chore(deps): update all non-major dependencies

[github-actions]

This PR contains the following updates:

Package Updates Summary

Type	Count
📦 NPM Packages	14
Total	14

📦 npm Dependencies

14 packages will be updated

Package	Change	Age	Adoption	Passing	Confidence
@stacksjs/bunpress (source)	0.1.4 -> 0.2.14
@types/bun (source)	1.3.13 -> 1.4.1
buddy-bot (source)	0.9.19 -> 0.10.5
esbuild (source)	0.27.7 -> 0.28.2
oxc-parser (source)	0.121.0 -> 0.148.0
oxc-transform (source)	0.121.0 -> 0.148.0
webpack (source)	5.106.2 -> 5.110.3
@stacksjs/bumpx (source)	0.2.6 -> 0.2.17
@stacksjs/clapp (source)	0.2.7 -> 0.2.15
@stacksjs/gitlint (source)	0.1.5 -> 0.1.8
@stacksjs/logsmith (source)	0.2.1 -> 0.2.11
bun-git-hooks (source)	0.3.1 -> 0.3.3
bunfig (source)	0.15.11 -> 0.15.19
pickier (source)	0.1.28 -> 0.1.65

---

Release Notes

stacksjs/bunpress (@stacksjs/bunpress)

0.1.4 -> 0.2.14

v0.2.14

Compare Source

Released by github-actions[bot] on 8/25/2026

v0.2.13

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.2.12

Compare Source

Released by github-actions[bot] on 8/19/2026

DefinitelyTyped/DefinitelyTyped (@types/bun)

1.3.13 -> 1.4.1

Compare Source

TypeScript definitions for bun

📖 View Release Notes

🔗 View Changelog

Release Notes

Changelog

stacksjs/buddy-bot (buddy-bot)

0.9.19 -> 0.10.5

v0.10.5

Compare Source

Compare changes

⚡ Performance Improvements

• ai: make the Anthropic SDK an optional peer, resolved on first use (a316c78) (by Chris [email protected])

🔧 Chores

• release v0.10.5 (7111ccd) (by Chris [email protected])

Contributors

• Chris [email protected]

Released by github-actions[bot] on 8/19/2026

v0.9.27

Compare Source

Released by github-actions[bot] on 8/8/2026

v0.9.26

Compare Source

Released by github-actions[bot] on 8/8/2026

evanw/esbuild (esbuild)

0.27.7 -> 0.28.2

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but no...

[View full release notes]

Released by github-actions[bot] on 8/8/2026

v0.28.1

Compare Source

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to [dellalibera](https://github.com/dellalibera) for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if ...

[View full release notes]

Released by github-actions[bot] on 6/11/2026

v0.28.0

Compare Source

• Add support for with { type: 'text' } imports (#4435)

  The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

  import string from './example.txt' with { type: 'text' }
  console.log(string)

• Add integrity checks to fallback download path (#4343)

  Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the re...

[View full release notes]

Released by github-actions[bot] on 4/2/2026

oxc-project/oxc (oxc-parser)

0.121.0 -> 0.148.0

crates_v0.148.0

Compare Source

💥 BREAKING CHANGES

• a31567a allocator: [BREAKING] Make Allocator::cursor_ptr and data_end_ptr private (#26081) (overlookmotel)

🚀 Features

• 115955d minifier: Drop cases whose condition is statically false (#26172) (Armano)
• 784e9fa minifier: Invert !0 and !1 in place for boolean context to 1 and 0 (#26050) (Armano)
• 1e902cc minifier: Expand fold leading assignments into the var decl (#26142) (Armano)
• 3ed4f6a minifier: Expand de morgan's optimization to allow move of ! (#25930) (Armano)
• 5672585 parser: Attach all comments to nodes (#25944) (camc314)

🐛 Bug Fixes

• a3d33dd semantic: Skip body bindings in type parameters and this param (#26169) (Dunqing)
• 4adfb4c semantic: Validate chained continue labels (#26157) (camc314)
• b874f48 ecmascript: Math.round only exact half ties (#26150) (camc314)
• a625378 minifier: Coerce omitted indexOf search argument (#26149) (camc314)
• dc7398b ecmascript: Trim trailing whitespace ...

[View full release notes]

Released by github-actions[bot] on 9/1/2026

apps_v1.81.0

Compare Source

Table of Contents

• Oxlint v1.81.0
• Oxfmt v0.66.0

Oxlint v1.81.0

🚀 Features

• 60b945d linter/nextjs/no-typos: Implement suggestion (#26091) (Mikhail Baev)

🐛 Bug Fixes

• 33ac4b0 linter/lsp: Prevent tsgolint from holding onto processes (#25570) (Adrian Schaedle)
• baf4b1e linter/import/no-empty-named-blocks: Make empty value import removal a suggestion (#26155) (camc314)
• 77cfaec linter/eslint/object-shorthand: Preserve __proto__ semantics (#26154) (camc314)
• fa3c082 linter/unicorn/prefer-set-size: Ignore shadowed Set constructors (#26153) (camc314)
• e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)
• d86c113 linter: Normalize reversed JS plugin locations (#26138) (camc314)
• 73c09b2 linter/eslint/no-use-before-define: Run on JS, JSX files (#26114) (camc314)
• 03ef0f2 linter/unicorn/no-useless-spread: Treat typed arrays as a distinct value hint (#26067) (Aadharsh Pannirselvam)
• bd1590...

