mirror of
https://github.com/oxc-project/oxc.git
synced 2026-09-14 19:36:11 +08:00
codex/parser-grouped-expression-allocation
20306 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 renovate[bot]
|
9a612d57e5 |
chore(deps): update npm packages (#26178)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [@typescript-eslint/parser](https://typescript-eslint.io/packages/parser) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser)) | [`8.67.0` → `8.68.0`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fparser/8.67.0/8.68.0) |  |  |  |  | | [@typescript-eslint/scope-manager](https://typescript-eslint.io/packages/scope-manager) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/scope-manager)) | [`8.67.0` → `8.68.0`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fscope-manager/8.67.0/8.68.0) |  |  |  |  | | [@typescript-eslint/visitor-keys](https://typescript-eslint.io) ([source](https://redirect.github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/visitor-keys)) | [`8.67.0` → `8.68.0`](https://renovatebot.com/diffs/npm/@typescript-eslint%2fvisitor-keys/8.67.0/8.68.0) |  |  |  |  | | [eslint](https://eslint.org) ([source](https://redirect.github.com/eslint/eslint)) | [`10.8.1` → `10.9.1`](https://renovatebot.com/diffs/npm/eslint/10.8.1/10.9.1) |  |  |  |  | | [svelte](https://svelte.dev) ([source](https://redirect.github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | [`5.56.10` → `5.57.0`](https://renovatebot.com/diffs/npm/svelte/5.56.10/5.57.0) |  |  |  |  | | [tinypool](https://redirect.github.com/tinylibs/tinypool) | [`2.1.0` → `2.1.2`](https://renovatebot.com/diffs/npm/tinypool/2.1.0/2.1.2) |  |  |  |  | | [vscode-languageserver-protocol](https://redirect.github.com/Microsoft/vscode-languageserver-node) ([source](https://redirect.github.com/Microsoft/vscode-languageserver-node/tree/HEAD/protocol)) | [`3.18.2` → `3.18.3`](https://renovatebot.com/diffs/npm/vscode-languageserver-protocol/3.18.2/3.18.3) |  |  |  |  | | [vscode-languageserver-textdocument](https://redirect.github.com/Microsoft/vscode-languageserver-node) ([source](https://redirect.github.com/Microsoft/vscode-languageserver-node/tree/HEAD/textDocument)) | [`1.0.12` → `1.0.14`](https://renovatebot.com/diffs/npm/vscode-languageserver-textdocument/1.0.12/1.0.14) |  |  |  |  | --- ### Release Notes <details> <summary>typescript-eslint/typescript-eslint (@​typescript-eslint/parser)</summary> ### [`v8.68.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/parser/CHANGELOG.md#8680-2026-08-24) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.67.0...v8.68.0) This was a version bump only for parser to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>typescript-eslint/typescript-eslint (@​typescript-eslint/scope-manager)</summary> ### [`v8.68.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/scope-manager/CHANGELOG.md#8680-2026-08-24) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.67.0...v8.68.0) This was a version bump only for scope-manager to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>typescript-eslint/typescript-eslint (@​typescript-eslint/visitor-keys)</summary> ### [`v8.68.0`](https://redirect.github.com/typescript-eslint/typescript-eslint/blob/HEAD/packages/visitor-keys/CHANGELOG.md#8680-2026-08-24) [Compare Source](https://redirect.github.com/typescript-eslint/typescript-eslint/compare/v8.67.0...v8.68.0) This was a version bump only for visitor-keys to align it with other projects, there were no code changes. See [GitHub Releases](https://redirect.github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0) for more information. You can read about our [versioning strategy](https://typescript-eslint.io/users/versioning) and [releases](https://typescript-eslint.io/users/releases) on our website. </details> <details> <summary>eslint/eslint (eslint)</summary> ### [`v10.9.1`](https://redirect.github.com/eslint/eslint/compare/v10.9.0...5c8c2417b9ff462f2dc4e54a062c59135b45b845) [Compare Source](https://redirect.github.com/eslint/eslint/compare/v10.9.0...v10.9.1) ### [`v10.9.0`](https://redirect.github.com/eslint/eslint/compare/v10.8.1...c27bc926e496985eb7911c09eb60914b2e4b5d0f) [Compare Source](https://redirect.github.com/eslint/eslint/compare/v10.8.1...v10.9.0) </details> <details> <summary>sveltejs/svelte (svelte)</summary> ### [`v5.57.0`](https://redirect.github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5570) [Compare Source](https://redirect.github.com/sveltejs/svelte/compare/svelte@5.56.10...svelte@5.57.0) ##### Minor Changes - feat: export `RenderOutput`, `SyncRenderOutput`, `Csp` and `Sha256Source` from `svelte/server` ([#​18648](https://redirect.github.com/sveltejs/svelte/pull/18648)) - feat: add `has` function to `createContext` ([#​18472](https://redirect.github.com/sveltejs/svelte/pull/18472)) - feat: support `defaultValue` on `<select>` ([#​18591](https://redirect.github.com/sveltejs/svelte/pull/18591)) - feat: add getOrInsert/getOrInsertComputed to SvelteMap ([#​18728](https://redirect.github.com/sveltejs/svelte/pull/18728)) ##### Patch Changes - fix: block template store subscriptions on the promise that assigns the store ([#​18582](https://redirect.github.com/sveltejs/svelte/pull/18582)) - fix: route $derived teardown errors through invoke\_error\_boundary ([#​18486](https://redirect.github.com/sveltejs/svelte/pull/18486)) - fix: track SvelteDate snapshots in reactions ([#​18700](https://redirect.github.com/sveltejs/svelte/pull/18700)) - fix: remove `<svelte:head>` anchors on unmount ([#​18697](https://redirect.github.com/sveltejs/svelte/pull/18697)) - fix: warn on undeclared shorthand event handlers on `<svelte:window>`, `<svelte:document>` and `<svelte:body>` ([#​18480](https://redirect.github.com/sveltejs/svelte/pull/18480)) - perf: reuse the cached value in the `<option>`/`<select>` value guard ([#​18713](https://redirect.github.com/sveltejs/svelte/pull/18713)) - fix: prevent malformed AST output for `<select>` with static `value` attribute ([#​18449](https://redirect.github.com/sveltejs/svelte/pull/18449)) - fix: apply ownership mutation ignores to binding assignments ([#​18718](https://redirect.github.com/sveltejs/svelte/pull/18718)) - fix: prevent onoutroend from firing twice when compilerOptions.hmr is true ([#​18655](https://redirect.github.com/sveltejs/svelte/pull/18655)) - fix: preserve whitespace after inline elements when printing ([#​18685](https://redirect.github.com/sveltejs/svelte/pull/18685)) - perf: fold SSR block-open markers into the branch's first push ([#​18712](https://redirect.github.com/sveltejs/svelte/pull/18712)) - fix: run `onDestroy` callbacks when a server render throws ([#​18585](https://redirect.github.com/sveltejs/svelte/pull/18585)) - fix: report `derived_invalid_export` for `export let x = $derived(...)` in runes mode ([#​18692](https://redirect.github.com/sveltejs/svelte/pull/18692)) - fix: never apply class hash to elements inside `<svelte:head>` ([#​18160](https://redirect.github.com/sveltejs/svelte/pull/18160)) - fix: keep `defaultChecked` on hydrated radio inputs with spread attributes ([#​18701](https://redirect.github.com/sveltejs/svelte/pull/18701)) - fix: accept `onfocusin`/`onfocusout` in `a11y_mouse_events_have_key_events` ([#​18689](https://redirect.github.com/sveltejs/svelte/pull/18689)) - perf: O(n²)→O(n) Map lookups for legacy `$:` reactive statement ordering ([#​18602](https://redirect.github.com/sveltejs/svelte/pull/18602)) - fix: distinct memoizer on style/class directives ([#​18466](https://redirect.github.com/sveltejs/svelte/pull/18466)) - fix: measure nested transitions before applying their starting styles ([#​18647](https://redirect.github.com/sveltejs/svelte/pull/18647)) - fix: don't turn component instances stored in `$state` into state proxies ([#​18646](https://redirect.github.com/sveltejs/svelte/pull/18646)) - perf: emit `$.only_child` for elements with a single child ([#​18717](https://redirect.github.com/sveltejs/svelte/pull/18717)) - fix: omit `bind:focused` from SSR output (it has no HTML attribute) ([#​18724](https://redirect.github.com/sveltejs/svelte/pull/18724)) - fix: more robust rendering of Svelte custom element slots ([#​18710](https://redirect.github.com/sveltejs/svelte/pull/18710)) - perf: optimize simple object destructuring in `@const` tags ([#​18390](https://redirect.github.com/sveltejs/svelte/pull/18390)) - fix: properly apply static textarea value attribute during CSR ([#​18727](https://redirect.github.com/sveltejs/svelte/pull/18727)) - fix: end a restored reaction context at the end of its synchronous segment ([#​18694](https://redirect.github.com/sveltejs/svelte/pull/18694)) - fix: keep the dependencies of a reaction that throws, so deriveds it read are neither leaked nor stuck in their error ([#​18703](https://redirect.github.com/sveltejs/svelte/pull/18703)) - fix: don't resurrect outroing elements when an ancestor block is paused and resumed ([#​18431](https://redirect.github.com/sveltejs/svelte/pull/18431)) - perf: use `$.comment()` for single-comment templates ([#​18714](https://redirect.github.com/sveltejs/svelte/pull/18714)) - chore: move `@types/trusted-types` to devDependencies ([#​18730](https://redirect.github.com/sveltejs/svelte/pull/18730)) - perf: store setters cache as `Set` instead of `Array` ([#​18251](https://redirect.github.com/sveltejs/svelte/pull/18251)) - fix: transform derived assignments and select function bindings correctly during server-side rendering ([#​18669](https://redirect.github.com/sveltejs/svelte/pull/18669)) - fix: keep boolean attributes with an empty string value when rendering attribute objects on the server ([#​18721](https://redirect.github.com/sveltejs/svelte/pull/18721)) - fix: sync `SvelteURL` port signal when the protocol setter clears the port ([#​18705](https://redirect.github.com/sveltejs/svelte/pull/18705)) - fix: block declaration tags and `{@const}` on async values read inside closures ([#​18533](https://redirect.github.com/sveltejs/svelte/pull/18533)) - fix: avoid css tree-shaking for exported Snippet ([#​18540](https://redirect.github.com/sveltejs/svelte/pull/18540)) - perf: treat `<img loading>` as a static element again ([#​18711](https://redirect.github.com/sveltejs/svelte/pull/18711)) - fix: prevent `selectedcontent` mutation from changing the selected option ([#​18495](https://redirect.github.com/sveltejs/svelte/pull/18495)) - fix: avoid `NaN` keyframe values in `slide` transition for elements without a layout box ([#​18430](https://redirect.github.com/sveltejs/svelte/pull/18430)) - fix: preserve line feed character references in attribute values ([#​18691](https://redirect.github.com/sveltejs/svelte/pull/18691)) - fix: decode uppercase-`X` hex numeric character references (`&#X...;`) ([#​18708](https://redirect.github.com/sveltejs/svelte/pull/18708)) - chore: clarify when `$effect.pre` runs relative to DOM updates ([#​18534](https://redirect.github.com/sveltejs/svelte/pull/18534)) - fix: scope SSR boundary failed snippets to their boundary ([#​18593](https://redirect.github.com/sveltejs/svelte/pull/18593)) </details> <details> <summary>tinylibs/tinypool (tinypool)</summary> ### [`v2.1.2`](https://redirect.github.com/tinylibs/tinypool/releases/tag/v2.1.2) [Compare Source](https://redirect.github.com/tinylibs/tinypool/compare/v2.1.1...v2.1.2) Contains security fix for <https://github.com/tinylibs/tinypool/security/advisories/GHSA-85c8-ppgw-ccpr>. #### What's Changed - fix: guard worker filename from proto pollution by [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [#​135](https://redirect.github.com/tinylibs/tinypool/pull/135) **Full Changelog**: <https://github.com/tinylibs/tinypool/compare/v2.1.1...v2.1.2> ### [`v2.1.1`](https://redirect.github.com/tinylibs/tinypool/releases/tag/v2.1.1) [Compare Source](https://redirect.github.com/tinylibs/tinypool/compare/v2.1.0...v2.1.1) Contains security fix for <https://github.com/tinylibs/tinypool/security/advisories/GHSA-5gmw-xhrv-c9v3>. #### What's Changed - fix: guard worker options from proto pollution by [@​AriPerkkio](https://redirect.github.com/AriPerkkio) in [#​134](https://redirect.github.com/tinylibs/tinypool/pull/134) **Full Changelog**: <https://github.com/tinylibs/tinypool/compare/v2.1.0...v2.1.1> </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Cameron <cameron.clark@hey.com> |
||
|
renovate[bot]
|
b9559fb8e9 |
chore(deps): update oxc to ^0.148.0 (#26221)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [@oxc-project/types](https://oxc.rs) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/npm/oxc-types)) | [`^0.147.0` → `^0.148.0`](https://renovatebot.com/diffs/npm/@oxc-project%2ftypes/0.147.0/0.148.0) |  |  |  |  | | [oxc-parser](https://oxc.rs/docs/guide/usage/parser) ([source](https://redirect.github.com/oxc-project/oxc/tree/HEAD/napi/parser)) | [`^0.147.0` → `^0.148.0`](https://renovatebot.com/diffs/npm/oxc-parser/0.147.0/0.148.0) |  |  |  |  | --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
oxc-guard
|
0b4e2e67f4 |
release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
# Oxlint ### 🚀 Features -oxfmt_v0.66.0 apps_v1.81.0 oxlint_v1.81.0 |
||
|
oxc-guard
|
894c8f9cd8 |
release(crates): oxc v0.148.0 (#26198)
### 💥 BREAKING CHANGES -crates_v0.148.0 |
||
|
Sysix
|
9e1b635d34 |
refactor(oxlint/lsp): delay String Conversion for FixedContent to CodeAction properties (#26176)
**Before:** Converting `Fix` to `FixContent` did convert `Cow` into `String` and stored into the `ServerLinter.code_action` Map, to get requested later by the client, where we convert `FixContent` to `CodeAction` (where we need the `String` format) **After:** Consume directly `Fix` `Cow` fields, and delay to conversion to `String` until the `CodeAction` is requested to be converted. So only downside I see, is that `textDocument/codeAction` is requested more times than a `textDocument/diagnostic` request. So the conversion does happen more times, but get released quickly. |
||
|
leaysgur
