chore(deps): update all non-major dependencies

[github-actions]

This PR contains the following updates:

Package Updates Summary

Type	Count
📦 NPM Packages	14
Total	14

📦 npm Dependencies

14 packages will be updated

Package	Change	Age	Adoption	Passing	Confidence
esbuild (source)	0.27.7 -> 0.28.1
oxc-parser (source)	0.121.0 -> 0.138.0
oxc-transform (source)	0.121.0 -> 0.138.0
webpack (source)	5.106.2 -> 5.108.3
@stacksjs/bumpx (source)	0.2.4 -> 0.2.6
@stacksjs/bunpress (source)	0.1.4 -> 0.1.10
@stacksjs/clapp (source)	0.2.7 -> 0.2.10
@stacksjs/gitlint (source)	0.1.5 -> 0.1.6
@stacksjs/logsmith (source)	0.2.1 -> 0.2.3
@types/bun (source)	1.3.13 -> 1.3.14
buddy-bot (source)	0.9.19 -> 0.9.20
bun-git-hooks (source)	0.3.1 -> 0.3.2
bunfig (source)	0.15.11 -> 0.15.14
pickier (source)	0.1.28 -> 0.1.36

---

Release Notes

evanw/esbuild (esbuild)

0.27.7 -> 0.28.1

v0.28.1

Compare Source

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to [dellalibera](https://github.com/dellalibera) for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if ...

[View full release notes]

Released by github-actions[bot] on 6/11/2026

v0.28.0

Compare Source

• Add support for with { type: 'text' } imports (#4435)

  The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

  import string from './example.txt' with { type: 'text' }
  console.log(string)

• Add integrity checks to fallback download path (#4343)

  Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the re...

[View full release notes]

Released by github-actions[bot] on 4/2/2026

oxc-project/oxc (oxc-parser)

0.121.0 -> 0.138.0

crates_v0.138.0

Compare Source

💥 BREAKING CHANGES

• 94fbacb ast: [BREAKING] Only export AstBuilder and NONE in builder module (#23876) (overlookmotel)
• 8de5122 ecmascript: [BREAKING] Switch to new AstBuilder (#23834) (overlookmotel)
• dc0ef38 transformer: [BREAKING] Switch to new AstBuilder (#23831) (overlookmotel)
• 88f4455 str: [BREAKING] Str and Ident methods take &GetAllocator (#23781) (overlookmotel)
• 36009dd allocator: [BREAKING] GetAllocator::allocator take &self (#23676) (overlookmotel)
• bd74f9d allocator: [BREAKING] Rename AllocatorAccessor trait to GetAllocator (#23675) (overlookmotel)

🚀 Features

• 326fe25 transformer_plugins: Support typeof define keys (#23605) (Alexander Lichter)
• f2091b3 ast: Unify old and new AstBuilders (#23875) (overlookmotel)
• cd1fd12 codegen: Expose Codegen::print_string API (#23785) (camc314)
• 785461b ast: Add custom builder methods to AST types (#23651) (overlookmotel)
• 05d1357 ast: Ad...

[View full release notes]

Released by github-actions[bot] on 6/29/2026

apps_v1.71.0

Compare Source

Table of Contents

• Oxlint v1.71.0
• Oxfmt v0.56.0

Oxlint v1.71.0

🚀 Features

• ff65285 linter: no-restricted-globals add missing upstream options (#23663) (Sysix)
• 7b8bd89 linter/typescript: Implement suggestion for no-unnecessary-type-constraint rule (#23646) (Mikhail Baev)
• 0dc2405 linter: Add schema for eslint/no-restricted-properties (#23619) (Sysix)
• b638d0e linter: Add schema for node/callback-return (#23615) (Sysix)
• eb8bedc linter: Add schema for import/extensions (#23557) (WaterWhisperer)
• 46f3625 linter: Implement node/no-sync rule (#23589) (fujitani sora)
• b01739a linter: Add schema for unicorn/numeric-separators-style (#23554) (Mikhail Baev)
• 68afd2a linter/node: Implement no-mixed-requires rule (#23539) (fujitani sora)
• 59d8893 linter: unicorn/numeric-separators-style support missing options (#23524) (Sysix)
• a421215 linter: Add schema for eslint/prefer-destructuring (#23410)...

[View full release notes]

Released by github-actions[bot] on 6/22/2026

crates_v0.137.0

Compare Source

💥 BREAKING CHANGES

• 7a76cd3 estree: [BREAKING] Make whether to include TS fields a runtime option (#23574) (overlookmotel)
• e7b6b68 estree: [BREAKING] ESTree config use methods not consts (#23573) (overlookmotel)

🚀 Features

• 556cc6d data_structures: Add CodeBuffer::as_str method (#23571) (overlookmotel)
• 38c4b06 parser: Add friendly error for adjacent JSX elements (#23378) (sapphi-red)
• 53509a8 minifier: Treeshake pure typed arrays and Set/Map array literals (#23469) (Dunqing)
• 09762d9 minifier: Inline const value for read-only vars (#22593) (Dunqing)

🐛 Bug Fixes

• 20375f9 react_compiler: Keep imports referenced only by a computed key (#23586) (Boshen)
• 31bfd9b minifier: Keep Object introspection calls on a possible Proxy (#23483) (Dunqing)
• 837a395 parser: Treat a line comment after ':' as leading, not trailing (#23515) (Dunqing)
• e409fe0 minifier: Keep new Map/WeakSet/WeakMap with a string argument (#23470) (Dunqing)
  ...

[View full release notes]

Released by github-actions[bot] on 6/18/2026

oxc-project/oxc (oxc-transform)

0.121.0 -> 0.138.0

crates_v0.138.0

Compare Source

💥 BREAKING CHANGES

• 94fbacb ast: [BREAKING] Only export AstBuilder and NONE in builder module (#23876) (overlookmotel)
• 8de5122 ecmascript: [BREAKING] Switch to new AstBuilder (#23834) (overlookmotel)
• dc0ef38 transformer: [BREAKING] Switch to new AstBuilder (#23831) (overlookmotel)
• 88f4455 str: [BREAKING] Str and Ident methods take &GetAllocator (#23781) (overlookmotel)
• 36009dd allocator: [BREAKING] GetAllocator::allocator take &self (#23676) (overlookmotel)
• bd74f9d allocator: [BREAKING] Rename AllocatorAccessor trait to GetAllocator (#23675) (overlookmotel)

🚀 Features

• 326fe25 transformer_plugins: Support typeof define keys (#23605) (Alexander Lichter)
• f2091b3 ast: Unify old and new AstBuilders (#23875) (overlookmotel)
• cd1fd12 codegen: Expose Codegen::print_string API (#23785) (camc314)
• 785461b ast: Add custom builder methods to AST types (#23651) (overlookmotel)
• 05d1357 ast: Ad...

[View full release notes]

Released by github-actions[bot] on 6/29/2026

apps_v1.71.0

Compare Source

Table of Contents

• Oxlint v1.71.0
• Oxfmt v0.56.0

Oxlint v1.71.0

🚀 Features

• ff65285 linter: no-restricted-globals add missing upstream options (#23663) (Sysix)
• 7b8bd89 linter/typescript: Implement suggestion for no-unnecessary-type-constraint rule (#23646) (Mikhail Baev)
• 0dc2405 linter: Add schema for eslint/no-restricted-properties (#23619) (Sysix)
• b638d0e linter: Add schema for node/callback-return (#23615) (Sysix)
• eb8bedc linter: Add schema for import/extensions (#23557) (WaterWhisperer)
• 46f3625 linter: Implement node/no-sync rule (#23589) (fujitani sora)
• b01739a linter: Add schema for unicorn/numeric-separators-style (#23554) (Mikhail Baev)
• 68afd2a linter/node: Implement no-mixed-requires rule (#23539) (fujitani sora)
• 59d8893 linter: unicorn/numeric-separators-style support missing options (#23524) (Sysix)
• a421215 linter: Add schema for eslint/prefer-destructuring (#23410)...

[View full release notes]

Released by github-actions[bot] on 6/22/2026

crates_v0.137.0

Compare Source

💥 BREAKING CHANGES

• 7a76cd3 estree: [BREAKING] Make whether to include TS fields a runtime option (#23574) (overlookmotel)
• e7b6b68 estree: [BREAKING] ESTree config use methods not consts (#23573) (overlookmotel)

🚀 Features

• 556cc6d data_structures: Add CodeBuffer::as_str method (#23571) (overlookmotel)
• 38c4b06 parser: Add friendly error for adjacent JSX elements (#23378) (sapphi-red)
• 53509a8 minifier: Treeshake pure typed arrays and Set/Map array literals (#23469) (Dunqing)
• 09762d9 minifier: Inline const value for read-only vars (#22593) (Dunqing)

🐛 Bug Fixes

• 20375f9 react_compiler: Keep imports referenced only by a computed key (#23586) (Boshen)
• 31bfd9b minifier: Keep Object introspection calls on a possible Proxy (#23483) (Dunqing)
• 837a395 parser: Treat a line comment after ':' as leading, not trailing (#23515) (Dunqing)
• e409fe0 minifier: Keep new Map/WeakSet/WeakMap with a string argument (#23470) (Dunqing)
  ...

