Bump the npm_and_yarn group across 2 directories with 8 updates by dependabot[bot] · Pull Request #2 · EmilynnJ/copilot-sdk

dependabot · 2026-05-30T10:00:49Z

Bumps the npm_and_yarn group with 5 updates in the /test/harness directory:

Package	From	To
@github/copilot	`0.0.394`	`1.0.43`
picomatch	`4.0.3`	`4.0.4`
postcss	`8.5.6`	`8.5.15`
rollup	`4.54.0`	`4.60.4`
vite	`7.3.0`	`7.3.3`

Bumps the npm_and_yarn group with 8 updates in the /nodejs directory:

Package	From	To
@github/copilot	`0.0.394`	`1.0.43`
picomatch	`4.0.3`	`4.0.4`
postcss	`8.5.6`	`8.5.15`
rollup	`4.53.5`	`4.60.4`
vite	`7.3.0`	`7.3.3`
minimatch	`3.1.2`	`3.1.5`
flatted	`3.3.3`	`3.4.2`
lodash	`4.17.21`	`4.18.1`

Updates @github/copilot from 0.0.394 to 1.0.43

Release notes

Sourced from @github/copilot's releases.

1.0.43

2026-05-06

Add username toggle to /statusline picker to display the active account in the footer

Auto mode uses server-side model routing for improved real-time model selection

Resume prompt shows correct session name when multiple sessions are active

Protect against RCE from malicious bare repositories nested inside a project (for more information, GHSA-9ccr-r5hg-74gf)

MCP server child processes (e.g. started via npx or uvx) are now fully terminated when a session ends

Show download progress when running the update command

1.0.43-0

Improved

Show download progress when running the update command

Fixed

MCP server child processes (e.g. started via npx or uvx) are now fully terminated when a session ends

1.0.42

2026-05-06

MCP server failure warning now suggests a directly runnable /mcp show command when the server name contains whitespace

MCP server failure warnings include stderr output to help diagnose connection errors

Add -C flag to change working directory before starting, similar to git -C

Exit message resume command shows session ID instead of auto-generated name when session has not been renamed

Remote session export now supports non-GitHub repositories and repo-less directories

Resuming a session no longer shows a false "session in use" warning after choosing "Go back"

Enter key no longer gets permanently stuck after cancelling a request

Suppress the exit summary when the session has no user messages and no saved session to resume

CLI updates on Windows no longer fail with ENOENT when a transient EPERM occurs during package extraction

Add rubber-duck agent for GPT sessions, powered by Claude (available in /experimental)

1.0.42-0

Added

Add rubber-duck agent for GPT sessions, powered by Claude (available in /experimental)

1.0.41

2026-05-05

CLI starts faster by rendering the UI immediately while authentication resolves in the background

Shell completions (bash, zsh, fish) are automatically installed on first run and updated after copilot update

Tab-completing slash commands that accept arguments now adds a trailing space automatically

Package extraction no longer crashes on Windows when antivirus or filesystem locks cause transient EPERM errors

Remote session connection errors show your logged-in account and tailored remediation steps

Markdown formatting renders in ask user prompt questions

Add experimental MCP Tasks support: MCP tools with taskSupport: "required" run as non-blocking background agents trackable via list_agents and read_agent (available when experimental mode is enabled, e.g. via /experimental on or the --experimental flag)

Extensions now load in prompt mode (-p). User extensions load by default; project extensions alnd management tools require GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS=true.

Assistant responses no longer contain spurious system notification XML tags

Large output guidance correctly references the configured grep tool name

Adding a plugin marketplace using a git SSH URL (e.g. git@github.com:owner/repo) now works correctly

Slash command picker searches command descriptions and underlines matched characters

... (truncated)

Changelog

Sourced from @github/copilot's changelog.

