufjs from 7.5.5 to 7.6.1 by @​dependabot[bot] in apocas/dockerode#834
• build(deps): bump @​grpc/grpc-js from 1.11.1 to 1.11.4 by @​dependabot[bot] in apocas/dockerode#837
• build(deps): bump protobufjs from 7.6.1 to 7.6.3 by @​dependabot[bot] in apocas/dockerode#838
• build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @​dependabot[bot] in apocas/dockerode#839

Full Changelog: apocas/dockerode@v5.0.0...v5.0.1

Commits

• 3624bc0 version bump
• c3ab2f9 Merge pull request #839 from apocas/dependabot/npm_and_yarn/js-yaml-4.2.0
• 4903ecd build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0
• ccb9b65 Merge pull request #838 from apocas/dependabot/npm_and_yarn/protobufjs-7.6.3
• 82a67cc Merge pull request #837 from apocas/dependabot/npm_and_yarn/grpc/grpc-js-1.11.4
• 8d86634 build(deps): bump protobufjs from 7.6.1 to 7.6.3
• d9f0ca5 build(deps): bump @​grpc/grpc-js from 1.11.1 to 1.11.4
• 139e89a Merge pull request #834 from apocas/dependabot/npm_and_yarn/protobufjs-7.6.1
• a92c171 Merge pull request #832 from apocas/dependabot/npm_and_yarn/protobufjs/utf8-1...
• bdd0c88 build(deps): bump protobufjs from 7.5.5 to 7.6.1
• Additional commits viewable in compare view

Updates express-rate-limit from 8.5.2 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

Commits

• 48db09e 8.7.0
• dce5871 v8.7.0 changelog
• 2f08044 Add inspect.software health badge (#673)
• a29757c feat: add retryAfter option (#661)
• 146e88b chore: rename license
• 5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
• 062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
• 514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
• 4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
• 83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
• Additional commits viewable in compare view

Updates ipaddr.js from 2.4.0 to 2.5.0

Changelog

Sourced from ipaddr.js's changelog.

2.5.0 - 2026-08-04

• remove ipaddr.min.js, end users must provide own minification/bundling
• fix: compress the leftmost zero run in toString (RFC 5952, 4.2.3)
• fix: strict IPv6 validation — reject :: with zero compression and hextets >4 hex digits
• fix: reject non-numeric prefix length in subnetMaskFromPrefixLength
• fix: compress trailing zero run in toString when a zoneIndex is present
• fix: throw a descriptive error for malformed input in IPv6.parse

Commits

• See full diff in compare view

Updates multer from 2.3.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

What's Changed

• docs: remove README translations by @​UlisesGascon in expressjs/multer#1463
• ci: add macOS to the test matrix by @​kilisamemarisaaa in expressjs/multer#1464
• feat. improve wording for LIMIT_UNEXPECTED_FILE error code by @​flashbag in expressjs/multer#426
• feat: add filename to file errors by @​UjjwalKumar239 in expressjs/multer#1416
• refactor: remove concat-stream dependency by @​Phillip9587 in expressjs/multer#1356
• fix: reject non-integer fileSize limits by @​abhu85 in expressjs/multer#1395
• fix: allow exactly limits.parts parts by @​deepakganesh78 in expressjs/multer#1446
• fix: do not consume maxCount for files skipped by fileFilter by @​Sagargupta16 in expressjs/multer#1426
• fix: validate all limits at construction time by @​ShubhamOulkar in expressjs/multer#1335
• test: cover storage engine _removeFile invocation semantics by @​kilisamemarisaaa in expressjs/multer#1460
• feat: accept a function for limits by @​hossein-zare in expressjs/multer#1133
• fix: add flush option to disk storage to fsync files before completion by @​kilisamemarisaaa in expressjs/multer#1458
• feat: expose busboy defCharset, highWaterMark and fileHwm options by @​UlisesGascon in expressjs/multer#1465
• docs: describe the file stream contract for storage engines by @​UlisesGascon in expressjs/multer#1468

... (truncated)

Changelog

Sourced from multer's changelog.

