chore(deps): update all non-major dependencies

[github-actions]

This PR contains the following updates:

Package Updates Summary

Type	Count
📦 NPM Packages	14
Total	14

📦 npm Dependencies

14 packages will be updated

Package	Change	Age	Adoption	Passing	Confidence
esbuild (source)	0.27.7 -> 0.28.1
oxc-parser (source)	0.121.0 -> 0.141.0
oxc-transform (source)	0.121.0 -> 0.141.0
webpack (source)	5.106.2 -> 5.108.4
@stacksjs/bumpx (source)	0.2.4 -> 0.2.6
@stacksjs/bunpress (source)	0.1.4 -> 0.1.20
@stacksjs/clapp (source)	0.2.7 -> 0.2.12
@stacksjs/gitlint (source)	0.1.5 -> 0.1.6
@stacksjs/logsmith (source)	0.2.1 -> 0.2.3
@types/bun (source)	1.3.13 -> 1.3.14
buddy-bot (source)	0.9.19 -> 0.9.22
bun-git-hooks (source)	0.3.1 -> 0.3.2
bunfig (source)	0.15.11 -> 0.15.15
pickier (source)	0.1.28 -> 0.1.40

---

Release Notes

evanw/esbuild (esbuild)

0.27.7 -> 0.28.1

v0.28.1

Compare Source

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to [dellalibera](https://github.com/dellalibera) for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if ...

[View full release notes]

Released by github-actions[bot] on 6/11/2026

v0.28.0

Compare Source

• Add support for with { type: 'text' } imports (#4435)

  The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

  import string from './example.txt' with { type: 'text' }
  console.log(string)

• Add integrity checks to fallback download path (#4343)

  Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the re...

[View full release notes]

Released by github-actions[bot] on 4/2/2026

oxc-project/oxc (oxc-parser)

0.121.0 -> 0.141.0

crates_v0.141.0

Compare Source

💥 BREAKING CHANGES

• 5293431 str: [BREAKING] Move IdentBuildHasher to oxc_str crate (#24717) (overlookmotel)
• 54cc121 ast: [BREAKING] Split MetaProperty into ImportMeta and NewTarget (#24557) (camc314)

🚀 Features

• 87823d0 minifier: Merge combined assign expression in conditional expression (#24707) (sapphi-red)
• 03a54c9 minifier: Merge assign expression against member expression in conditional expression (#24706) (sapphi-red)
• effd3c8 allocator: Add Vec::from_raw_parts_in (#24732) (overlookmotel)
• ddacf61 semantic: Add context notes for strict assignments (#24728) (camc314)
• 7e9b84a data_structures: Add implements! macro (#24721) (overlookmotel)
• 39e141b data_structures: Add const_str_eq function (#24720) (overlookmotel)
• cc3d17f semantic: Add context notes for reserved keyword diagnostic (#24715) (camc314)
• 4c71560 parser: More friendly error for spread element in dynamic imports (#24705) (sapphi-red)
• 7b045cd minfier:...

[View full release notes]

Released by github-actions[bot] on 7/21/2026

crates_v0.140.0

Compare Source

🚀 Features

• 5b20828 minifier: Extract sequence expression from expressions (#22003) (Armano)
• 616bfa2 minifier: Remove unreachable code after terminating statements (#24441) (Dunqing)
• ddab89a data_structures: Add likely and unlikely functions (#24368) (overlookmotel)
• a3a39f9 react_compiler: Implement enableEmitHookGuards codegen (#24329) (Boshen)
• b79eef7 minifier: Apply De Morgan's law to negated comparison chains in jump guards and loop tests (#24279) (Dunqing)
• 34ff7b4 minifier: Drop write-only property assignments to unused local bindings by default (#24112) (Dunqing)
• 1b829d8 semantic: Record const enums in EnumData (#24268) (Dunqing)
• ba0944c semantic: Add Scoping::set_symbol_span (#24221) (camc314)

🐛 Bug Fixes

• edf781d minifier: Keep reads of never-assigned uninitialized bindings (#24452) (Dunqing)
• 7d33363 minifier: Preserve guaranteed throws from class heritage evaluation (#24349) (Dunqing)
• 058a62f semantic: Track ambient co...

