chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
deno (source)	2.7.13 → 2.7.14
h3 (source)	^2.0.1-rc.20 → ^2.0.1-rc.21
rolldown (source)	^1.0.0-rc.17 → ^1.0.0-rc.18

---

Release Notes

denoland/deno (deno)

v2.7.14

Compare Source

• feat(ext/node): add fs.Utf8Stream
• feat(upgrade): delta updates via bsdiff patches (#​33274)
• fix(bundle): treat CSS same-document fragment URLs as external (#​33492)
• fix(cache): add missing CacheStorage.keys() and Cache.keys() methods (#​33275)
• fix(config): don't exclude workspace members from deploy file patterns
  (#​33562)
• fix(coverage): exclude transformer-injected helpers from coverage (#​33481)
• fix(doc): remove background from operators in dark mode code blocks (#​33267)
• fix(ext/bundle): clearer error when Deno.bundle is called in compiled binary
  (#​33503)
• fix(ext/crypto): throw TypeMismatchError for non-TypedArray in getRand
  (#​33470)
• fix(ext/fetch): don't mutate caller's options in Deno.createHttpClient
  (#​33497)
• fix(ext/fetch): use byte ReadableStream for Node Readable request bodies
  (#​33432)
• fix(ext/fs): normalize Deno.watchFs paths so events drop ./ segments (#​33490)
• fix(ext/napi): implement napi_async_init and napi_async_destroy (#​33282)
• fix(ext/net): default Deno.listenDatagram hostname to 0.0.0.0 (#​33496)
• fix(ext/node): accept X.509v1 server certs in tls.createServer (#​33505)
• fix(ext/node): accept string mode in fs.mkdir and fs.mkdirSync (#​33409)
• fix(ext/node): add Server BlockList, asyncDispose, and misc net improvements
  (#​33417)
• fix(ext/node): add _idleStart and _idleTimeout to Timeout (#​33604)
• fix(ext/node): align crypto random* validation with Node (#​33456)
• fix(ext/node): align fs.truncate / ftruncate argument validation with Node
  (#​33418)
• fix(ext/node): align module.builtinModules / getBuiltinModule with Node
  (#​33404)
• fix(ext/node): align node:module behavior with Node (#​33482)
• fix(ext/node): align node:test it/describe with Node, enable passing
  compat tests (#​33593)
• fix(ext/node): align util.styleText with Node (#​33547)
• fix(ext/node): allow https.Agent() without new, enable passing compat
  tests (#​33601)
• fix(ext/node): async fs.stat/lstat throwIfNoEntry + deprecate fs.Stats
  (#​33436)
• fix(ext/node): attach input URL to ERR_INVALID_FILE_URL_PATH (#​33398)
• fix(ext/node): attach path/syscall to fs.lstat / realpath / link errors
  (#​33446)
• fix(ext/node): brand-check SecureContext._external accessor (#​33569)
• fix(ext/node): cache hash digest so it survives stream.pipeline (#​33440)
• fix(ext/node): cancelling Readable.toWeb(req) no longer destroys the socket
  (#​33570)
• fix(ext/node): close fd on error in http2 stream respondWithFile (#​33614)
• fix(ext/node): correct buffer-length check in Readable._fromList decoder
  branch (#​33624)
• fix(ext/node): defer drain in http2 shutdownWritable so pushStream after end()
  works (#​33619)
• fix(ext/node): drain pending TLS cleartext in enc_write_cb (#​33378)
• fix(ext/node): emit Buffer for http2 'goaway' opaqueData (#​33502)
• fix(ext/node): emit DEP0031 deprecation warning for ecdh.setPublicKey(
  (#​33468)
• fix(ext/node): emit DEP0182 deprecation for short AES-GCM auth tag (#​33469)
• fix(ext/node): emit HPE_INVALID_TRANSFER_ENCODING for CL+chunked respo
  (#​33488)
• fix(ext/node): emit StatWatcher 'stop' event asynchronously (#​33448)
• fix(ext/node): emit TimeoutNaNWarning for invalid timer durations (#​33472)
• fix(ext/node): emit http2 frameError on send failure with translated HTTP/2
  error code (#​33631)
• fix(ext/node): emit stream-level PROTOCOL_ERROR in node:http2
• fix(ext/node): emit tlsClientError instead of crashing on TLS init failure
  (#​33429)
• fix(ext/node): enable test-als-defaultvalue-original (AsyncLocalStorage
  default value) (#​33464)
• fix(ext/node): encode http2 headers as Latin-1 to fix response splitting
  (#​33531)
• fix(ext/node): encode more chars in url.pathToFileURL() (#​33397)
• fix(ext/node): enforce HTTP/2 server header list size limits (#​33494)
• fix(ext/node): enforce http2 maxSessionInvalidFrames limit (#​33515)
• fix(ext/node): expose http2 sensitive headers received with NV_FLAG_NO_INDEX
  flag (#​33626)
• fix(ext/node): fix EEXIST error and data loss in writeFileSync on Windows
  (#​33413)
• fix(ext/node): fix ERR_INVALID_CHAR message & OutgoingMessage.prototype.write
  (#​33430)
• fix(ext/node): fix TLS client certificate authentication verification (#​33576)
• fix(ext/node): fix TLS socket error ordering and app data leak before identity
  verification (#​33585)
• fix(ext/node): fix TLS socket lifecycle and readStop backpressure (#​33524)
• fix(ext/node): fix closeIdleConnections destroying active connections (#​33596)
• fix(ext/node): fix fs.glob skipping siblings with */../ patterns (#​33372)
• fix(ext/node): fix spawnSync internal API for monkey-patching and killSignal
  (#​33545)
• fix(ext/node): flush GOAWAY before destroying http2 socket and expose
  internal/http2/core (#​33566)
• fix(ext/node): flush HTTP/2 client preface after settings submission (#​33387)
• fix(ext/node): forward enableConnectProtocol setting to peer in HTTP/2
  SETTINGS frame (#​33616)
• fix(ext/node): handle undefined http2 ping payload and cancel pending pings on
  destroy (#​33561)
• fix(ext/node): hide aggregateTwoErrors frame in AggregateError stack (#​33402)
• fix(ext/node): honor http2 strictFieldWhitespaceValidation option (#​33506)
• fix(ext/node): honor requestCert/ca on node:tls server, populate
  getPeerCertificate() (#​33439)
• fix(ext/node): honor weight option in http2 client.request and emit DEP0194
  (#​33622)
• fix(ext/node): http2 createConnection support and per-frame socket writes
  (#​33520)
• fix(ext/node): implement BlockList.rules / isBlockList / toJSON / fromJSON
  (#​33445)
• fix(ext/node): implement Socket.resetAndDestroy with TCP RST in node:net
  (#​33415)
• fix(ext/node): implement StatWatcher.ref() / unref() (#​33408)
• fix(ext/node): implement dns Resolver cancel() and timeout support (#​33580)
• fix(ext/node): implement dns.reverse() and fix dns.lookup() family parameter
  (#​33579)
• fix(ext/node): implement fs.mkdtempDisposableSync /
  fsPromises.mkdtempDisposable (#​33533)
• fix(ext/node): implement node:cluster fork/Worker and worker-side detection
  (#​33493)
• fix(ext/node): implement process.debugPort with ToInt32 coercion (#​33403)
• fix(ext/node): import kIncomingMessage/kServerResponse in http2 allowHTTP1
  fallback (#​33435)
• fix(ext/node): improve Node.js timer compatibility (#​33479)
• fix(ext/node): improve perf_hooks timerify and add missing exports (#​33581)
• fix(ext/node): include accepted values in Console colorMode error (#​33424)
• fix(ext/node): isolate parentPort from globalThis in worker_threads (#​32596)
• fix(ext/node): make Buffer.prototype methods generic-callable (#​33466)
• fix(ext/node): make http2 session.origin() round-trip origins and respect TLS
  servername (#​33629)
• fix(ext/node): make process.constructor a proper instanceof check (#​33447)
• fix(ext/node): name custom-promisified functions after their originals
  (#​33407)
• fix(ext/node): null-proto child_process options to block prototype pollution
  (#​33555)
• fix(ext/node): pass reusePort flags in Server.listen() without host (#​33530)
• fix(ext/node): pass signal name to process signal handlers (#​33425)
• fix(ext/node): pass stream fd to child process stdio instead of inheriting
  (#​33525)
• fix(ext/node): plumb llhttp error code, reason, and bytes parsed through
  HTTPParser (#​33591)
• fix(ext/node): prevent duplicate close emit when http2 client socket i
  (#​33538)
• fix(ext/node): re-arm Windows named pipe server after accept (#​33369)
• fix(ext/node): rebind http2 state buffers post-snapshot, enforce
  maxHeaderListPairs (#​33495)
• fix(ext/node): reject non-ArrayBufferView data in fs.writeFileSync (#​33406)
• fix(ext/node): rename _destroySsl to _destroySSL to match Node.js API (#​33599)
• fix(ext/node): replace unwrap with error propagation in parallel cp (#​33396)
• fix(ext/node): return relative path from fs.watch with recursive option
  (#​33428)
• fix(ext/node): strip trailing dot from SRV target in dns.resolveSrv() (#​33578)
• fix(ext/node): submit http2 RST_STREAM before flushing END_STREAM DATA frame
  on respondWithFD read (#​33633)
• fix(ext/node): support ALPNCallback in http2.createSecureServer (#​33521)
• fix(ext/node): support BlockList, AbortSignal, and constructor options in