2.4.0

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)
• Add filename to LIMIT_FILE_SIZE and LIMIT_UNEXPECTED_FILE errors (#1416)
• Accept a function for limits, called with the request, to set limits per request (#1133)
• Add opt-in flush option to DiskStorage to fsync files before the callback runs (#1458)
• Expose busboy's defCharset, highWaterMark and fileHwm options (#1465)
• Add streamHandler option to feed busboy from pre-consumed bodies (Google Cloud Functions, Firebase) (#1466)
• Allow multer.diskStorage() to be called without options (#1471)
• Decode WHATWG-escaped characters (%0A, %0D, %22) in field names, matching file.originalname since 2.3.0: req.body keys, file.fieldname and err.field now carry the real name. If you matched the escaped spelling as a workaround, use the real name now (#1473)
• Report the decoded filename in err.filename on LIMIT_FILE_SIZE errors, matching file.originalname (#1478)
• Reject non-integer or negative limits values at construction time; a float limit silently disabled the check (#1395, #1335)
• Accept requests with exactly limits.parts parts; LIMIT_PART_COUNT now fires only when the limit is exceeded. If you set parts one higher to work around this, you can drop the extra one (#1446)
• Files skipped by fileFilter no longer count towards maxCount (#1426)
• Change the LIMIT_UNEXPECTED_FILE message to "Unexpected file field" (#426)
• Remove the concat-stream dependency (#1356)
• Docs: add JSDoc to the public API and document the storage engine stream contract (#1467, #1468)
• Docs: add FormData upload examples (#896)
• Docs: remove the translated READMEs (#1463)
• Internal: run the test suite on macOS (#1464)

Commits

• 35979e5 2.4.0 (#1469)
• b888532 chore(deps): bump github/codeql-action/upload-sarif to 4.37.9 (#1474)
• e6bcd7d chore(deps): bump github/codeql-action/analyze from 4.37.4 to 4.37.9 (#1475)
• 00dec43 chore(deps): bump github/codeql-action/init from 4.37.4 to 4.37.9 (#1476)
• 8d5c3b7 feat: allow diskStorage without options (#1471)
• 02f6e82 fix: report the decoded filename on LIMIT_FILE_SIZE (#1478)
• bc3f72d fix: decode escaped field names, not just filenames (#1473)
• 2661325 docs: add JSDoc to the public API (#1467)
• 53337f9 fix: remove late-completing uploads aborted before the engine names them
• 7f2c9ab feat: add streamHandler option to feed busboy from pre-consumed bodies (#1466)
• Additional commits viewable in compare view

Updates @types/multer from 2.1.0 to 2.3.0

Commits

• See full diff in compare view

Updates socket.io from 4.8.3 to 4.8.4

Release notes

Sourced from socket.io's releases.

socket.io@4.8.4

Bug Fixes

• cleanup pending acks on timeout to prevent memory leak (37aad11)
• prevent uWebSockets.js from serving missing client files (dfb5ab3)
• reject stateful regexps for dynamic namespaces (59f4f24)
• types: allow emitWithAck() for events with void callbacks (#5453) (8b93a18)
• types: properly import http module (74599a6)

Dependencies

• engine.io@~6.6.0 (no change)
• ws@~8.21.0 (diff)

socket.io-client@4.8.4

Bug Fixes

• types: export ExtendedError for connect_error event (#5548) (c0d5450)
• types: export reserved event interfaces (#5533) (03945df)

Dependencies

• engine.io-client@~6.6.1 (no change)
• ws@~8.21.0 (diff)

Commits

• c239eb5 chore(release): socket.io@4.8.4
• 11a6f56 chore(release): socket.io-client@4.8.4
• 00e4e73 chore(release): engine.io-client@6.6.7
• e387ab1 chore: use @​rollup/plugin-terser instead of rollup-plugin-terser
• 9738333 chore(release): engine.io@6.6.11
• fc9dd90 docs(eio): rework README
• da008a5 fix(eio): refresh ping timeout on incoming packets
• 3df3fed fix(eio-client): restore default transport resolution
• aaf2af3 test: upgrade WebdriverIO to v9
• b5da079 refactor(sio): simplify packet handling switch
• Additional commits viewable in compare view

Updates tar-fs from 3.1.2 to 3.1.3

Commits

• db1ebde 3.1.3
• dbc4a7a fix regressions
• 16d5331 add edge-case regressions
• See full diff in compare view

Updates @google/genai from 2.17.1 to 2.26.0

Release notes

Sourced from @​google/genai's releases.

v2.26.0

2.26.0 (2026-10-01)

Features

• support continuation_token in GenerateContent (ac628c5)

v2.25.0

2.25.0 (2026-09-30)

Features

• add gcs_metrics_uri for exporting tuning job metrics. (bc085fb)
• Add Gemini 3.8 Flash TTS and Gemini 3.8 Flash Lite TTS models to SDKs (b12dad0)
• genai-sdk: Add environments dedicated module and from_environment support (4d7e80b)
• include labels for LiveClientSetup (d4bcdad)
• support labels for Gemini API GenerateContent (71c3997)

Bug Fixes

• use CreateAgentInteraction for Trigger.interaction and TriggerCreateParams.interaction (c4341e1)

v2.24.0

2.24.0 (2026-09-22)