|
9f81002229 |
fix(formatter): re-add suppressed statement terminators per options.semi (#26220)
```js // input (semi: true) // oxfmt-ignore const a = x // before // oxfmt-ignore const a = x // after // oxfmt-ignore const a = x; ``` ```js // input (semi: false) let a = 1; // oxfmt-ignore [b].sort(); // before let a = 1 // oxfmt-ignore [b].sort(); // <- ASI failure // after let a = 1 // oxfmt-ignore ;[b].sort() // <- OK ``` |
||
|
leaysgur
|
769ffd590d |
fix(formatter): print suppressed typecast parens (#26218)
```js
// input
foo(
// oxfmt-ignore
/** @type {A} */ (x),
/** @type {B} */ (y),
);
// before
foo(
// oxfmt-ignore
/** @type {A} */ x, // <-
/** @type {B} */ (y),
);
// after
foo(
// oxfmt-ignore
/** @type {A} */ (x), // <-
/** @type {B} */ (y),
);
```
|
||
|
leaysgur
|
5ff57f83c0 |
fix(formatter/sort-imports): handle custom side effect groups (#26217)
Fixes #26165 - `side_effect` is predefined selector, it cannot be used as custom group name - respect custom group which uses `side_effect` as side-effect-import correctly - fix metadata detection bug |
||
|
leaysgur
|
2f4d759717 |
fix(formatter): do not skip cast comment lookup (#26216)
Fixes #26202 --- The trigger for this issue is the presence of a suppressed typecast. ```js // oxfmt-ignore const cast = /** c */ (x) ``` Because a comment had already been printed in a subsequent typecast check without going through the casting mechanism, it failed to find its own cast comment. |
||
|
leaysgur
|
1213e12c0e |
fix(formatter): preserve comment for statement terminators and binary casts (#26213)
Refine comment position preserving rules, for statements and binary casts. Fixes idempotency issues for several sites. --- Trailing is the same-line run only. A newline-preceded comment is never trailing. It defers to the next node's leading pass, staying own-line with its blank lines. Comments around `as`/`satisfies` keep their source side and line-start side, within the grammar-defined slots (line terminator is not allowed between `as` and before). |
||
|
Sysix
|
8af5703b56 |
chore(oxlint/generate-config-types): remove unneeded DummyRule tsType mapping (#26206)
With the major update in https://github.com/oxc-project/oxc/pull/26193, this code does not do anything. Removing it. |
||
|
renovate[bot]
|
d3669fa41a |
chore(deps): update crate-ci/typos action to v1.50.0 (#26205)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [crate-ci/typos](https://redirect.github.com/crate-ci/typos) | action | minor | `v1.49.1` → `v1.50.0` | --- ### Release Notes <details> <summary>crate-ci/typos (crate-ci/typos)</summary> ### [`v1.50.0`](https://redirect.github.com/crate-ci/typos/releases/tag/v1.50.0) [Compare Source](https://redirect.github.com/crate-ci/typos/compare/v1.49.1...v1.50.0) #### \[1.50.0] - 2026-08-28 ##### Features - Updated the dictionary with the [August 2026](https://redirect.github.com/crate-ci/typos/issues/1587) changes </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
2436b4407c |
chore(deps): update pnpm to v11.24.0 (#26203)
> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [pnpm](https://pnpm.io) ([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm11/pnpm)) | [`11.17.0` → `11.24.0`](https://renovatebot.com/diffs/npm/pnpm/11.17.0/11.24.0) |  |  |  |  | --- ### Release Notes <details> <summary>pnpm/pnpm (pnpm)</summary> ### [`v11.24.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.24.0): pnpm 11.24 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.23.0...v11.24.0) ##### Minor Changes - Added global build approvals [pnpm/pnpm#14101](https://redirect.github.com/pnpm/pnpm/issues/14101). ##### Patch Changes - Fixed pnpm v11 incorrectly reporting `confirmModulesPurge` as unrecognized when set in `pnpm-workspace.yaml`. The Rust CLI now identifies the unsupported option as a pnpm v11 setting instead of suggesting an unrelated setting. - `pnpm install --frozen-lockfile` no longer fails with `ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE` when the pinned pnpm version recorded in `pnpm-lock.yaml` has to be re-resolved before it can be installed. It runs the pnpm version the lockfile pins and leaves the lockfile unchanged [#​14124](https://redirect.github.com/pnpm/pnpm/issues/14124). - Under `nodeLinker: hoisted`, peer-resolution variants of an injected directory dependency (a `file:` snapshot) are materialized as separate copies again instead of collapsing onto the first-seen variant. Each copy keeps its own peer-resolved dependency set, so a project pinning one peer version no longer resolves another project's variant — Bit root components with conflicting peers across injected copies rely on this. - Fixed `pnpm install --merge-git-branch-lockfiles --frozen-lockfile` failing with `ERR_PNPM_OUTDATED_LOCKFILE` when a branch lockfile predates the removal of a dependency, or its move to another dependency group [#​13966](https://redirect.github.com/pnpm/pnpm/issues/13966). A dependency that no project declares anymore is no longer reinstated by the merge, and the packages it was the only path to are dropped with it. - Batch workspace publishing accepts a shared scope-specific credential, rejects mismatched credentials for a registry before publishing, and runs the `publish` and `postpublish` scripts after each completed registry group [pnpm/pnpm#14101](https://redirect.github.com/pnpm/pnpm/issues/14101). - The Rust CLI now honors five settings it recognized but ignored: `updateNotifier`, `legacyDirFiltering`, `initAuthorName` / `initAuthorEmail` / `initAuthorUrl`, `initLicense`, and `initVersion`. `pnpm install` and `pnpm add` check once a day for a newer pnpm and print how to get it (turn it off with `updateNotifier: false`); a `{<dir>}` filter selector can go back to matching the subtree below the directory with `legacyDirFiltering: true`; and `pnpm init` writes the configured author, license, and version into the `package.json` it scaffolds. `PNPM_CONFIG_INIT_VERSION` is now read as well. `maxsockets`, npm's spelling of `maxSockets`, is no longer ignored: both spellings are read from `pnpm-workspace.yaml`, the global config file, the environment, and the command line, in that increasing order of precedence — a value passed on the command line now wins even when the two sides spelled the setting differently. A `lastUpdateCheck` timestamp dated in the future — after a clock change, a restored snapshot, or a hand-edited state file — no longer silences the update check until that time comes around. `legacyDirFiltering` no longer reaches the workspace-root selectors pnpm generates for itself: the `!{<workspace-root>}` exclusion a recursive `run` / `exec` / `add` / `test` appends, and the `{<workspace-root>}` inclusion `--workspace-root` appends. Read as subtree matches they named every project below the root, so a recursive command under the setting selected nothing at all, and `--workspace-root` pulled in every project below the root instead of the root alone [#​14101](https://redirect.github.com/pnpm/pnpm/issues/14101). - `pnpm install --frozen-lockfile` no longer fails when `pnpm-lock.yaml` records the pinned pnpm version alongside an engine package the running pnpm does not install it from. An entry pinning another version is still refused, and a plain install rewrites the block [#​14124](https://redirect.github.com/pnpm/pnpm/issues/14124). ### [`v11.23.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.23.0): pnpm 11.23 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.22.0...v11.23.0) #### Minor Changes - `pnpm config get` and `pnpm config list` now show the settings pnpm acts on under their documented names: - `registries` shows the registries pnpm resolves from, merged across every source (`.npmrc`, `pnpm-workspace.yaml`, the global config, CLI flags), in the shape the setting is written in: keyed by registry URL, with the default registry declared as the bare `@` scope. Built-in routes are included — the `@jsr` scope and the `npmjs` and `gh` prefixes — unless pointed elsewhere. Previously `pnpm config get registries` printed `undefined`. - `update` and `audit` show the effective sections, whichever spelling set them. The deprecated internal spellings (`updateConfig`, `auditConfig`, `auditLevel`) are no longer listed. - `catalogs` shows the complete resolved catalog set — the singular `catalog` block is its `default` entry — whichever spelling declared it. - The `registry` and `@scope:registry` entries show the merged routes rather than raw `.npmrc` values, so they always agree with the `registries` view. - Settings that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level `pnpm-workspace.yaml` (where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example, `globalShims` is a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys in a project's `pnpm-workspace.yaml`, previously ignored silently, are now reported the same way. `pnpm config get <key>` and `pnpm get <key>` no longer print config-load warnings, so a script capturing the value gets the value alone. - The `importPackage` pnpmfile hook is deprecated. pnpm now prints a warning when a pnpmfile defines it, and the hook will be removed in the next major version. It also opts the installation out of the parallel package importer, making installation slower. If you rely on this hook, comment on [#​14101](https://redirect.github.com/pnpm/pnpm/issues/14101). - `node_modules/.modules.yaml` no longer records the registries an install resolved from, and the recorded copy is dropped from the file on the first install that rewrites it. It dated from the lockfile format that spelled a dependency's path relative to its registry, where reading an installed tree meant knowing the registries it was installed with. Dependency paths have not carried a registry for several major versions, and the recorded copy outlived its use: `pnpm list`, `pnpm why`, and single-project installs preferred it over the project's own configuration, so a project whose registry had changed since its last install was still read through the old one. They now use the configured registries, like every other command already did. - When `enableGlobalVirtualStore` is on, every process pnpm spawns for the project (`pnpm run`, `pnpm exec`, lifecycle scripts) now receives a `NODE_PATH` pointing at the project's hoisted `node_modules`, plus a `NODE_OPTIONS` `--import` flag that registers a resolve hook restoring `NODE_PATH` lookups for ESM imports. Dependencies that import undeclared ("phantom") packages keep resolving under the global virtual store — for both CommonJS and ESM — without installing the `@pnpm/plugin-esm-node-path` config dependency [pnpm/pnpm#9618](https://redirect.github.com/pnpm/pnpm/issues/9618). Tools run by `pnpm dlx` resolve such dependencies too: the JS CLI passes them the same environment, while the Rust CLI's dlx cache is self-contained, so its layout already exposes them. - A registry can now declare that its abbreviated metadata carries the `time` field, so `resolutionMode: time-based` reads the full metadata document only from the registries that need it: ```yaml resolutionMode: time-based registries: https://npm.internal.example/: supportsTimeField: true ``` `registry.npmjs.org` omits `time` from abbreviated metadata, so a time-based resolution has to fall back to the much larger full document. That fallback used to be all-or-nothing: `registrySupportsTimeField` answered for every registry at once, so a project resolving from both the public registry and a Verdaccio instance either paid for full metadata everywhere or claimed a `time` field npmjs does not serve. The answer is now per registry, and `registrySupportsTimeField` remains the answer for every registry that does not declare one. The declaration is also sent to a pnpr server, which applies it to the resolution it runs on the client's behalf. - A pnpr resolve request now carries the client's registries the way the `registries` setting declares them — keyed by URL, with the scopes routed to each, the bare-specifier prefix each answers to, and each one's `serverType` — in place of the prefix map it used to send. The server routes them through the same inversion the config reader runs, so a pnpr-served install resolves a scoped dependency from the registry that scope is routed to, which it previously could not: only the default registry and the prefix-addressed ones reached the server. A declared `serverType` reaches it too, so the tarball URLs pnpr omits from the lockfile match the ones the client reconstructs. Built-in scope routes the project has not pointed elsewhere are not declared, so a pnpr server's allowlist is not asked about `npm.jsr.io` on requests that resolve no JSR package. A registry a request only declares is no longer refused up front for being off the server's allowlist — a client describes its whole configuration, including scopes a given resolve never reaches, so a stray `@scope:registry` in a developer's `~/.npmrc` no longer fails every install against a pnpr server that does not serve it. The boundary moves to the fetch itself: an origin the resolve does reach is refused before the request leaves the server, with the same message. This changes the resolve and verify-lockfile request bodies. A pnpr server and its clients have to be on matching versions; the protocol is still experimental and unversioned. - The `registries` setting now declares a registry once, keyed by its URL, with everything about that registry in the entry: how it lays out tarball URLs, the scopes routed to it, and the bare-specifier prefix it answers to. ```yaml registries: https://artifactory.example.com/artifactory/api/npm/npm-virtual/: serverType: artifactory scopes: ['@acme', '@acme-internal'] prefix: work ``` - **`serverType`** tells pnpm how the registry lays out its tarball URLs, which decides whether a URL can be omitted from `pnpm-lock.yaml`: - **undeclared** (the default) — strict. Only the exact canonical URL is treated as