chore(deps): update all non-major dependencies

[github-actions]

This PR contains the following updates:

Package Updates Summary

Type	Count
📦 NPM Packages	14
Total	14

📦 npm Dependencies

14 packages will be updated

Package	Change	Age	Adoption	Passing	Confidence
@stacksjs/bunpress (source)	0.1.4 -> 0.2.14
@types/bun (source)	1.3.13 -> 1.4.0
buddy-bot (source)	0.9.19 -> 0.10.5
esbuild (source)	0.27.7 -> 0.28.2
oxc-parser (source)	0.121.0 -> 0.147.0
oxc-transform (source)	0.121.0 -> 0.147.0
webpack (source)	5.106.2 -> 5.110.1
@stacksjs/bumpx (source)	0.2.6 -> 0.2.17
@stacksjs/clapp (source)	0.2.7 -> 0.2.13
@stacksjs/gitlint (source)	0.1.5 -> 0.1.8
@stacksjs/logsmith (source)	0.2.1 -> 0.2.11
bun-git-hooks (source)	0.3.1 -> 0.3.3
bunfig (source)	0.15.11 -> 0.15.19
pickier (source)	0.1.28 -> 0.1.65

---

Release Notes

stacksjs/bunpress (@stacksjs/bunpress)

0.1.4 -> 0.2.14

v0.2.14

Compare Source

Released by github-actions[bot] on 8/25/2026

v0.2.13

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.2.12

Compare Source

Released by github-actions[bot] on 8/19/2026

DefinitelyTyped/DefinitelyTyped (@types/bun)

1.3.13 -> 1.4.0

Compare Source

TypeScript definitions for bun

📖 View Release Notes

🔗 View Changelog

Release Notes

Changelog

stacksjs/buddy-bot (buddy-bot)

0.9.19 -> 0.10.5

v0.10.5

Compare Source

Compare changes

⚡ Performance Improvements

• ai: make the Anthropic SDK an optional peer, resolved on first use (a316c78) (by Chris chrisbreuer93@gmail.com)

🔧 Chores

• release v0.10.5 (7111ccd) (by Chris chris@stacksjs.com)

Contributors

• Chris chris@stacksjs.com

Released by github-actions[bot] on 8/19/2026

v0.9.27

Compare Source

Released by github-actions[bot] on 8/8/2026

v0.9.26

Compare Source

Released by github-actions[bot] on 8/8/2026

evanw/esbuild (esbuild)

0.27.7 -> 0.28.2

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but no...

[View full release notes]

Released by github-actions[bot] on 8/8/2026

v0.28.1

Compare Source

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to [dellalibera](https://github.com/dellalibera) for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if ...

[View full release notes]

Released by github-actions[bot] on 6/11/2026

v0.28.0

Compare Source

• Add support for with { type: 'text' } imports (#4435)

  The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

  import string from './example.txt' with { type: 'text' }
  console.log(string)

• Add integrity checks to fallback download path (#4343)

  Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the re...

[View full release notes]

Released by github-actions[bot] on 4/2/2026

oxc-project/oxc (oxc-parser)

0.121.0 -> 0.147.0

crates_v0.147.0

Compare Source

🚀 Features

• b6e9e5e minifier: Fold switch stmt whose parent is not block stmt (#25403) (Armano)

🐛 Bug Fixes

• 8db1053 codegen: Require sourcemap for example (#26047) (camc314)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 6f0c7cf minifier: Avoid merging if to for in sloppy mode when containing function declaration (#25638) (sapphi-red)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 6c5ad1b codegen: Only add mapping names for PrivateIdentifiers which have changed (#25958) (overlookmotel)
• 2dad1e0 parser: Track irregular line terminators in trivia (#25947) (camc314)
• 58ba651 minifier: Avoid merging if to for when the body contains a function declaration (#25637) (sapphi-red)
• a185ac3 codegen: Print # before private identifier in TS signature key (#25938) (overlookmotel)
• af82a07 minifier: Keep unary + when the other operand has side effects (#25645) (Kotaro Chikuba)

⚡ Pe...

