Skip to content

Bump the all-npm-dependencies group across 1 directory with 7 updates#1

Merged
fey merged 1 commit into
mainfrom
dependabot/npm_and_yarn/all-npm-dependencies-12544c9c08
Jun 1, 2026
Merged

Bump the all-npm-dependencies group across 1 directory with 7 updates#1
fey merged 1 commit into
mainfrom
dependabot/npm_and_yarn/all-npm-dependencies-12544c9c08

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026 •
edited
Loading

Bumps the all-npm-dependencies group with 7 updates in the / directory:

Package From To
@hotwired/stimulus 3.1.1 3.2.2
@hotwired/turbo-rails 7.2.4 8.0.23
@popperjs/core 2.11.6 2.11.8
bootstrap 5.2.2 5.3.8
bootstrap-icons 1.9.1 1.13.1
esbuild 0.15.13 0.28.0
sass 1.56.1 1.100.0

Updates @hotwired/stimulus from 3.1.1 to 3.2.2

Release notes

Sourced from @​hotwired/stimulus's releases.

v3.2.2

What's Changed

New Contributors

Full Changelog: hotwired/stimulus@v3.2.1...v3.2.2

v3.2.1

What's Changed

Full Changelog: hotwired/stimulus@v3.2.0...v3.2.1

v3.2.0

What's Changed

Full Changelog: hotwired/stimulus@v3.1.1...v3.2.0

Commits
  • 8cbca6d Release 3.2.2
  • 2db3585 Bump word-wrap from 1.2.3 to 1.2.4 (#706)
  • 7b810ec Update Values documentation for location of data attributes (#705)
  • d268067 Fix typo in documentation - global events (#704)
  • da8be68 Pass controller instance to registerActionOption callback (#691)
  • c989795 Bump semver from 5.7.1 to 5.7.2 (#703)
  • 2a3603c Bump semver from 5.7.1 to 5.7.2 in /examples (#702)
  • 7bf453c Pass the ActionEvent (with params) to registerActionOption callbacks (#692)
  • 4ef73b0 Add support for number values with underscores (#693)
  • 7974f63 add nested outlet property documentation (#696)
  • Additional commits viewable in compare view

Updates @hotwired/turbo-rails from 7.2.4 to 8.0.23

Commits
Maintainer changes

This version was pushed to npm by packagethief, a new releaser for @​hotwired/turbo-rails since your current version.


Updates @popperjs/core from 2.11.6 to 2.11.8

Commits

Updates bootstrap from 5.2.2 to 5.3.8

Release notes

Sourced from bootstrap's releases.

v5.3.8

What's Changed

Dependencies

New Contributors

Full Changelog: twbs/bootstrap@v5.3.7...v5.3.8

v5.3.7

📚 Documentation

... (truncated)

Commits

Updates bootstrap-icons from 1.9.1 to 1.13.1

Release notes

Sourced from bootstrap-icons's releases.

v1.13.1

Quick fix for search on the docs.

What's Changed

Full Changelog: twbs/icons@v1.13.0...v1.13.1

v1.13.0

What's Changed

Full Changelog: twbs/icons@v1.12.1...v1.13.0

v1.12.1

Forgot to generate new docs page for Bluesky because I was too excited about a single icon update.

v1.12.0: The Bluesky Update

There's only one new icon in this release… and it‘s Bluesky. 🤣

v1.11.4

What's Changed

Not including several dependency updates…

New Contributors

Full Changelog: twbs/icons@v1.11.3...v1.11.4

... (truncated)

Commits

Updates esbuild from 0.15.13 to 0.28.0

Release notes

Sourced from esbuild's releases.

v0.28.0

  • Add support for with { type: 'text' } imports (#4435)

    The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:

    import string from './example.txt' with { type: 'text' }
console.log(string)

  • Add integrity checks to fallback download path (#4343)

    Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

    This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

  • Update the Go compiler from 1.25.7 to 1.26.1

    This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

    • It now uses the new garbage collector that comes with Go 1.26.
    • The Go compiler is now more aggressive with allocating memory on the stack.
    • The executable format that the Go linker uses has undergone several changes.
    • The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

    You can read the Go 1.26 release notes for more information.

v0.27.7

  • Fix lowering of define semantics for TypeScript parameter properties (#4421)

    The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:

    // Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)
class Foo {
constructor(x = 1) {
this.x = x;
__publicField(this, "y", 2);
}
x;
}
// New output (with --loader=ts --target=es2021)
class Foo {

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2022

This changelog documents all esbuild versions published in the year 2022 (versions 0.14.11 through 0.16.12).

0.16.12

  • Loader defaults to js for extensionless files (#2776)

    Certain packages contain files without an extension. For example, the yargs package contains the file yargs/yargs which has no extension. Node, Webpack, and Parcel can all understand code that imports yargs/yargs because they assume that the file is JavaScript. However, esbuild was previously unable to understand this code because it relies on the file extension to tell it how to interpret the file. With this release, esbuild will now assume files without an extension are JavaScript files. This can be customized by setting the loader for "" (the empty string, representing files without an extension) to another loader. For example, if you want files without an extension to be treated as CSS instead, you can do that like this:

    • CLI:

      esbuild --bundle --loader:=css

    • JS:

      esbuild.build({
  bundle: true,
  loader: { '': 'css' },
})

    • Go:

      api.Build(api.BuildOptions{
  Bundle: true,
  Loader: map[string]api.Loader{"": api.LoaderCSS},
})

    In addition, the "type" field in package.json files now only applies to files with an explicit .js, .jsx, .ts, or .tsx extension. Previously it was incorrectly applied by esbuild to all files that had an extension other than .mjs, .mts, .cjs, or .cts including extensionless files. So for example an extensionless file in a "type": "module" package is now treated as CommonJS instead of ESM.

0.16.11

  • Avoid a syntax error in the presence of direct eval (#2761)

    The behavior of nested function declarations in JavaScript depends on whether the code is run in strict mode or not. It would be problematic if esbuild preserved nested function declarations in its output because then the behavior would depend on whether the output was run in strict mode or not instead of respecting the strict mode behavior of the original source code. To avoid this, esbuild transforms nested function declarations to preserve the intended behavior of the original source code regardless of whether the output is run in strict mode or not:

    // Original code
if (true) {
  function foo() {}
  console.log(!!foo)
  foo = null
  console.log(!!foo)
}

... (truncated)

Commits
  • 6a794df publish 0.28.0 to npm
  • 64ee0ea fix #4435: support with { type: text } imports
  • ef65aee fix sort order in snapshots_packagejson.txt
  • 1a26a8e try to fix test-old-ts, also shuffle CI tasks
  • 556ce6c use '' instead of null to omit build hashes
  • 8e675a8 ci: allow missing binary hashes for tests
  • 7067763 Reapply "update go 1.25.7 => 1.26.1"
  • 39473a9 fix #4343: integrity check for binary download
  • 2025c9f publish 0.27.7 to npm
  • c6b586e fix typo in Makefile for @esbuild/win32-x64
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.


Updates sass from 1.56.1 to 1.100.0

Release notes

Sourced from sass's releases.

Dart Sass 1.100.0

To install Sass 1.100.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

    See the Sass website for details.

See the full changelog for changes in earlier releases.

Dart Sass 1.99.0

To install Sass 1.99.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

  • User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

  • User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

  • User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

    See the Sass website for details.

  • In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

    See the Sass website for details.

  • Calls to functions whose names begin with - and end with -progid:... are deprecated.

    See the Sass website for details.

See the full changelog for changes in earlier releases.

Dart Sass 1.98.0

To install Sass 1.98.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

... (truncated)

Changelog

Sourced from sass's changelog.

1.100.0

  • Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

    See the Sass website for details.

1.99.0

  • Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

  • User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

  • User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

  • User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

    See the Sass website for details.

  • In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

    See the Sass website for details.

  • Calls to functions whose names begin with - and end with -progid:... are deprecated.

    See the Sass website for details.

1.98.0

Command-Line Interface

  • Gracefully handle dependency loops in --watch mode.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sass since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 19, 2026
@dependabot
Bump the all-npm-dependencies group across 1 directory with 7 updates
ae67c32 
Bumps the all-npm-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@hotwired/stimulus](https://github.com/hotwired/stimulus) | `3.1.1` | `3.2.2` |
| [@hotwired/turbo-rails](https://github.com/hotwired/turbo-rails) | `7.2.4` | `8.0.23` |
| [@popperjs/core](https://github.com/popperjs/popper-core) | `2.11.6` | `2.11.8` |
| [bootstrap](https://github.com/twbs/bootstrap) | `5.2.2` | `5.3.8` |
| [bootstrap-icons](https://github.com/twbs/icons) | `1.9.1` | `1.13.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.15.13` | `0.28.0` |
| [sass](https://github.com/sass/dart-sass) | `1.56.1` | `1.100.0` |



Updates `@hotwired/stimulus` from 3.1.1 to 3.2.2
- [Release notes](https://github.com/hotwired/stimulus/releases)
- [Changelog](https://github.com/hotwired/stimulus/blob/main/CHANGELOG.md)
- [Commits](hotwired/stimulus@v3.1.1...v3.2.2)

Updates `@hotwired/turbo-rails` from 7.2.4 to 8.0.23
- [Release notes](https://github.com/hotwired/turbo-rails/releases)
- [Commits](https://github.com/hotwired/turbo-rails/commits)

Updates `@popperjs/core` from 2.11.6 to 2.11.8
- [Release notes](https://github.com/popperjs/popper-core/releases)
- [Commits](floating-ui/floating-ui@v2.11.6...v2.11.8)

Updates `bootstrap` from 5.2.2 to 5.3.8
- [Release notes](https://github.com/twbs/bootstrap/releases)
- [Commits](twbs/bootstrap@v5.2.2...v5.3.8)

Updates `bootstrap-icons` from 1.9.1 to 1.13.1
- [Release notes](https://github.com/twbs/icons/releases)
- [Commits](twbs/icons@v1.9.1...v1.13.1)

Updates `esbuild` from 0.15.13 to 0.28.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2022.md)
- [Commits](evanw/esbuild@v0.15.13...v0.28.0)

Updates `sass` from 1.56.1 to 1.100.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.56.1...1.100.0)

---
updated-dependencies:
- dependency-name: "@hotwired/stimulus"
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-dependencies
- dependency-name: "@hotwired/turbo-rails"
  dependency-version: 8.0.23
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-npm-dependencies
- dependency-name: "@popperjs/core"
  dependency-version: 2.11.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-npm-dependencies
- dependency-name: bootstrap
  dependency-version: 5.3.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-dependencies
- dependency-name: bootstrap-icons
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-dependencies
- dependency-name: sass
  dependency-version: 1.99.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the all-npm-dependencies group with 7 updates Bump the all-npm-dependencies group across 1 directory with 7 updates Jun 1, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/all-npm-dependencies-12544c9c08 branch from f0a8ee8 to ae67c32 Compare June 1, 2026 03:58
@fey fey merged commit 9ecf0b4 into main Jun 1, 2026
2 checks passed
@fey fey deleted the dependabot/npm_and_yarn/all-npm-dependencies-12544c9c08 branch June 1, 2026 11:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@fey