Skip to content

release: v3.13.1 - detect dev conditions via execArgv and scoped installs… - #280

Merged
Shinrai merged 13 commits into
masterfrom
next
Aug 15, 2026
Merged

release: v3.13.1 - detect dev conditions via execArgv and scoped installs…#280
Shinrai merged 13 commits into
masterfrom
next

Conversation

@cldmv-bot

@cldmv-bot cldmv-bot Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

🚀 What's Changed

💥 Breaking Changes

No breaking changes

✨ Features

No new features

🐛 Bug Fixes

📦 Dependencies

🔧 Other Changes

👥 Contributors

coverage

Metric Coverage
Statements 100.0%
Branches 100.0%
Functions 100.0%
Lines 100.0%

Avg: 100.0% · 199ec9f · Node lts/*

dependabot Bot and others added 9 commits August 12, 2026 01:05
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.28.1 to 0.28.2.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [globals](https://github.com/sindresorhus/globals) from 17.8.0 to 17.9.0.
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.8.0...v17.9.0)

---
updated-dependencies:
- dependency-name: globals
  dependency-version: 17.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.2 to 26.2.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [eslint](https://github.com/eslint/eslint) from 10.8.0 to 10.8.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.0...v10.8.1)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [esbuild](https://github.com/evanw/esbuild) from 0.28.1 to 0.28.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/releases">esbuild's
releases</a>.</em></p>
<blockquote>
<h2>v0.28.2</h2>
<ul>
<li>
<p>Fix tree shaking bug due to TypeScript import alias (<a
href="https://redirect.github.com/evanw/esbuild/issues/4507">#4507</a>)</p>
<p>This release fixes a bug that could cause esbuild to incorrectly
tree-shake imports that are used in a TypeScript type alias under
certain circumstances. Affected code uses a TypeScript-specific
<code>import</code> assignment and looks something like this:</p>
<pre lang="ts"><code>import Base from './dep.js';
import Alias = Base.SomeType;
</code></pre>
</li>
<li>
<p>Fix CSS minification bug involving <code>&amp;</code> (<a
href="https://redirect.github.com/evanw/esbuild/issues/4497">#4497</a>)</p>
<p>This release fixes a bug where esbuild's CSS minifier incorrectly
removed a <code>&amp;</code> when it was unsafe to do so. Here is an
example:</p>
<pre lang="css"><code>/* Original code */
.a .b {
  &amp; .b:not(&amp; .c) {
    color: red;
  }
}
<p>/* Old output (with --minify) */<br />
.a .b{.b:not(&amp; .c){color:red}}</p>
<p>/* New output (with --minify) */<br />
.a .b{&amp; .b:not(&amp; .c){color:red}}<br />
</code></pre></p>
<p>This should match <code>&lt;span class=&quot;a&quot;&gt;&lt;span
class=&quot;b&quot;&gt;&lt;span
class=&quot;b&quot;&gt;yes&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;</code>
but not <code>&lt;span class=&quot;a&quot;&gt;&lt;span
class=&quot;b&quot;&gt;no&lt;/span&gt;&lt;/span&gt;</code>. The old
output incorrectly matched both.</p>
</li>
<li>
<p>Avoid overwriting input files without <code>--allow-overwrite</code>
(<a
href="https://redirect.github.com/evanw/esbuild/issues/4484">#4484</a>)</p>
<p>For example: <code>esbuild input.js --outfile=input.js</code> tells
esbuild to overwrite <code>input.js</code> with the output of running
esbuild on it. This was supposed to already be prevented by default, but
it accidentally regressed in version 0.17.0 and apparently didn't have
any test coverage. The error message was being printed but the input
file was still being overwritten. Oops.</p>
<p>This release puts the original behavior back. With this release,
esbuild should now actually avoid overwriting input files unless
<code>--allow-overwrite</code> is explicitly present. This is done by
not writing out any files when a build error is encountered.</p>