1.0.43 - 2026-05-06

Add username toggle to /statusline picker to display the active account in the footer

Auto mode uses server-side model routing for improved real-time model selection

Resume prompt shows correct session name when multiple sessions are active

Protect against RCE from malicious bare repositories nested inside a project

MCP server child processes (e.g. started via npx or uvx) are now fully terminated when a session ends

Show download progress when running the update command

1.0.42 - 2026-05-06

MCP server failure warning now suggests a directly runnable /mcp show command when the server name contains whitespace

MCP server failure warnings include stderr output to help diagnose connection errors

Add -C flag to change working directory before starting, similar to git -C

Exit message resume command shows session ID instead of auto-generated name when session has not been renamed

Remote session export now supports non-GitHub repositories and repo-less directories

Resuming a session no longer shows a false "session in use" warning after choosing "Go back"

Enter key no longer gets permanently stuck after cancelling a request

Suppress the exit summary when the session has no user messages and no saved session to resume

CLI updates on Windows no longer fail with ENOENT when a transient EPERM occurs during package extraction

Add rubber-duck agent for GPT sessions, powered by Claude (available in /experimental)

1.0.41 - 2026-05-05

CLI starts faster by rendering the UI immediately while authentication resolves in the background

Shell completions (bash, zsh, fish) are automatically installed on first run and updated after copilot update

Tab-completing slash commands that accept arguments now adds a trailing space automatically

Package extraction no longer crashes on Windows when antivirus or filesystem locks cause transient EPERM errors

Remote session connection errors show your logged-in account and tailored remediation steps

Markdown formatting renders in ask user prompt questions

Add experimental MCP Tasks support: MCP tools with taskSupport: "required" run as non-blocking background agents trackable via list_agents and read_agent (available when experimental mode is enabled, e.g. via /experimental on or the --experimental flag)

Extensions now load in prompt mode (-p). User extensions load by default; project extensions alnd management tools require GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS=true.

Assistant responses no longer contain spurious system notification XML tags

Large output guidance correctly references the configured grep tool name

Adding a plugin marketplace using a git SSH URL (e.g. git@github.com:owner/repo) now works correctly

Slash command picker searches command descriptions and underlines matched characters

Memory tool confirmation prompt now shows the scope (repository or user) when requesting permission to store a memory

SQL todo timeline entries display more accurately for INSERT OR IGNORE/REPLACE and blocked status updates

Streaming text and shimmer animations stay smooth on slow or busy hosts

Add --attachment flag in non-interactive (-p/--prompt) mode to attach files (images or native documents) to the initial prompt

@-mention completion works for ./ paths, no longer adds trailing space on directories, and shows project files before workspace roots

Improve stability on Windows by working around a V8 crash in Node 24.x

Session files containing Unicode line separator characters load correctly

Reasoning effort picker hint text displays "Esc to cancel" with correct spacing

Improve reliability of file edits by better recovering from fuzzy or misaligned edit blocks

1.0.40 - 2026-05-01

PR branch decoration displays correctly in the footer regardless of model name length

/clear and /new reset the active custom agent selection

... (truncated)

Commits

5ab6de6 Update changelog.md for version 1.0.42
ac346d1 Update changelog.md for version 1.0.41
cc85e32 Update changelog.md for version 1.0.40
cb0ddf8 Update changelog.md for version 1.0.39
4e5cb95 Update changelog.md for version 1.0.37
6d1c577 Update changelog.md for version 1.0.36
d7a0581 Update changelog.md for version 1.0.35
6594437 Update changelog.md for version 1.0.34
75fbe0c Update changelog.md for version 1.0.33
4e51f5a Update changelog.md for version 1.0.32
Additional commits viewable in compare view

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

e5474fc Publish 4.0.4
4516eb5 Merge commit from fork
5eceecd Merge commit from fork
0db7dd7 Run benchmark again against latest minimatch version (#161)
9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
2661f23 fix typo in globstars.js test name (#138)
1798b07 docs: fix makeRe example (#143)
9d76bc5 chore: undocument removed options (#146)
e4d718b Remove unused time-require (#160)
38dffeb chore(deps): pin dependencies (#158)
Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Changelog

Sourced from postcss's changelog.