[View full release notes]

Released by github-actions[bot] on 9/1/2026

crates_v0.147.0

Compare Source

🚀 Features

• b6e9e5e minifier: Fold switch stmt whose parent is not block stmt (#25403) (Armano)

🐛 Bug Fixes

• 8db1053 codegen: Require sourcemap for example (#26047) (camc314)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 6f0c7cf minifier: Avoid merging if to for in sloppy mode when containing function declaration (#25638) (sapphi-red)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 6c5ad1b codegen: Only add mapping names for PrivateIdentifiers which have changed (#25958) (overlookmotel)
• 2dad1e0 parser: Track irregular line terminators in trivia (#25947) (camc314)
• 58ba651 minifier: Avoid merging if to for when the body contains a function declaration (#25637) (sapphi-red)
• a185ac3 codegen: Print # before private identifier in TS signature key (#25938) (overlookmotel)
• af82a07 minifier: Keep unary + when the other operand has side effects (#25645) (Kotaro Chikuba)

⚡ Pe...

[View full release notes]

Released by github-actions[bot] on 8/24/2026

oxc-project/oxc (oxc-transform)

0.121.0 -> 0.148.0

crates_v0.148.0

Compare Source

💥 BREAKING CHANGES

• a31567a allocator: [BREAKING] Make Allocator::cursor_ptr and data_end_ptr private (#26081) (overlookmotel)

🚀 Features

• 115955d minifier: Drop cases whose condition is statically false (#26172) (Armano)
• 784e9fa minifier: Invert !0 and !1 in place for boolean context to 1 and 0 (#26050) (Armano)
• 1e902cc minifier: Expand fold leading assignments into the var decl (#26142) (Armano)
• 3ed4f6a minifier: Expand de morgan's optimization to allow move of ! (#25930) (Armano)
• 5672585 parser: Attach all comments to nodes (#25944) (camc314)

🐛 Bug Fixes

• a3d33dd semantic: Skip body bindings in type parameters and this param (#26169) (Dunqing)
• 4adfb4c semantic: Validate chained continue labels (#26157) (camc314)
• b874f48 ecmascript: Math.round only exact half ties (#26150) (camc314)
• a625378 minifier: Coerce omitted indexOf search argument (#26149) (camc314)
• dc7398b ecmascript: Trim trailing whitespace ...

[View full release notes]

Released by github-actions[bot] on 9/1/2026

apps_v1.81.0

Compare Source

Table of Contents

• Oxlint v1.81.0
• Oxfmt v0.66.0

Oxlint v1.81.0

🚀 Features

• 60b945d linter/nextjs/no-typos: Implement suggestion (#26091) (Mikhail Baev)

🐛 Bug Fixes

• 33ac4b0 linter/lsp: Prevent tsgolint from holding onto processes (#25570) (Adrian Schaedle)
• baf4b1e linter/import/no-empty-named-blocks: Make empty value import removal a suggestion (#26155) (camc314)
• 77cfaec linter/eslint/object-shorthand: Preserve __proto__ semantics (#26154) (camc314)
• fa3c082 linter/unicorn/prefer-set-size: Ignore shadowed Set constructors (#26153) (camc314)
• e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)
• d86c113 linter: Normalize reversed JS plugin locations (#26138) (camc314)
• 73c09b2 linter/eslint/no-use-before-define: Run on JS, JSX files (#26114) (camc314)
• 03ef0f2 linter/unicorn/no-useless-spread: Treat typed arrays as a distinct value hint (#26067) (Aadharsh Pannirselvam)
• bd1590...

[View full release notes]

Released by github-actions[bot] on 9/1/2026

crates_v0.147.0

Compare Source

🚀 Features

• b6e9e5e minifier: Fold switch stmt whose parent is not block stmt (#25403) (Armano)

🐛 Bug Fixes

• 8db1053 codegen: Require sourcemap for example (#26047) (camc314)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 6f0c7cf minifier: Avoid merging if to for in sloppy mode when containing function declaration (#25638) (sapphi-red)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 6c5ad1b codegen: Only add mapping names for PrivateIdentifiers which have changed (#25958) (overlookmotel)
• 2dad1e0 parser: Track irregular line terminators in trivia (#25947) (camc314)
• 58ba651 minifier: Avoid merging if to for when the body contains a function declaration (#25637) (sapphi-red)
• a185ac3 codegen: Print # before private identifier in TS signature key (#25938) (overlookmotel)
• af82a07 minifier: Keep unary + when the other operand has side effects (#25645) (Kotaro Chikuba)

⚡ Pe...

[View full release notes]

Released by github-actions[bot] on 8/24/2026

webpack/webpack (webpack)

5.106.2 -> 5.110.3

v5.110.3

Compare Source

Patch Changes

• Fix import() options, circular reexport severity and namespace writes. (by [alexander-akait](https://github.com/alexander-akait) in #21867)

• Skip ESM interop when require() targets a module outside the concatenation. (by [hai-x](https://github.com/hai-x) in #21884)

• Fix concatenated require() in a require.ensure callback or a computed request. (by [hai-x](https://github.com/hai-x) in #21907)

• Keep optimization.minimize a boolean; its options move to minimizeOptions. (by [alexander-akait](https://github.com/alexander-akait) in #21886)

• Fix mangled exports read through require() and a leaked internal reference. (by [alexander-akait](https://github.com/alexander-akait) ...

[View full release notes]

Released by github-actions[bot] on 9/1/2026

v5.110.2

Compare Source

Patch Changes

• Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by [alexander-akait](https://github.com/alexander-akait) in #21851)

• Minify more HTML and CSS shorthands, and cut two costs off printing. (by [alexander-akait](https://github.com/alexander-akait) in #21842)

• Report a named import that is never read when it names a missing export. (by [alexander-akait](https://github.com/alexander-akait) in #21856)

• Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by [alexander-akait](https://github.com/alexander-akait) in #21852)

• Stop output.html emitting an unused JS chunk for each generated page. (by [[alexander-akait](https://github.com/alexander-akai...

[View full release notes]

Released by github-actions[bot] on 8/30/2026

v5.110.1

Compare Source

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by [alexander-akait](https://github.com/alexander-akait) in #21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by [alexander-akait](https://github.com/alexander-akait) in #21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by [AgentEnder](https://github.com/AgentEnder) in #21845)

Released by github-actions[bot] on 8/27/2026

stacksjs/bumpx (@stacksjs/bumpx)

0.2.6 -> 0.2.17

v0.2.17

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 7/22/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 7/22/2026

stacksjs/clapp (@stacksjs/clapp)

0.2.7 -> 0.2.15

v0.2.15

Compare Source

Released by github-actions[bot] on 8/28/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 5/11/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 5/6/2026

stacksjs/gitlint (@stacksjs/gitlint)

0.1.5 -> 0.1.8

v0.1.8

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.1.7

Compare Source

Released by github-actions[bot] on 7/22/2026

v0.x.x

Compare Source

Released by github-actions[bot] on 5/8/2026

stacksjs/logsmith (@stacksjs/logsmith)

0.2.1 -> 0.2.11

v0.2.11

Compare Source

Released by github-actions[bot] on 7/28/2026

v0.2.10

Compare Source

Released by github-actions[bot] on 7/28/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 7/26/2026

stacksjs/bun-git-hooks (bun-git-hooks)

0.3.1 -> 0.3.3

v0.3.3

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.3.2

Compare Source

Released by github-actions[bot] on 5/14/2026

stacksjs/bunfig (bunfig)

0.15.11 -> 0.15.19

v0.15.19

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.15.18

Compare Source

Released by github-actions[bot] on 8/19/2026

v0.15.17

Compare Source

Released by github-actions[bot] on 7/31/2026

pickier/pickier (pickier)

0.1.28 -> 0.1.65

v0.1.65

Compare Source

Released by github-actions[bot] on 8/23/2026

v0.1.64

Compare Source

Released by github-actions[bot] on 8/23/2026

v0.1.63

Compare Source

Released by github-actions[bot] on 8/23/2026

---

📊 Package Statistics

• @stacksjs/bunpress: 77,770 weekly downloads
• @types/bun: 12,410,157 weekly downloads
• buddy-bot: 52,539 weekly downloads
• esbuild: 275,165,454 weekly downloads
• oxc-parser: 47,887,056 weekly downloads
• oxc-transform: 4,984,063 weekly downloads
• webpack: 56,430,458 weekly downloads
• @stacksjs/bumpx: 55,538 weekly downloads
• @stacksjs/clapp: 73,712 weekly downloads
• @stacksjs/gitlint: 50,893 weekly downloads
• @stacksjs/logsmith: 52,429 weekly downloads
• bun-git-hooks: 51,446 weekly downloads
• bunfig: 89,630 weekly downloads
• pickier: 62,072 weekly downloads

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Buddy 🤖

[netlify]

❌ Deploy Preview for dtsx failed. Why did it fail? →

Name	Link
🔨 Latest commit	dda8384
🔍 Latest deploy log	https://app.netlify.com/projects/dtsx/deploys/6a9b13af50046000086e6f34