Skip to content

chore(deps): update backend dependencies (major)#1818

Open
ggrossetie wants to merge 1 commit intomasterfrom
renovate/major-backend-dependencies
Open

chore(deps): update backend dependencies (major)#1818
ggrossetie wants to merge 1 commit intomasterfrom
renovate/major-backend-dependencies

Conversation

@ggrossetie
Copy link
Collaborator

@ggrossetie ggrossetie commented Nov 27, 2025

This PR contains the following updates:

Package Type Update Change
bcryptjs dependencies major ^2.4.3 -> ^3.0.0
c8 devDependencies major ~10.1 -> ~11.0.0
css-tree dependencies major ^2.3.1 -> ^3.0.0
dotenv dependencies major ^16.4.5 -> ^17.0.0
eslint (source) devDependencies major ~9.39 -> ~10.0.0
eslint-plugin-security devDependencies major ~3.0 -> ~4.0.0
jsdom dependencies major ^21.0.0 -> ^28.0.0

Release Notes

dcodeIO/bcrypt.js (bcryptjs)

v3.0.3

Compare Source

Bug fixes
  • Always yield to event loop before nextTick for async versions (#​164) (1211e9a)

v3.0.2

Compare Source

Bug fixes
  • Use upstream fix to emit interop helpers (28e5103)

v3.0.1

Compare Source

Bug fixes
  • Separate ESM and UMD type definitions (e7055ca)

v3.0.0

Compare Source

Breaking changes
  • Modernize project structure (2f45985)
    The project now exports an ECMAScript module by default, albeit with an UMD fallback, ships with types, the dist/ directory no longer exists in version control, and Closure Compiler externs have been removed.
  • Generate 2b hashes by default (d36bfb4)
    This library was not affected by the bug that led to incrementing the bcrypt version from 2a to 2b, but nowadays most implementations use 2b, including the native bcrypt binding, so this change aligns with them. Existing hashes will continue to work, but test logic that generates hashes and compares them literally might need to be updated to account for the new default.
Features
  • Add helper to check for password input length (d5656b3)
Other
  • Update publish workflow (2a9bea9)
  • Add note on using the ESM variant in the browser (e09eb9a)
  • Update types (58333a1)
  • Merge lint and test workflows (2e3b176)
  • Fix tests (ec02e8a)
  • Update legacy fallback to handle crypto dependency (9db275f)
  • Update lint workflow title (ac70ac5)
  • Adapt crypto module usage for ESM environments (574d690)
  • Format with prettier (e746547)
  • Rename default branch to 'main' (548559d)
  • Update description to mention TypeScript support (4977df0)
  • Add stale action for issues and PRs (a84d4e4)
  • Fix typo (c8c9c01)
  • Fix Node.js version in CI (1b54cc4)
Backlog from v2
  • Added externs to .npmignore (#​124) (7e2e93a)
    The npm package does not need externs as it is needed only for closure compiler. Added it in .npmignore since bcryptjs overrides global module and process in WebStorm IDE.
  • Make sure the bin script uses LF (684fac6)
  • Post-merge; Clean up a bit (b09f7f2)
  • Improve safeStringCompare using xor (#​77) (648482a)
  • Added bin entry (49a1d1a)
bcoe/c8 (c8)

v11.0.0

Compare Source

⚠ BREAKING CHANGES
  • deps: transitive deps require 20 || >=22
Bug Fixes
csstree/csstree (css-tree)

v3.1.0

Compare Source

  • Added support for boolean expression multiplier in syntax definition, i.e. <boolean-expr[ test ]> (#​304)
  • Added source, startOffset, startLine, and startColumn parameters to OffsetToLocation constructor, eliminating the need to call setSource() after creating a new OffsetToLocation instance
  • Exposed OffsetToLocation class in the main entry point, which was previously accessible only via css-tree/tokenizer
  • Fixed Raw node value consumption by ignoring stop tokens inside blocks, resolving an issue where Raw value consumption stopped prematurely. This fix also enables parsing of functions whose content includes stop characters (e.g., semicolons and curly braces) within declaration values, aligning with the latest draft of CSS Values and Units Module Level 5.
  • Fixed TokenStream#balance computation to handle unmatched brackets correctly. Previously, when encountering a closing bracket, the TokenStream would prioritize it over unmatched opening brackets, leading to improper parsing. For example, the parser would incorrectly consume the declaration value of .a { prop: ([{); } as ([{) instead of consuming it until all opened brackets were closed (([{); }). Now, unmatched closing brackets are discarded unless they match the most recent opening bracket on the stack. This change aligns CSSTree with CSS specifications and browser behavior.
  • Fixed syntax definition parser to allow a token to be followed by a multiplier (#​303)
  • Fixed location for Layer node (#​310)
  • Bumped mdn/data to 2.12.2

