[master] Michijs Dependabot changes #69

lsegurado · 2025-08-18T06:47:12Z

Updated Packages

Bump @storybook/addon-controls from 8.4.7 to 9.0.8
Bump bun from 1.1.20 to 1.2.20
Bump @storybook/web-components-vite from 8.4.7 to 9.1.2
Bump @michijs/dev-server from 0.8.6 to 0.8.7
Bump @storybook/addon-viewport from 8.4.7 to 9.0.8
Bump @storybook/addon-links from 8.4.7 to 9.1.2
Bump @storybook/addon-storysource from 8.4.7 to 8.6.14
Bump @storybook/builder-vite from 8.4.7 to 9.1.2
Bump @storybook/addon-a11y from 8.4.7 to 9.1.2
Bump @storybook/addon-docs from 8.4.7 to 9.1.2
Bump storybook from 8.4.7 to 9.1.2
Bump typescript from 5.8.3 to 5.9.2

lsegurado · 2025-08-18T06:47:13Z

Bump @michijs/dev-server from 0.8.6 to 0.8.7

Changelog:

Commit history:

94e298 chore: release v0.8.8-beta.4
304794 Delete .github/workflows/dependabot.yml
bf3fd0 chore: release v0.8.8-beta.3
3fdaf5 chore: release v0.8.8-beta.2
e92e52 Create dependabot.yml
f2e866 Update lint.yml
1941ed Update release-package.yml
eaa955 Delete .github/workflows/auto-release-package.yml
426763 Merge branch 'master' of https://github.com/michijs/dev-server
6b6f6c chore: release v0.8.8-beta.1

lsegurado · 2025-08-18T06:47:13Z

Bump typescript from 5.8.3 to 5.9.2

Changelog:

Commit history:

73c0bc Update deps (#62285)
e39d57 Update Node.js core modules (#62201)
605d7e Bump the github-actions group with 2 updates (#62252)
Signed-off-by: dependabot[bot] [email protected]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
391616 Bump github/codeql-action from 3.29.1 to 3.29.2 in the github-actions group (#62006)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
e3ef7f added john favret to pr_owners.txt (#62191)
c6a181 Bump version to 6.0 (#62162)
c1f565 Restructure CI to prepare for required checks and merge queues (#61978)
39c5d0 Fix private identifier fields generating errors in class expression declarations (#62155)

Co-authored-by: copilot-swe-agent[bot] [email protected]
Co-authored-by: RyanCavanaugh [email protected]
Co-authored-by: weswigham [email protected]
Co-authored-by: Wesley Wigham [email protected]
Co-authored-by: TypeScript Bot [email protected]
c3ee23 Add format to update baselines/fix lints task (#62160)
be8678 Give more specific errors for verbatimModuleSyntax (#62113)

lsegurado · 2025-08-18T06:47:13Z

Bump @storybook/addon-links from 8.4.7 to 9.1.2

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

lsegurado · 2025-08-18T06:47:13Z

Bump @storybook/addon-controls from 8.4.7 to 9.0.8

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

lsegurado · 2025-08-18T06:47:13Z

Bump @storybook/addon-docs from 8.4.7 to 9.1.2

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

lsegurado · 2025-08-18T06:47:13Z

Bump @storybook/addon-viewport from 8.4.7 to 9.0.8

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

lsegurado · 2025-08-18T06:47:13Z

Bump @storybook/builder-vite from 8.4.7 to 9.1.2

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

lsegurado · 2025-08-18T06:47:13Z

Bump storybook from 8.4.7 to 9.1.2

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

lsegurado · 2025-08-18T06:47:13Z

Bump bun from 1.1.20 to 1.2.20

Changelog:

Commit history:

cf868f install.sh: check if on riscv64, and if so bail out (#21924)
What does this PR do?

Solves install on RISC-V installs x86_64 version, but should bail out oven-sh/bun#21923

So: if on riscv64, bail out, and do not install the x86-64 version of
bun

How did you verify your code works?

On my RISCV system:
```
git clone https://github.com/sanderjo/bun.git sjo-oven-sh-bun
cd sjo-oven-sh-bun/
git branch -a
git checkout origin/detect_and_refuse_riscv64
grep -irn riscv64 src/cli/install.sh 
```
Yes, correct. And then:
```
sander@riscv:~/git/sjo-oven-sh-bun$ bash src/cli/install.sh
error: Not supported on riscv64
sander@riscv:~/git/sjo-oven-sh-bun$
```
Good.

Co-authored-by: sanderjo [email protected]
5fd3a4 fix: count top-level catalog strings before appending in Package.zig (#21942)

Summary

Fixes a crash in Package.zig where top-level catalog strings weren't
being counted before appending to the string builder.

Root Cause

The issue occurred in the parseWithJSON function where:
1. Counting phase: Only catalog strings in the "workspaces"
  expression were counted via lockfile.catalogs.parseCount()
2. Appending phase: There was a conditional call to
  lockfile.catalogs.parseAppend() for top-level JSON catalog strings
3. Result: String builder allocation was insufficient when top-level
  catalog strings were processed
Changes
- Added lockfile.catalogs.parseCount(lockfile, json, &string_builder)
  in the counting phase to ensure top-level catalog strings are always
  counted
- Added explanatory comment documenting why this counting is necessary
Test Plan
- Built debug version successfully
- Verified bun-debug binary works correctly
- Should be tested with package.json files that have top-level
  catalog configurations
🤖 Generated with Claude Code

Co-authored-by: Claude Bot [email protected]
Co-authored-by: Claude [email protected]
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
fecfe8 Update workers.md
57f799 Add linker bunfig documentation (#21940)

Add missing install.linker option to bunfig.toml documentation
f5077d remove extra --- in CLAUDE.md (#21928)

What does this PR do?

How did you verify your code works?
2112ef Add yarn.lock migration counter (#21931)
What does this PR do?

How did you verify your code works?
e020d2 docs: add Bun.stripANSI documentation with performance comparisons (#21933)
Summary
- Add comprehensive documentation for Bun.stripANSI() utility function
  in docs/api/utils.md
- Highlight significant performance advantages over npm strip-ansi
  package (6-57x faster)
- Include usage examples and detailed benchmark comparisons
- Document performance improvements across different string sizes
Test plan
- Documentation follows existing format and style
- Performance claims are backed by benchmark data from
  bench/snippets/strip-ansi.mjs
- Code examples are accurate and functional
🤖 Generated with Claude Code

Co-authored-by: Claude Bot [email protected]
Co-authored-by: Claude [email protected]
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jarred Sumner [email protected]
586805 fix: Remove unnecessary output statements (#21487)

What does this PR do?

Fixes a duplicate output issue in bun init where CLAUDE.md was being
listed twice in the file creation summary.
Fixes #21468

Problem: When running bun init, the file creation output showed
CLAUDE.md twice

How did you verify your code works?
a25d7a Fixup --compile-argv (#21916)

What does this PR do?

Fixup --compile-argv

How did you verify your code works?

better test
e5e973 fix: HTMLRewriter no longer crashes when element handlers throw exceptions (#21848)

Summary

Comprehensive fixes for multiple HTMLRewriter bugs including crashes,
memory leaks, and improper error handling.

🚨 Primary Issue Fixed (#21680)
- HTMLRewriter crash when element handlers throw exceptions -
  Process would crash with "ASSERTION FAILED: Unexpected exception
  observed" when JavaScript callbacks in element handlers threw exceptions
- Root cause: Exceptions weren't properly handled by
  JavaScriptCore's exception scope mechanism
- Solution: Used CatchScope to properly catch and propagate
  exceptions through Bun's error handling system
🚨 Additional Bugs Discovered & Fixed

1. Memory Leaks in Selector Handling
- Issue: selector_slice string was allocated but never freed when
  HTMLSelector.parse() failed
- Impact: Memory leak on every invalid CSS selector
- Fix: Added proper defer/errdefer cleanup in on_() and
  onDocument_() methods
2. Broken Selector Validation
- Issue: Invalid CSS selectors were silently succeeding instead of
  throwing meaningful errors
- Impact: Silent failures made debugging difficult; invalid
  selectors like "", "<<<", "div[" were accepted
- Fix: Changed return createLOLHTMLError(global) to return global.throwValue(createLOLHTMLError(global))
3. Resource Cleanup on Handler Creation Failures
- Issue: Allocated handlers weren't cleaned up if subsequent
  operations failed
- Impact: Potential resource leaks in error paths
- Fix: Added errdefer blocks for proper handler cleanup
Test plan
- Regression test for original crash case
  (test/regression/issue/21680.test.ts)
- Comprehensive edge case tests
  (test/regression/issue/htmlrewriter-additional-bugs.test.ts)
- All existing HTMLRewriter tests pass (41 tests, 146
  assertions)
- Memory leak testing with repeated invalid selector operations
- Security testing with malicious inputs, XSS attempts, large
  payloads
- Concurrent usage testing for thread safety and reuse patterns
Before (multiple bugs):

Crash:
```
ASSERTION FAILED: Unexpected exception observed on thread Thread:0xf5a15e0000e0 at:
The exception was thrown from thread Thread:0xf5a15e0000e0 at:
Error Exception: abc
!exception() || m_vm.hasPendingTerminationException()
AddressSanitizer: CHECK failed: asan_poisoning.cpp:37
error: script "bd" was terminated by signal SIGABRT (Abort)
```
Silent Selector Failures:
```
// These should throw but silently succeeded:
new HTMLRewriter().on("", handler);        // empty selector
new HTMLRewriter().on("<<<", handler);     // invalid CSS  
new HTMLRewriter().on("div[", handler);    // incomplete attribute
```
After (all issues fixed):

Proper Exception Handling:
```
try {
  new HTMLRewriter().on("script", {
    element(a) { throw new Error("abc"); }
  }).transform(new Response("<script></script>"));
} catch (e) {
  console.log("GOOD: Caught exception:", e.message); // "abc"
}
```
Proper Selector Validation:
```
// Now properly throws with descriptive errors:
new HTMLRewriter().on("", handler);        // Throws: "The selector is empty"
new HTMLRewriter().on("<<<", handler);     // Throws: "The selector is empty" 
new HTMLRewriter().on("div[", handler);    // Throws: "Unexpected end of selector"
```
Technical Details

Exception Handling Fix
- Used CatchScope to properly catch JavaScript exceptions from
  callbacks
- Captured exceptions in VM's unhandled_pending_rejection_to_capture
  mechanism
- Cleared exceptions from scope to prevent assertion failures
- Returned failure status to LOLHTML to trigger proper error propagation
Memory Management Fixes
- Added defer bun.default_allocator.free(selector_slice) for automatic
  cleanup
- Added errdefer blocks for handler cleanup on failures
- Ensured all error paths properly release allocated resources
Error Handling Improvements
- Fixed functions returning bun.JSError!JSValue to properly throw
  errors
- Distinguished between functions that return errors vs. throw them
- Preserved original exception messages through the error chain
Impact

✅ No more process crashes when HTMLRewriter handlers throw
exceptions
✅ No memory leaks from failed selector parsing operations
✅ Proper error messages for invalid CSS selectors with specific
failure reasons
✅ Improved reliability across all edge cases and malicious inputs
✅ Maintains 100% backward compatibility - all existing functionality
preserved

This makes HTMLRewriter significantly more robust and developer-friendly
while maintaining high performance.

Fixes #21680

🤖 Generated with Claude Code

Co-authored-by: Claude Bot [email protected]
Co-authored-by: Claude [email protected]
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

lsegurado · 2025-08-18T06:47:13Z

Bump @storybook/web-components-vite from 8.4.7 to 9.1.2

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

lsegurado · 2025-08-18T06:47:13Z

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

lsegurado · 2025-08-18T06:47:13Z

Bump @storybook/addon-storysource from 8.4.7 to 8.6.14

Changelog:

Commit history:

da8cf2 Merge pull request #32258 from storybookjs/norbert/canary-branch-name-autorelease
Build: Auto trigger canary release based on branch name
5fb916 Merge pull request #32259 from storybookjs/norbert/fix/static-copy

Core: Fix staticCopy bug
32046f Update skipPaths in copyAllStaticFiles to use outputDir for correct file handling
f36a3e Fix skipPaths in copyAllStaticFilesRelativeToMain to reference outputDir instead of targetPath
a843a8 auto trigger canary release based on branch name
d32f96 Merge pull request #31819 from storybookjs/sb10/esm-only

SB10: ESM-only
9ee310 bust cache
0eb8ae Refactor imports across multiple files to use named import for 'ts-dedent' for consistency and clarity
f8d785 reduce size of
dcd0f6 remove flaky story capture

Michijs Dependabot changes

85e8dc0

lsegurado closed this Aug 18, 2025

lsegurado deleted the michijs-dependabot branch August 18, 2025 08:41

Uh oh!

[master] Michijs Dependabot changes #69

[master] Michijs Dependabot changes #69

Uh oh!

Conversation

lsegurado commented Aug 18, 2025

Updated Packages

Uh oh!

lsegurado commented Aug 18, 2025

Bump @michijs/dev-server from 0.8.6 to 0.8.7

v0.8.8-beta.4

v0.8.8-beta.3

v0.8.8-beta.2

v0.8.8-beta.0

v0.8.7

v0.8.7-beta.9

v0.8.7-beta.10

v0.8.7-beta.8

v0.8.7-beta.7

v0.8.7-beta.6

v0.8.7-beta.5

v0.8.7-beta.4

v0.8.7-beta.3

v0.8.7-beta.2

v0.8.7-beta.1

v0.8.7-beta.0

v0.8.6

v0.8.6-beta.12

v0.8.6-beta.11

v0.8.6-beta.10

v0.8.6-beta.9

v0.8.6-beta.8

v0.8.6-beta.7

v0.8.6-beta.6

v0.8.6-beta.5

v0.8.6-beta.4

v0.8.6-beta.3

v0.8.6-beta.2

v0.8.6-beta.1

v0.8.6-beta.0

Uh oh!

lsegurado commented Aug 18, 2025

Bump typescript from 5.8.3 to 5.9.2

v5.9.2

v5.8.3

Uh oh!

lsegurado commented Aug 18, 2025

Bump @storybook/addon-links from 8.4.7 to 9.1.2

v9.2.0-alpha.3

9.2.0-alpha.3

v9.1.2

9.1.2

v9.2.0-alpha.2

9.2.0-alpha.2

v9.1.1

9.1.1

v9.2.0-alpha.1

9.2.0-alpha.1

v9.2.0-alpha.0

9.2.0-alpha.0

v9.1.0

9.1.0

v9.1.0-beta.3

9.1.0-beta.3

v9.1.0-beta.2

9.1.0-beta.2

v9.1.0-beta.1

9.1.0-beta.1

v9.1.0-beta.0

9.1.0-beta.0

v9.1.0-alpha.10

9.1.0-alpha.10

v9.1.0-alpha.9

9.1.0-alpha.9

v9.0.18

9.0.18

v9.1.0-alpha.8

9.1.0-alpha.8

v9.0.17

9.0.17