reconstructible. - **`npm`** — the registry behaves like `registry.npmjs.org`, which also serves a scoped package from its percent-encoded path. Declare this for a faithful mirror or caching proxy of the public registry so its tarball URLs can be omitted too. - **`artifactory`** — JFrog Artifactory repeats the scope in a scoped package's tarball filename (`@acme/widget/-/@acme/widget-1.0.0.tgz`) where the npm registry strips it (`@acme/widget/-/widget-1.0.0.tgz`). Declaring it lets pnpm rebuild that URL, so it is omitted from `pnpm-lock.yaml` instead of being written out for every scoped package [pnpm/get-npm-tarball-url#16](https://redirect.github.com/pnpm/get-npm-tarball-url/issues/16). - **`scopes`** lists the `@`-prefixed scopes that resolve from this registry. A bare `'@'` is the scope-less default registry, the one the `registry` setting names. - **`prefix`** is the alias a dependency addresses this registry by, as in `"foo": "work:^1.0.0"`. The layout is never inferred from the registry URL, so nothing changes unless you declare it; `registry.npmjs.org` continues to behave as `npm` without being declared. Because the lockfile depends on `serverType`, it is read from `pnpm-workspace.yaml` only — a `serverType` in the global `config.yaml` is ignored, so one developer's machine cannot shape a lockfile their collaborators read back with a different layout. Credentials are rejected in this setting, in a key as well as in a field, and still belong in `.npmrc`. An entry that routes nothing to itself and matches no configured registry is reported as a warning rather than silently ignored. ##### Migrating The older `registries` shape, a map of `<scope>: <url>` strings, still works and needs no change: ```yaml registries: '@acme': https://npm.acme.example/ ``` `namedRegistries` is deprecated in favor of the `prefix` field, and is still read for prefixes `registries` does not declare. `toLockfileResolution` and `isCanonicalRegistryTarballUrl` now take their registry and layout as an options object rather than positional arguments, so `@pnpm/lockfile.utils` and `@pnpm/resolving.tarball-url` get a major bump. - An install that had to re-hash store files to verify them now reports it. If that cost more than a second, it says how long — `The integrity of N files was checked in 2.5s.` — and if it was quick but covered more than a thousand files, it names the cause instead: their timestamps changed since the store recorded them, which a backup tool, an antivirus scan or a copied store can do. - Added `virtualStoreType`, which names where the virtual store lives — one store per machine, or one per project: ```yaml virtualStoreType: global # or: project ``` It is the canonical spelling of `enableGlobalVirtualStore`, which keeps working. When a project sets both, `virtualStoreType` wins. It can also be set through `PNPM_CONFIG_VIRTUAL_STORE_TYPE` and read back with `pnpm config get virtualStoreType`. The default is unchanged — `project`, so the shared store stays opt-in. The setting is independent of `nodeLinker`. `isolated` and `pnp` both work with either store type, and `hoisted` writes no virtual store at all, so it is unaffected. #### Patch Changes - `pnpm add --allow-build` now adds to the `allowBuilds` entries already in `pnpm-workspace.yaml` instead of replacing them [#​13872](https://redirect.github.com/pnpm/pnpm/issues/13872). - Kept pending build approvals available after removing an unrelated dependency. - `pnpm approve-builds` now removes `onlyBuiltDependencies`, `onlyBuiltDependenciesFile`, `neverBuiltDependencies`, and `ignoredBuiltDependencies` from `pnpm-workspace.yaml` when it writes `allowBuilds`. Those settings were replaced by `allowBuilds` in pnpm 11 and silently ignored since, so a workspace migrated from pnpm 10 kept them around looking active. - `pnpm audit` no longer reports a patched version that was never published or is deprecated. The inferred patched range (e.g. `>=4.17.24` from `<=4.17.23`) is now checked against the registry packument, and the report is corrected to the lowest non-deprecated published version that satisfies it (e.g. `>=4.18.1` when `4.17.24` does not exist and `4.18.0` is deprecated). When no published version satisfies the range, the report shows `Patched versions: None`. This also prevents `pnpm audit --fix` from adding overrides or `minimumReleaseAgeExclude` entries for patches that do not exist [#​13824](https://redirect.github.com/pnpm/pnpm/issues/13824). `pnpm audit --fix` and `pnpm audit --fix update` no longer add a `minimumReleaseAgeExclude` entry when the registry packument shows that the minimum patched version was never published. Previously such entries were written for versions that do not exist, which would have let a later publish of that version bypass the `minimumReleaseAge` gate [#​11563](https://redirect.github.com/pnpm/pnpm/issues/11563). The `--json` output of `pnpm audit` now returns `patched_versions: null` for advisories whose inferred patch is not available (never published, skipped, yanked, or deprecated), making it easier for tooling to distinguish "no fix available" from "fix available at version X". - Fixed `pnpm patch-commit` in project and edit paths containing non-ASCII characters. - The package and bump pickers of `pnpm change` now size their page from the terminal height instead of always showing 7 rows. They fall back to 7 rows when the terminal height is unknown [`pnpm/pnpm#13815`](https://redirect.github.com/pnpm/pnpm/issues/13815). - Canceling a `pnpm change` prompt with Ctrl-c no longer prints a stack trace. It reports `Change canceled` and exits with a success status, like the other interactive commands [#​13814](https://redirect.github.com/pnpm/pnpm/issues/13814). - Re-fetch full registry metadata when `minimumReleaseAge` is enabled and an abbreviated packument's `time` map omits timestamps for some versions. This prevents mature versions from being filtered out and resolution from falling back to the lowest matching version [pnpm/pnpm#13741](https://redirect.github.com/pnpm/pnpm/issues/13741). - A config dependency carrying an inline integrity (the `<version>+<integrity>` form, or the object form without a `tarball`) now takes its tarball URL from the registry's packument instead of deriving it from the registry URL, so migrating one costs an extra metadata request. On a registry that serves tarballs from a path pnpm cannot derive, GitLab's group endpoint for one, installing such a config dependency failed with a 404 while the same package installed fine as a regular dependency [#​13765](https://redirect.github.com/pnpm/pnpm/issues/13765). - Fixed `PNPM_CONFIG_NODE_VERSION` being ignored when setting the Node.js version used for compatibility checks. - A custom fetcher can no longer replace the archive integrity that `pnpm-lock.yaml` pins: the locked value is restored after a `canFetch` or `fetch` hook rewrites the resolution, and delegating a locked archive to a directory or git source now fails instead of installing unverified content. The Rust CLI now also loads the pnpmfiles named by the `pnpmfile` setting (a single path or an ordered list), and hands custom fetchers native `localTarball` and `remoteTarball` callbacks — including on a fresh install that has to compute a missing tarball integrity, which is then reused by later offline installs. File maps a fetcher returns are accepted only when they match what those native callbacks extracted. - Fixed an issue where running `pnpm dedupe --check` in projects with `nodeLinker: hoisted` would cause dependencies to be moved out of `node_modules` into `node_modules/.ignored`. - `pnpm deploy --prod` and `pnpm deploy --no-optional` no longer list the excluded dependency groups in the deployed `package.json` and `pnpm-lock.yaml`. The deployed lockfile referenced packages that the deploy left out of its graph, so installing in the deploy directory afterwards created dangling symlinks [#​13623](https://redirect.github.com/pnpm/pnpm/issues/13623). - Don't treat files like `license16.json` as a package license when deciding if the workspace LICENSE file should be included in the packed package. - `pnpm exec --recursive --no-reporter-hide-prefix` no longer prints a blank prefixed line after each chunk of a command's output, and no longer splits a line in two when it straddles a chunk boundary. - Fixed `404` errors when installing from a registry that serves scoped packages only from a percent-encoded path, such as GitHub Enterprise Server. Outside `registry.npmjs.org`, a tarball URL that encodes the scope separator as `%2f` or `%2F` is no longer mistaken for one that pnpm can rebuild from the package name, version, and registry, so it is kept in `pnpm-lock.yaml` and requested verbatim on the next install [#​13534](https://redirect.github.com/pnpm/pnpm/issues/13534). - Fixed `trustPolicyExclude` and `minimumReleaseAgeExclude` being ignored when set to a single string instead of a list. The value was read one character at a time, so the exclusion never matched the package it named — and a `*` anywhere in it matched every package, silently switching the policy off. - `pnpm init` now pins the exact pnpm version instead of a `^` range, and records it in the `packageManager` field alongside `devEngines.packageManager`. Corepack reads only `packageManager` and accepts nothing but an exact version, so it rejected the generated `package.json` with "expected a semver version" [pnpm/pnpm#13969](https://redirect.github.com/pnpm/pnpm/issues/13969). A package created inside an existing workspace is still left unpinned — it follows the pin at the workspace root — and `--no-init-package-manager` still scaffolds a manifest without any pin. In pnpm 12, `pnpm init` also honors `initType` and its `--init-type` flag, so the manifest it writes is the same one pnpm 11 writes. - Fixed an issue where package overrides were written into the metadata cache, causing removed overrides to keep applying on subsequent installs [pnpm/pnpm#13918](https://redirect.github.com/pnpm/pnpm/issues/13918). - On Windows, upgrading pnpm no longer leaves a stale `pnpm.ps1` behind. PowerShell resolves `pnpm.ps1` ahead of `pnpm.cmd`, so a shim written by an older installation kept running the previous version. Linking the pnpm CLI's bins now deletes it [#​13919](https://redirect.github.com/pnpm/pnpm/issues/13919). - Fixed an inconsistency where `minimumReleaseAgeExclude` (and `trustPolicyExclude`) wildcard/bare-name rules behaved differently in the evaluator and normalizer. A bare rule now consistently evaluates as matching every version, preventing unexpected behavior and silent widening of version policy exemptions when pnpm rewrites the workspace manifest [pnpm/pnpm#13725](https://redirect.github.com/pnpm/pnpm/issues/13725). - A frozen install no longer rewrites the `packageManagerDependencies` block of `pnpm-lock.yaml`. When the pnpm version pinned by `devEngines.packageManager` (or by `packageManager`) is missing from the lockfile or no longer matches it, `--frozen-lockfile` now fails with `ERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILE` instead of resolving the version and saving it, so a manifest whose pin was bumped without regenerating the lockfile can no longer pass CI [#​14009](https://redirect.github.com/pnpm/pnpm/issues/14009). - A git dependency installed over HTTPS from a hosted repository now keeps its branch, tag, or version range in the specifier recorded in `package.json`. It was written back without one, so the next `pnpm update` moved the dependency to the repository's default branch [#​13999](https://redirect.github.com/pnpm/pnpm/issues/13999). - Fixed `pnpm update --global --latest` failing with a 404 error when a globally installed package was not added from the registry by name. Packages installed from a local path (`link:`/`file:`), a git repository, a tarball URL, an `npm:` alias, or a named registry now keep their spec during a global update instead of being looked up by name in the default registry. See [#​12854](https://redirect.github.com/pnpm/pnpm/issues/12854). - Fix recursive `pnpm update <name>@<version>` so an exact pinned update stays scoped to the requested version line: copies of the same package on another major line — or, for a `0.x` request, another minor line — keep their locked resolution instead of being re-resolved along with the target. - Under `nodeLinker: hoisted`, a dependency declared against a peer-resolution variant of a package version is no longer dropped from the installed layout. All variants of a version share one hoisted copy, and edges pointing at any of them now resolve to it, so the depending project keeps the package in its `.package-map.json` and the depending package keeps it in its `node_modules/.bin`. - Fixed `pnpm install --merge-git-branch-lockfiles` deleting the per-branch lockfiles when the `lockfile` setting is `false`. Such an install never reads them, so it has nothing to merge them into and now leaves them alone. - Fixed `pnpm install` sometimes not exiting after printing `Done in Xs` [#​12297](https://redirect.github.com/pnpm/pnpm/issues/12297). - Fixed pnpm failing to read `.modules.yaml` files containing long dependency paths [#​13875](https://redirect.github.com/pnpm/pnpm/issues/13875). The manifest is now parsed as JSON (the format pnpm writes it in), falling back to the YAML parser only for manifests written by old pnpm versions. - With `preferSymlinkedExecutables`, `NODE_PATH` again points at the virtual store of the workspace root when pnpm is run from inside a workspace package, so scripts can resolve dependencies that live only in the hoisted store [#​13912](https://redirect.github.com/pnpm/pnpm/issues/13912). - Reduced registry metadata requests during dependency resolution by reusing cached metadata when lockfile preferences prove that no uncached version can win [pnpm/pnpm#13976](https://redirect.github.com/pnpm/pnpm/issues/13976). - `pnpm pkg get` and `pnpm