[View full release notes]

Released by github-actions[bot] on 6/18/2026

webpack/webpack (webpack)

5.106.2 -> 5.108.3

v5.108.3

Compare Source

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by [alexander-akait](https://github.com/alexander-akait) in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by [xiaoxiaojx](https://github.com/xiaoxiaojx) in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by [alexander-akait](https://github.com/alexander-akait) in #21303)

Released by github-actions[bot] on 6/29/2026

v5.108.2

Compare Source

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by [hai-x](https://github.com/hai-x) in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by [alexander-akait](https://github.com/alexander-akait) in #21286)

Released by github-actions[bot] on 6/29/2026

v5.108.1

Compare Source

Patch Changes

• Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by [xiaoxiaojx](https://github.com/xiaoxiaojx) in #21280)

• Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by [alexander-akait](https://github.com/alexander-akait) in #21269)

Released by github-actions[bot] on 6/26/2026

stacksjs/bumpx (@stacksjs/bumpx)

0.2.4 -> 0.2.6

v0.2.6

Compare Source

Released by github-actions[bot] on 5/4/2026

v0.2.5

Compare Source

Released by github-actions[bot] on 4/26/2026

stacksjs/bunpress (@stacksjs/bunpress)

0.1.4 -> 0.1.10

v0.1.10

Compare Source

Released by github-actions[bot] on 6/29/2026

v0.1.6

Compare Source

Released by github-actions[bot] on 5/24/2026

v0.1.5

Compare Source

Released by github-actions[bot] on 5/10/2026

stacksjs/clapp (@stacksjs/clapp)

0.2.7 -> 0.2.10

v0.2.10

Compare Source

Released by github-actions[bot] on 5/14/2026

v0.2.9

Compare Source

Released by github-actions[bot] on 5/11/2026

v0.2.8

Compare Source

Released by github-actions[bot] on 5/6/2026

stacksjs/gitlint (@stacksjs/gitlint)

0.1.5 -> 0.1.6

v0.x.x

Compare Source

Released by github-actions[bot] on 5/8/2026

stacksjs/logsmith (@stacksjs/logsmith)

0.2.1 -> 0.2.3

v0.2.3

Compare Source

Released by github-actions[bot] on 5/27/2026

DefinitelyTyped/DefinitelyTyped (@types/bun)

1.3.13 -> 1.3.14

Compare Source

TypeScript definitions for bun

📖 View Release Notes

🔗 View Changelog

Release Notes

Changelog

stacksjs/buddy-bot (buddy-bot)

0.9.19 -> 0.9.20

v0.9.20

Compare Source

Released by github-actions[bot] on 5/25/2026

v0.9.9

Compare Source

Released by github-actions[bot] on 10/15/2025

v0.9.8

Compare Source

Released by github-actions[bot] on 10/7/2025

stacksjs/bun-git-hooks (bun-git-hooks)

0.3.1 -> 0.3.2

v0.3.2

Compare Source

Released by github-actions[bot] on 5/14/2026

stacksjs/bunfig (bunfig)

0.15.11 -> 0.15.14

v0.15.14

Compare Source

Released by github-actions[bot] on 6/10/2026

v0.15.13

Compare Source

Released by github-actions[bot] on 5/8/2026

v0.15.12

Compare Source

Released by github-actions[bot] on 5/8/2026

pickier/pickier (pickier)

0.1.28 -> 0.1.36

v0.1.36

Compare Source

Released by github-actions[bot] on 6/27/2026

v0.1.35

Compare Source

Released by github-actions[bot] on 6/10/2026

v0.1.34

Compare Source

Released by github-actions[bot] on 6/9/2026

---

📊 Package Statistics

• esbuild: 237,969,557 weekly downloads
• oxc-parser: 20,404,253 weekly downloads
• oxc-transform: 4,081,022 weekly downloads
• webpack: 49,468,822 weekly downloads
• @stacksjs/bumpx: 57,408 weekly downloads
• @stacksjs/bunpress: 57,073 weekly downloads
• @stacksjs/clapp: 62,153 weekly downloads
• @stacksjs/gitlint: 56,783 weekly downloads
• @stacksjs/logsmith: 56,780 weekly downloads
• @types/bun: 7,992,362 weekly downloads
• buddy-bot: 57,506 weekly downloads
• bun-git-hooks: 58,513 weekly downloads
• bunfig: 61,955 weekly downloads
• pickier: 49,695 weekly downloads

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Buddy 🤖

[netlify]

❌ Deploy Preview for dtsx failed. Why did it fail? →

Name	Link
🔨 Latest commit	c8adeec
🔍 Latest deploy log	https://app.netlify.com/projects/dtsx/deploys/6a42f167a00c5f00081a1c1f