chore(deps): update all non-major dependencies

[github-actions]

This PR contains the following updates:

Package Updates Summary

Type	Count
📦 NPM Packages	13
Total	13

📦 npm Dependencies

13 packages will be updated

Package	Change	Age	Adoption	Passing	Confidence
@stacksjs/bunpress (source)	0.1.4 -> 0.2.21
@types/bun (source)	1.3.13 -> 1.4.3
buddy-bot (source)	0.9.19 -> 0.10.5
esbuild (source)	0.27.7 -> 0.28.2
oxc-parser (source)	0.121.0 -> 0.155.0
oxc-transform (source)	0.121.0 -> 0.155.0
webpack (source)	5.106.2 -> 5.112.0
@stacksjs/bumpx (source)	0.2.6 -> 0.2.25
@stacksjs/gitlint (source)	0.1.5 -> 0.1.8
@stacksjs/logsmith (source)	0.2.1 -> 0.2.14
bun-git-hooks (source)	0.3.1 -> 0.3.3
bunfig (source)	0.15.11 -> 0.15.21
pickier (source)	0.1.28 -> 0.1.74

---

Release Notes

stacksjs/bunpress (@stacksjs/bunpress)

0.1.4 -> 0.2.21

v0.2.21

Compare Source

Released by github-actions[bot] on 10/17/2026

v0.2.20

Compare Source

Released by github-actions[bot] on 10/17/2026

v0.2.19

Compare Source

Released by github-actions[bot] on 10/11/2026

DefinitelyTyped/DefinitelyTyped (@types/bun)

1.3.13 -> 1.4.3

Compare Source

TypeScript definitions for bun

📖 View Release Notes

🔗 View Changelog

Release Notes

Changelog

stacksjs/buddy-bot (buddy-bot)

0.9.19 -> 0.10.5

v0.10.5

Compare Source

Compare changes

⚡ Performance Improvements

• ai: make the Anthropic SDK an optional peer, resolved on first use (a316c78) (by Chris chrisbreuer93@gmail.com)

🔧 Chores

• release v0.10.5 (7111ccd) (by Chris chris@stacksjs.com)

Contributors

• Chris chris@stacksjs.com

Released by github-actions[bot] on 8/19/2026

v0.9.27

Compare Source

Released by github-actions[bot] on 8/8/2026

v0.9.26

Compare Source

Released by github-actions[bot] on 8/8/2026

evanw/esbuild (esbuild)

0.27.7 -> 0.28.2

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but no...

[View full release notes]

Released by github-actions[bot] on 8/8/2026

v0.28.1

Compare Source

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to [dellalibera](https://github.com/dellalibera) for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if ...

[View full release notes]

Released by github-actions[bot] on 6/11/2026

v0.28.0

Compare Source

• Add support for with { type: 'text' } imports (#4435)

  The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

  import string from './example.txt' with { type: 'text' }
  console.log(string)

• Add integrity checks to fallback download path (#4343)

  Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the re...

[View full release notes]

Released by github-actions[bot] on 4/2/2026

oxc-project/oxc (oxc-parser)

0.121.0 -> 0.155.0

oxlint_v1.89.0

Compare Source

💥 BREAKING CHANGES

• e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
• a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

• 770ada4 linter: Mark vue 3 rules as recommended (#27717) (Cam McHenry)
• ba38c1d linter: Mark react/react-hooks rules as recommended (#27701) (Cam McHenry)
• d85a3ba linter: Mark promise rules as recommended (#27693) (Cam McHenry)
• e71c88a linter: Mark node rule as recommended (#27692) (Cam McHenry)
• 7213f61 linter: Mark nextjs rules as recommended (#27691) (Cam McHenry)
• d7c6b26 linter: Mark jsx-a11y rules as recommended (#27690) (Cam McHenry)
• 199dfdc linter: Mark jsdoc rules as recommended (#27689) (Cam McHenry)
• 780bff3 linter: Mark jest/vitest rules as recommended (#27672) (Cam McHenry)
• 6ae6859 linter: Mark import rules as recommended (#27671) (Cam McHenry)
• b7a1df3 linter: Mark unicorn rules as recommended (`chore(deps): update dependency actions/cache to v5.0.3 #2767...

[View full release notes]

Released by github-actions[bot] on 10/19/2026

oxfmt_v0.74.0

Compare Source

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with ...

[View full release notes]

Released by github-actions[bot] on 10/19/2026

crates_v0.155.0

Compare Source

💥 BREAKING CHANGES

• c7d229b transformer: [BREAKING] Decode JSX entities to lone surrogates (#26712) (Dunqing)
• e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
• a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

• 7bb2697 minifier: Minimize array join expression (#27905) (Armano)
• 5d91db8 ast: Generate node ID setters for enums (#27500) (camc314)
• 6b5057b minifier: Add de morgan optimization for void expressions (#27375) (Armano)

🐛 Bug Fixes

• ce6a088 minifier: Fold string indices by UTF-16 code unit (#27096) (Dunqing)
• 7c47246 linter: Check module specifiers and string values that contain lone surrogates (#26717) (Dunqing)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• bd37e78 ecmascript: Look through sequence expre...

[View full release notes]

Released by github-actions[bot] on 10/19/2026

oxc-project/oxc (oxc-transform)

0.121.0 -> 0.155.0

oxlint_v1.89.0

Compare Source

💥 BREAKING CHANGES

• e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
• a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

• 770ada4 linter: Mark vue 3 rules as recommended (#27717) (Cam McHenry)
• ba38c1d linter: Mark react/react-hooks rules as recommended (#27701) (Cam McHenry)
• d85a3ba linter: Mark promise rules as recommended (#27693) (Cam McHenry)
• e71c88a linter: Mark node rule as recommended (#27692) (Cam McHenry)
• 7213f61 linter: Mark nextjs rules as recommended (#27691) (Cam McHenry)
• d7c6b26 linter: Mark jsx-a11y rules as recommended (#27690) (Cam McHenry)
• 199dfdc linter: Mark jsdoc rules as recommended (#27689) (Cam McHenry)
• 780bff3 linter: Mark jest/vitest rules as recommended (#27672) (Cam McHenry)
• 6ae6859 linter: Mark import rules as recommended (#27671) (Cam McHenry)
• b7a1df3 linter: Mark unicorn rules as recommended (`chore(deps): update dependency actions/cache to v5.0.3 #2767...

[View full release notes]

Released by github-actions[bot] on 10/19/2026

oxfmt_v0.74.0

Compare Source

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with ...

[View full release notes]

Released by github-actions[bot] on 10/19/2026

crates_v0.155.0

Compare Source

💥 BREAKING CHANGES

• c7d229b transformer: [BREAKING] Decode JSX entities to lone surrogates (#26712) (Dunqing)
• e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
• a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

• 7bb2697 minifier: Minimize array join expression (#27905) (Armano)
• 5d91db8 ast: Generate node ID setters for enums (#27500) (camc314)
• 6b5057b minifier: Add de morgan optimization for void expressions (#27375) (Armano)

🐛 Bug Fixes

• ce6a088 minifier: Fold string indices by UTF-16 code unit (#27096) (Dunqing)
• 7c47246 linter: Check module specifiers and string values that contain lone surrogates (#26717) (Dunqing)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• bd37e78 ecmascript: Look through sequence expre...

[View full release notes]

Released by github-actions[bot] on 10/19/2026

webpack/webpack (webpack)

5.106.2 -> 5.112.0

v5.112.0

Compare Source

Minor Changes

• Apply plugins set on a multi-configuration array to the MultiCompiler. (by [alexander-akait](https://github.com/alexander-akait) in #22702)

• Add optimization.minimize.css.dropOverriddenDeclarations, dropping a declaration a later one overrides where no target is named. (by [alexander-akait](https://github.com/alexander-akait) in #22175)

• Export more plugins under their scope, move eleven loose exports under theirs, deprecate the old, and expose template.DependencyTemplate, module.NullFactory and util.makeSerializable. (by [alexander-akait](https://github.com/alexander-akait) in #22261)

• Let util.makeSerializable take several requests, current one first. (by [alexander-akait](https://github.com/alexander-akait) ...

[View full release notes]

Released by github-actions[bot] on 10/15/2026

v5.111.1

Compare Source

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by [alexander-akait](https://github.com/alexander-akait) in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by [aryanraj45](https://github.com/aryanraj45) in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by [aryanraj45](https://github.com/aryanraj45) in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by [alexander-akait](https://github.com/alexander-akait) in #22154)

• Follow HTML template form and frameset rules during tree construction. (by [dependabot](https://github.com/apps/dependabot) in [#22129]...