pkg set` now accept hyphens inside a dot-notation property path, so `pnpm pkg get dependencies.some-package-name` reads the key instead of failing with `ERR_PNPM_UNEXPECTED_TOKEN_IN_PROPERTY_PATH`. The bracketed and quoted forms already worked and are unchanged. - A resolve request now carries the client's `resolutionMode`, so an install delegated to a pnpr server picks versions the way the client would. `time-based` and `lowest-direct` reached the server as nothing at all, leaving it on its `highest` default: the returned lockfile pinned the highest satisfying version of every dependency, and the setting appeared to be ignored. This adds a field to the resolve request body. A server older than its client ignores it and keeps resolving `highest`; the protocol is still experimental and unversioned. - Fixed `pnpm` installs using pnpr to honor the client's `autoInstallPeers`, `dedupePeers`, and `excludeLinksFromLockfile` settings [pnpm/pnpm#13389](https://redirect.github.com/pnpm/pnpm/issues/13389). - `pnpm remove` now prunes undecided entries (`"set this to true or false"`) from `allowBuilds` in `pnpm-workspace.yaml` when `sharedWorkspaceLockfile: true` and the corresponding packages are removed [pnpm/pnpm#13892](https://redirect.github.com/pnpm/pnpm/issues/13892). - Fixed workspace discovery for `pnpm-workspace.yaml` files without a `packages` field so commands only consider the workspace root instead of recursively scanning nested projects [#​14047](https://redirect.github.com/pnpm/pnpm/issues/14047). - A runtime installed through `devEngines.runtime` now matches the host when `supportedArchitectures` lists several platforms. Listing `os: [darwin, linux]` and `cpu: [x64, arm64]` used to install the runtime built for the first entry of each list, so a machine running Linux on arm64 got a macOS x64 Node.js that could not execute [#​13898](https://redirect.github.com/pnpm/pnpm/issues/13898). - `pnpm sbom` now fails with `ERR_PNPM_SBOM_MISSING_IMPORTERS` when `pnpm-lock.yaml` has no entry for a selected project, instead of writing an SBOM that under-reports that project's dependencies. Previously this crashed with `Cannot read properties of undefined (reading 'devDependencies')`. - `pnpm self-update` now rewrites a simple `devEngines.packageManager.version` range (`^`/`~`) to the newly installed version, keeping the operator — matching how `pnpm update` and `pnpm runtime set` rewrite ranges. Complex ranges such as `>=8.0.0` that the new version satisfies are still left unchanged [#​13935](https://redirect.github.com/pnpm/pnpm/issues/13935). - `pnpm self-update <tag>` no longer downgrades when the dist-tag points at the pnpm version already running and that version is younger than `minimumReleaseAge`. The maturity cutoff moved the tag back to the previous mature release, so `pnpm self-update next-12` on v12.0.0-rc.4 switched to v12.0.0-rc.3. - `pnpm set-script` now updates `package.json` instead of failing with `ERR_PNPM_NOT_IMPLEMENTED` [`pnpm/pnpm#13956`](https://redirect.github.com/pnpm/pnpm/issues/13956). - `pnpm update` now preserves the existing range operator when updating a prerelease dependency. See [#​7002](https://redirect.github.com/pnpm/pnpm/issues/7002). - Installs are faster in workspaces that declare inter-workspace dependencies with plain ranges (`"*"`, `"^1.2.3"`) rather than the `workspace:` protocol. With `preferWorkspacePackages` enabled, linking such a dependency no longer makes a registry request that cannot change the outcome — and workspace packages that were never published no longer cost a 404 on every install. - Added `fetchWarnTimeoutMs` and `fetchMinSpeedKiBps` to the Rust pnpm CLI and its N-API bindings. Slow registry metadata requests and tarball downloads now emit pnpm-compatible warnings without exposing URL credentials, query parameters, fragments, or control characters [pnpm/pnpm#12042](https://redirect.github.com/pnpm/pnpm/issues/12042). - An override change is now absorbed by the fast lockfile update even when another, unchanged override uses the `catalog:` protocol. Previously any `catalog:`-valued override forced a full re-resolution whenever the override list changed, which could move unrelated packages in the lockfile (for example after `pnpm audit --fix` added an override). - Packed workspace package manifests now preserve dependency order, making repeated `pnpm pack` output deterministic [#​10167](https://redirect.github.com/pnpm/pnpm/issues/10167). - `pnpm update <name>@<version>` now fails with `ERR_PNPM_UPDATE_VERSION_ON_INDIRECT_DEP` when the package is not a direct dependency of any selected project, instead of quietly updating it to whatever a fresh install would resolve. There is nowhere to record the version in that case, so the request cannot be honored, and the error points at the `overrides` entry that does pin a transitive dependency. Ranges and tags are unaffected, and a package that any selected project declares directly still takes its version as before. - `trustPolicy: no-downgrade` no longer aborts the install with `ERR_PNPM_MISSING_TIME` on registries that serve no per-version `time` field when `minimumReleaseAgeIgnoreMissingTime` is set. The trust check reads the same publish dates the `minimumReleaseAge` check does, so it now honors the same opt-in and skips the affected package with a warning [#​12446](https://redirect.github.com/pnpm/pnpm/issues/12446). `minimumReleaseAgeIgnoreMissingTime` no longer lets a lockfile entry the registry does not list pass the `minimumReleaseAge` check during lockfile verification. The opt-in covers a registry that cannot date its releases; a packument that does date every version it lists is saying it never published this one, which stays a hard failure. The missing-`time` warning now names the check it is reporting on, so a package whose `minimumReleaseAge` and `trustPolicy` checks are both skipped warns about both instead of only the first. - `pnpm update <pkg>@<version>` now updates only the selected packages and leaves unrelated dependencies unchanged. A selector that renames the package it installs — `pnpm update <alias>@npm:<pkg>@<version>` or the `jsr:` equivalent — now targets the package the alias installs rather than the alias. - Fixed `verifyDepsBeforeRun` being ignored when set to `install`, `warn`, `error`, or `prompt` through the `PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN` environment variable or the `--config.verify-deps-before-run` flag [#​13816](https://redirect.github.com/pnpm/pnpm/issues/13816). Only the boolean values were accepted before, so a string value was silently dropped. - `pnpm version <bump>` with `--dry-run` no longer edits `package.json` files. It now only reports the bumps it would make, and skips the working tree check, the version lifecycle scripts, the commit, and the tag [`pnpm/pnpm#13953`](https://redirect.github.com/pnpm/pnpm/issues/13953). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.22.0`](https://redirect.github.com/pnpm/pnpm/compare/v11.21.0...v11.22.0) [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.21.0...v11.22.0) ### [`v11.21.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.21.0): pnpm 11.21 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.20.0...v11.21.0) #### Minor Changes - Added interactive group selection to `pnpm update --global --interactive`. - Running `pnpm setup`, `pnpm self-update`, or a command that modifies the global installation (such as `pnpm add --global`) through `sudo` now prints a warning. pnpm keeps global packages and configuration in the invoking user's home directory, so running these commands as root silently operates on the root user's home directory instead of yours. They will fail with `ERR_PNPM_SUDO_NOT_SUPPORTED` in pnpm v12. Read-only global commands (such as `pnpm bin --global`) are unaffected. #### Patch Changes - Fixed pnpm failing to start under asynchronous Node.js module loaders when no `.pnpmfile.mjs` exists [pnpm/pnpm#11701](https://redirect.github.com/pnpm/pnpm/issues/11701). - Fixed `minimumReleaseAge` fallback for custom dist-tags so the selected version does not exceed the registry’s original tag target. - Removing a dependency from `package.json` and reinstalling no longer re-resolves the dependency graph. The importer's entry is dropped from `pnpm-lock.yaml`, anything it made unreachable is pruned, and a catalog entry that loses its last referent is removed — all without registry access. Installs still fall back to a full resolution when a package that stays resolves a peer dependency through the removed one, since that would change the surviving package's entry rather than only prune. - Changing a catalog entry to a different exact version no longer re-resolves the dependency graph. The package is replaced in `pnpm-lock.yaml` directly, reusing the same check the `pnpm.overrides` fast path applies: every locked dependency of the package must still satisfy the new version's manifest. Installs fall back to a full resolution when anything other than the catalog reaches the package — an importer that depends on it directly, or another package that depends on it — since the graph would then need both versions. - Fixed a CI regression where `github:owner/repo` dependencies (and other shorthand Git specifiers) would fail to install with `Permission denied (publickey)` on CI runners that lack SSH keys. The Git resolver no longer records an SSH URL unless the user explicitly wrote one (e.g. `git+ssh://` or `git@host:...`): - The repository visibility probe (an HTTP HEAD request) now retries transient failures such as `429 Too Many Requests`, so host throttling of CI runners is no longer mistaken for a private repository. - For non-SSH specifiers, anonymous HTTPS `git ls-remote` access is now tried before SSH, so a public repository whose visibility probe fails still resolves to a portable HTTPS URL instead of an SSH URL that only works where SSH keys are configured. - When every probe fails, the resolver falls back to HTTPS for shorthand and HTTPS-style specifiers, and only guesses SSH when the user explicitly provided an SSH URL. - A repository that could not be confirmed public is no longer resolved to the host's anonymous archive URL (e.g. `codeload.github.com`, which would fail to download for a private repository); it stays a regular `git` resolution so installs can use ambient Git credentials such as credential helpers and tokens. Note that a private repository that is reachable both over authenticated HTTPS and over SSH now resolves to its HTTPS URL, where previous versions recorded the SSH URL. Fixes [pnpm/pnpm#13276](https://redirect.github.com/pnpm/pnpm/issues/13276). <!-- cspell:ignore publickey --> - `ng build` and `nuxt build` now work under the global virtual store: pnpm's built-in compatibility extensions add the `tslib` dependency that `@angular/build` uses without declaring and the `unplugin` dependency that `@nuxt/vite-builder` v4 uses without declaring. - Fixed `link:` dependencies under `enableGlobalVirtualStore` so linked children are materialized and slots remain isolated by their resolved link targets. - An install that skips resolution because `pnpm-lock.yaml` is already up to date now reacts fully to packages the lockfile removed — for example after pulling a lockfile in which a dependency was deleted. The hoist layer is recomputed, so a package that became hoistable when a direct dependency was removed is hoisted, and `pendingBuilds` entries for removed packages are dropped instead of staying pending forever. - The held-back-update warning printed by `pnpm update` no longer fires when `minimumReleaseAge` is the actual reason a newer version was not picked. The warning's baseline now applies the same maturity cutoff as the pick itself, so it no longer wrongly attributes the hold-back to "your manifests and already installed dependencies" or recommends an override that would defeat the age gate. See [#​13071](https://redirect.github.com/pnpm/pnpm/issues/13071). - Checking whether `ignoredOptionalDependencies` is up to date no longer reorders the configured patterns. The check sorted them in place, which could move an `!` exclusion ahead of the pattern it excludes from and flip which optional dependencies were ignored. - Changing `autoInstallPeers`, `dedupePeers`, `peersSuffixMaxLength`, `excludeLinksFromLockfile`, or `injectWorkspacePackages` no longer re-resolves the dependency graph when the lockfile proves the setting cannot affect it: no package or project declares a peer dependency for the peer settings, and no project depends on a directory or on another workspace project for the link and injection settings. The new setting is recorded in `pnpm-lock.yaml` and the install proceeds from the existing resolution. Every other case still falls back to a full resolution. - Adding, editing, or removing an entry in `patchedDependencies` no longer re-resolves the dependency graph. Resolution never reads a patch — it only records the patch file's hash against the package it matches — so the install now rewrites the affected entries in `pnpm-lock.yaml` and materializes the patched package from the store instead. Installs still fall back to a full resolution when the patched package is reachable as a peer dependency, and when the new configuration would leave a patch unused while `allowUnusedPatches` is off, so `ERR_PNPM_UNUSED_PATCH` is still reported. - Resolving a private git repository no longer blocks on an interactive credential prompt: `git ls-remote` now fails fast with an authentication error when git has no credentials for the repository [#​13522](https://redirect.github.com/pnpm/pnpm/issues/13522). - Lockfile verification now honors offline mode by using cached registry metadata instead of reaching the registry. When the required metadata is not available locally, verification reports the same `ERR_PNPM_NO_OFFLINE_META` condition used by offline resolution. - POSIX shell shims now follow symbolic links before computing `basedir`, preventing execution failures when a shim is invoked via an external symlink on `PATH` [#​13405](https://redirect.github.com/pnpm/pnpm/issues/13405). - The automatic `packageManager` version switch works again on registries whose tarball URLs point at a different host than the registry itself (load-balanced feed proxies, Artifactory-style mirrors). Package-manager entries are now always recorded with integrity-only resolutions — the download URL is derived from the trusted bootstrap registry instead — and entries persisted in an invalid shape by an earlier pnpm are discarded and re-resolved instead of failing every command [#​13619](https://redirect.github.com/pnpm/pnpm/issues/13619). - Registries that serve no npm signature metadata (private mirrors and feed proxies commonly strip `dist.signatures`) no longer break the automatic `packageManager` version switch and `pnpm self-update` [#​13147](https://redirect.github.com/pnpm/pnpm/issues/13147). When the configured registry cannot provide a verifiable signature, pnpm now fetches the signature from `registry.npmjs.org` and verifies it against the same embedded npm keys over the installed integrity — which proves exactly the same thing. If no signature can be obtained from either source (for example, both are unreachable, or the registry publishes only a `shasum`), pnpm proceeds with a warning instead of failing, but only when the packages resolve through a registry configured in the user's own (non-project) configuration; the download stays pinned by the lockfile integrity, and a signature that exists but does not validate still fails the switch. - `pnpm fetch`, and any install run with `virtualStoreOnly`, no longer writes a `.pnp.cjs` loader under `nodeLinker: pnp`. These installs populate the virtual store without linking the project, so the loader would have claimed the project resolves out of a store it was never linked into. The importer links and `node_modules/.package-map.json` were already skipped; the PnP loader now follows the same rule. - Prevent pnpm from removing project files when `modulesDir` resolves to the project root. - Speed up installs after adding `ignoredOptionalDependencies` patterns by removing newly ignored optional dependencies and pruning packages that are no longer reachable without resolving the dependency graph again. - When a failed install re-copies a bin script from the store, rerunning `pnpm install` now reapplies the executable bit to the bin instead of leaving it non-executable [#​12742](https://redirect.github.com/pnpm/pnpm/issues/12742). - `pnpm root -g` and `pnpm bin -g` now print warnings to stderr instead of stdout, so their stdout stays a clean, machine-readable path. Previously, running either command with `--global` in a project that pins a package manager (e.g. via the `packageManager` field) printed a warning like `[WARN] Using --global skips the package manager check for this project` ahead of the path, breaking programs that capture the output as a path [#​13672](https://redirect.github.com/pnpm/pnpm/issues/13672). In pnpm 12, `pnpm root -g` and `pnpm prefix -g` are now supported (they previously failed with `ERR_PNPM_CLI_ROOT_GLOBAL_UNSUPPORTED` / `ERR_PNPM_CLI_PREFIX_GLOBAL_UNSUPPORTED`), and the reporter output of `dlx`, `create`, `config`, `sbom`, `with`, `store`, `prefix`, `root`, and `bin` goes to stderr, matching pnpm 11. - `pnpm setup` no longer makes Node.js print a `MODULE_TYPELESS_PACKAGE_JSON` warning about `dist/worker.js` on every command. The `package.json` it writes next to a standalone executable now declares `"type": "module"`. - `pnpm update` without saving no longer records a version that the manifest's range excludes. The kept range stays authoritative: a requested version outside it is skipped with a warning, and a requested range, a dist tag, or `--latest` resolves within it instead of past it. Previously each of these could write a lockfile entry that contradicted its own specifier, which the next `pnpm install --frozen-lockfile` rejected with `ERR_PNPM_OUTDATED_LOCKFILE` [#​12764](https://redirect.github.com/pnpm/pnpm/issues/12764). - `pnpm version -r --json` now outputs `[]` instead of human-readable text when no pending changes exist [`pnpm/pnpm#13217`](https://redirect.github.com/pnpm/pnpm/issues/13217). <!-- sponsors --> #### Platinum Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://bit.cloud/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/bit.svg" width="80" alt="Bit"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://openai.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/openai_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/openai_light.svg" /> <img src="https://pnpm.io/img/users/openai_dark.svg" width="160" alt="OpenAI" /> </picture> </a> </td> </tr> </tbody> </table> #### Gold Sponsors <table> <tbody> <tr> <td align="center" valign="middle"> <a href="https://sanity.io/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/sanity.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/sanity_light.svg" /> <img src="https://pnpm.io/img/users/sanity.svg" width="120" alt="Sanity" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://discord.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/discord.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/discord_light.svg" /> <img src="https://pnpm.io/img/users/discord.svg" width="220" alt="Discord" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://vite.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"><img src="https://pnpm.io/img/users/vitejs.svg" width="42" alt="Vite"></a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://serpapi.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/serpapi_dark.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/serpapi_light.svg" /> <img src="https://pnpm.io/img/users/serpapi_dark.svg" width="160" alt="SerpApi" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://coderabbit.ai/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/coderabbit.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/coderabbit_light.svg" /> <img src="https://pnpm.io/img/users/coderabbit.svg" width="220" alt="CodeRabbit" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://stackblitz.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/stackblitz.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/stackblitz_light.svg" /> <img src="https://pnpm.io/img/users/stackblitz.svg" width="190" alt="Stackblitz" /> </picture> </a> </td> </tr> <tr> <td align="center" valign="middle"> <a href="https://workleap.com/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/workleap.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/workleap_light.svg" /> <img src="https://pnpm.io/img/users/workleap.svg" width="190" alt="Workleap" /> </picture> </a> </td> <td align="center" valign="middle"> <a href="https://nx.dev/?utm_source=pnpm&utm_medium=release_notes" target="_blank" rel="noopener noreferrer"> <picture> <source media="(prefers-color-scheme: light)" srcset="https://pnpm.io/img/users/nx.svg" /> <source media="(prefers-color-scheme: dark)" srcset="https://pnpm.io/img/users/nx_light.svg" /> <img src="https://pnpm.io/img/users/nx.svg" width="50" alt="Nx" /> </picture> </a> </td> </tr> </tbody> </table> <!-- sponsors end --> ### [`v11.20.0`](https://redirect.github.com/pnpm/pnpm/releases/tag/v11.20.0): pnpm 11.20 [Compare Source](https://redirect.github.com/pnpm/pnpm/compare/v11.19.0...v11.20.0) #### Minor Changes - **Security fix.** Affects projects using `namedRegistries` on pnpm 11.1.0–11.19.x. It is **semi-breaking** for those projects — see "If you use named registries" below. The lockfile recorded no marker for which registry a package came from. Packages were keyed by `name@version` alone, and entry lookup went through `refToRelative(ref, name)`, so a dependency you declared against one registry could be satisfied by an entry that was actually resolved from another. When two registries served the same name and version, both collapsed onto a single `packages:` entry and whichever resolved first decided the tarball every consumer got. That is a package-substitution risk: a package you expect from your private registry could be installed from a different registry that publishes the same name and version, and the lockfile recorded nothing that would let you tell. Packages resolved from a named registry are now recorded under registry-qualified keys (`<name>@<registryName>:<version>`, e.g. `foo@work:1.0.0`), so each registry gets its own entry and the lockfile pins which one a dependency came from. The lockfile format version is unchanged. Registry-qualified keys appear only for packages resolved from a named registry, so a project that does not use `namedRegistries` sees no difference, and older pnpm versions keep reading the file. ##### If you use named registries Your next non-frozen install re-keys those entries, which shows up as a lockfile diff. Commit it — that diff is the fix being applied. Review it: an entry that moves to a registry you did not expect is worth investigating. Everyone working on the project should be on this version or newer before you do. An older pnpm reads the re-keyed lockfile fine — frozen installs are unaffected — but it does not produce registry-qualified keys itself, so any install that updates the lockfile writes those entries back to the old shape, and the next install on a curren > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on the first day of the month" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
Dunqing
|
a3d33dda7c |
fix(semantic): skip body bindings in type parameters and this param (#26169)
#26099 resolves parameter and signature references before visiting the function body, so they cannot bind to declarations that only exist inside the body. That early pass only ran when the function had parameters or a return type. Type parameter constraints and a `this` parameter type are visited before that check, so a function whose signature has references only in those positions skipped the pass. Its references then resolved after the body was visited and bound to body-local types. ## Example ```ts type U = number; function f<T extends U>() { type U = string; return null! as T; } ``` Before this change, `U` in the constraint resolved to the body-local `type U = string`. TypeScript scopes local types to the function body, so it must resolve to the outer alias. The same happened for `function f(this: U) { type U = string }` and for arrow functions with type parameters. The early pass now runs for every function and arrow function. It returns immediately when the signature produced no references, so the `has_parameter() || return_type.is_some()` condition, which approximated that check, is no longer needed. Also adds a regression test for the compaction in `resolve_references_for_current_scope`: a resolved reference followed by an unresolved one must neither drop nor duplicate entries, and no existing test covered that ordering. Verified with the semantic and transformer unit tests, Clippy, `cargo coverage -- semantic`, and transform conformance; no snapshots changed. AI assistance: Claude Code was used to investigate, implement, and verify this change. The contributor is responsible for the submitted change. |
||
|
Dunqing
|
a09c3e0220 |
refactor(semantic): simplify resolve_references_for_current_scope (#26167)
Follow-up to https://github.com/oxc-project/oxc/pull/26099: make it readable and easy to understand. |
||
|
Armano
|
115955d048 |
feat(minifier): drop cases whose condition is statically false (#26172)
Add logic to drop switch cases whose test is never reached fixes #26141 |
||
|
leaysgur
|
1fb37b6e47 |
feat(formatter/css): format declaration-shaped raw-prelude rules (postcss nested config blocks) (#26194)
Fixes #26158 --- > Otherwise, [restore a mark](https://drafts.csswg.org/css-syntax-3/#token-stream-restore-a-mark) from input, then [consume a qualified rule](https://drafts.csswg.org/css-syntax-3/#consume-a-qualified-rule) from input, with nested set to true, and [<semicolon-token>](https://drafts.csswg.org/css-syntax-3/#typedef-semicolon-token) as the stop token. > https://drafts.csswg.org/css-syntax-3/#consume-block-contents When fallback happens: format block, keep prelude verbatim. |
||
|
Yuji Sugiura
|
cd00a2c635 |
chore(oxlint): regenerate config types by cargo lintgen (#26195)
Follow up on #26193. (Also fixes main CI failures) `json-schema-to-typescript`: `^15.0.4` → `^16.0.0` changed the output. |
||
|
leaysgur
|
286aa71962 |
chore(deps): bump fast_glob (#26192)
https://github.com/oxc-project/fast-glob/releases/tag/v1.1.1 |
||
|
renovate[bot]
|
c73a335a0b |
chore(deps): update dependency json-schema-to-typescript to v16 (#26193)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [json-schema-to-typescript](https://redirect.github.com/bcherny/json-schema-to-typescript) | [`^15.0.4` → `^16.0.0`](https://renovatebot.com/diffs/npm/json-schema-to-typescript/15.0.4/16.0.0) |  |  |  |  | --- ### Release Notes <details> <summary>bcherny/json-schema-to-typescript (json-schema-to-typescript)</summary> ### [`v16.0.0`](https://redirect.github.com/bcherny/json-schema-to-typescript/blob/HEAD/CHANGELOG.md#1600) [Compare Source](https://redirect.github.com/bcherny/json-schema-to-typescript/compare/5584e38566f0746633a08f4ad3b11439256967e7...7f72770eb854328c96b112be445da0306bebdbaf) This release collects the fixes and small features merged since 15.0.4. Several of them correct types that were previously emitted wrong, so existing schemas may generate different output; hence the major version. New: - [`e3c7776`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/e3c7776) Feat: Support OpenAPI 3.0 `nullable: true`, including next to a `$ref`; such schemas now emit `T | null` ([#​755](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/755), fixes [#​410](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/410)) - [`ab31f41`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/ab31f41) Feat: Support draft-3 / Swagger 2 property-level `required: true`; such properties are now emitted as required ([#​756](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/756), fixes [#​440](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/440), [#​6](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/6)) - [`111c187`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/111c187) Feat: Resolve draft-07 named-anchor `$ref`s (`"#name"` matching a sibling `$id: "#name"`) instead of crashing ([#​744](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/744), fixes [#​220](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/220)) May change emitted types for existing schemas: - [`efceb64`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/efceb64) Bugfix: Multiple `patternProperties` (or `patternProperties` with `additionalProperties: false`) are folded into one index signature typed as the union of their value types, instead of being dropped ([#​754](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/754), fixes [#​160](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/160), [#​315](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/315)) - [`b84b3da`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/b84b3da) Bugfix: `allOf` members made up only of unsupported keywords (eg. `if`/`then`, `not`) no longer add a stray `{[k: string]: unknown}` to the intersection ([#​743](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/743), fixes [#​369](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/369)) - [`d8618e5`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/d8618e5) Bugfix: `properties`/`patternProperties` on a nested schema were dropped when combined with `oneOf`/`anyOf`/`allOf`; they are now intersected with the compound type ([#​708](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/708), fixes [#​630](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/630)) - [`4eee0f1`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/4eee0f1) Bugfix: `$ref`s to definitions with dotted names (eg. `#/definitions/v1.ManagedFieldsEntry`) were truncated at the first dot (`V1`); the full name is now used (`V1ManagedFieldsEntry`) ([#​705](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/705), fixes [#​645](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/645)) - [`7a3dd8e`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/7a3dd8e) Bugfix: Nested arrays with `minItems`/`maxItems` are capped by the cumulative product of their bounds against `maxItems`, falling back to an unbounded array instead of hanging or emitting enormous tuple unions ([#​703](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/703), fixes [#​690](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/690)) - [`34a692c`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/34a692c) Bugfix: `type: null` (the JSON null value) is treated as `type: "null"` instead of as an untyped object ([#​702](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/702), fixes [#​667](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/667)) - [`0f9d309`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/0f9d309) Bugfix: `unreachableDefinitions` now declares definitions even when `declareExternallyReferenced` is off ([#​706](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/706), fixes [#​652](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/652)) - [`1900e1f`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/1900e1f) Bugfix: With `inferStringEnumKeysFromValues`, a `const` is emitted as a literal type again rather than a single-member enum ([#​701](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/701), fixes [#​666](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/666)) - [`606e359`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/606e359) Bugfix: A schema with an array `type` and `properties` (eg. `type: ['object', 'null']`) at the root or as an untitled definition compiled to `A & (A | null)`, making the non-object members unreachable; it now emits `A | null` ([#​753](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/753), supersedes [#​672](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/672)) - [`c73ea75`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/c73ea75) Bugfix: An empty schema inside `allOf` (eg. `allOf: [{$ref: '#/definitions/User'}, {}]`) collapsed the whole intersection to `unknown`; the empty member is now dropped and `User` is kept ([#​752](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/752), fixes [#​654](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/654)) - [`9c50776`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/9c50776) Bugfix: The `description` of an inline `items` schema is no longer dropped; it is added to the JSDoc of the array's declaration as an `Items: ...` paragraph ([#​751](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/751), fixes [#​660](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/660)) Fixes for crashes and output that did not compile: - [`b25c768`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/b25c768) Bugfix: A root-level `$ref` to a definition that is itself only a `$ref` no longer crashes with "Refs should have been resolved by the resolver!" ([#​741](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/741), fixes [#​740](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/740)) - [`b25c768`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/b25c768) Bugfix: A root-level `$ref` to a definition that refers back to itself (directly or through `items`/`properties`) compiles instead of crashing with the same error ([#​741](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/741), fixes [#​132](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/132), [#​730](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/730)). The referenced definition is still emitted as its own interface alongside the root type - [`107dd42`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/107dd42) Bugfix: Index signatures from `patternProperties`/`additionalProperties` are widened to cover sibling named properties, so the interface typechecks (TS2411). Index signatures that already typechecked are emitted type-equivalent to before ([#​704](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/704), fixes [#​671](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/671)) - [`a2234d3`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/a2234d3) Bugfix: `inferStringEnumKeysFromValues` no longer produces invalid enum members for non-string, empty or digit-leading values ([#​694](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/694), fixes [#​657](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/657)) - [`377c6a1`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/377c6a1) Bugfix: A named enum (`tsEnumNames`) in a position with no name no longer emits a nameless `enum` declaration; it degrades to a union of literals ([#​693](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/693), fixes [#​691](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/691)) - [`c44faed`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/c44faed) Bugfix: Generated type names can no longer start with a digit or collapse to an empty name ([#​698](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/698), fixes [#​640](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/640)) - [`8d8a141`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/8d8a141) Bugfix: Recursive schemas that reach the generator without a name (a self-referencing `$ref` with a sibling keyword such as `description`, a recursive `oneOf` under `components/schemas`, an untitled recursive schema in another file) are given a generated type name instead of overflowing the stack. Schemas that compiled before are unchanged, except that an anonymous recursive union with a `{}`/`true` member now keeps its alias (same type, one extra `export type`) ([#​760](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/760), fixes [#​482](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/482), [#​614](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/614)) Other: - [`bf06bbb`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/bf06bbb) Bugfix (CLI): Piping a schema on stdin no longer prints a `DEP0187` deprecation warning on Node 24 ([#​750](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/750)) - [`3abde40`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/3abde40) Perf: `compile()` no longer scans every definition once per parsed node; schemas with thousands of definitions compile much faster (schemastore's CloudFormation schema: \~54 s -> \~3 s). Generated output is unchanged ([#​759](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/759)) - [`b88891c`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/b88891c) Perf: Formatting large, mostly quote-free outputs is several times faster (prettier is told the output is a `.d.ts`, so it skips its JSX-detection scan); a caller's own `style.filepath` still wins. Generated output is unchanged ([#​758](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/758)) - [`16c2e77`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/16c2e77) Bugfix (CLI): relative `$ref`s are resolved against each schema file's own directory rather than `process.cwd()`, so a schema passed by path from another directory finds its siblings; an explicit `--cwd` still wins ([#​742](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/742), fixes [#​324](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/324), [#​680](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/680)) - [`9219636`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/9219636) Updated runtime dependencies: js-yaml 4 -> 5 (YAML files parse as before, [#​689](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/689)), prettier ^3.9 (short unions that fit on one line are no longer wrapped; users on the existing `^3.2.5` range may already see this), [@​apidevtools/json-schema-ref-parser](https://redirect.github.com/apidevtools/json-schema-ref-parser) ^11.9 ([#​686](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/686)) - [`a5834aa`](https://redirect.github.com/bcherny/json-schema-to-typescript/commit/a5834aa) Removed the `is-glob` dependency ([#​643](https://redirect.github.com/bcherny/json-schema-to-typescript/issues/643)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
leaysgur
|
9d0e3d34f3 |
chore(oxfmt): bump tinypool (#26191)
Security fixes: https://github.com/tinylibs/tinypool/releases |
||
|
Alexander S.
|
409b4e27f3 |
perf(lsp): increase concurrency level by available threads (#25153)
> Adjusts the Oxc language server startup to scale Tower LSP request handling concurrency based on the machine’s available parallelism, aiming to improve throughput on higher-core systems without fully saturating the host. The saturation is from personal feeling and did not get benchmarked. --------- Signed-off-by: Alexander S. <sysix@sysix-coding.de> Signed-off-by: Yuji Sugiura <6259812+leaysgur@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Yuji Sugiura <6259812+leaysgur@users.noreply.github.com> |
||
|
connorshea
|
464ddd1806 |
docs(linter): support a shared short description for jest/vitest rules (#26186)
AI Disclosure: Generated with Claude Code, Fable 5. Reviewed by me. This sets up the short_description to be added to the various rules shared between jest and vitest. `declare_oxc_lint!` now accepts a path to a shared constant for `short_description`, mirroring how `docs = SHARED_DOCUMENTATION` works. Like `documentation`, the handling is gated behind the `ruledocs` feature. A shared short description is added to `expect-expect`, `no-disabled-tests`, and `valid-expect`. Rules where the wording legitimately differs per framework (e.g. `no-alias-methods`) can keep per-plugin string literals, which remain supported. Or we can opt to add the raw strings on every one of these rules and drop the shared short desc idea, I don't have a strong preference either way. Once we decide and merge this, we can add the short descriptions for all the other remaining shared rules. We'll also need to split up the two remaining rules that are problematic (https://github.com/oxc-project/oxc/issues/23186), then we can expose the `short_description` field in the JSON rules formatter for use on the website's rules list view. |
||
|
renovate[bot]
|
ac817c6e50 |
chore(deps): update rust crate javascript-globals to v2 (#26185)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [javascript-globals](https://redirect.github.com/oxc-project/javascript-globals) | workspace.dependencies | major | `1.5.1` → `2.0.0` | --- ### Release Notes <details> <summary>oxc-project/javascript-globals (javascript-globals)</summary> ### [`v2.0.0`](https://redirect.github.com/oxc-project/javascript-globals/blob/HEAD/CHANGELOG.md#200---2026-08-27) [Compare Source](https://redirect.github.com/oxc-project/javascript-globals/compare/javascript-globals-v1.6.0...javascript-globals-v2.0.0) ##### Other - \[**breaking**] compact generated global tables ([#​280](https://redirect.github.com/oxc-project/javascript-globals/pull/280)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
c6ffd7f046 |
chore(deps): update crate-ci/typos action to v1.49.1 (#26184)
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [crate-ci/typos](https://redirect.github.com/crate-ci/typos) | action | patch | `v1.49.0` → `v1.49.1` | `v1.50.0` | --- ### Release Notes <details> <summary>crate-ci/typos (crate-ci/typos)</summary> ### [`v1.49.1`](https://redirect.github.com/crate-ci/typos/releases/tag/v1.49.1) [Compare Source](https://redirect.github.com/crate-ci/typos/compare/v1.49.0...v1.49.1) #### \[1.49.1] - 2026-08-27 ##### Fixes - Don't correct the brand name `HashiCorp` </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
connorshea
|
9db5ad39b5 |
docs(linter): add short description to vue/no-dupe-keys (#26183)
This rule was the only Vue rule missing a short description, so this fixes that. |
||
|
renovate[bot]
|
f1831d59ea |
chore(deps): update rust crates (#26179)
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [convert_case](https://redirect.github.com/rutrum/convert-case) | workspace.dependencies | minor | `0.11.0` → `0.12.0` | | [flate2](https://redirect.github.com/rust-lang/flate2-rs) | workspace.dependencies | patch | `1.1.9` → `1.1.10` | | [indexmap](https://redirect.github.com/indexmap-rs/indexmap) | workspace.dependencies | patch | `2.14.0` → `2.14.1` | | [mimalloc-safe](https://redirect.github.com/napi-rs/mimalloc-safe) | workspace.dependencies | patch | `0.1.64` → `0.1.65` | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>rutrum/convert-case (convert_case)</summary> ### [`v0.12.0`](https://redirect.github.com/rutrum/convert-case/blob/HEAD/CHANGELOG.md#0120-Optimizations) [Compare Source](https://redirect.github.com/rutrum/convert-case/compare/0.11.0...0.12.0) This release improves speed and memory efficiency. A couple techniques were used: - Character case checks first check ascii before doing the more expensive grapheme checks (which require heap allocations). - Delimiter only splits get a dedicated path in the `split` method. - The case of characters is computed upfront in a bitmask before checking individual boundary conditions in `split`. Built-in boundaries get a custom implementation built on top of this bitmask. | Benchmark | Before | After | Improvement | | ----------------------------------------------- | --------- | -------- | ----------- | | `snake_short` (`"hello_world"`) | 412 ns | 21.3 ns | −95% | | `lower_upper` (`"lowerUpperUpper"`) | 1,631 ns | 475 ns | −71% | | `acronym` (`"XMLRequest"`) | 1,108 ns | 418 ns | −62% | | `camel_set` (`"getTotalLength3D"`) | 3,844 ns | 643 ns | −83% | | `defaults_mixed` (9 boundaries) | 8,083 ns | 1,500 ns | −81% | | `defaults_long_snake` (265 chars) | 52,281 ns | 4,730 ns | −91% | | `unicode_cyrillic` (`"ПЕРСПЕКТИВА24"`) | 8,334 ns | 741 ns | −91% | | Full pipeline `from_to_all` (4 words x 14 x 14) | 1,230 µs | 263 µs | −79% | </details> <details> <summary>rust-lang/flate2-rs (flate2)</summary> ### [`v1.1.10`](https://redirect.github.com/rust-lang/flate2-rs/releases/tag/1.1.10) [Compare Source](https://redirect.github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10) #### What's Changed - feat: reuse zlib's decoder buffer by [@​Vaiz](https://redirect.github.com/Vaiz) in [#​532](https://redirect.github.com/rust-lang/flate2-rs/pull/532) - feat: add reset method for read::GzDecoder and buffered::GzDecoder by [@​Vaiz](https://redirect.github.com/Vaiz) in [#​534](https://redirect.github.com/rust-lang/flate2-rs/pull/534) - Drop cloudflare-zlib by [@​kornelski](https://redirect.github.com/kornelski) in [#​539](https://redirect.github.com/rust-lang/flate2-rs/pull/539) - Add a wrapper for the `Crc` struct by [@​MikkelPaulson](https://redirect.github.com/MikkelPaulson) in [#​540](https://redirect.github.com/rust-lang/flate2-rs/pull/540) - Bump miniz\_oxide to 0.9 by [@​oscargus](https://redirect.github.com/oscargus) in [#​543](https://redirect.github.com/rust-lang/flate2-rs/pull/543) - Upgrade miniz\_oxide and add unit tests of the different flush kinds by [@​fintelia](https://redirect.github.com/fintelia) in [#​498](https://redirect.github.com/rust-lang/flate2-rs/pull/498) - Fix infinite loop in writing gzip header/footer by [@​Shnatsel](https://redirect.github.com/Shnatsel) in [#​547](https://redirect.github.com/rust-lang/flate2-rs/pull/547) - test: generate corrupt gzip fixture at runtime by [@​nanookclaw](https://redirect.github.com/nanookclaw) in [#​550](https://redirect.github.com/rust-lang/flate2-rs/pull/550) - Reject oversized gzip extra fields by [@​Byron](https://redirect.github.com/Byron) in [#​553](https://redirect.github.com/rust-lang/flate2-rs/pull/553) - Reject incomplete deflate streams at EOF by [@​Guflly](https://redirect.github.com/Guflly) in [#​556](https://redirect.github.com/rust-lang/flate2-rs/pull/556) - Include `README.md` in a private module by [@​bushrat011899](https://redirect.github.com/bushrat011899) in [#​562](https://redirect.github.com/rust-lang/flate2-rs/pull/562) - Add `no_std` support using nightly `alloc_io` by [@​bushrat011899](https://redirect.github.com/bushrat011899) in [#​559](https://redirect.github.com/rust-lang/flate2-rs/pull/559) - Update `get_mut()` documentation to make clear how 'inner\` can be used by [@​Byron](https://redirect.github.com/Byron) in [#​558](https://redirect.github.com/rust-lang/flate2-rs/pull/558) #### New Contributors - [@​Vaiz](https://redirect.github.com/Vaiz) made their first contribution in [#​532](https://redirect.github.com/rust-lang/flate2-rs/pull/532) - [@​MikkelPaulson](https://redirect.github.com/MikkelPaulson) made their first contribution in [#​540](https://redirect.github.com/rust-lang/flate2-rs/pull/540) - [@​oscargus](https://redirect.github.com/oscargus) made their first contribution in [#​543](https://redirect.github.com/rust-lang/flate2-rs/pull/543) - [@​nanookclaw](https://redirect.github.com/nanookclaw) made their first contribution in [#​550](https://redirect.github.com/rust-lang/flate2-rs/pull/550) - [@​Guflly](https://redirect.github.com/Guflly) made their first contribution in [#​556](https://redirect.github.com/rust-lang/flate2-rs/pull/556) - [@​bushrat011899](https://redirect.github.com/bushrat011899) made their first contribution in [#​562](https://redirect.github.com/rust-lang/flate2-rs/pull/562) **Full Changelog**: <https://github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10> </details> <details> <summary>indexmap-rs/indexmap (indexmap)</summary> ### [`v2.14.1`](https://redirect.github.com/indexmap-rs/indexmap/blob/HEAD/RELEASES.md#2141-2026-08-28) [Compare Source](https://redirect.github.com/indexmap-rs/indexmap/compare/2.14.0...2.14.1) - Simplify comparisons where `Equivalent` isn't needed (`Q = K`). - Unify index assertions for bounds checks. - Fix (or `expect`) clippy lints. </details> <details> <summary>napi-rs/mimalloc-safe (mimalloc-safe)</summary> ### [`v0.1.65`](https://redirect.github.com/napi-rs/mimalloc-safe/blob/HEAD/CHANGELOG.md#0165---2026-08-24) [Compare Source](https://redirect.github.com/napi-rs/mimalloc-safe/compare/mimalloc-safe-v0.1.64...mimalloc-safe-v0.1.65) ##### Chore - *(deps)* Update actions/setup-node action to v7 ([#​89](https://redirect.github.com/napi-rs/mimalloc-safe/pull/89)) - *(deps)* Update yarn to v4.18.0 ([#​87](https://redirect.github.com/napi-rs/mimalloc-safe/pull/87)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
renovate[bot]
|
a58595c5f5 |
chore(deps): update github actions (#26177)
This PR contains the following updates: | Package | Type | Update | Change | Pending | |---|---|---|---|---| | [CodSpeedHQ/action](https://redirect.github.com/CodSpeedHQ/action) | action | minor | `v5.0.3` → `v5.2.1` | | | [semgrep/semgrep](https://redirect.github.com/semgrep/semgrep-proprietary) | container | minor | `1.174.0` → `1.175.0` | | | [taiki-e/install-action](https://redirect.github.com/taiki-e/install-action) | action | minor | `v2.86.4` → `v2.87.0` | `v2.87.2` (+1) | --- > [!WARNING] > Some dependencies could not be looked up. Check the warning logs for more information. --- ### Release Notes <details> <summary>CodSpeedHQ/action (CodSpeedHQ/action)</summary> ### [`v5.2.1`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.1) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1) Bumps the CodSpeed runner to [v5.2.1](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.1). ##### 🚀 Features - Add a `simulation-track-subprocess` input, which enables measuring the subprocesses spawned by the benchmarked process in `simulation` mode by [@​adriencaccia](https://redirect.github.com/adriencaccia) in [#​235](https://redirect.github.com/CodSpeedHQ/action/pull/235) - Bump the go-runner to [v1.3.0](https://redirect.github.com/CodSpeedHQ/codspeed-go/releases/tag/v1.3.0), adding Go 1.26 and 1.27 support by [@​adriencaccia](https://redirect.github.com/adriencaccia) in [#​516](https://redirect.github.com/CodSpeedHQ/codspeed/pull/516) **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> #### What's Changed - feat: add simulation-track-subprocess input by [@​adriencaccia](https://redirect.github.com/adriencaccia) in [#​235](https://redirect.github.com/CodSpeedHQ/action/pull/235) - chore: bump runner version to 5.2.1 by [@​github-actions](https://redirect.github.com/github-actions)\[bot] in [#​236](https://redirect.github.com/CodSpeedHQ/action/pull/236) **Full Changelog**: <https://github.com/CodSpeedHQ/action/compare/v5.2.0...v5.2.1> ### [`v5.2.0`](https://redirect.github.com/CodSpeedHQ/action/releases/tag/v5.2.0) [Compare Source](https://redirect.github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0) Bumps the CodSpeed runner to [v5.2.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.2.0), including [v5.1.0](https://redirect.github.com/CodSpeedHQ/codspeed/releases/tag/v5.1.0). ##### 🚀 Features - Add a `--simulation-track-subprocess` flag that enables tracking benchmark subprocesses, along with per-thread dumps by [@​GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [#​493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493) and [#​513](https://redirect.github.com/CodSpeedHQ/codspeed/pull/513) - Collect RSS via rss\_stat and folio-rmap reconstruction by [@​not-matthias](https://redirect.github.com/not-matthias) in [#​453](https://redirect.github.com/CodSpeedHQ/codspeed/pull/453) - Support CircleCI for GitHub repositories by [@​fargito](https://redirect.github.com/fargito) in [#​482](https://redirect.github.com/CodSpeedHQ/codspeed/pull/482) ##### 🐛 Bug Fixes - Fix cache behavior that was causing an apt reinstall of the libc debug symbols despite cache restore by [@​GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [#​509](https://redirect.github.com/CodSpeedHQ/codspeed/pull/509) ##### ⚙️ Internals - Bump pinned valgrind-codspeed to [3.26.0-0codspeed7](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/releases/tag/3.26.0-0codspeed7) by [@​adriencaccia](https://redirect.github.com/adriencaccia) in [#​515](https://redirect.github.com/CodSpeedHQ/codspeed/pull/515) - fix(callgrind): represent os threads under `--separate-threads=yes` by [@​GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [CodSpeedHQ/valgrind-codspeed#24](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/24) - feat(callgrind): track subprocesses across fork and exec by [@​GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [CodSpeedHQ/valgrind-codspeed#25](https://redirect.github.com/CodSpeedHQ/valgrind-codspeed/pull/25) - Stop skipping the rustup wrapper for valgrind by [@​GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [#​493](https://redirect.github.com/CodSpeedHQ/codspeed/pull/493) **Full Runner Changelog**: <https://github.com/CodSpeedHQ/codspeed/blob/main/CHANGELOG.md> #### What's Changed - fix: add the distribution to the instruments cache key by [@​GuillaumeLagrange](https://redirect.github.com/GuillaumeLagrange) in [#​233](https://redirect.github.com/CodSpeedHQ/action/pull/233) - chore: bump runner version to 5.1.0 by [@​github-actions](https://redirect.github.com/github-actions)\[bot] in [#​232](https://redirect.github.com/CodSpeedHQ/action/pull/232) - chore: bump runner version to 5.2.0 by [@​github-actions](https://redirect.github.com/github-actions)\[bot] in [#​234](https://redirect.github.com/CodSpeedHQ/action/pull/234) **Full Changelog**: <https://github.com/CodSpeedHQ/action/compare/v5.0.3...v5.2.0> </details> <details> <summary>taiki-e/install-action (taiki-e/install-action)</summary> ### [`v2.87.0`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.87.0): 2.87.0 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.8...v2.87.0) - Support `kache`. ([#​1980](https://redirect.github.com/taiki-e/install-action/pull/1980), thanks [@​ChrisJr404](https://redirect.github.com/ChrisJr404)) - Update `vacuum@latest` to 0.30.1. - Update `uv@latest` to 0.12.6. - Update `mise@latest` to 2026.8.14. - Update `editorconfig-checker@latest` to 3.11.2. ### [`v2.86.8`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.86.8): 2.86.8 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.7...v2.86.8) - Update `wasmtime@latest` to 48.0.1. - Update `wasm-tools@latest` to 1.258.0. - Update `oxfmt@latest` to 1.80.0. - Update `mise@latest` to 2026.8.12. - Update `kingfisher@latest` to 2.0.0. - Update `cargo-zigbuild@latest` to 0.23.2. ### [`v2.86.7`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.86.7): 2.86.7 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.6...v2.86.7) - Update `tombi@latest` to 1.4.1. - Update `rafn@latest` to 0.1.5. - Update `cargo-binstall@latest` to 1.22.0. ### [`v2.86.6`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.86.6): 2.86.6 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.5...v2.86.6) - Update `dprint@latest` to 0.56.1. - Update `cargo-lambda@latest` to 1.9.2. - Update `biome@latest` to 2.5.10. ### [`v2.86.5`](https://redirect.github.com/taiki-e/install-action/releases/tag/v2.86.5): 2.86.5 [Compare Source](https://redirect.github.com/taiki-e/install-action/compare/v2.86.4...v2.86.5) - Update `zola@latest` to 0.23.4. - Update `wasm-tools@latest` to 1.257.1. - Update `protoc@latest` to 3.36.0. - Update `mise@latest` to 2026.8.10. - Update `cargo-dinghy@latest` to 0.8.6. - Update `wasmtime@latest` to 48.0.0. </details> --- ### Configuration 📅 **Schedule**: (in timezone Asia/Shanghai) - Branch creation - "before 10am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/oxc-project/oxc). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> |
||
|
billychannnnnn
|
db66f5821d |
docs(linter): correct export/import mismatch in bar and foo example (#25927)
The example incorrectly used a named import for a default export.
