Skip to content

⬆ Bump the bun-packages group with 6 updates - #214

Merged
savannahostrowski merged 1 commit into
mainfrom
dependabot/bun/bun-packages-bb4605162b
Jul 28, 2026
Merged

⬆ Bump the bun-packages group with 6 updates#214
savannahostrowski merged 1 commit into
mainfrom
dependabot/bun/bun-packages-bb4605162b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the bun-packages group with 6 updates:

Package From To
p-map 7.0.5 7.0.6
posthog-node 5.41.0 5.46.0
toml 4.3.0 5.0.0
@biomejs/biome 2.5.3 2.5.5
lint-staged 17.0.8 17.1.0
sinon 22.0.0 22.1.0

Updates p-map from 7.0.5 to 7.0.6

Release notes

Sourced from p-map's releases.

v7.0.6

  • Fix abort listener cleanup for already-aborted signals (#91) 3f153f1

sindresorhus/p-map@v7.0.5...v7.0.6

Commits

Updates posthog-node from 5.41.0 to 5.46.0

Release notes

Sourced from posthog-node's releases.

posthog-node@5.46.0

5.46.0

Minor Changes

  • #4172 9621830 Thanks @​haacked! - send minimal $feature_flag_called events when the server enables it

    When the v2 /flags response carries minimalFlagCalledEvents: true (or, for posthog-node local evaluation, the flag-definitions payload carries minimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false), $feature_flag_called events are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties, $set/$set_once, the $feature/<key> enumeration, $active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags, has_experiment unknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration. before_send runs after the filter and may re-add stripped properties. (2026-07-20)

Patch Changes

  • Updated dependencies [9621830]:
    • @​posthog/core@​1.44.0

posthog-node@5.45.2

5.45.2

Patch Changes

  • #4168 06d19a2 Thanks @​dustinbyrne! - Avoid Next.js Edge runtime warnings for native compression and fatal error handling. (2026-07-16)
  • Updated dependencies [06d19a2]:
    • @​posthog/core@​1.43.1

posthog-node@5.45.1

5.45.1

Patch Changes

posthog-node@5.45.0

5.45.0

Minor Changes

  • #4159 fad6d9a Thanks @​haacked! - add $feature_flag_has_experiment to $feature_flag_called events

    $feature_flag_called events now carry a $feature_flag_has_experiment boolean sourced from the server's has_experiment flag metadata (the /flags?v=2 response for remote evaluation, the /api/feature_flag/local_evaluation definitions for posthog-node local evaluation). The property is only sent when the server explicitly reports has_experiment; it is omitted entirely when the value is unknown (older servers, missing metadata, bootstrapped or locally injected flags). (2026-07-16)

Patch Changes

  • Updated dependencies [fad6d9a]:
    • @​posthog/core@​1.43.0

posthog-node@5.44.0

5.44.0

Minor Changes

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.46.0

Minor Changes

  • #4172 9621830 Thanks @​haacked! - send minimal $feature_flag_called events when the server enables it

    When the v2 /flags response carries minimalFlagCalledEvents: true (or, for posthog-node local evaluation, the flag-definitions payload carries minimal_flag_called_events: true) and the evaluated flag is not linked to an experiment ($feature_flag_has_experiment === false), $feature_flag_called events are rebuilt from a strict allowlist of flag-evaluation, processing-control, and SDK-identity properties. Super properties, $set/$set_once, the $feature/<key> enumeration, $active_feature_flags, and the context envelope are stripped. Any missing signal (no gate on the response, bootstrapped or locally injected flags, has_experiment unknown) falls back to the full event, and experiment-linked flags always send the full envelope. The gate is stored alongside the cached flags (posthog-js persistence, posthog-node poller state) and is server-controlled, with no SDK-side configuration. before_send runs after the filter and may re-add stripped properties. (2026-07-20)

Patch Changes

  • Updated dependencies [9621830]:
    • @​posthog/core@​1.44.0

5.45.2

Patch Changes

  • #4168 06d19a2 Thanks @​dustinbyrne! - Avoid Next.js Edge runtime warnings for native compression and fatal error handling. (2026-07-16)
  • Updated dependencies [06d19a2]:
    • @​posthog/core@​1.43.1

5.45.1

Patch Changes

5.45.0

Minor Changes

  • #4159 fad6d9a Thanks @​haacked! - add $feature_flag_has_experiment to $feature_flag_called events

    $feature_flag_called events now carry a $feature_flag_has_experiment boolean sourced from the server's has_experiment flag metadata (the /flags?v=2 response for remote evaluation, the /api/feature_flag/local_evaluation definitions for posthog-node local evaluation). The property is only sent when the server explicitly reports has_experiment; it is omitted entirely when the value is unknown (older servers, missing metadata, bootstrapped or locally injected flags). (2026-07-16)

Patch Changes

  • Updated dependencies [fad6d9a]:
    • @​posthog/core@​1.43.0

5.44.0

Minor Changes

  • #4153 fc2cb2e Thanks @​eli-r-ph! - Raise the default maxQueueSize from 1000 to 10000. Backend workloads are more likely to burst-enqueue events synchronously ahead of a flush than browser/mobile clients, so the previous default risked silently dropping events under bursty load. An explicit maxQueueSize option still overrides this default. (2026-07-15)

Patch Changes

... (truncated)

Commits
  • 34a03e2 chore: update versions and lockfile [version bump]
  • 9621830 feat(flags): minimize $feature_flag_called events for non-experiment flags (#...
  • 8bf1b19 chore: ban object-literal type assertions in package sources (#4192)
  • be17ec1 chore: update versions and lockfile [version bump]
  • 06d19a2 fix: avoid Next.js Edge runtime warnings (#4168)
  • 60c2492 chore: update versions and lockfile [version bump]
  • 9eb2b28 fix(node): standardize flush interval default (#4164)
  • be5249f fix(docs): exclude internal members and tag deprecated ones in SDK references...
  • 422b9a4 chore: update versions and lockfile [version bump]
  • fad6d9a feat(flags): add $feature_flag_has_experiment to $feature_flag_called events ...
  • Additional commits viewable in compare view

Updates toml from 4.3.0 to 5.0.0

Changelog

Sourced from toml's changelog.

5.0.0 - July 14 2026

  • Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.
  • Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.
Commits

Updates @biomejs/biome from 2.5.3 to 2.5.5

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.5

2.5.5

Patch Changes

  • #10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}

  • #10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
declare const value: Recursive;
String(value);
value || "fallback";

  • #10977 0bf7486 Thanks @​ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #10983 edc0ed7 Thanks @​ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

  • #10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.5

Patch Changes

  • #10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}

  • #10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
declare const value: Recursive;
String(value);
value || "fallback";

  • #10977 0bf7486 Thanks @​ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #10983 edc0ed7 Thanks @​ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

  • #10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }

... (truncated)

Commits

Updates lint-staged from 17.0.8 to 17.1.0

Release notes

Sourced from lint-staged's releases.

v17.1.0

Minor Changes

  • #1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

    Before:

    Size of node_modules/ after installing: 1561.7 kB with 29 packages.

    Fancy interactive spinners, but output dynamically changes:

    ✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...
✔ Staging changes from tasks...
✔ Cleaning up temporary files...

    After:

    Size of node_modules/ after installing: 974.0 kB with 5 packages (37.6 % smaller, 82.7 % less transitive dependencies).

    Simpler but more explicit output:

    ⋯ Backing up original state…
✔ Done backing up original state (35b38ed1)!
⋯ Running tasks for staged files…
    *.js — 1 file
      ⋯ oxlint --fix
    *.{json,md} — 1 file
      ⋯ oxfmt --write
✔ oxfmt --write
✔ oxlint --fix
✔ Done running tasks for staged files!
⋯ Staging changes from tasks…
✔ Done staging changes from tasks!
⋯ Cleaning up temporary files…
✔ Done cleaning up temporary files!

Patch Changes

  • #1816 c19079d - Try to restore hidden unstaged changes when using --no-revert.

  • #1818 efb23a2 - Console output colors are enabled/disabled more consistently.

  • #1818 26112a1 - Failed JS function tasks now properly kill other tasks, unless --continue-on-error is used. Previously their failure didn't affect other tasks.

Changelog

Sourced from lint-staged's changelog.

17.1.0

Minor Changes

  • #1816 7568d4f - The console output of lint-staged has been simplified so that there's less interactive spinners and more explicit messages like "Started…" -> "Done!". The primary purpose of this was to remove Listr2, a very large dependency.

    Before:

    Size of node_modules/ after installing: 1561.7 kB with 29 packages.

    Fancy interactive spinners, but output dynamically changes:

    ✔ Backed up original state in git stash (0b191303)
✔ Running tasks for staged files...
✔ Staging changes from tasks...
✔ Cleaning up temporary files...

    After:

    Size of node_modules/ after installing: 974.0 kB with 5 packages (37.6 % smaller, 82.7 % less transitive dependencies).

    Simpler but more explicit output:

    ⋯ Backing up original state…
✔ Done backing up original state (35b38ed1)!
⋯ Running tasks for staged files…
    *.js — 1 file
      ⋯ oxlint --fix
    *.{json,md} — 1 file
      ⋯ oxfmt --write
✔ oxfmt --write
✔ oxlint --fix
✔ Done running tasks for staged files!
⋯ Staging changes from tasks…
✔ Done staging changes from tasks!
⋯ Cleaning up temporary files…
✔ Done cleaning up temporary files!

Patch Changes

  • #1816 c19079d - Try to restore hidden unstaged changes when using --no-revert.

  • #1818 efb23a2 - Console output colors are enabled/disabled more consistently.

... (truncated)

Commits
  • dd5a95f Merge pull request #1817 from lint-staged/changeset-release/main
  • aad7f3b chore(changeset): release
  • 11b1d5c Merge pull request #1818 from lint-staged/fixes
  • efb23a2 fix: enable colors globally based on option
  • 26112a1 fix: function task failure kills other tasks, unless --continue-on-error wa...
  • 9b98b7f fix: handle error when calculating hash of unstaged changes
  • d43432b fix: do not allow NaN concurrency
  • bd4dcbf fix: do not drop backup stash when restoring unstaged changes fails and using...
  • 9153a77 Merge pull request #1816 from lint-staged/replace-listr2
  • 290e618 refactor: use common identity function
  • Additional commits viewable in compare view

Updates sinon from 22.0.0 to 22.1.0

Changelog

Sourced from sinon's changelog.

22.1.0

  • d36e921b fix: let returns override returnsArg (王胜)

    Signed-off-by: 王胜 2318857637@qq.com

  • 40c4caa0 fix: align restoreObject docs test with idempotent behavior (#2745) (Julia Miller)

    restoreObject was made idempotent in #2737 — it no longer throws for objects with no restorable methods. Updates the docs page and its corresponding test to reflect this.

  • a68dac19 fix: throw a clear error when throwArg index equals the argument count (#2743) (spokodev)
    • fix: throw a clear error when throwArg index equals the argument count

    spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it with pos equal to the number of recorded arguments slipped past the guard and reached throw this.args[pos], throwing undefined instead of the intended TypeError. A thrown undefined cannot be inspected as an Error and is reported by test frameworks as no exception thrown.

    Use >= to match ensureArgs in behavior.js and the sibling callArg helpers, which already reject an out-of-range index with a clear error.

  • 9ea504e3 feat: make sinon.restoreObject idempotent (#2737) (Ilia Choly)

    Passing an object with no live fakes to restoreObject now restores nothing instead of throwing, giving it symmetry with sinon.restore() and sandbox.restore(). The strict "found no methods" check is retained for spy(object) and stub(object), which now use a dedicated walkObjectStrict export, while restoreObject uses the loose walkObject. Passing a falsy value still throws.

    Fixes #2736

  • 4db4feff fix: preserve fake undefined argument validation (Vishal Kumar Singh)
  • 755a40d7 fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

    The global callId counter in proxy-invoke.js caused calledImmediatelyBefore and calledImmediatelyAfter to fail when tests run in parallel with separate sandboxes. Each sandbox now maintains its own callId counter, passed through the spy/stub/fake creation chain via a context object.

    Fixes #2472

Released by Morgan Roderick on 2026-07-20.

Commits
  • ab289e9 22.1.0
  • bb3b75a chore: remove Jekyll steps from version hook
  • bb38f25 chore: run docs tests in preversion hook
  • d36e921 fix: let returns override returnsArg
  • 11db213 ci: run docs tests on every PR (#2746)
  • 40c4caa fix: align restoreObject docs test with idempotent behavior (#2745)
  • 5ccb7fd build(deps): bump the action-deps group with 4 updates (#2744)
  • a68dac1 fix: throw a clear error when throwArg index equals the argument count (#2743)
  • 9ea504e feat: make sinon.restoreObject idempotent (#2737)
  • cf5d9e8 fix: remove dead link and exclude code example URLs from link check
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
⬆ Bump the bun-packages group with 6 updates
0972c75 
Bumps the bun-packages group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [p-map](https://github.com/sindresorhus/p-map) | `7.0.5` | `7.0.6` |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.41.0` | `5.46.0` |
| [toml](https://github.com/BinaryMuse/toml-node) | `4.3.0` | `5.0.0` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.3` | `2.5.5` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.1.0` |
| [sinon](https://github.com/sinonjs/sinon) | `22.0.0` | `22.1.0` |


Updates `p-map` from 7.0.5 to 7.0.6
- [Release notes](https://github.com/sindresorhus/p-map/releases)
- [Commits](sindresorhus/p-map@v7.0.5...v7.0.6)

Updates `posthog-node` from 5.41.0 to 5.46.0
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.46.0/packages/node)

Updates `toml` from 4.3.0 to 5.0.0
- [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md)
- [Commits](BinaryMuse/toml-node@v4.3.0...v5.0.0)

Updates `@biomejs/biome` from 2.5.3 to 2.5.5
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.5/packages/@biomejs/biome)

Updates `lint-staged` from 17.0.8 to 17.1.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.0.8...v17.1.0)

Updates `sinon` from 22.0.0 to 22.1.0
- [Release notes](https://github.com/sinonjs/sinon/releases)
- [Changelog](https://github.com/sinonjs/sinon/blob/main/CHANGES.md)
- [Commits](sinonjs/sinon@v22.0.0...v22.1.0)

---
updated-dependencies:
- dependency-name: p-map
  dependency-version: 7.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: posthog-node
  dependency-version: 5.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-packages
- dependency-name: toml
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bun-packages
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: lint-staged
  dependency-version: 17.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-packages
- dependency-name: sinon
  dependency-version: 22.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 28, 2026
@github-actions github-actions Bot added the internal Internal changes label Jul 28, 2026
@savannahostrowski
savannahostrowski merged commit a383a1e into main Jul 28, 2026
15 checks passed
@savannahostrowski
savannahostrowski deleted the dependabot/bun/bun-packages-bb4605162b branch July 28, 2026 16:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file internal Internal changes javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@savannahostrowski