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Commits

eae46db Release 8.5.15 version
79508ff Update CI actions
b128e21 Speed up declaration parsing by avoiding creating new array on each token
9825dca Fix code format
55789c8 Update dependencies
84fbbe9 Install older pnpm action for old Node.js
9f860bd Revert pnpm action for old Node.js
0877198 Update CI actions
b2d1a33 Fix linter warnings
0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
Additional commits viewable in compare view

Updates rollup from 4.54.0 to 4.60.4

Release notes

Sourced from rollup's releases.

v4.60.4

4.60.4

2026-05-14

Bug Fixes

Improve stability of chunk hashes (#6362)

Pull Requests

#6362: fix: stabilize chunk assignment across parallel file reads (@sonukapoor, @Sonu Kapoor, @TrickyPi, @lukastaegert)

#6370: fix(deps): update minor/patch updates (@renovate[bot])

#6371: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)

#6372: chore(deps): update react monorepo to v19 (major) (@renovate[bot])

#6373: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6375: Resolve vulnerabilities (@lukastaegert)

v4.60.2

4.60.2

2026-04-18

Bug Fixes

Resolve a variable rendering bug when generating different formats from the same build (#6350)

Pull Requests

#6327: docs: fix various typos in source and documentation (@Abhi3975, @lukastaegert)

#6331: fix(deps): update minor/patch updates (@renovate[bot])

#6332: chore(deps): update codecov/codecov-action action to v6 (@renovate[bot])

#6333: chore(deps): update dependency eslint-plugin-unicorn to v64 (@renovate[bot])

#6334: fix(deps): update rust crate swc_compiler_base to v51 (@renovate[bot])

#6335: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6346: fix(deps): update minor/patch updates (@renovate[bot])

#6347: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6348: fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)

#6349: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6350: fix: reset variable render names between outputs in the same generate (@barry3406, @lukastaegert)

#6351: chore(deps): update minor/patch updates (@renovate[bot])

#6352: chore(deps): update cross-platform-actions/action action to v1 (@renovate[bot])

#6353: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)

#6354: chore(deps): lock file maintenance (@renovate[bot])

#6355: chore(deps): lock file maintenance (@renovate[bot])

#6356: chore(deps): lock file maintenance (@renovate[bot])

#6358: chore: remove cross-env from devDeps (@K-tecchan)

v4.60.1

4.60.1

... (truncated)

Changelog

Sourced from rollup's changelog.

4.60.4

2026-05-14

Bug Fixes

Improve stability of chunk hashes (#6362)

Pull Requests

#6362: fix: stabilize chunk assignment across parallel file reads (@sonukapoor, @Sonu Kapoor, @TrickyPi, @lukastaegert)

#6370: fix(deps): update minor/patch updates (@renovate[bot])

#6371: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)

#6372: chore(deps): update react monorepo to v19 (major) (@renovate[bot])

#6373: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6375: Resolve vulnerabilities (@lukastaegert)

4.60.3

2026-05-04

Bug Fixes

Ensure nested "exports" variables are not renamed (#6360)

Pull Requests

#6360: fix: do not rename nested "exports" bindings that do not conflict (@tariqrafique, @lukastaegert)

#6364: chore(deps): update msys2/setup-msys2 digest to e989830 (@renovate[bot])

#6365: fix(deps): update minor/patch updates (@renovate[bot])

#6366: fix(deps): update swc monorepo (major) (@renovate[bot])

#6367: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6368: docs: add missing backticks in plugin-development (@lumirlumir, @lukastaegert)

4.60.2

2026-04-18

Bug Fixes

Resolve a variable rendering bug when generating different formats from the same build (#6350)

Pull Requests

#6327: docs: fix various typos in source and documentation (@Abhi3975, @lukastaegert)

#6331: fix(deps): update minor/patch updates (@renovate[bot])

#6332: chore(deps): update codecov/codecov-action action to v6 (@renovate[bot])

#6333: chore(deps): update dependency eslint-plugin-unicorn to v64 (@renovate[bot])

#6334: fix(deps): update rust crate swc_compiler_base to v51 (@renovate[bot])

#6335: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

... (truncated)

Commits

d311a84 4.60.4
6aa3248 fix: stabilize chunk assignment across parallel file reads (#6362)
82a0fe7 Resolve vulnerabilities (#6375)
71f5ebc chore(deps): update dependency lru-cache to v11 (#6371)
af91d77 chore(deps): lock file maintenance (#6373)
65e7b94 chore(deps): update react monorepo to v19 (major) (#6372)
642587f fix(deps): update minor/patch updates (#6370)
b47bdab 4.60.3
15c5f33 Add again some unneeded dev dependencies, to make some builds succeed
12195dc fix: do not rename nested "exports" bindings that do not conflict (#6360)
Additional commits viewable in compare view

Updates vite from 7.3.0 to 7.3.3

Release notes

Sourced from vite's releases.