</li>
<li>
<p>Fix incorrect code generated when using top-level await (<a
href="https://redirect.github.com/evanw/esbuild/issues/4498">#4498</a>)</p>
<p>Previously esbuild could generate code containing a syntax error in
complex scenarios involving top-level await used in a dependency cycle.
The problem was a missing <code>async</code> on one or more module
wrapper closures. With this release, esbuild now uses a fixed-point
iteration algorithm to correctly annotate all dependencies in the cycle
as needing an <code>async</code> module wrapper.</p>
</li>
<li>
<p>Fix a minification bug with lowered logical assignment operators (<a
href="https://redirect.github.com/evanw/esbuild/issues/4508">#4508</a>)</p>
<p>This release fixes a bug that could cause esbuild to generate
incorrect code for logical assignment operators when lowering them to an
older target environment. Specifically the lowering process requires
duplicating the left-hand side, but esbuild incorrectly failed to count
the duplicate as a new usage when the left-hand side is an identifier.
That then caused the minifier to believe that the left-hand side was
only used once and could attempt to incorrectly inline an initializer
into the first usage. This bug has now been fixed:</p>
<pre lang="js"><code>// Original code
function foo() {
  let x
  bar(x ||= {})
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/evanw/esbuild/blob/main/CHANGELOG.md">esbuild's
changelog</a>.</em></p>
<blockquote>
<h2>0.28.2</h2>
<ul>
<li>
<p>Fix tree shaking bug due to TypeScript import alias (<a
href="https://redirect.github.com/evanw/esbuild/issues/4507">#4507</a>)</p>
<p>This release fixes a bug that could cause esbuild to incorrectly
tree-shake imports that are used in a TypeScript type alias under
certain circumstances. Affected code uses a TypeScript-specific
<code>import</code> assignment and looks something like this:</p>
<pre lang="ts"><code>import Base from './dep.js';
import Alias = Base.SomeType;
</code></pre>
</li>
<li>
<p>Fix CSS minification bug involving <code>&amp;</code> (<a
href="https://redirect.github.com/evanw/esbuild/issues/4497">#4497</a>)</p>
<p>This release fixes a bug where esbuild's CSS minifier incorrectly
removed a <code>&amp;</code> when it was unsafe to do so. Here is an
example:</p>
<pre lang="css"><code>/* Original code */
.a .b {
  &amp; .b:not(&amp; .c) {
    color: red;
  }
}
<p>/* Old output (with --minify) */<br />
.a .b{.b:not(&amp; .c){color:red}}</p>
<p>/* New output (with --minify) */<br />
.a .b{&amp; .b:not(&amp; .c){color:red}}<br />
</code></pre></p>
<p>This should match <code>&lt;span class=&quot;a&quot;&gt;&lt;span
class=&quot;b&quot;&gt;&lt;span
class=&quot;b&quot;&gt;yes&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;</code>
but not <code>&lt;span class=&quot;a&quot;&gt;&lt;span
class=&quot;b&quot;&gt;no&lt;/span&gt;&lt;/span&gt;</code>. The old
output incorrectly matched both.</p>
</li>
<li>
<p>Avoid overwriting input files without <code>--allow-overwrite</code>
(<a
href="https://redirect.github.com/evanw/esbuild/issues/4484">#4484</a>)</p>
<p>For example: <code>esbuild input.js --outfile=input.js</code> tells
esbuild to overwrite <code>input.js</code> with the output of running
esbuild on it. This was supposed to already be prevented by default, but
it accidentally regressed in version 0.17.0 and apparently didn't have
any test coverage. The error message was being printed but the input
file was still being overwritten. Oops.</p>
<p>This release puts the original behavior back. With this release,
esbuild should now actually avoid overwriting input files unless
<code>--allow-overwrite</code> is explicitly present. This is done by
not writing out any files when a build error is encountered.</p>
</li>
<li>
<p>Fix incorrect code generated when using top-level await (<a