[View full release notes]

Released by github-actions[bot] on 7/14/2026

apps_v1.74.0

Compare Source

Table of Contents

• Oxlint v1.74.0
• Oxfmt v0.59.0

Oxlint v1.74.0

🚀 Features

• 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#24044) (Boshen)
• 92f154a oxlint,oxfmt: Auto-discover .mts config files (#24357) (camc314)
• 8c1d74b linter/import/no-duplicates: Add autofix logic (#24273) (Cole Ellison)

🐛 Bug Fixes

• ac7176d linter/import/no-duplicates: Avoid duplicate commas when merging imports (#24467) (camc314)
• 261aa39 linter/import/no-duplicates: Preserve type modifiers when merging imports (#24466) (camc314)
• dbd08b6 linter/unicorn/prefer-string-raw: Skip fix for TSPropertySignature keys (#24465) (camc314)
• df67932 linter: Skip suppression validation with --type-check-only (#24462) (Stephen Zhou)
• 0b086de linter/jest/prefer-lowercase-title: False positive when lowercaseFirstCharacterOnly is false (#24414) (Connor Shea)
• 097cb95 linter: Allow vite-plus/test and `[effect](http...

[View full release notes]

Released by github-actions[bot] on 7/14/2026

oxc-project/oxc (oxc-transform)

0.121.0 -> 0.141.0

crates_v0.141.0

Compare Source

💥 BREAKING CHANGES

• 5293431 str: [BREAKING] Move IdentBuildHasher to oxc_str crate (#24717) (overlookmotel)
• 54cc121 ast: [BREAKING] Split MetaProperty into ImportMeta and NewTarget (#24557) (camc314)

🚀 Features

• 87823d0 minifier: Merge combined assign expression in conditional expression (#24707) (sapphi-red)
• 03a54c9 minifier: Merge assign expression against member expression in conditional expression (#24706) (sapphi-red)
• effd3c8 allocator: Add Vec::from_raw_parts_in (#24732) (overlookmotel)
• ddacf61 semantic: Add context notes for strict assignments (#24728) (camc314)
• 7e9b84a data_structures: Add implements! macro (#24721) (overlookmotel)
• 39e141b data_structures: Add const_str_eq function (#24720) (overlookmotel)
• cc3d17f semantic: Add context notes for reserved keyword diagnostic (#24715) (camc314)
• 4c71560 parser: More friendly error for spread element in dynamic imports (#24705) (sapphi-red)
• 7b045cd minfier:...

[View full release notes]

Released by github-actions[bot] on 7/21/2026

crates_v0.140.0

Compare Source

🚀 Features

• 5b20828 minifier: Extract sequence expression from expressions (#22003) (Armano)
• 616bfa2 minifier: Remove unreachable code after terminating statements (#24441) (Dunqing)
• ddab89a data_structures: Add likely and unlikely functions (#24368) (overlookmotel)
• a3a39f9 react_compiler: Implement enableEmitHookGuards codegen (#24329) (Boshen)
• b79eef7 minifier: Apply De Morgan's law to negated comparison chains in jump guards and loop tests (#24279) (Dunqing)
• 34ff7b4 minifier: Drop write-only property assignments to unused local bindings by default (#24112) (Dunqing)
• 1b829d8 semantic: Record const enums in EnumData (#24268) (Dunqing)
• ba0944c semantic: Add Scoping::set_symbol_span (#24221) (camc314)

🐛 Bug Fixes

• edf781d minifier: Keep reads of never-assigned uninitialized bindings (#24452) (Dunqing)
• 7d33363 minifier: Preserve guaranteed throws from class heritage evaluation (#24349) (Dunqing)
• 058a62f semantic: Track ambient co...

[View full release notes]

Released by github-actions[bot] on 7/14/2026

apps_v1.74.0

Compare Source

Table of Contents

• Oxlint v1.74.0
• Oxfmt v0.59.0

Oxlint v1.74.0

🚀 Features

• 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#24044) (Boshen)
• 92f154a oxlint,oxfmt: Auto-discover .mts config files (#24357) (camc314)
• 8c1d74b linter/import/no-duplicates: Add autofix logic (#24273) (Cole Ellison)

🐛 Bug Fixes

• ac7176d linter/import/no-duplicates: Avoid duplicate commas when merging imports (#24467) (camc314)
• 261aa39 linter/import/no-duplicates: Preserve type modifiers when merging imports (#24466) (camc314)
• dbd08b6 linter/unicorn/prefer-string-raw: Skip fix for TSPropertySignature keys (#24465) (camc314)
• df67932 linter: Skip suppression validation with --type-check-only (#24462) (Stephen Zhou)
• 0b086de linter/jest/prefer-lowercase-title: False positive when lowercaseFirstCharacterOnly is false (#24414) (Connor Shea)
• 097cb95 linter: Allow vite-plus/test and `[effect](http...