Features

• add sample_audio to Voice in GAOS SDK (d001d18)
• add Voices API resource to GAOS SDK (f97113f)
• expose SpeechMetadata, VoiceConfig.voice, and SpeechAnnotation in public GenAI SDKs (19b7858)
• support field.value_field syntax for map add_union_value annotations. (51d701a)
• update discovery doc (42f9716)
• wire voice into sdk (08b568e)

Bug Fixes

• sanitize path parameter descriptions in GAOS OpenAPI generation (1567962)

v2.23.0

2.23.0 (2026-09-16)

Features

• add credential APIs resource to gaos. (0e6410b)

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

2.26.0 (2026-10-01)

Features

• support continuation_token in GenerateContent (ac628c5)

2.25.0 (2026-09-30)

Features

• add gcs_metrics_uri for exporting tuning job metrics. (bc085fb)
• Add Gemini 3.8 Flash TTS and Gemini 3.8 Flash Lite TTS models to SDKs (b12dad0)
• genai-sdk: Add environments dedicated module and from_environment support (4d7e80b)
• include labels for LiveClientSetup (d4bcdad)
• support labels for Gemini API GenerateContent (71c3997)

Bug Fixes

• use CreateAgentInteraction for Trigger.interaction and TriggerCreateParams.interaction (c4341e1)

2.24.0 (2026-09-22)

Features

• add sample_audio to Voice in GAOS SDK (d001d18)
• add Voices API resource to GAOS SDK (f97113f)
• expose SpeechMetadata, VoiceConfig.voice, and SpeechAnnotation in public GenAI SDKs (19b7858)
• support field.value_field syntax for map add_union_value annotations. (51d701a)
• update discovery doc (42f9716)
• wire voice into sdk (08b568e)

Bug Fixes

• sanitize path parameter descriptions in GAOS OpenAPI generation (1567962)

2.23.0 (2026-09-16)

Features

• add credential APIs resource to gaos. (0e6410b)
• Add RetrievalCallStep and RetrievalResultStep to interactions schema and SDKs. (d03d569)
• implement environments files upload and download across Python and TypeScript SDKs (3a4c512)
• support custom fetch in HttpOptions (01897b3)
• wire credential APIs resource to sdk. (280da75)

... (truncated)

Commits

• ae573cc chore(main): release 2.26.0 (#1990)
• ac628c5 feat: support continuation_token in GenerateContent
• b74135d chore(main): release 2.25.0 (#1974)
• 6c073f1 chore: adjust packaging scripts.
• 67c550d docs: clarify Voice expire_time and store TTL behavior in GAOS SDK
• 14659a9 docs(overlays): describe environment and path on GetEnvironmentFiles and ...
• c4341e1 fix: use CreateAgentInteraction for Trigger.interaction and `TriggerCreat...
• bc085fb feat: add gcs_metrics_uri for exporting tuning job metrics.
• d593489 chore: Add back Temperature and top_p
• 4d7e80b feat(genai-sdk): Add environments dedicated module and from_environment support
• Additional commits viewable in compare view

Updates @types/multer from 2.1.0 to 2.3.0

Commits

• See full diff in compare view

Updates autoprefixer from 10.5.0 to 10.6.1

Release notes

Sourced from autoprefixer's releases.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

Changelog

Sourced from autoprefixer's changelog.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

10.5.2

• Moved -webkit-fill-available before -moz-available, so Firefox will use -webkit- version which is closer to stretch.

10.5.1

• Fixed grid-area span reset for overriding areas (by @​puneetdixit200).

Commits

• c99614d Release 10.6.1 version
• f1d08cb Update dependencies
• cf1ebcb Fix grid gap inheritance from row-gap and column-gap longhands (#1557)
• e1212dc Release 10.6.0 version
• dac3c5f Add support for prefixing initial-letter (#1556)
• b031690 Release 10.5.6 version
• da65c36 Add warning when Autoprefixer can cover CSS for old Safari
• 604f8d9 Update dependencies
• 54608ca Fix old WebKit gradients with color hints (#1554)
• 7e81fff Release 10.5.5 version
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for autoprefixer since your current version.

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by @​hybrist.

• Automatically add the -webkit-mask prefix (#4357, #4358)

  This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

  /* Original code */
  main {
    mask: url(x.png) center/5rem no-repeat
  }
  /* Old output (with --target=chrome110) */
  main {
  mask: url(x.png) center/5rem no-repeat;
  }
  /* New output (with --target=chrome110) */
  main {
  -webkit-mask: url(x.png) center/5rem no-repeat;
  mask: url(x.png) center/5rem no-repeat;
  }

  This change was contributed by @​BPJEnnova.

• Additional minification of switch statements (#4176, #4359)

  This release contains additional minification patterns for reducing switch statements. Here is an example:

  // Original code
  switch (x) {
    case 0:
      foo()
      break
    case 1:
    default:
      bar()
  }

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.