href="https://redirect.github.com/evanw/esbuild/issues/4498">#4498</a>)</p>
<p>Previously esbuild could generate code containing a syntax error in
complex scenarios involving top-level await used in a dependency cycle.
The problem was a missing <code>async</code> on one or more module
wrapper closures. With this release, esbuild now uses a fixed-point
iteration algorithm to correctly annotate all dependencies in the cycle
as needing an <code>async</code> module wrapper.</p>
</li>
<li>
<p>Fix a minification bug with lowered logical assignment operators (<a
href="https://redirect.github.com/evanw/esbuild/issues/4508">#4508</a>)</p>
<p>This release fixes a bug that could cause esbuild to generate
incorrect code for logical assignment operators when lowering them to an
older target environment. Specifically the lowering process requires
duplicating the left-hand side, but esbuild incorrectly failed to count
the duplicate as a new usage when the left-hand side is an identifier.
That then caused the minifier to believe that the left-hand side was
only used once and could attempt to incorrectly inline an initializer
into the first usage. This bug has now been fixed:</p>
<pre lang="js"><code>// Original code
function foo() {
  let x
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/evanw/esbuild/commit/609683d892977362a0f99026cb74b96263d728a9"><code>609683d</code></a>
publish 0.28.2 to npm</li>
<li><a
href="https://github.com/evanw/esbuild/commit/11b1fe48df6859393d9469f323b5ebd17baaf989"><code>11b1fe4</code></a>
add to release notes</li>
<li><a
href="https://github.com/evanw/esbuild/commit/ab50d91559a27e54cd0a27a403389130ea10d97d"><code>ab50d91</code></a>
css: fix green/blue channel swap in oklch gamut mapping (<a
href="https://redirect.github.com/evanw/esbuild/issues/4488">#4488</a>)</li>
<li><a
href="https://github.com/evanw/esbuild/commit/04627b6cf99b4a7491bebb0268173a7c77a85030"><code>04627b6</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4498">#4498</a>:
<code>async</code> TLA checks need a worklist</li>
<li><a
href="https://github.com/evanw/esbuild/commit/5c15177a308c7224604058a769c4abf0a66b0a36"><code>5c15177</code></a>
disable <code>gopls</code> in the <code>go</code> folder</li>
<li><a
href="https://github.com/evanw/esbuild/commit/fc2ee9babc5a2e8ea7ec7c10dd5850b71f7cec7e"><code>fc2ee9b</code></a>
css: adjust parser to allow <code>--foo: {...}</code></li>
<li><a
href="https://github.com/evanw/esbuild/commit/209db54371e62ad1c50e12e56bb93c74c53b0408"><code>209db54</code></a>
release notes for css nesting bugfix</li>
<li><a
href="https://github.com/evanw/esbuild/commit/c625d31bf08a0647ec724bf76c7115f7aec55971"><code>c625d31</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4497">#4497</a>:
preserve nested ampersands during minification (<a
href="https://redirect.github.com/evanw/esbuild/issues/4500">#4500</a>)</li>
<li><a
href="https://github.com/evanw/esbuild/commit/34474e278528a60f58c959c0f422d2bfa6f6886d"><code>34474e2</code></a>
better isolation of current part in js parser</li>
<li><a
href="https://github.com/evanw/esbuild/commit/07f6e8c50677e0b41e5ed726c08b0ea200b14e5b"><code>07f6e8c</code></a>
fix <a
href="https://redirect.github.com/evanw/esbuild/issues/4507">#4507</a>:
<code>import</code> assignment tree-shaking bug</li>
<li>Additional commits viewable in <a
href="https://github.com/evanw/esbuild/compare/v0.28.1...v0.28.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=esbuild&package-manager=npm_and_yarn&previous-version=0.28.1&new-version=0.28.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps [globals](https://github.com/sindresorhus/globals) from 17.8.0 to
17.9.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sindresorhus/globals/releases">globals's
releases</a>.</em></p>
<blockquote>
<h2>v17.9.0</h2>
<ul>