[View full release notes]

Released by github-actions[bot] on 7/14/2026

webpack/webpack (webpack)

5.106.2 -> 5.108.4

v5.108.4

Compare Source

Patch Changes

• Speed up non-CSS-Modules parsing by not building unused selector AST nodes. (by [alexander-akait](https://github.com/alexander-akait) in #21324)

• Speed up non-CSS-Modules CSS parsing by dropping value tokens nothing reads. (by [alexander-akait](https://github.com/alexander-akait) in #21324)

• Resolve HTML asset URLs against the document <base href>. (by [alexander-akait](https://github.com/alexander-akait) in #21329)

• Add HTML integration tests: generateError output, ignored src, null-char parse. (by [aryanraj45](https://github.com/aryanraj45) in #21328)

• Reduce CPU and memory overhead of HTML and CSS parsing and code generation. (by [alexander-akait](https://g...

[View full release notes]

Released by github-actions[bot] on 7/4/2026

v5.108.3

Compare Source

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by [alexander-akait](https://github.com/alexander-akait) in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by [xiaoxiaojx](https://github.com/xiaoxiaojx) in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by [alexander-akait](https://github.com/alexander-akait) in #21303)

Released by github-actions[bot] on 6/29/2026

v5.108.2

Compare Source

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by [hai-x](https://github.com/hai-x) in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by [alexander-akait](https://github.com/alexander-akait) in #21286)

Released by github-actions[bot] on 6/29/2026

stacksjs/bumpx (@stacksjs/bumpx)

0.2.4 -> 0.2.6

v0.2.6

Compare Source

Released by github-actions[bot] on 5/4/2026

v0.2.5

Compare Source

Released by github-actions[bot] on 4/26/2026

stacksjs/bunpress (@stacksjs/bunpress)

0.1.4 -> 0.1.20

v0.1.20

Compare Source

Released by github-actions[bot] on 7/21/2026

v0.1.6

Compare Source

Released by github-actions[bot] on 5/24/2026

v0.1.5

Compare Source

Released by github-actions[bot] on 5/10/2026

stacksjs/clapp (@stacksjs/clapp)

0.2.7 -> 0.2.12

v0.2.12

Compare Source

Released by github-actions[bot] on 7/21/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 5/11/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 5/6/2026

stacksjs/gitlint (@stacksjs/gitlint)

0.1.5 -> 0.1.6

v0.x.x

Compare Source

Released by github-actions[bot] on 5/8/2026

stacksjs/logsmith (@stacksjs/logsmith)

0.2.1 -> 0.2.3

v0.2.3

Compare Source

Released by github-actions[bot] on 5/27/2026

DefinitelyTyped/DefinitelyTyped (@types/bun)

1.3.13 -> 1.3.14

Compare Source

TypeScript definitions for bun

📖 View Release Notes

🔗 View Changelog

Release Notes

Changelog

stacksjs/buddy-bot (buddy-bot)

0.9.19 -> 0.9.22

v0.9.22

Compare Source

Released by github-actions[bot] on 7/15/2026

v0.9.21

Compare Source

Released by github-actions[bot] on 7/15/2026

v0.9.20

Compare Source

Released by github-actions[bot] on 5/25/2026

stacksjs/bun-git-hooks (bun-git-hooks)

0.3.1 -> 0.3.2

v0.3.2

Compare Source

Released by github-actions[bot] on 5/14/2026

stacksjs/bunfig (bunfig)

0.15.11 -> 0.15.15

v0.15.15

Compare Source

Released by github-actions[bot] on 7/16/2026

v0.15.14

Compare Source

Released by github-actions[bot] on 6/10/2026

v0.15.13

Compare Source

Released by github-actions[bot] on 5/8/2026

pickier/pickier (pickier)

0.1.28 -> 0.1.40

v0.1.40

Compare Source

Released by github-actions[bot] on 7/16/2026

v0.1.39

Compare Source

Released by github-actions[bot] on 7/15/2026

v0.1.38

Compare Source

Released by github-actions[bot] on 7/10/2026

---

📊 Package Statistics

• esbuild: 254,237,680 weekly downloads
• oxc-parser: 34,988,875 weekly downloads
• oxc-transform: 4,343,439 weekly downloads
• webpack: 52,246,177 weekly downloads
• @stacksjs/bumpx: 48,610 weekly downloads
• @stacksjs/bunpress: 51,856 weekly downloads
• @stacksjs/clapp: 64,053 weekly downloads
• @stacksjs/gitlint: 46,913 weekly downloads
• @stacksjs/logsmith: 48,428 weekly downloads
• @types/bun: 8,451,700 weekly downloads
• buddy-bot: 48,408 weekly downloads
• bun-git-hooks: 48,617 weekly downloads
• bunfig: 62,727 weekly downloads
• pickier: 49,968 weekly downloads

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Buddy 🤖

[netlify]

❌ Deploy Preview for dtsx failed. Why did it fail? →

Name	Link
🔨 Latest commit	73f3a40
🔍 Latest deploy log	https://app.netlify.com/projects/dtsx/deploys/6a5fe0ccf87f4d00089a6639