v7.3.3

Please refer to CHANGELOG.md for details.

v7.3.2

Please refer to CHANGELOG.md for details.

v7.3.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.3 (2026-05-07)

Bug Fixes

avoid destructure lowering for newer safari (#22346) (5ab51c0)

7.3.2 (2026-04-06)

Bug Fixes

avoid path traversal with optimize deps sourcemap handler (#22161) (09d8c90)

backport #22159, apply server.fs check to env transport (#22162) (19db0f2)

check server.fs after stripping query as well (#22160) (f8103cc)

7.3.1 (2026-01-07)

Features

add ignoreOutdatedRequests option to optimizeDeps (#21364) (9d39d37)

Commits

ca31424 release: v7.3.3
5ab51c0 fix: avoid destructure lowering for newer safari (#22346)
cc383e0 release: v7.3.2
09d8c90 fix: avoid path traversal with optimize deps sourcemap handler (#22161)
f8103cc fix: check server.fs after stripping query as well (#22160)
19db0f2 fix: backport #22159, apply server.fs check to env transport (#22162)
95e8923 release: v7.3.1
9d39d37 feat: add ignoreOutdatedRequests option to optimizeDeps (#21364)
See full diff in compare view

Updates @github/copilot from 0.0.394 to 1.0.43

Release notes

Sourced from @github/copilot's releases.

1.0.43

2026-05-06

Add username toggle to /statusline picker to display the active account in the footer

Auto mode uses server-side model routing for improved real-time model selection

Resume prompt shows correct session name when multiple sessions are active

Protect against RCE from malicious bare repositories nested inside a project (for more information, GHSA-9ccr-r5hg-74gf)

MCP server child processes (e.g. started via npx or uvx) are now fully terminated when a session ends

Show download progress when running the update command

1.0.43-0

Improved

Show download progress when running the update command

Fixed

MCP server child processes (e.g. started via npx or uvx) are now fully terminated when a session ends

1.0.42

2026-05-06

MCP server failure warning now suggests a directly runnable /mcp show command when the server name contains whitespace

MCP server failure warnings include stderr output to help diagnose connection errors

Add -C flag to change working directory before starting, similar to git -C

Exit message resume command shows session ID instead of auto-generated name when session has not been renamed

Remote session export now supports non-GitHub repositories and repo-less directories

Resuming a session no longer shows a false "session in use" warning after choosing "Go back"

Enter key no longer gets permanently stuck after cancelling a request

Suppress the exit summary when the session has no user messages and no saved session to resume

CLI updates on Windows no longer fail with ENOENT when a transient EPERM occurs during package extraction

Add rubber-duck agent for GPT sessions, powered by Claude (available in /experimental)

1.0.42-0

Added

Add rubber-duck agent for GPT sessions, powered by Claude (available in /experimental)

1.0.41

2026-05-05

CLI starts faster by rendering the UI immediately while authentication resolves in the background

Shell completions (bash, zsh, fish) are automatically installed on first run and updated after copilot update

Tab-completing slash commands that accept arguments now adds a trailing space automatically

Package extraction no longer crashes on Windows when antivirus or filesystem locks cause transient EPERM errors

Remote session connection errors show your logged-in account and tailored remediation steps

Markdown formatting renders in ask user prompt questions

Add experimental MCP Tasks support: MCP tools with taskSupport: "required" run as non-blocking background agents trackable via list_agents and read_agent (available when experimental mode is enabled, e.g. via /experimental on or the --experimental flag)

Extensions now load in prompt mode (-p). User extensions load by default; project extensions alnd management tools require GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS=true.

Assistant responses no longer contain spurious system notification XML tags

Large output guidance correctly references the configured grep tool name

Adding a plugin marketplace using a git SSH URL (e.g. git@github.com:owner/repo) now works correctly

Slash command picker searches command descriptions and underlines matched characters

... (truncated)

Changelog

Sourced from @github/copilot's changelog.

1.0.43 - 2026-05-06

Add username toggle to /statusline picker to display the active account in the footer

Auto mode uses server-side model routing for improved real-time model selection

Resume prompt shows correct session name when multiple sessions are active

Protect against RCE from malicious bare repositories nested inside a project

MCP server child processes (e.g. started via npx or uvx) are now fully terminated when a session ends

Show download progress when running the update command

1.0.42 - 2026-05-06

MCP server failure warning now suggests a directly runnable /mcp show command when the server name contains whitespace

MCP server failure warnings include stderr output to help diagnose connection errors

Add -C flag to change working directory before starting, similar to git -C

Exit message resume command shows session ID instead of auto-generated name when session has not been renamed

Remote session export now supports non-GitHub repositories and repo-less directories

Resuming a session no longer shows a false "session in use" warning after choosing "Go back"

Enter key no longer gets permanently stuck after cancelling a request

Suppress the exit summary when the session has no user messages and no saved session to resume

CLI updates on Windows no longer fail with ENOENT when a transient EPERM occurs during package extraction

Add rubber-duck agent for GPT sessions, powered by Claude (available in /experimental)

1.0.41 - 2026-05-05

CLI starts faster by rendering the UI immediately while authentication resolves in the background

Shell completions (bash, zsh, fish) are automatically installed on first run and updated after copilot update

Tab-completing slash commands that accept arguments now adds a trailing space automatically

Package extraction no longer crashes on Windows when antivirus or filesystem locks cause transient EPERM errors

Remote session connection errors show your logged-in account and tailored remediation steps

Markdown formatting renders in ask user prompt questions

Add experimental MCP Tasks support: MCP tools with taskSupport: "required" run as non-blocking background agents trackable via list_agents and read_agent (available when experimental mode is enabled, e.g. via /experimental on or the --experimental flag)

Extensions now load in prompt mode (-p). User extensions load by default; project extensions alnd management tools require GITHUB_COPILOT_PROMPT_MODE_EXTENSIONS=true.

Assistant responses no longer contain spurious system notification XML tags

Large output guidance correctly references the configured grep tool name

Adding a plugin marketplace using a git SSH URL (e.g. git@github.com:owner/repo) now works correctly

Slash command picker searches command descriptions and underlines matched characters

Memory tool confirmation prompt now shows the scope (repository or user) when requesting permission to store a memory

SQL todo timeline entries display more accurately for INSERT OR IGNORE/REPLACE and blocked status updates

Streaming text and shimmer animations stay smooth on slow or busy hosts

Add --attachment flag in non-interactive (-p/--prompt) mode to attach files (images or native documents) to the initial prompt

@-mention completion works for ./ paths, no longer adds trailing space on directories, and shows project files before workspace roots

Improve stability on Windows by working around a V8 crash in Node 24.x

Session files containing Unicode line separator characters load correctly

Reasoning effort picker hint text displays "Esc to cancel" with correct spacing

Improve reliability of file edits by better recovering from fuzzy or misaligned edit blocks

1.0.40 - 2026-05-01

PR branch decoration displays correctly in the footer regardless of model name length

/clear and /new reset the active custom agent selection

... (truncated)

Commits

5ab6de6 Update changelog.md for version 1.0.42
ac346d1 Update changelog.md for version 1.0.41
cc85e32 Update changelog.md for version 1.0.40
cb0ddf8 Update changelog.md for version 1.0.39
4e5cb95 Update changelog.md for version 1.0.37
6d1c577 Update changelog.md for version 1.0.36
d7a0581 Update changelog.md for version 1.0.35
6594437 Update changelog.md for version 1.0.34
75fbe0c Update changelog.md for version 1.0.33
4e51f5a Update changelog.md for version 1.0.32
Additional commits viewable in compare view

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

e5474fc Publish 4.0.4
4516eb5 Merge commit from fork
5eceecd Merge commit from fork
0db7dd7 Run benchmark again against latest minimatch version (#161)
9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
2661f23 fix typo in globstars.js test name (#138)
1798b07 docs: fix makeRe example (#143)
9d76bc5 chore: undocument removed options (#146)
e4d718b Remove unused time-require (#160)
38dffeb chore(deps): pin dependencies (#158)
Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Changelog

Sourced from postcss's changelog.