<li>Update globals (2026-08-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)
5a958ed</li>
</ul>
<hr />
<p><a
href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sindresorhus/globals/commit/8e7b9358b190d26acca88cc2804707fbcd90a229"><code>8e7b935</code></a>
17.9.0</li>
<li><a
href="https://github.com/sindresorhus/globals/commit/5a958ed06064fb879b64416655109d8eaffd2611"><code>5a958ed</code></a>
Update globals (2026-08-01) (<a
href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)</li>
<li>See full diff in <a
href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=globals&package-manager=npm_and_yarn&previous-version=17.8.0&new-version=17.9.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
from 26.1.2 to 26.2.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/node&package-manager=npm_and_yarn&previous-version=26.1.2&new-version=26.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
Bumps [eslint](https://github.com/eslint/eslint) from 10.8.0 to 10.8.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/eslint/eslint/releases">eslint's
releases</a>.</em></p>
<blockquote>
<h2>v10.8.1</h2>
<h2>Bug Fixes</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/18eb0a7e787b9fac3049ef3dad0e845d2bd940a4"><code>18eb0a7</code></a>
fix: prevent ASI hazard in <code>no-unused-labels</code> autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21173">#21173</a>)
(dongkyu lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/151ba3f5834a0909e8b9b1736f4889ac694c0104"><code>151ba3f</code></a>
fix: false positives in <code>getter-return</code> and
<code>accessor-pairs</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21163">#21163</a>)
(Grit)</li>
<li><a
href="https://github.com/eslint/eslint/commit/6898df9364639ee64b9448a4cb6b08a30c16bd37"><code>6898df9</code></a>
fix: ignore meta-property names in <code>id-denylist</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21166">#21166</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/4d7db6628e2badf0857cb88734fe641c3874bce9"><code>4d7db66</code></a>
fix: ignore meta-property names in <code>id-match</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21167">#21167</a>)
(Pixel)</li>
<li><a
href="https://github.com/eslint/eslint/commit/677214e7eea83d8bc6e4b79eea871577e1369d5f"><code>677214e</code></a>
fix: handle ASI hazards in no-unused-vars removeVar suggestion (<a
href="https://redirect.github.com/eslint/eslint/issues/20935">#20935</a>)
(kuldeep kumar)</li>
</ul>
<h2>Documentation</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/7d0cbf81cfdb7526b5c4cb7b222ddc7f257db560"><code>7d0cbf8</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0a05812adb12598b32e85297b98df5ad14501d60"><code>0a05812</code></a>
docs: add missing backticks to <code>no-duplicate-imports.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21183">#21183</a>)
(Lee Daeun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/678c90b55da2889d4400cbf6e2584ab683faf202"><code>678c90b</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/8a104242e8e1c5614940fab7324346974cff7d26"><code>8a10424</code></a>
docs: Update README (GitHub Actions Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/69bb948061105426dbe6e3c931fcda783286e020"><code>69bb948</code></a>
docs: Update README (GitHub Actions Bot)</li>
</ul>
<h2>Chores</h2>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/0a148005051fded2ef1d14cc228ae505251b4b10"><code>0a14800</code></a>
chore: update github/codeql-action action to v4.37.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21196">#21196</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/05adcb13542061dc7fadde5cd58d23d405a96d93"><code>05adcb1</code></a>
test: fix failing ecosystem test for <code>eslint-plugin-unicorn</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21191">#21191</a>)
(Lazizbek Ergashev)</li>
<li><a
href="https://github.com/eslint/eslint/commit/56110356652dd614b3cf0933538abb551fc6bd6f"><code>5611035</code></a>
test: add error locations info to <code>no-void</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21185">#21185</a>)
(Lee Daeun)</li>
<li><a
href="https://github.com/eslint/eslint/commit/ee47333aa681cfc3cb54df08c38f211ea219cc2a"><code>ee47333</code></a>
ci: bump github/codeql-action from 4 to 4.37.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21176">#21176</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/f131c034ad91bbf06bcbb6b5e931447a8e419a46"><code>f131c03</code></a>
chore: improve ecosystem test failure reporting (<a
href="https://redirect.github.com/eslint/eslint/issues/20937">#20937</a>)
(crimsonjay0)</li>
<li><a
href="https://github.com/eslint/eslint/commit/1f6eddee609b369b50993eab08d437dda4700991"><code>1f6edde</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21182">#21182</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d3266fb26c719c6b90a6cbe54bb120c9335ad19c"><code>d3266fb</code></a>
chore: unpin <code>webpack</code> dependency (<a
href="https://redirect.github.com/eslint/eslint/issues/21172">#21172</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/65a6519cc8733b4688558a8611397cf9d01dd55d"><code>65a6519</code></a>
chore: add allowScripts field to package.json (<a
href="https://redirect.github.com/eslint/eslint/issues/21092">#21092</a>)
(GiHoon Noh)</li>
<li><a
href="https://github.com/eslint/eslint/commit/22e52568536e0009d4493dc888736bc163220c4b"><code>22e5256</code></a>
ci: add <code>triage:no</code> label to Dependabot PRs (<a
href="https://redirect.github.com/eslint/eslint/issues/21141">#21141</a>)
(lumir)</li>
<li><a
href="https://github.com/eslint/eslint/commit/55c9038836c91b6bd5617f0c97bea2274c9cc0bf"><code>55c9038</code></a>
ci: bump actions/labeler from 6 to 7 (<a
href="https://redirect.github.com/eslint/eslint/issues/21159">#21159</a>)
(dependabot[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/7280e78183d4711a49916b6a49ba5efaa651a991"><code>7280e78</code></a>
chore: update dependency prettier to v3.9.6 (<a
href="https://redirect.github.com/eslint/eslint/issues/21162">#21162</a>)
(renovate[bot])</li>
<li><a
href="https://github.com/eslint/eslint/commit/eddbad60158d8cda86830fbe934a9d2282273b32"><code>eddbad6</code></a>
test: fix failing ecosystem test for <code>eslint-plugin-unicorn</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21156">#21156</a>)
(Francesco Trotta)</li>
<li><a
href="https://github.com/eslint/eslint/commit/60a178d5ef1b0c471be0831031ed7347f8f81dc2"><code>60a178d</code></a>
chore: update ecosystem plugins (<a
href="https://redirect.github.com/eslint/eslint/issues/21150">#21150</a>)
(ESLint Bot)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f9f61dc6112836f46a58a410c38b8c2faf10973f"><code>f9f61dc</code></a>
test: add error locations to <code>no-unreachable</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21151">#21151</a>)
(JIYEON)</li>
<li><a
href="https://github.com/eslint/eslint/commit/d08629382b0a6aaa042823b796e5100e60053b54"><code>d086293</code></a>
test: add error locations to <code>no-undef</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21147">#21147</a>)
(JIYEON)</li>
<li><a
href="https://github.com/eslint/eslint/commit/cc01b67061bbf558aa25746883ea1cad847f7cf2"><code>cc01b67</code></a>
test: add error locations to <code>no-useless-catch</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21144">#21144</a>)
(devoil)</li>
<li><a
href="https://github.com/eslint/eslint/commit/688e75ede01b295d51f2f86c9d82da020a4c887e"><code>688e75e</code></a>
chore: add missing backticks in JSDoc (<a
href="https://redirect.github.com/eslint/eslint/issues/21143">#21143</a>)
(Bo Hyun Kim)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7c1e17543ad396f50f65b003cf9142d43d3c63b0"><code>7c1e175</code></a>
test: add error locations to <code>require-await</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21145">#21145</a>)
(Grit)</li>
<li><a
href="https://github.com/eslint/eslint/commit/588a26ddce3c5a20f5b3f3d51ba1353cce7b4b0c"><code>588a26d</code></a>
test: add error locations to <code>no-extra-label</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21139">#21139</a>)
(dongkyu lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/059aa895743639e3ab53d14f9d944ff4be042233"><code>059aa89</code></a>
test: add error locations to <code>no-useless-concat</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21140">#21140</a>)
(dongkyu lee)</li>
<li><a
href="https://github.com/eslint/eslint/commit/5a452a8ba53917d65c9d83c3959ed35c2f890613"><code>5a452a8</code></a>
test: add error locations to <code>no-const-assign</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21138">#21138</a>)
(dongkyu lee)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/eslint/eslint/commit/c049dc3c4294da7afe3d920a1a5fdeba388f4983"><code>c049dc3</code></a>
10.8.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/a3f78269412f033ec018be06296390a582afd132"><code>a3f7826</code></a>
Build: changelog update for 10.8.1</li>
<li><a
href="https://github.com/eslint/eslint/commit/18eb0a7e787b9fac3049ef3dad0e845d2bd940a4"><code>18eb0a7</code></a>
fix: prevent ASI hazard in <code>no-unused-labels</code> autofix (<a
href="https://redirect.github.com/eslint/eslint/issues/21173">#21173</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0a148005051fded2ef1d14cc228ae505251b4b10"><code>0a14800</code></a>
chore: update github/codeql-action action to v4.37.4 (<a
href="https://redirect.github.com/eslint/eslint/issues/21196">#21196</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/7d0cbf81cfdb7526b5c4cb7b222ddc7f257db560"><code>7d0cbf8</code></a>
docs: Update README</li>
<li><a
href="https://github.com/eslint/eslint/commit/05adcb13542061dc7fadde5cd58d23d405a96d93"><code>05adcb1</code></a>
test: fix failing ecosystem test for <code>eslint-plugin-unicorn</code>
(<a
href="https://redirect.github.com/eslint/eslint/issues/21191">#21191</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/56110356652dd614b3cf0933538abb551fc6bd6f"><code>5611035</code></a>
test: add error locations info to <code>no-void</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21185">#21185</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/ee47333aa681cfc3cb54df08c38f211ea219cc2a"><code>ee47333</code></a>
ci: bump github/codeql-action from 4 to 4.37.3 (<a
href="https://redirect.github.com/eslint/eslint/issues/21176">#21176</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/f131c034ad91bbf06bcbb6b5e931447a8e419a46"><code>f131c03</code></a>
chore: improve ecosystem test failure reporting (<a
href="https://redirect.github.com/eslint/eslint/issues/20937">#20937</a>)</li>
<li><a
href="https://github.com/eslint/eslint/commit/0a05812adb12598b32e85297b98df5ad14501d60"><code>0a05812</code></a>
docs: add missing backticks to <code>no-duplicate-imports.js</code> (<a
href="https://redirect.github.com/eslint/eslint/issues/21183">#21183</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/eslint/eslint/compare/v10.8.0...v10.8.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eslint&package-manager=npm_and_yarn&previous-version=10.8.0&new-version=10.8.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
@cldmv-bot cldmv-bot Bot added ! release → master v4 flow: persistent next → master release PR (carries the next feature release) release Marks a pull request as a pending release — merge to publish a new version semver: patch This release contains only backwards-compatible bug fixes type: dependencies Relates to dependency updates, version bumps, or package management labels Aug 12, 2026
@github-actions

github-actions Bot commented Aug 12, 2026

Copy link
Copy Markdown

🔒 Dependency Review

  • 0 vulnerable package(s)
  • 0 package(s) with incompatible licenses
  • 0 package(s) with invalid SPDX license definitions
  • 0 package(s) with unknown licenses
  • 0 denied package(s)
  • 0 package(s) with OpenSSF Scorecard score < 3

Full job summary

@cldmv-bot

cldmv-bot Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

📦 Bundle size unchanged

File Raw Δ Raw Gzipped Δ Gzipped
dist/lib/builders/api-assignment.mjs 15.4 kB 3.3 kB
dist/lib/builders/api_builder.mjs 48.7 kB 9.9 kB
dist/lib/builders/builder.mjs 2.7 kB 1.2 kB
dist/lib/builders/modes-processor.mjs 40.6 kB 6.9 kB
dist/lib/errors.mjs 4.4 kB 1.7 kB
dist/lib/factories/component-base.mjs 1.7 kB 866 B
dist/lib/factories/context.mjs 1010 B 525 B
dist/lib/handlers/api-cache-manager.mjs 3.4 kB 1.4 kB
dist/lib/handlers/api-manager.mjs 56.1 kB 11.6 kB
dist/lib/handlers/context-async.mjs 3.8 kB 1.3 kB
dist/lib/handlers/context-live.mjs 6.7 kB 2.2 kB
dist/lib/handlers/hook-manager.mjs 19.6 kB 4.9 kB
dist/lib/handlers/lifecycle-token.mjs 959 B 540 B
dist/lib/handlers/lifecycle.mjs 2.2 kB 1010 B
dist/lib/handlers/materialize-manager.mjs 1.2 kB 672 B
dist/lib/handlers/metadata.mjs 12.2 kB 3.2 kB
dist/lib/handlers/module-manager.mjs 9.3 kB 3.0 kB
dist/lib/handlers/ownership.mjs 6.3 kB 2.1 kB
dist/lib/handlers/permission-manager.mjs 15.9 kB 4.0 kB
dist/lib/handlers/trusted-root.mjs 3.1 kB 1.2 kB
dist/lib/handlers/unified-wrapper.mjs 74.3 kB 13.2 kB
dist/lib/handlers/version-manager.mjs 14.3 kB 3.7 kB
dist/lib/helpers/caller-pinning.mjs 804 B 496 B
dist/lib/helpers/class-instance-wrapper.mjs 2.7 kB 1.1 kB
dist/lib/helpers/config.mjs 14.5 kB 3.8 kB
dist/lib/helpers/eventemitter-context.mjs 9.0 kB 1.8 kB
dist/lib/helpers/eventtarget-context.mjs 3.3 kB 1.2 kB
dist/lib/helpers/generate-manifest.mjs 6.8 kB 2.3 kB
dist/lib/helpers/hint-detector.mjs 1.3 kB 756 B
dist/lib/helpers/manifest-resolver.mjs 1004 B 611 B
dist/lib/helpers/modes-utils.mjs 1.1 kB 696 B
dist/lib/helpers/module-discovery.mjs 7.5 kB 2.5 kB
dist/lib/helpers/module-manifest-validator.mjs 8.7 kB 1.9 kB
dist/lib/helpers/module-sort.mjs 1.0 kB 593 B
dist/lib/helpers/pattern-matcher.mjs 2.6 kB 1.2 kB
dist/lib/helpers/platform.mjs 1.8 kB 953 B
dist/lib/helpers/resolve-from-caller.mjs 3.0 kB 1.3 kB
dist/lib/helpers/sanitize.mjs 7.7 kB 2.3 kB
dist/lib/helpers/scheduler-context.mjs 1.9 kB 876 B
dist/lib/helpers/utilities.mjs 1.7 kB 909 B
dist/lib/i18n/languages/de-de.json 64.3 kB 18.3 kB
dist/lib/i18n/languages/en-gb.json 56.7 kB 16.0 kB
dist/lib/i18n/languages/en-us.json 56.7 kB 16.0 kB
dist/lib/i18n/languages/es-es.json 63.8 kB 17.8 kB
dist/lib/i18n/languages/es-mx.json 63.8 kB 17.8 kB
dist/lib/i18n/languages/fr-fr.json 64.8 kB 17.8 kB
dist/lib/i18n/languages/hi-in.json 107.0 kB 20.1 kB
dist/lib/i18n/languages/ja-jp.json 76.3 kB 18.8 kB
dist/lib/i18n/languages/ko-kr.json 66.1 kB 17.8 kB
dist/lib/i18n/languages/pt-br.json 63.1 kB 17.5 kB
dist/lib/i18n/languages/ru-ru.json 77.8 kB 18.9 kB
dist/lib/i18n/languages/zh-cn.json 55.6 kB 17.4 kB
dist/lib/i18n/translations.mjs 5.0 kB 1.8 kB
dist/lib/modes/eager.mjs 2.0 kB 1006 B
dist/lib/modes/lazy.mjs 2.5 kB 1.2 kB
dist/lib/processors/flatten.mjs 9.9 kB 2.4 kB
dist/lib/processors/loader.mjs 12.3 kB 4.0 kB
dist/lib/processors/type-generator.mjs 6.7 kB 2.6 kB
dist/lib/processors/typescript.mjs 10.7 kB 4.0 kB
dist/lib/runtime/runtime-asynclocalstorage.mjs 3.0 kB 1.1 kB
dist/lib/runtime/runtime-livebindings.mjs 3.1 kB 1.1 kB
dist/lib/runtime/runtime.mjs 2.2 kB 800 B
dist/lib/typegen/typegen.mjs 2.1 kB 1.0 kB
dist/slothlet.mjs 17.9 kB 5.1 kB
Total 1.28 MB ±0 B 343.8 kB ±0 B

📊 Generated by bundle-size. Brotli sizes also measured but omitted from the table for brevity.

Shinrai and others added 2 commits August 14, 2026 20:58
…#270)

devcheck's dev-environment guard only read `--conditions` from NODE_OPTIONS,
and only treated a package as installed when its immediate parent folder was
literally `node_modules`. Two false `process.exit(1)` paths followed:

- The CLI form `node --conditions=slothlet-dev file.mjs` (and how vitest
  passes conditions to its workers) puts the flag in `process.execArgv`, not
  NODE_OPTIONS, so a correctly-configured dev with `src/` present and no
  `dist/` hit a spurious error. Fold execArgv into the condition haystack.
- A scoped install lives at `node_modules/@cldmv/slothlet`, whose parent is
  the `@cldmv` scope dir, so the guard never tripped for slothlet's own
  package; a git/tarball install (ships `src/`, no `dist/`) would exit(1)
  inside a consumer. Detect a `node_modules` segment anywhere above the file.

Adds a spawn-based regression suite covering both paths plus the preserved
NODE_OPTIONS and unscoped-install behavior.

Fixes #270
@cldmv-bot cldmv-bot Bot added the area: tests Touches test files, fixtures, or test infrastructure label Aug 15, 2026
@cldmv-bot cldmv-bot Bot changed the title release: v3.13.1 - bump esbuild from 0.28.1 to 0.28.2 release: v3.13.1 - detect dev conditions via execArgv and scoped installs… Aug 15, 2026
@cldmv-bot cldmv-bot Bot added the type: bug Something is broken or not behaving as expected label Aug 15, 2026
Shinrai and others added 2 commits August 14, 2026 21:53
Author the v3.13.1 release notes for the changes now integrated on next:
the devcheck dev-environment fix (#270) plus four routine devDependency
bumps (#276-#279) and a declaration-tree regeneration that catches the
committed types up to already-shipped v3.13.0 source (no source module
changed in the range).

- docs/changelog/v3/v3.13.1.md: new per-version changelog.
- README: promote v3.13.1 to Latest, move v3.13.0 into Recent Releases,
  and drop v3.12.0 to keep the list at four per the What's New rules.
@cldmv-bot cldmv-bot Bot added the type: documentation Relates to docs, README updates, guides, or inline code comments label Aug 15, 2026
@Shinrai
Shinrai merged commit c940669 into master Aug 15, 2026
33 checks passed
@cldmv-bot
cldmv-bot Bot deleted the next branch August 15, 2026 05:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: tests Touches test files, fixtures, or test infrastructure ! release → master v4 flow: persistent next → master release PR (carries the next feature release) release Marks a pull request as a pending release — merge to publish a new version semver: patch This release contains only backwards-compatible bug fixes type: bug Something is broken or not behaving as expected type: dependencies Relates to dependency updates, version bumps, or package management type: documentation Relates to docs, README updates, guides, or inline code comments

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant