chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@types/node-fetch	^2.6.1 -> ^2.6.2
@types/semver	^7.3.9 -> ^7.3.10
esbuild	^0.14.43 -> ^0.14.46
eslint (source)	^8.17.0 -> ^8.18.0
h3	^0.7.9 -> ^0.7.10
listhen	^0.2.12 -> ^0.2.13
miniflare	^2.5.0 -> ^2.5.1
mlly	^0.5.2 -> ^0.5.3
pnpm (source)	7.2.1 -> 7.3.0
typescript (source)	^4.7.3 -> ^4.7.4

---

Release Notes

evanw/esbuild

v0.14.46

Compare Source

• Add the ability to override support for individual syntax features (#​2060, #​2290, #​2308)

  The target setting already lets you configure esbuild to restrict its output by only making use of syntax features that are known to be supported in the configured target environment. For example, setting target to chrome50 causes esbuild to automatically transform optional chain expressions into the equivalent older JavaScript and prevents you from using BigInts, among many other things. However, sometimes you may want to customize this set of unsupported syntax features at the individual feature level.

  Some examples of why you might want to do this:

  • JavaScript runtimes often do a quick implementation of newer syntax features that is slower than the equivalent older JavaScript, and you can get a speedup by telling esbuild to pretend this syntax feature isn't supported. For example, V8 has a long-standing performance bug regarding object spread that can be avoided by manually copying properties instead of using object spread syntax. Right now esbuild hard-codes this optimization if you set target to a V8-based runtime.

  • There are many less-used JavaScript runtimes in addition to the ones present in browsers, and these runtimes sometimes just decide not to implement parts of the specification, which might make sense for runtimes intended for embedded environments. For example, the developers behind Facebook's JavaScript runtime Hermes have decided to not implement classes despite it being a major JavaScript feature that was added seven years ago and that is used in virtually every large JavaScript project.

  • You may be processing esbuild's output with another tool, and you may want esbuild to transform certain features and the other tool to transform certain other features. For example, if you are using esbuild to transform files individually to ES5 but you are then feeding the output into Webpack for bundling, you may want to preserve import() expressions even though they are a syntax error in ES5.

  With this release, you can now use --supported:feature=false to force feature to be unsupported. This will cause esbuild to either rewrite code that uses the feature into older code that doesn't use the feature (if esbuild is able to), or to emit a build error (if esbuild is unable to). For example, you can use --supported:arrow=false to turn arrow functions into function expressions and --supported:bigint=false to make it an error to use a BigInt literal. You can also use --supported:feature=true to force it to be supported, which means esbuild will pass it through without transforming it. Keep in mind that this is an advanced feature. For most use cases you will probably want to just use target instead of using this.

  The full set of currently-allowed features are as follows:

  JavaScript:

  • arbitrary-module-namespace-names
  • array-spread
  • arrow
  • async-await
  • async-generator
  • bigint
  • class
  • class-field
  • class-private-accessor
  • class-private-brand-check
  • class-private-field
  • class-private-method
  • class-private-static-accessor
  • class-private-static-field
  • class-private-static-method
  • class-static-blocks
  • class-static-field
  • const-and-let
  • default-argument
  • destructuring
  • dynamic-import
  • exponent-operator
  • export-star-as
  • for-await
  • for-of
  • generator
  • hashbang
  • import-assertions
  • import-meta
  • logical-assignment
  • nested-rest-binding
  • new-target
  • node-colon-prefix-import
  • node-colon-prefix-require
  • nullish-coalescing
  • object-accessors
  • object-extensions
  • object-rest-spread
  • optional-catch-binding
  • optional-chain
  • regexp-dot-all-flag
  • regexp-lookbehind-assertions
  • regexp-match-indices
  • regexp-named-capture-groups
  • regexp-sticky-and-unicode-flags
  • regexp-unicode-property-escapes
  • rest-argument
  • template-literal
  • top-level-await
  • typeof-exotic-object-is-object
  • unicode-escapes

  CSS:

  • hex-rgba
  • rebecca-purple
  • modern-rgb-hsl
  • inset-property
  • nesting

  Since you can now specify --supported:object-rest-spread=false yourself to work around the V8 performance issue mentioned above, esbuild will no longer automatically transform all instances of object spread when targeting a V8-based JavaScript runtime going forward.

  Note that JavaScript feature transformation is very complex and allowing full customization of the set of supported syntax features could cause bugs in esbuild due to new interactions between multiple features that were never possible before. Consider this to be an experimental feature.

• Implement extends constraints on infer type variables (#​2330)

  TypeScript 4.7 introduced the ability to write an extends constraint after an infer type variable, which looks like this:

  type FirstIfString<T> =
    T extends [infer S extends string, ...unknown[]]
      ? S
      : never;

  You can read the blog post for more details: https://devblogs.microsoft.com/typescript/announcing-typescript-4-7/#extends-constraints-on-infer-type-variables. Previously this was a syntax error in esbuild but with this release, esbuild can now parse this syntax correctly.

• Allow define to match optional chain expressions (#​2324)

  Previously esbuild's define feature only matched member expressions that did not use optional chaining. With this release, esbuild will now also match those that use optional chaining:

  // Original code
  console.log(a.b, a?.b)
  
  // Old output (with --define:a.b=c)
  console.log(c, a?.b);
  
  // New output (with --define:a.b=c)
  console.log(c, c);

  This is for compatibility with Webpack's DefinePlugin, which behaves the same way.

v0.14.45

Compare Source

• Add a log message for ambiguous re-exports (#​2322)

  In JavaScript, you can re-export symbols from another file using export * from './another-file'. When you do this from multiple files that export different symbols with the same name, this creates an ambiguous export which is causes that name to not be exported. This is harmless if you don't plan on using the ambiguous export name, so esbuild doesn't have a warning for this. But if you do want a warning for this (or if you want to make it an error), you can now opt-in to seeing this log message with --log-override:ambiguous-reexport=warning or --log-override:ambiguous-reexport=error. The log message looks like this:

  ▲ [WARNING] Re-export of "common" in "example.js" is ambiguous and has been removed [ambiguous-reexport]
  
    One definition of "common" comes from "a.js" here:
  
      a.js:2:11:
        2 │ export let common = 2
          ╵            ~~~~~~
  
    Another definition of "common" comes from "b.js" here:
  
      b.js:3:14:
        3 │ export { b as common }
          ╵               ~~~~~~
  

• Optimize the output of the JSON loader (#​2161)

  The json loader (which is enabled by default for .json files) parses the file as JSON and generates a JavaScript file with the parsed expression as the default export. This behavior is standard and works in both node and the browser (well, as long as you use an import assertion). As an extension, esbuild also allows you to import additional top-level properties of the JSON object directly as a named export. This is beneficial for tree shaking. For example:

  import { version } from 'esbuild/package.json'
  console.log(version)

  If you bundle the above code with esbuild, you'll get something like the following:

  // node_modules/esbuild/package.json
  var version = "0.14.44";
  
  // example.js
  console.log(version);

  Most of the package.json file is irrelevant and has been omitted from the output due to tree shaking. The way esbuild implements this is to have the JavaScript file that's generated from the JSON look something like this with a separate exported variable for each property on the top-level object:

  // node_modules/esbuild/package.json
  export var name = "esbuild";
  export var version = "0.14.44";
  export var repository = "https://github.com/evanw/esbuild";
  export var bin = {
    esbuild: "bin/esbuild"
  };
  ...
  export default {
    name,
    version,
    repository,
    bin,
    ...
  };

  However, this means that if you import the default export instead of a named export, you will get non-optimal output. The default export references all top-level properties, leading to many unnecessary variables in the output. With this release esbuild will now optimize this case to only generate additional variables for top-level object properties that are actually imported:

  // Original code
  import all, { bar } from 'data:application/json,{"foo":[1,2,3],"bar":[4,5,6]}'
  console.log(all, bar)
  
  // Old output (with --bundle --minify --format=esm)
  var a=[1,2,3],l=[4,5,6],r={foo:a,bar:l};console.log(r,l);
  
  // New output (with --bundle --minify --format=esm)
  var l=[4,5,6],r={foo:[1,2,3],bar:l};console.log(r,l);

  Notice how there is no longer an unnecessary generated variable for foo since it's never imported. And if you only import the default export, esbuild will now reproduce the original JSON object in the output with all top-level properties compactly inline.

• Add id to warnings returned from the API

  With this release, warnings returned from esbuild's API now have an id property. This identifies which kind of log message it is, which can be used to more easily filter out certain warnings. For example, reassigning a const variable will generate a message with an id of "assign-to-constant". This also gives you the identifier you need to apply a log override for that kind of message: https://esbuild.github.io/api/#log-override.

v0.14.44

Compare Source

• Add a copy loader (#​2255)

  You can configure the "loader" for a specific file extension in esbuild, which is a way of telling esbuild how it should treat that file. For example, the text loader means the file is imported as a string while the binary loader means the file is imported as a Uint8Array. If you want the imported file to stay a separate file, the only option was previously the file loader (which is intended to be similar to Webpack's file-loader package). This loader copies the file to the output directory and imports the path to that output file as a string. This is useful for a web application because you can refer to resources such as .png images by importing them for their URL. However, it's not helpful if you need the imported file to stay a separate file but to still behave the way it normally would when the code is run without bundling.

  With this release, there is now a new loader called copy that copies the loaded file to the output directory and then rewrites the path of the import statement or require() call to point to the copied file instead of the original file. This will automatically add a content hash to the output name by default (which can be configured with the --asset-names= setting). You can use this by specifying copy for a specific file extension, such as with --loader:.png=copy.

• Fix a regression in arrow function lowering (#​2302)

  This release fixes a regression with lowering arrow functions to function expressions in ES5. This feature was introduced in version 0.7.2 and regressed in version 0.14.30.

  In JavaScript, regular function expressions treat this as an implicit argument that is determined by how the function is called, but arrow functions treat this as a variable that is captured in the closure from the surrounding lexical scope. This is emulated in esbuild by storing the value of this in a variable before changing the arrow function into a function expression.

  However, the code that did this didn't treat this expressions as a usage of that generated variable. Version 0.14.30 began omitting unused generated variables, which caused the transformation of this to break. This regression happened due to missing test coverage. With this release, the problem has been fixed:

  // Original code
  function foo() {
    return () => this
  }
  
  // Old output (with --target=es5)
  function foo() {
    return function() {
      return _this;
    };
  }
  
  // New output (with --target=es5)
  function foo() {
    var _this = this;
    return function() {
      return _this;
    };
  }

  This fix was contributed by @​nkeynes.

• Allow entity names as define values (#​2292)

  The "define" feature allows you to replace certain expressions with certain other expressions at compile time. For example, you might want to replace the global identifier IS_PRODUCTION with the boolean value true when building for production. Previously the only expressions you could substitute in were either identifier expressions or anything that is valid JSON syntax. This limitation exists because supporting more complex expressions is more complex (for example, substituting in a require() call could potentially pull in additional files, which would need to be handled). With this release, you can now also now define something as a member expression chain of the form foo.abc.xyz.

• Implement package self-references (#​2312)

  This release implements a rarely-used feature in node where a package can import itself by name instead of using relative imports. You can read more about this feature here: https://nodejs.org/api/packages.html#self-referencing-a-package-using-its-name. For example, assuming the package.json in a given package looks like this:

  // package.json
  {
    "name": "a-package",
    "exports": {
      ".": "./main.mjs",
      "./foo": "./foo.js"
    }
  }

  Then any module in that package can reference an export in the package itself:

  // ./a-module.mjs
  import { something } from 'a-package'; // Imports "something" from ./main.mjs.

  Self-referencing is also available when using require, both in an ES module, and in a CommonJS one. For example, this code will also work:

  // ./a-module.js
  const { something } = require('a-package/foo'); // Loads from ./foo.js.

• Add a warning for assigning to an import (#​2319)

  Import bindings are immutable in JavaScript, and assigning to them will throw an error. So instead of doing this:

  import { foo } from 'foo'
  foo++

  You need to do something like this instead:

  import { foo, setFoo } from 'foo'
  setFoo(foo + 1)

  This is already an error if you try to bundle this code with esbuild. However, this was previously allowed silently when bundling is disabled, which can lead to confusion for people who don't know about this aspect of how JavaScript works. So with this release, there is now a warning when you do this:

  ▲ [WARNING] This assignment will throw because "foo" is an import [assign-to-import]
  
      example.js:2:0:
        2 │ foo++
          ╵ ~~~
  
    Imports are immutable in JavaScript. To modify the value of this import, you must export a setter
    function in the imported file (e.g. "setFoo") and then import and call that function here instead.
  

  This new warning can be turned off with --log-override:assign-to-import=silent if you don't want to see it.

• Implement alwaysStrict in tsconfig.json (#​2264)

  This release adds alwaysStrict to the set of TypeScript tsconfig.json configuration values that esbuild supports. When this is enabled, esbuild will forbid syntax that isn't allowed in strict mode and will automatically insert "use strict"; at the top of generated output files. This matches the behavior of the TypeScript compiler: https://www.typescriptlang.org/tsconfig#alwaysStrict.

eslint/eslint

v8.18.0

Compare Source

Features

• a6273b8 feat: account for rule creation time in performance reports (#​15982) (Nitin Kumar)

Bug Fixes

• f364d47 fix: Make no-unused-vars treat for..of loops same as for..in loops (#​15868) (Alex Bass)

Documentation

• 4871047 docs: Update analytics, canonical URL, ads (#​15996) (Nicholas C. Zakas)
• cddad14 docs: Add correct/incorrect containers (#​15998) (Nicholas C. Zakas)
• b04bc6f docs: Add rules meta info to rule pages (#​15902) (Nicholas C. Zakas)
• 1324f10 docs: unify the wording referring to optional exception (#​15893) (Abdelrahman Elkady)
• ad54d02 docs: add missing trailing slash to some internal links (#​15991) (Milos Djermanovic)
• df7768e docs: Switch to version-relative URLs (#​15978) (Nicholas C. Zakas)
• 21d6479 docs: change some absolute links to relative (#​15970) (Milos Djermanovic)
• f31216a docs: Update README team and sponsors (ESLint Jenkins)

Build Related

• ed49f15 build: remove unwanted parallel and image-min for dev server (#​15986) (Strek)

Chores

• f6e2e63 chore: fix 'replaced by' rule list (#​16007) (Milos Djermanovic)
• d94dc84 chore: remove unused deprecation warnings (#​15994) (Francesco Trotta)
• cdcf11e chore: fix versions link (#​15995) (Milos Djermanovic)
• d2a8715 chore: add trailing slash to pathPrefix (#​15993) (Milos Djermanovic)
• 58a1bf0 chore: tweak URL rewriting for local previews (#​15992) (Milos Djermanovic)
• 80404d2 chore: remove docs deploy workflow (#​15984) (Nicholas C. Zakas)
• 71bc750 chore: Set permissions for GitHub actions (#​15971) (Naveen)
• 90ff647 chore: avoid generating subdirectories for each page on new docs site (#​15967) (Milos Djermanovic)

unjs/h3

v0.7.10

Compare Source

unjs/listhen

v0.2.13

Compare Source

cloudflare/miniflare

v2.5.1

Compare Source

⚠️ Security Update

• Upgrade undici to 5.5.1, addressing GHSA-pgw7-wx7w-2w33
• Upgrade node-forge to 1.3.1, addressing GHSA-2r2c-g63r-vccr, GHSA-x4jg-mjrx-434g and GHSA-cfm4-qjh2-4765
• Upgrade minimist to 1.2.6, addressing GHSA-xvch-5gv4-984h

unjs/mlly

v0.5.3

Compare Source

pnpm/pnpm

v7.3.0

Compare Source

Minor Changes

• A new setting added: pnpm.peerDependencyRules.allowAny. allowAny is an array of package name patterns, any peer dependency matching the pattern will be resolved from any version, regardless of the range specified in peerDependencies. For instance:

  {
     "pnpm": {
       "peerDependencyRules": {
         "allowAny": ["@​babel/*", "eslint"]
       }
     }
  }

  The above setting will mute any warnings about peer dependency version mismatches related to @babel/ packages or eslint.

• The pnpm.peerDependencyRules.ignoreMissing setting may accept package name patterns. So you may ignore any missing @babel/* peer dependencies, for instance:

  {
    "pnpm": {
      "peerDependencyRules": {
        "ignoreMissing": ["@​babel/*"]
      }
    }
  }

• Experimental. New settings added: use-git-branch-lockfile, merge-git-branch-lockfiles, merge-git-branch-lockfiles-branch-pattern #​4475.

Patch Changes

• Packages that should be built are always cloned or copied from the store. This is required to prevent the postinstall scripts from modifying the original source files of the package.

Our Sponsors

#### What's Changed * feat: enhance peer dependency rules by @​TravisJRyan in https://github.com/pnpm/pnpm/pull/4876 * feat: add git-branch-lockfile config to generate lockfile in each branch by @​chengcyber in https://github.com/pnpm/pnpm/pull/4475 * fix: built packages should not modify the original files in the store by @​zkochan in https://github.com/pnpm/pnpm/pull/4898 #### New Contributors * @​TravisJRyan made their first contribution in https://github.com/pnpm/pnpm/pull/4876

Full Changelog: pnpm/pnpm@v7.2.1...v7.3.0

Microsoft/TypeScript

v4.7.4

Compare Source

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

• fixed issues query for Typescript 4.7.0 (Beta).
• fixed issues query for Typescript 4.7.1 (RC).
• fixed issues query for Typescript 4.7.2 (Stable).
• fixed issues query for Typescript 4.7.3 (Stable).
• fixed issues query for Typescript 4.7.4 (Stable).

Downloads are available on:

• npm
• Visual Studio 2022/2019 (Select new version in project options)
• NuGet package

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.