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

Commits

eae46db Release 8.5.15 version
79508ff Update CI actions
b128e21 Speed up declaration parsing by avoiding creating new array on each token
9825dca Fix code format
55789c8 Update dependencies
84fbbe9 Install older pnpm action for old Node.js
9f860bd Revert pnpm action for old Node.js
0877198 Update CI actions
b2d1a33 Fix linter warnings
0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
Additional commits viewable in compare view

Updates rollup from 4.53.5 to 4.60.4

Release notes

Sourced from rollup's releases.

v4.60.4

4.60.4

2026-05-14

Bug Fixes

Improve stability of chunk hashes (#6362)

Pull Requests

#6362: fix: stabilize chunk assignment across parallel file reads (@sonukapoor, @Sonu Kapoor, @TrickyPi, @lukastaegert)

#6370: fix(deps): update minor/patch updates (@renovate[bot])

#6371: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)

#6372: chore(deps): update react monorepo to v19 (major) (@renovate[bot])

#6373: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6375: Resolve vulnerabilities (@lukastaegert)

v4.60.2

4.60.2

2026-04-18

Bug Fixes

Resolve a variable rendering bug when generating different formats from the same build (#6350)

Pull Requests

#6327: docs: fix various typos in source and documentation (@Abhi3975, @lukastaegert)

#6331: fix(deps): update minor/patch updates (@renovate[bot])

#6332: chore(deps): update codecov/codecov-action action to v6 (@renovate[bot])

#6333: chore(deps): update dependency eslint-plugin-unicorn to v64 (@renovate[bot])

#6334: fix(deps): update rust crate swc_compiler_base to v51 (@renovate[bot])

#6335: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6346: fix(deps): update minor/patch updates (@renovate[bot])

#6347: chore(deps): update dependency lru-cache to v11 (@renovate[bot])

#6348: fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)

#6349: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

#6350: fix: reset variable render names between outputs in the same generate (@barry3406, @lukastaegert)

#6351: chore(deps): update minor/patch updates (@renovate[bot])

#6352: chore(deps): update cross-platform-actions/action action to v1 (@renovate[bot])

#6353: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)

#6354: chore(deps): lock file maintenance (@renovate[bot])

#6355: chore(deps): lock file maintenance (@renovate[bot])

#6356: chore(deps): lock file maintenance (@renovate[bot])

#6358: chore: remove cross-env from devDeps (@K-tecchan)

v4.60.1

4.60.1

... (truncated)

Changelog

Sourced from rollup's changelog.

4.60.4

2026-05-14

Bug Fixes

Improve stability of chunk hashes (#6362)

Pull Requests

#6362: fix: stabilize chunk assignment across parallel file reads (@sonukapoor, @Sonu Kapoor, @TrickyPi, @lukastaegert)

#6370: fix(deps): update minor/patch updates (@renovate[bot])

#6371: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)

#6372: chore(deps): update react monorepo to v19 (major) (@renovate[bot])

#6373: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)

[!NOTE]

Bump @github/copilot from ^0.0.394 to ^1.0.43 in nodejs and test/harness

Updates @github/copilot to ^1.0.43 in both nodejs/package.json and test/harness/package.json, along with their respective lockfiles. This is a major version bump (0.x → 1.x).

^{Macroscope summarized 55bc304.}

Bumps the npm_and_yarn group with 5 updates in the /test/harness directory: | Package | From | To | | --- | --- | --- | | [@github/copilot](https://github.com/github/copilot-cli) | `0.0.394` | `1.0.43` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.15` | | [rollup](https://github.com/rollup/rollup) | `4.54.0` | `4.60.4` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.0` | `7.3.3` | Bumps the npm_and_yarn group with 8 updates in the /nodejs directory: | Package | From | To | | --- | --- | --- | | [@github/copilot](https://github.com/github/copilot-cli) | `0.0.394` | `1.0.43` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.15` | | [rollup](https://github.com/rollup/rollup) | `4.53.5` | `4.60.4` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.0` | `7.3.3` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | Updates `@github/copilot` from 0.0.394 to 1.0.43 - [Release notes](https://github.com/github/copilot-cli/releases) - [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md) - [Commits](github/copilot-cli@v0.0.394...v1.0.43) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) Updates `postcss` from 8.5.6 to 8.5.15 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.15) Updates `rollup` from 4.54.0 to 4.60.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.54.0...v4.60.4) Updates `vite` from 7.3.0 to 7.3.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.3/packages/vite) Updates `@github/copilot` from 0.0.394 to 1.0.43 - [Release notes](https://github.com/github/copilot-cli/releases) - [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md) - [Commits](github/copilot-cli@v0.0.394...v1.0.43) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) Updates `postcss` from 8.5.6 to 8.5.15 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.15) Updates `rollup` from 4.53.5 to 4.60.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.54.0...v4.60.4) Updates `vite` from 7.3.0 to 7.3.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.3/packages/vite) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.3.3...v3.4.2) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) --- updated-dependencies: - dependency-name: "@github/copilot" dependency-version: 1.0.43 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.15 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.60.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@github/copilot" dependency-version: 1.0.43 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.15 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.60.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