[View full release notes]

Released by github-actions[bot] on 8/24/2026

apps_v1.80.0

Compare Source

Table of Contents

• Oxlint v1.80.0
• Oxfmt v0.65.0

Oxlint v1.80.0

🚀 Features

• 70c3e35 linter/typescript/no-confusing-non-null-assertion: Implement suggestion (#26012) (Mikhail Baev)

🐛 Bug Fixes

• 17ae11c linter/oxc/double-comparisons: Handle grouped logical expressions (#26044) (camc314)
• 8a353a7 linter/eslint/no-control-regex: Refine help message text (#25996) (Rahul Mishra)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 8d94cd1 linter/eslint/no-useless-rename: Preserve type modifiers (#26020) (Cameron)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 51d36d7 linter/vue: Resolve vue imports via shared import helpers (#25903) (Connor Shea)
• 83a68d2 linter/react/no-react-children: Resolve react imports by symbol (#25901) (Connor Shea)
• 124e196 linter: Resolve globals by reference, not by name (#25905) (Connor Shea)
• a701bcc linter: Remove invali...

[View full release notes]

Released by github-actions[bot] on 8/24/2026

crates_v0.146.0

Compare Source

🚀 Features

• 83cb516 minifier: Improve negation of expressions in boolean context (#25755) (Armano)

🐛 Bug Fixes

• 82a790d codegen: Narrow printSync input type (#25871) (camc314)
• 134fb22 isolated-declarations: Preserve unresolved parameter types (#25909) (Dunqing)
• 526c2b3 codegen: Remove deprecated test APIs (#25889) (camc314)
• 344a9b2 codegen: Align enum template sourcemaps (#25872) (camc314)

⚡ Performance

• 603b904 packages/codegen: Check sourceText only once (#25887) (overlookmotel)
• 5ef0c93 minifier: Unwrap all unary exprs without creating dummy expressions (#25891) (Armano)
• 8783524 packages/codegen: Remove loop from growMappingBuffer (#25886) (overlookmotel)
• b6b14c0 packages/codegen: Remove redundant branch (#25885) (overlookmotel)
• be6adf0 packages/sourcemap: Make location passed to recordSourceMapping always a number (#25884) (overlookmotel)
• f720f15 packages/codegen: Take named-mapping only code off hot path in `recordSo...

[View full release notes]

Released by github-actions[bot] on 8/19/2026

oxc-project/oxc (oxc-transform)

0.121.0 -> 0.147.0

crates_v0.147.0

Compare Source

🚀 Features

• b6e9e5e minifier: Fold switch stmt whose parent is not block stmt (#25403) (Armano)

🐛 Bug Fixes

• 8db1053 codegen: Require sourcemap for example (#26047) (camc314)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 6f0c7cf minifier: Avoid merging if to for in sloppy mode when containing function declaration (#25638) (sapphi-red)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 6c5ad1b codegen: Only add mapping names for PrivateIdentifiers which have changed (#25958) (overlookmotel)
• 2dad1e0 parser: Track irregular line terminators in trivia (#25947) (camc314)
• 58ba651 minifier: Avoid merging if to for when the body contains a function declaration (#25637) (sapphi-red)
• a185ac3 codegen: Print # before private identifier in TS signature key (#25938) (overlookmotel)
• af82a07 minifier: Keep unary + when the other operand has side effects (#25645) (Kotaro Chikuba)

⚡ Pe...

[View full release notes]

Released by github-actions[bot] on 8/24/2026

apps_v1.80.0

Compare Source

Table of Contents

• Oxlint v1.80.0
• Oxfmt v0.65.0

Oxlint v1.80.0

🚀 Features

• 70c3e35 linter/typescript/no-confusing-non-null-assertion: Implement suggestion (#26012) (Mikhail Baev)

🐛 Bug Fixes

• 17ae11c linter/oxc/double-comparisons: Handle grouped logical expressions (#26044) (camc314)
• 8a353a7 linter/eslint/no-control-regex: Refine help message text (#25996) (Rahul Mishra)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 8d94cd1 linter/eslint/no-useless-rename: Preserve type modifiers (#26020) (Cameron)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 51d36d7 linter/vue: Resolve vue imports via shared import helpers (#25903) (Connor Shea)
• 83a68d2 linter/react/no-react-children: Resolve react imports by symbol (#25901) (Connor Shea)
• 124e196 linter: Resolve globals by reference, not by name (#25905) (Connor Shea)
• a701bcc linter: Remove invali...

[View full release notes]

Released by github-actions[bot] on 8/24/2026

crates_v0.146.0

Compare Source

🚀 Features

• 83cb516 minifier: Improve negation of expressions in boolean context (#25755) (Armano)

🐛 Bug Fixes

• 82a790d codegen: Narrow printSync input type (#25871) (camc314)
• 134fb22 isolated-declarations: Preserve unresolved parameter types (#25909) (Dunqing)
• 526c2b3 codegen: Remove deprecated test APIs (#25889) (camc314)
• 344a9b2 codegen: Align enum template sourcemaps (#25872) (camc314)

⚡ Performance

• 603b904 packages/codegen: Check sourceText only once (#25887) (overlookmotel)
• 5ef0c93 minifier: Unwrap all unary exprs without creating dummy expressions (#25891) (Armano)
• 8783524 packages/codegen: Remove loop from growMappingBuffer (#25886) (overlookmotel)
• b6b14c0 packages/codegen: Remove redundant branch (#25885) (overlookmotel)
• be6adf0 packages/sourcemap: Make location passed to recordSourceMapping always a number (#25884) (overlookmotel)
• f720f15 packages/codegen: Take named-mapping only code off hot path in `recordSo...

[View full release notes]

Released by github-actions[bot] on 8/19/2026

webpack/webpack (webpack)

5.106.2 -> 5.110.1

v5.110.1

Compare Source

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by [alexander-akait](https://github.com/alexander-akait) in #21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by [alexander-akait](https://github.com/alexander-akait) in #21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by [AgentEnder](https://github.com/AgentEnder) in #21845)

Released by github-actions[bot] on 8/27/2026

v5.110.0

Compare Source

Minor Changes

• Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by [hai-x](https://github.com/hai-x) in #21519)

• Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the bui...

[View full release notes]

Released by github-actions[bot] on 8/27/2026

v5.109.2

Compare Source

Patch Changes

• Resolve aliases pointing at a package directory whose name ends with .js again. (by [alexander-akait](https://github.com/alexander-akait) in #21542)

• Name CSS sources in source maps by their resource path, without the css prefix. (by [bjohansebas](https://github.com/bjohansebas) in #21536)

• Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by [bjohansebas](https://github.com/bjohansebas) in #21528)

• Report "universal" as the loader context target for the universal target. (by [alexander-akait](https://github.com/alexander-akait) in [#21540](`w...

[View full release notes]

Released by github-actions[bot] on 7/28/2026

stacksjs/bumpx (@stacksjs/bumpx)

0.2.6 -> 0.2.17

v0.2.17

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 7/22/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 7/22/2026

stacksjs/clapp (@stacksjs/clapp)

0.2.7 -> 0.2.13

v0.2.13

Compare Source

Released by github-actions[bot] on 8/13/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 5/11/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 5/6/2026

stacksjs/gitlint (@stacksjs/gitlint)

0.1.5 -> 0.1.8

v0.1.8

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.1.7

Compare Source

Released by github-actions[bot] on 7/22/2026

v0.x.x

Compare Source

Released by github-actions[bot] on 5/8/2026

stacksjs/logsmith (@stacksjs/logsmith)

0.2.1 -> 0.2.11

v0.2.11

Compare Source

Released by github-actions[bot] on 7/28/2026

v0.2.10

Compare Source

Released by github-actions[bot] on 7/28/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 7/26/2026

stacksjs/bun-git-hooks (bun-git-hooks)

0.3.1 -> 0.3.3

v0.3.3

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.3.2

Compare Source

Released by github-actions[bot] on 5/14/2026

stacksjs/bunfig (bunfig)

0.15.11 -> 0.15.19

v0.15.19

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.15.18

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.15.17

Compare Source

Released by github-actions[bot] on 7/31/2026

pickier/pickier (pickier)

0.1.28 -> 0.1.65

v0.1.65

Compare Source

Released by github-actions[bot] on 8/23/2026

v0.1.64

Compare Source

Released by github-actions[bot] on 8/23/2026

v0.1.63

Compare Source

Released by github-actions[bot] on 8/23/2026

---

📊 Package Statistics

• @stacksjs/bunpress: 119,897 weekly downloads
• @types/bun: 12,248,603 weekly downloads
• buddy-bot: 83,068 weekly downloads
• esbuild: 273,795,730 weekly downloads
• oxc-parser: 47,541,011 weekly downloads
• oxc-transform: 5,008,171 weekly downloads
• webpack: 56,233,474 weekly downloads
• @stacksjs/bumpx: 84,958 weekly downloads
• @stacksjs/clapp: 104,220 weekly downloads
• @stacksjs/gitlint: 80,756 weekly downloads
• @stacksjs/logsmith: 82,157 weekly downloads
• bun-git-hooks: 79,756 weekly downloads
• bunfig: 134,171 weekly downloads
• pickier: 94,645 weekly downloads

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Buddy 🤖

[netlify]

❌ Deploy Preview for dtsx failed. Why did it fail? →

Name	Link
🔨 Latest commit	9f35b2d
🔍 Latest deploy log	https://app.netlify.com/projects/dtsx/deploys/6a70a9aa76fc0c0008b4cd37