  node:net Socket (#​33414)
• fix(ext/node): support ignore option in fs.watch and fs.promises.watch
  (#​33610)
• fix(ext/node): support encoding option in fs.readdir; don't double-call glob
  callback (#​33501)
• fix(ext/node): support http2 pushStream and client push events (#​33516)
• fix(ext/node): support reusePort option and fix bind/pipe handling in node:net
  (#​33416)
• fix(ext/node): support util.promisify on http2.connect (#​33489)
• fix(ext/node): support v1 X.509 certs and http2 ALPN fallback (#​33510)
• fix(ext/node): throw ERR_INVALID_ARG_VALUE when rmdir gets options.recursive
  (#​33565)
• fix(ext/node): throw ERR_INVALID_URL from http/https request string URL
  (#​33427)
• fix(ext/node): throw TypeError for Symbol keys/values in process.env (#​33399)
• fix(ext/node): timer _destroyed flag, Symbol.dispose, and setInterval abort
  (#​33528)
• fix(ext/node): track http2 custom settings and SETTINGS ACK callbacks (#​33518)
• fix(ext/node): treat unsolicited HTTP/2 PING ACK as connection-level protocol
  error (#​33625)
• fix(ext/node): use AbortSignal.addEventListener in addAbortListener (#​33557)
• fix(ext/node): use ERR_INVALID_ARG_TYPE for tls.createServer non-object
  options (#​33589)
• fix(ext/node): use ERR_INVALID_ARG_VALUE in module.createRequire (#​33449)
• fix(ext/node): use Node's address-type check in dgram Socket.send (#​33420)
• fix(ext/node): use node:timers for http server connection checks, expo
  (#​33483)
• fix(ext/node): use proper error codes for require() invalid arguments (#​33609)
• fix(ext/node): validate fs.watch boolean options (#​33627)
• fix(ext/node): validate boolean arg in process.setSourceMapsEnabled (#​33473)
• fix(ext/node): validate ciphers option in tls.createSecureContext() (#​33597)
• fix(ext/node): validate dgram options.recvBufferSize / sendBufferSize (#​33444)
• fix(ext/node): validate oaepHash in publicEncrypt/privateDecrypt (#​33388)
• fix(ext/node): validate options.type in Readable.toWeb (#​33560)
• fix(ext/node): validate process.chdir argument is a string (#​33401)
• fix(ext/node): walk sandbox prototype chain in vm property_query (#​33463)
• fix(ext/node): wire JSStreamSocket handle write/shutdown for http2 (#​33526)
• fix(ext/node): wire up captureRejection handler for http2 servers (#​33542)
• fix(ext/node): yield to I/O in http2 write path so stream pipeline finishes
  (#​33541)
• fix(ext/web): align AbortSignal.timeout error message with Node (#​33460)
• fix(ext/web): allow transferring non-serializable types in structuredClone
  (#​33491)
• fix(ext/web): handle late write racing with TransformStream cancel (#​33478)
• fix(ext/web): narrow ReadableStreamBYOBRequest.view to Uint8Array (#​33477)
• fix(ext/web): retain source from MessageEventInit (#​33500)
• fix(ext/web): route console.dirxml through the log printer (#​33443)
• fix(ext/web): set ERR_MISSING_ARGS code on URL.revokeObjectURL no-arg (#​33471)
• fix(ext/web): structuredClone of non-serializable Web types throws
  DataCloneError (#​33465)
• fix(ext/webidl): set ERR_ILLEGAL_CONSTRUCTOR code on illegal constructor calls
  (#​33535)
• fix(ext/webidl): set ERR_INVALID_THIS code on brand-check TypeError (#​33467)
• fix(node/buffer): fix panic in transcode with odd-length UTF-16LE input
  (#​33390)
• fix(node/compat): disable flaky test-child-process-exec-kill-throws on Windows
  (#​33426)
• fix(node/compat): disable flaky test-fs-read-stream-pos on Windows (#​33421)
• fix(node/compat): fix shard report merging and fetching in CI reporting
  (#​33431)
• fix(permissions): normalize paths for macOS filesystem comparison (#​33451)
• fix(task): match workspace directory name in --filter (#​33499)
• fix(task): use explicit workspace root check in directory-name fallback
  (#​33540)
• fix(x): forward --unstable-* flags to JSR and URL targets (#​33450)
• fix: bound fs.readFile on non-terminating sources (#​33262)
• fix: drop config-only unstable features from unstable_args() (#​33452)
• fix: match single-char wildcard segments in npm package imports (#​33513)
• perf(ext/node): pool 64KB read buffers to reduce allocation pressure (#​33395)
• perf: optimize worker and MessagePort message passing (#​32657)
• perf: upgrade rusty_v8 to 147.4.0 (#​33422)

h3js/h3 (h3)

v2.0.1-rc.21

Compare Source

compare changes

🚀 Enhancements

• Coerce thrown number/string to HTTPError (#​1372)

🩹 Fixes

• setCookie: Handle encode and stringify serialize options (#​1377)
• event-stream: Do not emit unhandled rejection when readable side is canceled (#​1376)
• withoutBase: Collapse leading slashes (64acfe6)

📖 Documentation

• Fix typo in error handling (#​1364)

🏡 Chore

• Update deps (e2f8cbd)
• Update deps (4e38f49)

❤️ Contributors

• Pooya Parsa (@​pi0)
• Max maximogarciamtnez@gmail.com
• Drackin Best (@​Drackin)
• Kevin Dyes kevin.dyes@icloud.com
• Daniel Roe (@​danielroe)

rolldown/rolldown (rolldown)

v1.0.0-rc.18

Compare Source

💥 BREAKING CHANGES

• optimization: default unspecified inlineConst.mode to smart (#​9248) by @​IWANABETHATGUY

🐛 Bug Fixes

• rolldown_plugin_vite_import_glob: return error instead of panicking when virtual module uses a relative glob (#​9241) by @​shulaoda
• binding: treat empty inlineConst object as omitted (#​9247) by @​IWANABETHATGUY
• rolldown: keep enum declaration for optional-chain access (#​9229) by @​Dunqing
• link_stage: restore inline let-else in exports-kind filter (#​9237) by @​IWANABETHATGUY
• dev/lazy: avoid module reinitialization in lazy compilation patches (#​9179) by @​h-a-n-a
• dev: visit identifier references for runtime rewrites in HMR finalizer (#​9191) by @​h-a-n-a
• chunk-optimizer: pick dominator for runtime placement to avoid cycles (#​9164) by @​IWANABETHATGUY
• make this.emitFile chunk path synchronous to avoid deadlock (#​9031) by @​lazarv
• use sentinel id for browser: false ignored modules (#​9192) by @​shulaoda
• prevent chunk optimizer from creating import cycles (#​9228) by @​IWANABETHATGUY

🚜 Refactor

• replace tokio::sync::Mutex with std::sync::Mutex for non-IO data (#​9176) by @​shulaoda
• rolldown_plugin_vite_import_glob: do not rewrite import path for absolute base (#​9195) by @​shulaoda
• runtime_helper: wrap DependedRuntimeHelperMap in a struct (#​9215) by @​IWANABETHATGUY
• drop redundant clear() in determine_safely_merge_cjs_ns (#​9206) by @​IWANABETHATGUY
• clean up generate_lazy_export (#​9208) by @​IWANABETHATGUY
• bitset: return bool from set_bit to fuse guard-and-set (#​9207) by @​IWANABETHATGUY
• link_stage: simplify exports-kind filter and clarify safety comments (#​9205) by @​IWANABETHATGUY

📚 Documentation

• determine_module_exports_kind (#​9252) by @​IWANABETHATGUY
• fix dead link to esbuild ESM/CJS interop tests (#​9230) by @​Copilot
• remove CSS bundling references (#​9234) by @​shulaoda
• correct IncrementalFullBuild row in BundleMode table (#​9214) by @​IWANABETHATGUY
• design: add bundler data lifecycle design doc (#​9212) by @​hyf0
• remove minifier alpha status notices (#​9202) by @​sapphi-red

⚙️ Miscellaneous Tasks

• upgrade oxc to 0.128.0 (#​9260) by @​shulaoda
• deps: bump rolldown-ariadne to 0.6.0 (#​9254) by @​IWANABETHATGUY
• deps: update github actions (#​9259) by @​renovate[bot]
• deps: update github actions (#​9258) by @​renovate[bot]
• remove renovate overrides (#​9257) by @​Boshen
• use ubuntu-latest for security workflow (#​9256) by @​Boshen
• notify Discord around release publish (#​9251) by @​Boshen
• add release environment to npm publish workflow (#​9250) by @​Boshen
• justfile: drop the -- separator before forwarded args in vp run (#​9246) by @​shulaoda
• deps: update test262 submodule for tests (#​9243) by @​sapphi-red
• add more tracing instrumentations (#​9220) by @​sapphi-red
• rolldown_plugin_vite_import_glob: remove outdated sourcemap doc comment (#​9213) by @​shulaoda
• update security workflow (#​9201) by @​Boshen

❤️ New Contributors

• @​lazarv made their first contribution in #​9031

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 2am and before 3am"
• Automerge
  • "after 1am and before 2am"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nitro.build	Ready	Preview, Comment	Apr 29, 2026 2:35pm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	h3@​2.0.1-rc.21

View full report