chore(deps): bump the production-dependencies group across 1 directory with 8 updates #24

dependabot · 2025-11-17T13:30:37Z

Bumps the production-dependencies group with 8 updates in the / directory:

Package	From	To
globby	`15.0.0`	`16.0.0`
js-yaml	`4.1.0`	`4.1.1`
pixi.js	`8.14.0`	`8.14.1`
sharp	`0.34.4`	`0.34.5`
shiki	`3.14.0`	`3.15.0`
@types/node	`24.10.0`	`24.10.1`
@types/yargs	`17.0.34`	`17.0.35`
esbuild	`0.25.12`	`0.27.0`

Updates globby from 15.0.0 to 16.0.0

Release notes

Sourced from globby's releases.

v16.0.0

Breaking

Respect parent .gitignore files when gitignore option is enabled b9a9a84

When {gitignore: true}, Globby now searches for .gitignore files up to the Git repo root (if detected). This matches Git's actual behavior where parent .gitignore patterns apply to subdirectories. Previously, only .gitignore files within the glob search path were considered. This change could break existing code that relied on the previous, more limited behavior.

Improvements

Support negation-only patterns 1273541

Respect custom fs implementation from options c2eb272

Add some more options to isGitIgnored functions e794ff9

Improve error message for invalid cwd option 7535e6d

Fixes

Fix {gitignore: true} performance issue fcb07c3

Fix bundler compatibility e6c72c9

Fix parent directory patterns with gitignore option 11dd2df

Fix ignore patterns with parent directory references a58d117

Fix types for stats option c10f600

sindresorhus/globby@v15.0.0...v16.0.0

Commits

cdbb6a2 16.0.0
e6c72c9 Fix bundler compatibility
b9a9a84 Respect parent .gitignore files when gitignore option is enabled
db9cb72 Add test for suppressErrors option with file patterns
69e0ee7 Add test for ignore option with trailing slashes
11dd2df Fix parent directory patterns with gitignore option
e4d0918 Add tests for special characters in directory names
f926132 Improve path check in gitignore logic
7535e6d Improve error message for invalid cwd option
c10f600 Fix types for stats option
Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
See full diff in compare view

Updates pixi.js from 8.14.0 to 8.14.1

Release notes

Sourced from pixi.js's releases.

v8.14.1

💾 Download

Installation:
npm install pixi.js@8.14.1
Development Build:

https://cdn.jsdelivr.net/npm/pixi.js@8.14.1/dist/pixi.js

https://cdn.jsdelivr.net/npm/pixi.js@8.14.1/dist/pixi.mjs

Production Build:

https://cdn.jsdelivr.net/npm/pixi.js@8.14.1/dist/pixi.min.js

https://cdn.jsdelivr.net/npm/pixi.js@8.14.1/dist/pixi.min.mjs

Documentation:

https://pixijs.download/v8.14.1/docs/index.html

Changed

pixijs/pixijs@v8.14.0...v8.14.1

🐛 Fixed

fix: bytesPerRow calculation for BufferImageSource in WebGPU by @koteelok in pixijs/pixijs#11718

fix: Guards mask reset from null reference by @Zyie in pixijs/pixijs#11719

fix: Prevents errors during worker manager reset by @Zyie in pixijs/pixijs#11720

🧹 Chores

chore: move transcoders off pixijs.download by @bigtimebuddy in pixijs/pixijs#11730

chore: cleanup using optional chaining by @bigtimebuddy in pixijs/pixijs#11713

Commits

10a92cf v8.14.1
15bd3d9 fix: Guards mask reset from null reference (#11719)
91fe1d6 chore: cleanup using optional chaining (#11713)
3ab0949 Fix bytesPerRow calculation for BufferImageSource (#11718)
e40a370 fix: Prevents errors during worker manager reset (#11720)
63a01c5 chore: move transcoders off pixijs.download (#11730)
See full diff in compare view

Updates sharp from 0.34.4 to 0.34.5

Release notes

Sourced from sharp's releases.

v0.34.5

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

Simplify ICC processing when retaining input profiles. #4468

v0.34.5-rc.1

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

Simplify ICC processing when retaining input profiles. #4468

v0.34.5-rc.0

Upgrade to libvips v8.17.3 for upstream bug fixes.

Add experimental support for prebuilt Linux RISC-V 64-bit binaries.

Support building from source with npm v12+, deprecate --build-from-source flag. #4458

Add support for BigTIFF output. #4459 @throwbi

Improve error messaging when only warnings issued. #4465

... (truncated)

Commits

e062456 Release v0.34.5
6450c70 Prerelease v0.34.5-rc.1
f7c95d1 TypeScript: consolidate a few enum-like properties
ef86a75 Prerelease v0.34.5-rc.0
6c1e840 Use structured binding for tuples where possible
e1628d8 Simplify ICC processing when retaining input profiles #4468
4f9f817 Linter: apply all recommended biome settings
09d5aa8 Docs: update internal and libvips doc links
040b73c Upgrade to libvips v8.17.3
1f2f33d Ensure licensing headers are retained by code bundlers
Additional commits viewable in compare view

Updates shiki from 3.14.0 to 3.15.0

Release notes

Sourced from shiki's releases.

v3.15.0

   🚀 Features

lang-ansi: Fallback for missing theme ANSI colors - by @Chanakyasinde and @antfu in shikijs/shiki#1095 (f36ea)

transformers: Support meta.indent for indent guides - by @L33Z22L11 in shikijs/shiki#1087 (d8f89)

   🐞 Bug Fixes

Allow singleton highlighter recovery after invalid language error - by @Maxiemad in shikijs/shiki#1091 (218c9)

vitepress-twoslash: Prevent popper show/hide on dragging - by @bluwy in shikijs/shiki#1090 (29522)

    View changes on GitHub

Commits

63ab64b chore: release v3.15.0
218c901 fix: allow singleton highlighter recovery after invalid language error (#1091)
c056371 chore: update snapshot
See full diff in compare view

Updates @types/node from 24.10.0 to 24.10.1

Commits

See full diff in compare view

Updates @types/yargs from 17.0.34 to 17.0.35

Commits

See full diff in compare view

Updates esbuild from 0.25.12 to 0.27.0

Release notes

Sourced from esbuild's releases.

v0.27.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information.

Use Uint8Array.fromBase64 if available (#4286)

With this release, esbuild's binary loader will now use the new Uint8Array.fromBase64 function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specify target when using this feature with Node (for example --target=node22) unless you're using Node v25+.

Update the Go compiler from v1.23.12 to v1.25.4 (#4208, #4311)

This raises the operating system requirements for running esbuild:

Linux: now requires a kernel version of 3.2 or later

macOS: now requires macOS 12 (Monterey) or later

v0.26.0

Enable trusted publishing (#4281)

GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

Changelog

Sourced from esbuild's changelog.

0.27.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information.

Use Uint8Array.fromBase64 if available (#4286)

With this release, esbuild's binary loader will now use the new Uint8Array.fromBase64 function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specify target when using this feature with Node (for example --target=node22) unless you're using Node v25+.

Update the Go compiler from v1.23.12 to v1.25.4 (#4208, #4311)

This raises the operating system requirements for running esbuild:

Linux: now requires a kernel version of 3.2 or later

macOS: now requires macOS 12 (Monterey) or later

0.26.0

Enable trusted publishing (#4281)

GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

Commits

2b91699 publish 0.27.0 to npm
22b425c fix #4286: use Uint8Array.fromBase64 if present (#4295)
6d187ef update go 1.25.3 => 1.25.4
9d0d4e7 update go 1.23.12 => 1.25.3 (#4318)
b6979d8 use a patched go compiler for release builds
893d2b9 delete temporary release.yml workflow
cee3918 add a temporary release.yml workflow
f5bb1d6 fix publish.yml
17ff82b publish 0.26.0 to npm
f87181f enable trusted publishing (#4319)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…y with 8 updates Bumps the production-dependencies group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [globby](https://github.com/sindresorhus/globby) | `15.0.0` | `16.0.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [pixi.js](https://github.com/pixijs/pixijs) | `8.14.0` | `8.14.1` | | [sharp](https://github.com/lovell/sharp) | `0.34.4` | `0.34.5` | | [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `3.14.0` | `3.15.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.10.0` | `24.10.1` | | [@types/yargs](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/yargs) | `17.0.34` | `17.0.35` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.12` | `0.27.0` | Updates `globby` from 15.0.0 to 16.0.0 - [Release notes](https://github.com/sindresorhus/globby/releases) - [Commits](sindresorhus/globby@v15.0.0...v16.0.0) Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `pixi.js` from 8.14.0 to 8.14.1 - [Release notes](https://github.com/pixijs/pixijs/releases) - [Commits](pixijs/pixijs@v8.14.0...v8.14.1) Updates `sharp` from 0.34.4 to 0.34.5 - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.34.4...v0.34.5) Updates `shiki` from 3.14.0 to 3.15.0 - [Release notes](https://github.com/shikijs/shiki/releases) - [Commits](https://github.com/shikijs/shiki/commits/v3.15.0/packages/shiki) Updates `@types/node` from 24.10.0 to 24.10.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/yargs` from 17.0.34 to 17.0.35 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/yargs) Updates `esbuild` from 0.25.12 to 0.27.0 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.25.12...v0.27.0) --- updated-dependencies: - dependency-name: globby dependency-version: 16.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: pixi.js dependency-version: 8.14.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: sharp dependency-version: 0.34.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: shiki dependency-version: 3.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: "@types/node" dependency-version: 24.10.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@types/yargs" dependency-version: 17.0.35 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: esbuild dependency-version: 0.27.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2025-11-24T14:00:29Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 17, 2025

dependabot bot closed this Nov 24, 2025

dependabot bot deleted the dependabot/npm_and_yarn/production-dependencies-a4ad9cdeea branch November 24, 2025 14:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the production-dependencies group across 1 directory with 8 updates #24

chore(deps): bump the production-dependencies group across 1 directory with 8 updates #24

Uh oh!

dependabot bot commented on behalf of github Nov 17, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Nov 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): bump the production-dependencies group across 1 directory with 8 updates #24

chore(deps): bump the production-dependencies group across 1 directory with 8 updates #24

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.0.0

Breaking

Improvements

Fixes

[4.1.1] - 2025-11-12

Security

v8.14.1

💾 Download

Changed

🐛 Fixed

🧹 Chores

v0.34.5

v0.34.5-rc.1

v0.34.5-rc.0

v3.15.0

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v0.27.0

v0.26.0

0.27.0

0.26.0

Uh oh!

dependabot bot commented on behalf of github Nov 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Nov 17, 2025 •

edited

Loading