codesherlock-ai · 2026-05-30T10:00:53Z

We could not run your PR Review. We noticed that you are part of an Org. We require everyone who is part of an Org to SignUp via GitHub so we can track your individual usage and maximize on your usage capacity. Enroll into CodeSherlock system by signing up via GitHub using the SignUp link. Also, please note — every user pays for their own usage.

matterai-app · 2026-05-30T10:00:54Z

Important

PR Analysis Skipped

PR analysis skipped for dependabot PRs as per the configuration setting. Run a manually review by commenting /matter review

💡Tips to use MatterAI

Command List

/matter summary: Generate AI Summary for the PR
/matter review: Generate AI Reviews for the latest commit in the PR
/matter review-full: Generate AI Reviews for the complete PR
/matter release-notes: Generate AI release-notes for the PR
/matter : Chat with your PR with MatterAI Agent
/matter remember : Generate AI memories for the PR
/matter explain: Get an explanation of the PR
/matter help: Show the list of available commands and documentation
Need help? Join our Discord server: https://discord.gg/fJU5DvanU3

matterai-app · 2026-05-30T10:00:55Z

Caution

PR Analysis Skipped - Monthly Quota Exceeded

PR analysis skipped as you have reached the free tier limit of 15 PR reviews per month and 25 PR summaries per month. Please upgrade to a paid plan for MatterAI.

Current Plan: Free Tier
Review Free Tier Limit: 15 PR reviews per month
Current Usage: 15 PR reviews

Summary Free Tier Limit: 25 PR summaries per month
Current Usage: 26 PR summaries
Resets in: 1 days

Upgrade your plan on the console here: https://app.matterai.so/ai-code-reviews?tab=Billing

codeant-ai · 2026-05-30T10:00:55Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 30, 2026

Navigation Menu

Bump the npm_and_yarn group across 2 directories with 8 updates - #2

Bump the npm_and_yarn group across 2 directories with 8 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/test/harness/npm_and_yarn-8c544a5faa

dependabot Bot commented on behalf of github May 30, 2026 •

edited by macroscopeapp Bot

Loading

Bump `@github/copilot` from `^0.0.394` to `^1.0.43` in nodejs and test/harness

Uh oh!

codesherlock-ai Bot commented May 30, 2026

Uh oh!

matterai-app Bot commented May 30, 2026

PR Analysis Skipped

Command List

Uh oh!

matterai-app Bot commented May 30, 2026

PR Analysis Skipped - Monthly Quota Exceeded

Uh oh!

codeant-ai Bot commented May 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 30, 2026 • edited by macroscopeapp Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.0.43

1.0.43-0

1.0.42

1.0.42-0

1.0.41

1.0.43 - 2026-05-06

1.0.42 - 2026-05-06

1.0.41 - 2026-05-05

1.0.40 - 2026-05-01

4.0.4

What's Changed

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

v4.60.4

4.60.4

Bug Fixes

Pull Requests

v4.60.2

4.60.2

Bug Fixes

Pull Requests

v4.60.1

4.60.1

4.60.4

Bug Fixes

Pull Requests

4.60.3

Bug Fixes

Pull Requests

4.60.2

Bug Fixes

Pull Requests

v7.3.3

v7.3.2

v7.3.1

7.3.3 (2026-05-07)

Bug Fixes

7.3.2 (2026-04-06)

Bug Fixes

7.3.1 (2026-01-07)

Features

1.0.43

1.0.43-0

1.0.42

1.0.42-0

1.0.41

1.0.43 - 2026-05-06

1.0.42 - 2026-05-06

1.0.41 - 2026-05-05

1.0.40 - 2026-05-01

4.0.4

What's Changed

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

dependabot Bot commented on behalf of github May 30, 2026 •

edited by macroscopeapp Bot

Loading

Bump `@github/copilot` from `^0.0.394` to `^1.0.43` in nodejs and test/harness