Changed `export default function bar()` to `export function bar()` to
align with the `import { bar }` statement.
Signed-off-by: billychannnnnn <billychannnnnn@foxmail.com>
|
||
|
Adrian Schaedle
|
33ac4b0915 |
fix(linter/lsp): prevent tsgolint from holding onto processes (#25570)
Attempts to address: - oxc-project/oxc#17070 - oxc-project/oxc#21402, - oxc-project/oxc-vscode#264 I recently started enabling the type-aware rules as part of my editor's linter (zed). I quickly started hitting resource exhaustion limits on macOS. Listing processes showed thousands of zombie tsgolint entries with oxlint as the parent. Doing a little digging, I found the above issues listing similar resource exhaustion. oxc-project/oxc#24670 attempted to solve this issue by calling `child.kill` on the tsgolint process, but this is not enough on macOS. From [the `Child` docs](https://doc.rust-lang.org/std/process/struct.Child.html): > On some systems, calling wait or similar is necessary for the OS to release resources. A process that terminated but has not been waited on is still around as a “zombie”. Leaving too many zombies around may exhaust global resources (for example process IDs). > > The standard library does not automatically wait on child processes (not even if the Child is dropped), it is up to the application developer to do so. As a consequence, dropping Child handles without waiting on them first is not recommended in long-running applications. This change follows this advice and adds a `wait` after the existing `kill`. |
||
|
Armano
|
784e9faad2 |
feat(minifier): invert !0 and !1 in place for boolean context to 1 and 0 (#26050)
improve negation of 1 and 0 to 0 and 1 in boolean context previously only `!!0` and `!!1` could be inlined to `1` and `0` and now `!0` and `!1` will also be inlined, this change allows us to flip numeric values in-place instead of having to first to create unary and remove it afterwards ``` !0 was converted before to 1 in some cases: 1. negate 1 2. !1 - add unary 3. 0 - remove unary now: 1. negate 1 2. 0 ``` |
||
|
Armano
|
1e902cc1ad |
feat(minifier): expand fold leading assignments into the var decl (#26142)
expands leading assignment inlining into variable declarations for
`return`, `switch`, `if`, `throw`, `for`, `for in`, `for of`
```js
// return
var a; return a = b(), c;
var a = b(); return c;
// throw
var a; throw a = b(), c;
var a = b(); throw c;
// switch
var a; switch (a = b(), c) {}
var a = b(); switch (c) {}
// for
var a; for (a = b(), c; ;) d;
var a = b(); for (c; ;) d;
// if
var a; if (a = b(), c) d;
var a = b(); if (c) d;
```
fixes #25949
|
||
|
camc314
|
4adfb4c949 |
fix(semantic): validate chained continue labels (#26157)
## Summary - follow chained labels to their terminal statement when validating labeled `continue` - reject label chains that terminate in a non-iteration statement - add a focused negative coverage fixture and update the parser coverage snapshot |
||
|
Armano
|
3ed4f6ad90 |
feat(minifier): expand de morgan's optimization to allow move of ! (#25930)
Expand negation to include move of `!` operator to inner children ```js !(a == b && c == 3 && a) a != b || c != 3 | !a ``` delta calculation is dependent on boolean context - if we expect truthly/falsly value negation of `!a` will be converted to `a` (-1 delta) - in ambiguous context `!a` will be converted to `!!a` (+1 delta) ```js a = !!(!b || !c); // ^ ^ ^ -3 a = !(b || c) // ^ ^ ^ +1 - if we could detect if parens can be removed it would be -1 // ^^^ ^^ -1 - if we would know that we can remove parens ``` |
||
|
camc314
|
baf4b1e00a |
fix(linter/import/no-empty-named-blocks): make empty value import removal a suggestion (#26155)
## Summary - classify removal of empty value imports as a suggestion because deleting them can drop module evaluation side effects - keep removal of empty type-only imports as an automatic fix - preserve the rule’s existing deletion behavior |
||
|
camc314
|
77cfaec3f3 |
fix(linter/eslint/object-shorthand): preserve __proto__ semantics (#26154)
## Summary - exclude non-computed `__proto__` properties from shorthand and longform conversions - preserve computed `__proto__` properties as safely fixable - add regressions for methods, arrows, property shorthand, quoted keys, and `never` mode |
||
|
camc314
|
fa3c0825e2 |
fix(linter/unicorn/prefer-set-size): ignore shadowed Set constructors (#26153)
## Summary - verify that new Set constructors resolve to the intrinsic global before reporting or fixing - preserve detection for direct constructions and const-bound Set instances - add regression coverage for a locally shadowed constructor that returns an array |
||
|
camc314
|
b874f480c9 |
fix(ecmascript): Math.round only exact half ties (#26150)
[ECMA-262 §21.3.2.29, `Math.round`](https://tc39.es/ecma262/multipage/numbers-and-dates.html#sec-math.round). - If `0 < n < 0.5`, return `+0`. - If `-0.5 ≤ n < -0`, return `-0`. - Otherwise choose the closest integer, preferring `+∞` only for an actual tie. |
||
|
camc314
|
a625378066 |
fix(minifier): coerce omitted indexOf search argument (#26149)
## Summary - Apply `ToString(undefined)` when `String.prototype.indexOf` or `lastIndexOf` is called without a search argument. - Keep folding strings without the resulting `"undefined"` substring to `-1`. - Add focused helper and minifier regression coverage. ```js "undefined".indexOf(); // 0 "undefined".lastIndexOf(); // 0 "abcdef".indexOf(); // -1 "abcdef".lastIndexOf(); // -1 ``` |
||
|
camc314
|
dc7398beae |
fix(ecmascript): trim trailing whitespace in string to number (#26148)
## Summary `StringToNumber` previously removed ECMAScript whitespace only from the beginning of a string. Legal trailing whitespace therefore remained in the value passed to Rust’s numeric parsers, causing valid JavaScript numeric strings to produce `NaN`. For example: ```js "1 " * 2 // incorrectly folded to NaN "0x10 " - 0 // incorrectly folded to NaN ``` This changes `trim_start_matches` to `trim_matches`, applying the existing ECMAScript whitespace predicate to both ends of the string. After the change: ```js "1 " * 2 // folds to 2 "0x10 " - 0 // folds to 16 ``` The custom predicate remains important because ECMAScript and Rust define whitespace differently. Tests cover every ECMAScript whitespace character and verify that non-ECMAScript whitespace such as U+0085 is not accepted. |
||
|
camc314
|
243b685c3d |
fix(transformer/object-rest): lower multiple declarators correctly (#26147)
## Summary
Fix ES2018 object-rest lowering when one variable declaration contains multiple object-rest declarators.
### Before
Given:
```js
let { a, ...r } = x, { b, ...s } = y;
```
Oxc produced:
```js
let { a } = x, { b } = y,
s = babelHelpers.objectWithoutProperties(y, ["b"]),
{} = null;
```
The `r` binding was lost.
Each replacement was recorded using its original declarator index. Replacing the first declarator expanded it into multiple entries, shifting the second declarator. The subsequent replacement still used the old index and overwrote part of the first expansion.
### After
Oxc now produces:
```js
let { a } = x,
r = babelHelpers.objectWithoutProperties(x, ["a"]),
{ b } = y,
s = babelHelpers.objectWithoutProperties(y, ["b"]);
```
Queued replacements are applied from right to left. Replacing a later declarator cannot change the index of an earlier one, so every recorded index remains valid.
Regression coverage includes multiple `let`, `const`, and `var` declarators.
|
||
|
camc314
|
dc09a3aa9d |
fix(parser): avoid panic on escaped string export names (#26146)
## Summary Fix a parser panic when a string-named export decodes to a literal `\u` sequence. Lone-surrogate validation now uses the metadata captured by the lexer instead of rescanning decoded string contents. This also prevents false diagnostics for names such as `"\\uD800"`. ## Before: ``` thread 'main' (10990283) panicked at crates/oxc_ast/src/ast_impl/literal.rs:89:42: end byte index 4 is out of bounds for string of length 0 stack backtrace: 0: __rustc::rust_begin_unwind 1: core::panicking::panic_fmt 2: core::str::slice_error_fail_rt 3: core::str::slice_error_fail 4: <core::ops::range::RangeTo<usize> as core::slice::index::SliceIndex<str>>::index 5: <str as core::ops::index::Index<core::ops::range::RangeTo<usize>>>::index 6: <oxc_ast::ast::literal::StringLiteral>::is_string_well_formed_unicode 7: <oxc_parser::ParserImpl<oxc_parser::config::NoTokensParserConfig>>::parse_module_export_name ``` |
||
|
camc314
|
e412cf2ce3 |
fix(linter): clamp invalid JS plugin locations (#26144)
Follow-up to #26138, closes #25867. External plugins can report a node range past the source text. The default formatter rejects that invalid span and previously panicked. Clamp external diagnostic offsets to the source's UTF-16 length before normalizing reversed ranges. The end-to-end fixture now covers: - reversed locations - negative loc values - negative node ranges - an out-of-range node range in Unicode source text |
||
|
Dunqing
|
c3dedc9b0c |
fix(semantic): skip function body bindings in parameters (#26099)
Function parameters, TypeScript signatures, and function bodies currently share one Oxc semantic scope. A reference in a parameter can therefore bind to a declaration inside the body, even though JavaScript does not make body declarations visible there. Rolldown may then treat a global as local, skip a configured define, or remove live code.
## Example
```js
export function load(value = typeof window !== "undefined") {
var window;
return value;
}
```
The body `var window` is not visible to the default value. Before this change, Oxc resolved `window` in the default value to that body declaration. It should remain a global reference.
The workaround resolves parameter and signature references before visiting the body, while only parameter bindings are present. If a reference is still unresolved, its `lookup_scope_id` advances to the function's parent. Final resolution resumes there, so declarations added while visiting the body are skipped. References created in the body still begin at the function scope and resolve normally.
```text
Before: parameter reference -> completed function scope -> body binding (wrong)
After: parameter reference -> parameter bindings -> parent scopes
body reference -> completed function scope -> parent scopes
```
Parameter decorators already begin in the enclosing class scope, so they are left for normal final resolution. This emulates separate parameter and body scopes until https://github.com/oxc-project/backlog/issues/176 is implemented.
The corrected semantic data also exposes the transformer case covered by #26105.
Verified with semantic and transformer-plugin tests, Clippy, coverage, allocation snapshots, and diff checks. `just ready` completed workspace checks but stopped at a codegen snapshot recorded with Node.js v26.5.0; the local version is v25.8.1.
Closes #20427
Closes #22783
Downstream reports:
- https://github.com/rolldown/rolldown/issues/10722
- https://github.com/rolldown/rolldown/issues/10779
AI assistance: OpenAI Codex was used to investigate, implement, and test this change. The contributor is responsible for the submitted change.
|
||
|
camc314
|
d86c1137c4 |
fix(linter): normalize reversed JS plugin locations (#26138)
## Summary - normalize reversed JS plugin diagnostic locations to empty spans at their stated start - add an end-to-end regression fixture for reversed `loc` positions https://github.com/oxc-project/oxc/issues/25867 |
||
|
leaysgur
|
57e8e22483 |
fix(formatter_css): space a folded sign after a call in Less operations (#26134)
Follow up on #26132. By that change, Less is also possible to format binary operation like SCSS. |
||
|
leaysgur
|
0e734cc7ae |
test(formatter_css): pin signed-value parser fixes from oxc-css-parser 0.0.12 (#26132)
Bump parser and pin fixed by https://github.com/oxc-project/oxc-css-parser/pull/158 |
||
|
leaysgur
|
b8796080d5 | docs(formatter,formatter_graphql,formatter_yaml): annotate own-line comment inlining as known policy violation (#26131) | ||
|
leaysgur
|
f94b22296c |
test(formatter,formatter_css,formatter_json,formatter_yaml): restore coverage lost in fixture consolidation (#26129)
- Restore wrongly consolidated fixtures - State new fixtures policy and apply - Check `endOfLine` option and output at test harness level |
||
|
leaysgur
|
deab23cac2 |
test(oxfmt): consolidate redundant conformance edge-case fixtures (#26127)
Consolidate redundant fixtures. |