[View full release notes]

Released by github-actions[bot] on 9/18/2026

v5.111.0

Compare Source

Minor Changes

• Enable output.module by default with futureDefaults on ESM-capable targets. (by [alexander-akait](https://github.com/alexander-akait) in #22088)

• Remove experiments.outputModule, set output.module to emit ESM instead. (by [alexander-akait](https://github.com/alexander-akait) in #22011)

• Add output.copy to copy files and directories into the output directory. (by [alexander-akait](https://github.com/alexander-akait) in #21938)

• Accept a file URL in any spelling Node reads where an absolute path is taken. (by [alexander-akait](https://github.com/alexander-akait) in #22012)

• Minify inline CSS and JSON via renderEmbeddedSource, exporting webpack's own. (by [[alexander-akait](https://git...

[View full release notes]

Released by github-actions[bot] on 9/14/2026

stacksjs/bumpx (@stacksjs/bumpx)

0.2.6 -> 0.2.25

v0.2.25

Compare Source

Released by github-actions[bot] on 10/19/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 7/22/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 7/22/2026

stacksjs/gitlint (@stacksjs/gitlint)

0.1.5 -> 0.1.8

v0.1.8

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.1.7

Compare Source

Released by github-actions[bot] on 7/22/2026

v0.x.x

Compare Source

Released by github-actions[bot] on 5/8/2026

stacksjs/logsmith (@stacksjs/logsmith)

0.2.1 -> 0.2.14

v0.2.14

Compare Source

Compare changes

🐛 Bug Fixes

• release: generate the changelog ourselves, not through bumpx (aaa65a5) (by glennmichael123 gtorregosa@gmail.com)

🧹 Chores

• release v0.2.14 (f348cbc) (by glennmichael123 gtorregosa@gmail.com)
• changelog for v0.2.13 (1c758c0) (by glennmichael123 gtorregosa@gmail.com)
• add the v0.2.13 changelog entry bumpx failed to write (bccd461) (by glennmichael123 gtorregosa@gmail.com)

📄 Miscellaneous

• Revert "chore: changelog for v0.2.13" (0965117) (by glennmichael123 gtorregosa@gmail.com)

Contributors

• glennmichael123 gtorregosa@gmail.com

Released by github-actions[bot] on 10/8/2026

v0.2.13

Compare Source

Compare changes

🐛 Bug Fixes

• parser: a hex colour is not an issue, and a cross-repo ref keeps its owner (fbcc297) (by glennmichael123 gtorregosa@gmail.com) (#3402)

🧹 Chores

• release v0.2.13 (5746d89) (by glennmichael123 gtorregosa@gmail.com)

Contributors

• glennmichael123 gtorregosa@gmail.com

Released by github-actions[bot] on 10/7/2026

v0.2.12

Compare Source

Released by github-actions[bot] on 10/3/2026

stacksjs/bun-git-hooks (bun-git-hooks)

0.3.1 -> 0.3.3

v0.3.3

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.3.2

Compare Source

Released by github-actions[bot] on 5/14/2026

stacksjs/bunfig (bunfig)

0.15.11 -> 0.15.21

v0.15.21

Compare Source

Released by github-actions[bot] on 10/18/2026

v0.15.20

Compare Source

Released by github-actions[bot] on 10/18/2026

v0.15.19

Compare Source

Released by github-actions[bot] on 8/19/2026

pickier/pickier (pickier)

0.1.28 -> 0.1.74

v0.1.73

Compare Source

Released by github-actions[bot] on 10/17/2026

v0.1.72

Compare Source

Released by github-actions[bot] on 10/15/2026

v0.1.71

Compare Source

Released by github-actions[bot] on 10/11/2026

---

📊 Package Statistics

• @stacksjs/bunpress: 58,671 weekly downloads
• @types/bun: 10,856,605 weekly downloads
• buddy-bot: 22,993 weekly downloads
• esbuild: 184,305,627 weekly downloads
• oxc-parser: 37,080,958 weekly downloads
• oxc-transform: 3,650,022 weekly downloads
• webpack: 31,412,656 weekly downloads
• @stacksjs/bumpx: 37,516 weekly downloads
• @stacksjs/gitlint: 26,490 weekly downloads
• @stacksjs/logsmith: 25,327 weekly downloads
• bun-git-hooks: 31,836 weekly downloads
• bunfig: 71,247 weekly downloads
• pickier: 49,440 weekly downloads

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Buddy 🤖

[netlify]

❌ Deploy Preview for dtsx failed. Why did it fail? →

Name	Link
🔨 Latest commit	4963892
🔍 Latest deploy log	https://app.netlify.com/projects/dtsx/deploys/6ad6a81524d6d64146b19251