v3.0.1

Compare Source

  • Bumped mdn/data to 2.12.1
  • Added errors array to the Lexer#validate() method result, providing details on problematic syntax.
  • Added CSS wide keyword customization and introspection:
    • Added a Lexer#cssWideKeywords dictionary to list CSS-wide keywords
    • Updated the Lexer's constructor to consider config.cssWideKeywords for overriding the default list
    • Expanded the lexer's dump output to include the cssWideKeywords dictionary
    • Modified the fork() method to accept a cssWideKeywords option, allowing the addition of new keywords to the existing list
  • Reverted changes to Block to include { and }, and Atrule and Rule to exclude { and } for a block (#​296)
  • Removed second parameter (assign) for the callback in the fork() method (e.g., syntax.fork((config, assign) => { ... })), as it simply refers to Object.assign()
  • Fixes in syntaxes: <basic-shapes>, <absolute-color-function> and <'stroke-opacity'>

v3.0.0

Compare Source

  • Added support for the @container at-rule
  • Added support for the @starting-style at-rule
  • Added support for the @scope at-rule
  • Added support for the @position-try at-rule
  • Added support for the @layer at-rule
  • Added support for layer, layer() and supports() in the @media at-rule (according to the @​import rule in Cascading and Inheritance 5)
  • Added Layer and LayerList node types
  • Added TokenStream#lookupTypeNonSC() method
  • Added <dashed-ident> to generic types
  • Bumped mdn/data to 2.10.0
  • Aligned <'font'> to CSS Fonts 4
  • Aligned <color> to CSS Color 5
  • Fixed initialization when Object.prototype is extended or polluted (#​262)
  • Fixed fork() method to consider the generic option when creating a Lexer instance (#​266)
  • Fixed crash on parse error when custom line or offset is specified via options (#​251)
  • Fixed speak syntax patch (#​241)
  • Fixed :lang() to accept a list of <ident> or <string> per spec (#​265)
  • Fixed lexer matching for syntaxes referred to as <'property'>, when the syntax has a top-level #-multiplier (#​102)
  • Relaxed parsing of syntax definition to allow whitespaces in range multiplier (#​270)
  • Changed parseWithFallback() to rollback tokenIndex before calling a fallback
  • Changed Block to not include { and }
  • Changed Atrule and Rule to include { and } for a block
  • Changed Ratio parsing:
    • Left and right parts contain nodes instead of strings
    • Both left and right parts of a ratio can now be any number; validation of number range is no longer within the parser's scope.
    • Both parts can now be functions. Although not explicitly mentioned in the specification, mathematical functions can replace numbers, addressing potential use cases (#​162).
    • As per the CSS Values and Units Level 4 specification, the right part of Ratio can be omitted. While this can't be a parser output (which would produce a Number node), it's feasible during Ratio node construction or transformation.
  • Changes to query-related at-rules:
    • Added new node types:

      • Feature: represents features like (feature) and (feature: value), fundamental for both @media and @container at-rules
      • FeatureRange: represents features in a range context
      • FeatureFunction: represents functional features such as @supports's selector() or @container's style()
      • Condition: used across all query-like at-rules, encapsulating queries with features and the not, and, and or operators
      • GeneralEnclosure: represents the <general-enclosed> production, which caters to unparsed parentheses or functional expressions

      Note: All new nodes include a kind property to define the at-rule type. Supported kinds are media, supports, and container.

    • Added support for functions for features and features in a range context, e.g. (width: calc(100cm / 6))

    • Added a condition value for the parser's context option to parse queries. Use the kind option to specify the condition type, e.g., parse('...', { context: 'condition', kind: 'media' }).

    • Introduced a features section in the syntax configuration for defining functional features of at-rules. Expand definitions using the fork() method. The current definition is as follows:

      features: {
          supports: { selector() { /* ... */ } },
          container: { style() { /* ... */ } }
      }
    • Changes for @media at-rule:

      • Enhanced prelude parsing for complex queries. Parentheses with errors will be parsed as GeneralEnclosed.
      • Added support for features in a range context, e.g. (width > 100px) or (100px < height < 400px)
      • Transitioned from MediaFeature node type to the Feature node type with kind: "media".
      • Changed MediaQuery node structure into the following form:
        type MediaQuery = {
            type: "MediaQuery";
            modifier: string | null; // e.g. "not", "only", etc.
            mediaType: string | null; // e.g. "all", "screen", etc.
            condition: Condition | null;
        }
    • Changes for @supports at-rule:

      • Enhanced prelude parsing for complex queries. Parentheses with errors will be parsed as GeneralEnclosed.
      • Added support for features in a range context, e.g. (width > 100px) or (100px < height < 400px)
      • Added SupportsDeclaration node type to encapsulate a declaration in a query, replacing Parentheses.
      • Parsing now employs Condition or SupportsDeclaration nodes of kind supports instead of Parentheses.
      • Added support for the selector() feature via the FeatureFunction node (configured in features.supports.selector).
motdotla/dotenv (dotenv)

v17.3.1

Compare Source

Changed
  • Fix as2 example command in README and update spanish README

v17.3.0

Compare Source

Added
  • Add a new README section on dotenv’s approach to the agentic future.
Changed
  • Rewrite README to get humans started more quickly with less noise while simultaneously making more accessible for llms and agents to go deeper into details.

v17.2.4

Compare Source

Changed
  • Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#​915)
  • Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

v17.2.3

Compare Source

Changed
  • Fixed typescript error definition (#​912)

v17.2.2

Compare Source

Added
  • 🙏 A big thank you to new sponsor Tuple.app - the premier screen sharing app for developers on macOS and Windows. Go check them out. It's wonderful and generous of them to give back to open source by sponsoring dotenv. Give them some love back.

v17.2.1

Compare Source

Changed
  • Fix clickable tip links by removing parentheses (#​897)

v17.2.0

Compare Source

Added
  • Optionally specify DOTENV_CONFIG_QUIET=true in your environment or .env file to quiet the runtime log (#​889)
  • Just like dotenv any DOTENV_CONFIG_ environment variables take precedence over any code set options like ({quiet: false})

v17.1.0

Compare Source

Added
  • Add additional security and configuration tips to the runtime log (#​884)
  • Dim the tips text from the main injection information text
const TIPS = [
  '🔐 encrypt with dotenvx: https://dotenvx.com',
  '🔐 prevent committing .env to code: https://dotenvx.com/precommit',
  '🔐 prevent building .env in docker: https://dotenvx.com/prebuild',
  '🛠️  run anywhere with `dotenvx run -- yourcommand`',
  '⚙️  specify custom .env file path with { path: \'/custom/path/.env\' }',
  '⚙️  enable debug logging with { debug: true }',
  '⚙️  override existing env vars with { override: true }',
  '⚙️  suppress all logs with { quiet: true }',
  '⚙️  write to custom object with { processEnv: myObject }',
  '⚙️  load multiple .env files with { path: [\'.env.local\', \'.env\'] }'
]

v17.0.1

Compare Source

Changed
  • Patched injected log to count only populated/set keys to process.env (#​879)

v17.0.0

Compare Source

Changed
  • Default quiet to false - informational (file and keys count) runtime log message shows by default (#​875)
eslint/eslint (eslint)

v10.0.2

Compare Source

Bug Fixes

  • 2b72361 fix: update ajv to 6.14.0 to address security vulnerabilities (#​20537) (루밀LuMir)

Documentation

  • 13eeedb docs: link rule type explanation to CLI option --fix-type (#​20548) (Mike McCready)
  • 98cbf6b docs: update migration guide per Program range change (#​20534) (Huáng Jùnliàng)
  • 61a2405 docs: add missing semicolon in vars-on-top rule example (#​20533) (Abilash)

Chores

v10.0.1

Compare Source

Bug Fixes

Documentation

  • 5b3dbce docs: add AI acknowledgement section to templates (#​20431) (루밀LuMir)
  • 6f23076 docs: toggle nav in no-JS mode (#​20476) (Tanuj Kanti)
  • b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

v10.0.0

Compare Source

Breaking Changes

  • f9e54f4 feat!: estimate rule-tester failure location (#​20420) (ST-DDT)
  • a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#​20227) (루밀LuMir)
  • c7046e6 feat!: enable JSX reference tracking (#​20152) (Pixel998)
  • fa31a60 feat!: add name to configs (#​20015) (Kirk Waiblinger)
  • 3383e7e fix!: remove deprecated SourceCode methods (#​20137) (Pixel998)
  • 501abd0 feat!: update dependency minimatch to v10 (#​20246) (renovate[bot])
  • ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#​20125) (唯然)
  • 96512a6 fix!: Remove deprecated rule context methods (#​20086) (Nicholas C. Zakas)
  • c69fdac feat!: remove eslintrc support (#​20037) (Francesco Trotta)
  • 208b5cc feat!: Use ScopeManager#addGlobals() (#​20132) (Milos Djermanovic)
  • a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#​20155) (Tanuj Kanti)
  • a89059d feat!: Program range span entire source text (#​20133) (Pixel998)
  • 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#​20082) (Pixel998)
  • f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#​20223) (Milos Djermanovic)
  • aa3fb2b fix!: tighten func-names schema (#​20119) (Pixel998)
  • f6c0ed0 feat!: report eslint-env comments as errors (#​20128) (Francesco Trotta)
  • 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#​20096) (Pixel998)
  • 523c076 feat!: drop support for jiti < 2.2.0 (#​20016) (michael faith)
  • 454a292 feat!: update eslint:recommended configuration (#​20210) (Pixel998)
  • 4f880ee feat!: remove v10_* and inactive unstable_* flags (#​20225) (sethamus)
  • f18115c feat!: no-shadow-restricted-names report globalThis by default (#​20027) (sethamus)
  • c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#​20160) (Milos Djermanovic)

Features

  • bff9091 feat: handle Array.fromAsync in array-callback-return (#​20457) (Francesco Trotta)
  • 290c594 feat: add self to no-implied-eval rule (#​20468) (sethamus)
  • 43677de feat: fix handling of function and class expression names in no-shadow (#​20432) (Milos Djermanovic)
  • f0cafe5 feat: rule tester add assertion option requireData (#​20409) (fnx)
  • f7ab693 feat: output RuleTester test case failure index (#​19976) (ST-DDT)
  • 7cbcbf9 feat: add countThis option to max-params (#​20236) (Gerkin)
  • f148a5e feat: add error assertion options (#​20247) (ST-DDT)
  • 09e6654 feat: update error loc of require-yield and no-useless-constructor (#​20267) (Tanuj Kanti)

Bug Fixes

  • 436b82f fix: update eslint (#​20473) (renovate[bot])
  • 1d29d22 fix: detect default this binding in Array.fromAsync callbacks (#​20456) (Francesco Trotta)
  • 727451e fix: fix regression of global mode report range in strict rule (#​20462) (ntnyq)
  • e80485f fix: remove fake FlatESLint and LegacyESLint exports (#​20460) (Francesco Trotta)
  • 9eeff3b fix: update esquery (#​20423) (cryptnix)
  • b34b938 fix: use Error.prepareStackTrace to estimate failing test location (#​20436) (Francesco Trotta)
  • 51aab53 fix: update eslint (#​20443) (renovate[bot])
  • 23490b2 fix: handle space before colon in RuleTester location estimation (#​20433) (Francesco Trotta)
  • f244dbf fix: use MessagePlaceholderData type from @eslint/core (#​20348) (루밀LuMir)
  • d186f8c fix: update eslint (#​20427) (renovate[bot])
  • 2332262 fix: error location should not modify error message in RuleTester (#​20421) (Milos Djermanovic)
  • ab99b21 fix: ensure filename is passed as third argument to verifyAndFix() (#​20405) (루밀LuMir)
  • 8a60f3b fix: remove ecmaVersion and sourceType from ParserOptions type (#​20415) (Pixel998)
  • eafd727 fix: remove TDZ scope type (#​20231) (jaymarvelz)
  • 39d1f51 fix: correct Scope typings (#​20404) (sethamus)
  • 2bd0f13 fix: update verify and verifyAndFix types (#​20384) (Francesco Trotta)
  • ba6ebfa fix: correct typings for loadESLint() and shouldUseFlatConfig() (#​20393) (루밀LuMir)
  • e7673ae fix: correct RuleTester typings (#​20105) (Pixel998)
  • 53e9522 fix: strict removed formatters check (#​20241) (ntnyq)
  • b017f09 fix: correct no-restricted-import messages (#​20374) (Francesco Trotta)

Documentation

  • e978dda docs: Update README (GitHub Actions Bot)
  • 4cecf83 docs: Update README (GitHub Actions Bot)
  • c79f0ab docs: Update README (GitHub Actions Bot)
  • 773c052 docs: Update README (GitHub Actions Bot)
  • f2962e4 docs: document meta.docs.frozen property (#​20475) (Pixel998)
  • 8e94f58 docs: fix broken anchor links from gerund heading updates (#​20449) (Copilot)
  • 1495654 docs: Update README (GitHub Actions Bot)
  • 0b8ed5c docs: document support for :is selector alias (#​20454) (sethamus)
  • 1c4b33f docs: Document policies about ESM-only dependencies (#​20448) (Milos Djermanovic)
  • 3e5d38c docs: add missing indentation space in rule example (#​20446) (fnx)
  • 63a0c7c docs: Update README (GitHub Actions Bot)
  • 65ed0c9 docs: Update README (GitHub Actions Bot)
  • b0e4717 docs: [no-await-in-loop] Expand inapplicability (#​20363) (Niklas Hambüchen)
  • fca421f docs: Update README (GitHub Actions Bot)
  • d925c54 docs: update config syntax in no-lone-blocks (#​20413) (Pixel998)
  • 7d5c95f docs: remove redundant sourceType: "module" from rule examples (#​20412) (Pixel998)
  • 02e7e71 docs: correct .mts glob pattern in files with extensions example (#​20403) (Ali Essalihi)
  • 264b981 docs: Update README (GitHub Actions Bot)
  • 5a4324f docs: clarify "local" option of no-unused-vars (#​20385) (Milos Djermanovic)
  • e593aa0 docs: improve clarity, grammar, and wording in documentation site README (#​20370) (Aditya)
  • 3f5062e docs: Add messages property to rule meta documentation (#​20361) (Sabya Sachi)
  • 9e5a5c2 docs: remove Examples headings from rule docs (#​20364) (Milos Djermanovic)
  • 194f488 docs: Update README (GitHub Actions Bot)
  • 0f5a94a docs: [class-methods-use-this] explain purpose of rule (#​20008) (Kirk Waiblinger)
  • df5566f docs: add Options section to all rule docs (#​20296) (sethamus)
  • adf7a2b docs: no-unsafe-finally note for generator functions (#​20330) (Tom Pereira)
  • ef7028c docs: Update README (GitHub Actions Bot)
  • fbae5d1 docs: consistently use "v10.0.0" in migration guide (#​20328) (Pixel998)
  • 778aa2d docs: ignoring default file patterns (#​20312) (Tanuj Kanti)
  • 4b5dbcd docs: reorder v10 migration guide (#​20315) (Milos Djermanovic)
  • 5d84a73 docs: Update README (GitHub Actions Bot)
  • 37c8863 docs: fix incorrect anchor link in v10 migration guide (#​20299) (Pixel998)
  • 077ff02 docs: add migrate-to-10.0.0 doc (#​20143) (唯然)
  • 3822e1b docs: Update README (GitHub Actions Bot)

Build Related

  • 9f08712 Build: changelog update for 10.0.0-rc.2 (Jenkins)
  • 1e2c449 Build: changelog update for 10.0.0-rc.1 (Jenkins)
  • c4c72a8 Build: changelog update for 10.0.0-rc.0 (Jenkins)
  • 7e4daf9 Build: changelog update for 10.0.0-beta.0 (Jenkins)
  • a126a2a build: add .scss files entry to knip (#​20389) (Francesco Trotta)
  • f5c0193 Build: changelog update for 10.0.0-alpha.1 (Jenkins)
  • 165326f Build: changelog update for 10.0.0-alpha.0 (Jenkins)

Chores


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@netlify
Copy link

netlify bot commented Nov 27, 2025

Deploy Preview for stylo-docs canceled.

Name Link
🔨 Latest commit aab5ee7
🔍 Latest deploy log https://app.netlify.com/projects/stylo-docs/deploys/699fb92153d0c90008c850a4

@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch 2 times, most recently from ae095b0 to 5001060 Compare November 29, 2025 02:43
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch 4 times, most recently from af276c8 to da567ce Compare December 15, 2025 02:49
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch 3 times, most recently from c71c713 to d465074 Compare December 24, 2025 02:46
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch 3 times, most recently from 676f4a2 to 96c8097 Compare January 5, 2026 10:11
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch from 96c8097 to fd7a951 Compare January 14, 2026 02:58
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch from fd7a951 to 2421066 Compare January 22, 2026 02:56
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch 6 times, most recently from 76d27a9 to f5bbe58 Compare February 7, 2026 03:06
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch 2 times, most recently from 6d7f142 to b8cc6fa Compare February 12, 2026 03:12
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch from b8cc6fa to 5f0f6be Compare February 20, 2026 03:09
@ggrossetie ggrossetie force-pushed the renovate/major-backend-dependencies branch from 5f0f6be to aab5ee7 Compare February 26, 2026 03:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant