Skip to content

⬆ Bump the bun-packages group with 6 updates - #231

Merged
savannahostrowski merged 2 commits into
mainfrom
dependabot/bun/bun-packages-e797bf7900
Sep 1, 2026
Merged

⬆ Bump the bun-packages group with 6 updates#231
savannahostrowski merged 2 commits into
mainfrom
dependabot/bun/bun-packages-e797bf7900

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the bun-packages group with 6 updates:

Package From To
posthog-node 5.47.3 5.51.2
web-tree-sitter 0.26.11 0.26.13
@biomejs/biome 2.5.6 2.5.10
@types/bun 1.3.14 1.4.0
esbuild 0.28.1 0.28.2
ovsx 1.1.0 1.1.1

Updates posthog-node from 5.47.3 to 5.51.2

Release notes

Sourced from posthog-node's releases.

posthog-node@5.51.2

5.51.2

Patch Changes

  • #4639 1faeb74 Thanks @​marandaneto! - Handle empty feature flag evaluation key scopes without running local or remote evaluation. (2026-08-25)

  • #4610 930de19 Thanks @​marandaneto! - Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior. (2026-08-25)

  • Updated dependencies [930de19, d4eee8f]:

    • @​posthog/core@​1.48.11

posthog-node@5.51.1

5.51.1

Patch Changes

  • #4614 3593c43 Thanks @​iamomiid! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream. (2026-08-24)
  • Updated dependencies [3593c43]:
    • @​posthog/core@​1.48.9

posthog-node@5.51.0

5.51.0

Minor Changes

  • #4564 233ac88 Thanks @​marandaneto! - Fall back to remote evaluation when a requested flag is missing from loaded local definitions. This changes scoped calls that previously omitted the flag without making a request. (2026-08-24)

posthog-node@5.50.0

5.50.0

Minor Changes

  • #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

posthog-node@5.49.4

5.49.4

Patch Changes

  • #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

posthog-node@5.49.3

5.49.3

... (truncated)

Changelog

Sourced from posthog-node's changelog.

5.51.2

Patch Changes

  • #4639 1faeb74 Thanks @​marandaneto! - Handle empty feature flag evaluation key scopes without running local or remote evaluation. (2026-08-25)

  • #4610 930de19 Thanks @​marandaneto! - Share feature flag matching, hashing, variant, and payload evaluation helpers across the Node.js and Convex SDKs without changing their runtime-specific SemVer behavior. (2026-08-25)

  • Updated dependencies [930de19, d4eee8f]:

    • @​posthog/core@​1.48.11

5.51.1

Patch Changes

  • #4614 3593c43 Thanks @​iamomiid! - The Node SDK now sends the raw gzip bytes as the request body instead of wrapping them in a Blob. On Node 24.16 and later, reading a Blob request body leaks a native BlobReader that is never released, so a service calling capture() and flush() once per request grew by roughly 2.3 KB of heap per event and never gave it back. This completes the work in #4423: switching to node:zlib removed the compression-time Blob reads, but the body itself was still a Blob and still got read once per request. Compression behaviour, headers and the wire format are unchanged, and the edge build keeps using CompressionStream. (2026-08-24)
  • Updated dependencies [3593c43]:
    • @​posthog/core@​1.48.9

5.51.0

Minor Changes

  • #4564 233ac88 Thanks @​marandaneto! - Fall back to remote evaluation when a requested flag is missing from loaded local definitions. This changes scoped calls that previously omitted the flag without making a request. (2026-08-24)

5.50.0

Minor Changes

  • #4484 557140e Thanks @​posthog! - FeatureFlagEvaluations.isEnabled() now accepts an optional defaultValue option, returned whenever the flag has no value (missing key, not loaded, or a failed request). A flag with a present value — including false and variant strings — always wins over defaultValue. Purely additive; omitting the option preserves the existing false-on-miss behavior. (2026-08-21)

5.49.4

Patch Changes

  • #4569 00d22ea Thanks @​v11t! - fix getFeatureFlagResult returning null variant instead of undefined when remotely evaluated (2026-08-21)

5.49.3

Patch Changes

  • #4583 6322f09 Thanks @​turnipdabeets! - Fix logs and metrics being silently dropped when an attribute holds a very large integer, a function, a symbol, a sparse array, or a truncated emoji. Cap log and metric attributes at 20 levels of nesting, 1,000 entries per object and 10,000 values in total, marking anything beyond as [Truncated]. Type OtlpAnyValue.intValue as string | number — code reading that field must handle both. (2026-08-21)
  • Updated dependencies [6322f09]:

... (truncated)

Commits
  • d22676a chore: update versions and lockfile [version bump]
  • 1faeb74 fix(flags): handle empty evaluation key scopes (#4639)
  • d4eee8f refactor(surveys): share property matching helpers (#4611)
  • 930de19 refactor(feature-flags): share local evaluation helpers (#4610)
  • 0540533 chore: update versions and lockfile [version bump]
  • 3593c43 fix(node): send gzip bytes instead of a Blob request body (#4614)
  • cedf844 chore: update versions and lockfile [version bump]
  • 233ac88 feat(node): fall back for requested flags missing locally (#4564)
  • 3508c05 chore: update versions and lockfile [version bump]
  • 557140e feat(node): isEnabled() accepts a caller-supplied default value (#4484)
  • Additional commits viewable in compare view

Updates web-tree-sitter from 0.26.11 to 0.26.13

Release notes

Sourced from web-tree-sitter's releases.

v0.26.13

What's Changed

Full Changelog: tree-sitter/tree-sitter@v0.26.12...v0.26.13

v0.26.12

What's Changed

Full Changelog: tree-sitter/tree-sitter@v0.26.11...v0.26.12

Commits

Updates @biomejs/biome from 2.5.6 to 2.5.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
<Component /* c */ client:load />

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
<div class={/* a note */}>x</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
  <p>a</p>
</>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
const a = "</script>";
// </script> in a comment
---

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
<Component /* c */ client:load />

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
<div class={/* a note */}>x</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
  <p>a</p>
</>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
const a = "</script>";
// </script> in a comment
---

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

    <!-- c -->

... (truncated)

Commits

Updates @types/bun from 1.3.14 to 1.4.0

Commits

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates ovsx from 1.1.0 to 1.1.1

Release notes

Sourced from ovsx's releases.

CLI v1.1.1

Dependencies

  • Bump ip-address from 10.2.0 to 10.4.0
  • Bump fast-uri from 3.1.4 to 3.1.5
  • Bump js-yaml from 4.3.0 to 4.3.1

Frontend Library v1.1.1

Fixed

  • Fix the WebUI build failing on s390x and ppc64le: use postcss instead of lightningcss (no ppc64le binary) for CSS, and bump vite for the Rolldown big-endian sourcemap fix (#2051)
  • Fix the admin publisher revoke dialog prompting for an Eclipse login even when the target publisher's agreement status is none or could not be determined (nothing confirmed to revoke)

Dependencies

  • Remove the unused @mui/base dependency; it is deprecated upstream (replaced by @base-ui/react) and nothing in the codebase imports from it
  • Bump socks from 2.8.3 to 2.8.9
  • Bump ip-address from 9.0.5 to 10.4.0
  • Bump postcss from 8.5.22 to 8.5.25
  • Bump vite from 8.1.5 to 8.2.1
  • Bump dompurify from 3.4.12 to 3.4.13
  • Bump js-yaml from 4.3.0 to 4.3.1
  • Bump react-router from 7.18.1 to 7.18.2

v1.1.1

This release of Open VSX consists of:

Deploying the server application is documented in the Wiki.

What's Changed

🏕 Features

... (truncated)

Changelog

Sourced from ovsx's changelog.

[v1.1.1] (09/08/2026)

Dependencies

  • Bump ip-address from 10.2.0 to 10.4.0
  • Bump fast-uri from 3.1.4 to 3.1.5
  • Bump js-yaml from 4.3.0 to 4.3.1
Commits
  • 0eb87af chore: prepare cli 1.1.1 release
  • a3bcfef build(deps): bump js-yaml from 4.3.0 to 4.3.1 in /cli (#2056)
  • 5c257bf build(deps): bump fast-uri from 3.1.4 to 3.1.5 in /cli (#2041)
  • ed9f099 chore(deps): bump socks and ip-address versions
  • 37bc90b chore: bump for next dev cycle
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
⬆ Bump the bun-packages group with 6 updates
0ccc05e 
Bumps the bun-packages group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [posthog-node](https://github.com/PostHog/posthog-js/tree/HEAD/packages/node) | `5.47.3` | `5.51.2` |
| [web-tree-sitter](https://github.com/tree-sitter/tree-sitter/tree/HEAD/lib/binding_web) | `0.26.11` | `0.26.13` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.6` | `2.5.10` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.3.14` | `1.4.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [ovsx](https://github.com/eclipse-openvsx/openvsx/tree/HEAD/cli) | `1.1.0` | `1.1.1` |


Updates `posthog-node` from 5.47.3 to 5.51.2
- [Release notes](https://github.com/PostHog/posthog-js/releases)
- [Changelog](https://github.com/PostHog/posthog-js/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/PostHog/posthog-js/commits/posthog-node@5.51.2/packages/node)

Updates `web-tree-sitter` from 0.26.11 to 0.26.13
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](https://github.com/tree-sitter/tree-sitter/commits/v0.26.13/lib/binding_web)

Updates `@biomejs/biome` from 2.5.6 to 2.5.10
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.10/packages/@biomejs/biome)

Updates `@types/bun` from 1.3.14 to 1.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `ovsx` from 1.1.0 to 1.1.1
- [Release notes](https://github.com/eclipse-openvsx/openvsx/releases)
- [Changelog](https://github.com/eclipse-openvsx/openvsx/blob/main/cli/CHANGELOG.md)
- [Commits](https://github.com/eclipse-openvsx/openvsx/commits/v1.1.1/cli)

---
updated-dependencies:
- dependency-name: posthog-node
  dependency-version: 5.51.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun-packages
- dependency-name: web-tree-sitter
  dependency-version: 0.26.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: "@types/bun"
  dependency-version: 1.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun-packages
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-packages
- dependency-name: ovsx
  dependency-version: 1.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
@savannahostrowski savannahostrowski added the internal Internal changes label Sep 1, 2026
@savannahostrowski
savannahostrowski merged commit e361fd3 into main Sep 1, 2026
8 checks passed
@savannahostrowski
savannahostrowski deleted the dependabot/bun/bun-packages-e797bf7900 branch September 1, 2026 15:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file internal Internal changes javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@savannahostrowski