chore(deps): bump the minor-and-patch group with 4 updates by dependabot[bot] · Pull Request #19 · thaw-app/platform

dependabot · 2026-08-24T16:55:22Z

Bumps the minor-and-patch group with 4 updates: @pulumi/pulumi, es-toolkit, @biomejs/biome and @types/bun.

Updates @pulumi/pulumi from 3.257.0 to 3.259.0

Release notes

Sourced from @pulumi/pulumi's releases.

v3.259.0

3.259.0 (2026-08-19)

Features

[cli/new] Show a single confirmation of project, stack, and config defaults in interactive pulumi new instead of prompting for each value #24223

[cli] Introduce PULUMI_DEFAULT_ORGANIZATION to be able to set the default org #24384

Bug Fixes

[cli/stack] Announce Created stack when creating a stack against the Pulumi Cloud backend #24280

[cli] Retry pulumi neo cancellation requests that the service rejects and keep Esc responsive instead of showing "Cancelling..." forever #24267

[cli/import] Generate a component resource definition when importing local components #24294

[auto/nodejs] Remove Node.js Automation API output buffer limit #24333

[sdk/go] Always emit the value and environment keys when serializing esc.Value and esc.Range, matching the fields the ESC OpenAPI contract marks required #24346

[engine] Fix the engine returning extension package refs for non-parameterised packages against the same base #24347

[cli/neo] Fix approval replies and mode changes being silently dropped when the outbound event queue is full #24370

[codegen/go] Fix nondeterministic Go program codegen for objects that mix null and typed properties #24366

[cli/do] Keep snippets when delete fails, so delete can be retried #24271

[cli/package] Report every schema validation error when pulumi package add fails to bind a package schema #24367

[programgen/python] Fix casing of local component outputs #24379

[cli/policy] Make policy group ls respect the default org #24385

Improvements

[cli] Explain which state backend pulumi login failed against, where that backend was configured, and how to change it #24322

[backend/diy] Report the state backend URL as configured when it cannot be opened, adding the resolved form when normalization changed it, and name a local path a state directory rather than a bucket #24335

[sdkgen/python] Type constant properties as Literal[value] instead of their primitive type #24358

[cli/plugin] Add --parallel flag to pulumi plugin install #24369

[cli] Fix progress bar rendering for parallel plugin installs #24372

v3.258.0

3.258.0 (2026-08-17)

Features

[cli] Add opt-in encryption of stored credentials with a key protected by the operating system, selected with PULUMI_CREDENTIAL_STORE #24212

[cli/new] Ask for a cloud provider and language in interactive pulumi new instead of listing every template #24226

[sdk/go] Add policyx.NewStackValidationPolicy and wire up the analyzer's AnalyzeStack RPC so Go policy packs can validate the full stack #24232

Bug Fixes

[sdkgen/go] Generate valid Go package clauses for schema modules whose names contain hyphens #24288

[sdkgen/nodejs] Export schema modules whose names contain hyphens under a valid sanitized identifier, including their type namespaces #24288

[cli/import] pulumi preview --import-file no longer emits unknown values, and pulumi import rejects files that contain them #24261

[auto/python] Add missing program argument on preview_refresh and preview_destroy stack methods #24274

[cli/new] Fix cloning templates and repositories into paths containing symlinks with absolute targets #24329

[cli/do] Fix global project lookup #24334

Improvements

... (truncated)

Changelog

Sourced from @pulumi/pulumi's changelog.

3.259.0 (2026-08-20)

Features

[cli/new] Show a single confirmation of project, stack, and config defaults in interactive pulumi new instead of prompting for each value #24223

[cli] Introduce PULUMI_DEFAULT_ORGANIZATION to be able to set the default org #24384

Bug Fixes

[cli/stack] Announce Created stack when creating a stack against the Pulumi Cloud backend #24280

[cli] Retry pulumi neo cancellation requests that the service rejects and keep Esc responsive instead of showing "Cancelling..." forever #24267

[cli/import] Generate a component resource definition when importing local components #24294

[auto/nodejs] Remove Node.js Automation API output buffer limit #24333

[sdk/go] Always emit the value and environment keys when serializing esc.Value and esc.Range, matching the fields the ESC OpenAPI contract marks required #24346

[engine] Fix the engine returning extension package refs for non-parameterised packages against the same base #24347

[cli/neo] Fix approval replies and mode changes being silently dropped when the outbound event queue is full #24370

[codegen/go] Fix nondeterministic Go program codegen for objects that mix null and typed properties #24366

[cli/do] Keep snippets when delete fails, so delete can be retried #24271

[cli/package] Report every schema validation error when pulumi package add fails to bind a package schema #24367

[programgen/python] Fix casing of local component outputs #24379

[cli/policy] Make policy group ls respect the default org #24385

Improvements

[cli] Explain which state backend pulumi login failed against, where that backend was configured, and how to change it #24322

[backend/diy] Report the state backend URL as configured when it cannot be opened, adding the resolved form when normalization changed it, and name a local path a state directory rather than a bucket #24335

[sdkgen/python] Type constant properties as Literal[value] instead of their primitive type #24358

[cli/plugin] Add --parallel flag to pulumi plugin install #24369

[cli] Fix progress bar rendering for parallel plugin installs #24372

3.258.0 (2026-08-17)

Features

[cli] Add opt-in encryption of stored credentials with a key protected by the operating system, selected with PULUMI_CREDENTIAL_STORE #24212

[cli/new] Ask for a cloud provider and language in interactive pulumi new instead of listing every template #24226

[sdk/go] Add policyx.NewStackValidationPolicy and wire up the analyzer's AnalyzeStack RPC so Go policy packs can validate the full stack #24232

Bug Fixes

[sdkgen/go] Generate valid Go package clauses for schema modules whose names contain hyphens #24288

[sdkgen/nodejs] Export schema modules whose names contain hyphens under a valid sanitized identifier, including their type namespaces #24288

[cli/import] pulumi preview --import-file no longer emits unknown values, and pulumi import rejects files that contain them #24261

[auto/python] Add missing program argument on preview_refresh and preview_destroy stack methods #24274

[cli/new] Fix cloning templates and repositories into paths containing symlinks with absolute targets #24329

[cli/do] Fix global project lookup #24334

Improvements

[sdk/python] Use the resource monitor's advertised feature set consistently throughout the Python SDK #24308

... (truncated)

Commits

3ad196a Add l3-map-test (#24379)
909b495 replace progress bar library with vbauerster/mpb (#24372)
d6259c0 Skip local components when generating import code (#24294)
45ce854 Use mapset.Set instead of codegen.StringSet/codegen.Set in codegen (#24357)
7a230d9 Update Node.js deps (#24368)
976666a Remove Node.js Automation API output buffer limit (#24333)
1536e2b Policy resource metadata test (#24348)
0708f38 Changelog and go.mod updates for v3.258.0 (#24355)
360d9d6 Freeze v3.258.0 (#24350)
6fb9daf Add opt-in OS-protected credential encryption (PULUMI_CREDENTIAL_STORE) (#24212)
Additional commits viewable in compare view

Updates es-toolkit from 1.50.0 to 1.51.0

Release notes

Sourced from es-toolkit's releases.

v1.51.0

Released on August 17th, 2026.

Added the es-toolkit/bigint entrypoint: bigint counterparts of the math functions (sum, sumBy, max, min, maxBy, minBy, clamp, inRange, median, medianBy, percentile, range, rangeRight), kept separate so the number implementations stay unchanged. ([#1966])

Added dedent, which removes common leading whitespace from template strings. ([#1679])

Added deepFreeze for recursively freezing objects. ([#1680])

Added mapValuesAsync and mapKeysAsync. ([#1544])

Added toPascalCaseKeys, toKebabCaseKeys, and toConstantCaseKeys, completing the object key casing family. ([#1984])

Exported the ToCamelCaseKeys, ToPascalCaseKeys, ToSnakeCaseKeys, ToKebabCaseKeys, and ToConstantCaseKeys types. ([#1651])

Added a preserveArrays option to flattenObject. ([#974])

Fixed retry to pass the last error to the delay callback ([#1759]) and to throw the last attempt's error without applying a final delay ([#1901]).

Fixed mergeWith and toMerged to handle mixed array/object types consistently with merge. ([#2026])

Fixed pullAt to remove the correct elements with negative indices. ([#1613])

Fixed at, pullAt, orderBy, and sortBy to accept readonly arrays. ([#2016])

Moved limitAsync from the array to the promise category. ([#2022])

Included the NOTICE file in the published npm and JSR packages. ([#2020])

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected edge cases now matches Lodash, so results may differ if you relied on the previous output.

Added entries and entriesIn. ([#1874])

Fixed compat/isMatch and compat/isMatchWith to handle object source patterns against primitive and non-plain-object targets like Lodash. ([#1432])

Fixed compat/set to block constructor.prototype paths, preventing prototype pollution. ([#1904])

Fixed compat/find to respect array-like length ([#1958]) and to convert fromIndex to an integer ([#1961]), and compat/indexOf to convert fromIndex to an integer when searching for NaN ([#1951]).

Fixed compat/orderBy to resolve unresolved deep paths and nullish elements to undefined ([#2010]), to exclude the length property from array-like values ([#2002]), and to read the criterion property from primitive values ([#1903]).

Fixed compat/toPath to split unquoted dotted keys inside brackets. ([#1899])

Fixed compat/omit to treat a key array as a single deep path. ([#1902])

Fixed compat/map to make the iteratee optional with an identity default. ([#1928])

Fixed compat/size to count combined Unicode symbols as single characters. ([#1900])

Fixed compat/intersectionBy to support number, object, and nullish iteratee shorthands ([#1993]), and compat/intersectionWith to apply the comparator when deduplicating the first array ([#1953]).

... (truncated)

Changelog

Sourced from es-toolkit's changelog.

Version v1.51.0

Released on August 17th, 2026.

Added the es-toolkit/bigint entrypoint: bigint counterparts of the math functions (sum, sumBy, max, min, maxBy, minBy, clamp, inRange, median, medianBy, percentile, range, rangeRight), kept separate so the number implementations stay unchanged. (#1966)

Added dedent, which removes common leading whitespace from template strings. (#1679)

Added deepFreeze for recursively freezing objects. (#1680)

Added mapValuesAsync and mapKeysAsync. (#1544)

Added toPascalCaseKeys, toKebabCaseKeys, and toConstantCaseKeys, completing the object key casing family. (#1984)

Exported the ToCamelCaseKeys, ToPascalCaseKeys, ToSnakeCaseKeys, ToKebabCaseKeys, and ToConstantCaseKeys types. (#1651)

Added a preserveArrays option to flattenObject. (#974)

Fixed retry to pass the last error to the delay callback (#1759) and to throw the last attempt's error without applying a final delay (#1901).

Fixed mergeWith and toMerged to handle mixed array/object types consistently with merge. (#2026)

Fixed pullAt to remove the correct elements with negative indices. (#1613)

Fixed at, pullAt, orderBy, and sortBy to accept readonly arrays. (#2016)

Moved limitAsync from the array to the promise category. (#2022)

Included the NOTICE file in the published npm and JSR packages. (#2020)

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected edge cases now matches Lodash, so results may differ if you relied on the previous output.

Added entries and entriesIn. (#1874)

Fixed compat/isMatch and compat/isMatchWith to handle object source patterns against primitive and non-plain-object targets like Lodash. (#1432)

Fixed compat/set to block constructor.prototype paths, preventing prototype pollution. (#1904)

Fixed compat/find to respect array-like length (#1958) and to convert fromIndex to an integer (#1961), and compat/indexOf to convert fromIndex to an integer when searching for NaN (#1951).

Fixed compat/orderBy to resolve unresolved deep paths and nullish elements to undefined (#2010), to exclude the length property from array-like values (#2002), and to read the criterion property from primitive values (#1903).

Fixed compat/toPath to split unquoted dotted keys inside brackets. (#1899)

Fixed compat/omit to treat a key array as a single deep path. (#1902)

Fixed compat/map to make the iteratee optional with an identity default. (#1928)

Fixed compat/size to count combined Unicode symbols as single characters. (#1900)

Fixed compat/intersectionBy to support number, object, and nullish iteratee shorthands (#1993), and compat/intersectionWith to apply the comparator when deduplicating the first array (#1953).

Fixed compat/difference, compat/differenceBy, compat/uniqBy, and compat/unionBy to normalize -0 to 0. (#2007)

Fixed compat/maxBy and compat/minBy to skip nullish iteratee values (#1927),

... (truncated)

Commits

5dc4477 v1.51.0
39a2661 feat(string/dedent): add dedent function for removing common leading whitespa...
5e0f057 fix/compat array find array like length (#1958)
4c94c3d fix(isMatch): handle primitive targets with object source patterns correctly ...
b7cdf14 feat: implement {mapValues,mapKeys}Async functions (#1544)
2a37b36 fix(retry): pass error to delay callback (#1759)
87fc74f test: Add browser compatibility test suite (#2012)
3fdea04 feat(flattenObject): add preserveArrays option (#974)
21c76cf feat(object/deepFreeze): add deepFreeze function for recursively freezing obj...
6d18625 fix(pullAt): fix incorrect element removal with negative indices (#1613)
Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.8 to 2.5.9

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.9

2.5.9

Patch Changes
#11321 41386f3 Thanks @dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

#11248 57b197e Thanks @yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.
#11377 a8798ea Thanks @Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.
@layer {
  a {
    color: red;
  }
}
#11327 6771cf5 Thanks @dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.
 <div>
   
+
   
 </div>
#10312 ba8aa18 Thanks @dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

#11333 715e0cd Thanks @kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.
#11343 9b98211 Thanks @johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.
@variant @xl {
  div {
    background: red;
  }
}
#11220 3e8c488 Thanks @santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

For example, Biome no longer reports greet as undeclared in the following Svelte component:
<script module>

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.9

Patch Changes
#11321 41386f3 Thanks @dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

#11248 57b197e Thanks @yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.
#11377 a8798ea Thanks @Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.
@layer {
  a {
    color: red;
  }
}
#11327 6771cf5 Thanks @dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.
 <div>
   
+
   
 </div>
#10312 ba8aa18 Thanks @dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

#11333 715e0cd Thanks @kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.
#11343 9b98211 Thanks @johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.
@variant @xl {
  div {
    background: red;
  }
}
#11220 3e8c488 Thanks @santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

For example, Biome no longer reports greet as undeclared in the following Svelte component:
<script module>
  export function greet() {
    console.log("Hello!");

... (truncated)

Commits

2081460 ci: release (#11309)
6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
a8798ea feat: useNamedLayer (#11377)
85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
e65f07e feat(lint): nursery useControlLabel (#11312)
ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
See full diff in compare view

Updates @types/bun from 1.3.14 to 1.4.0

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 4 updates: [@pulumi/pulumi](https://github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs), [es-toolkit](https://github.com/toss/es-toolkit), [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) and [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun). Updates `@pulumi/pulumi` from 3.257.0 to 3.259.0 - [Release notes](https://github.com/pulumi/pulumi/releases) - [Changelog](https://github.com/pulumi/pulumi/blob/master/CHANGELOG.md) - [Commits](https://github.com/pulumi/pulumi/commits/v3.259.0/sdk/nodejs) Updates `es-toolkit` from 1.50.0 to 1.51.0 - [Release notes](https://github.com/toss/es-toolkit/releases) - [Changelog](https://github.com/toss/es-toolkit/blob/main/CHANGELOG.md) - [Commits](toss/es-toolkit@v1.50.0...v1.51.0) Updates `@biomejs/biome` from 2.5.8 to 2.5.9 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.9/packages/@biomejs/biome) Updates `@types/bun` from 1.3.14 to 1.4.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun) --- updated-dependencies: - dependency-name: "@pulumi/pulumi" dependency-version: 3.259.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: es-toolkit dependency-version: 1.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@biomejs/biome" dependency-version: 2.5.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/bun" dependency-version: 1.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 24, 2026

Navigation Menu

Uh oh!

chore(deps): bump the minor-and-patch group with 4 updates - #19

chore(deps): bump the minor-and-patch group with 4 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-333944e774

dependabot Bot commented on behalf of github Aug 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.259.0

3.259.0 (2026-08-19)

Features

Bug Fixes

Improvements

v3.258.0

3.258.0 (2026-08-17)

Features

Bug Fixes

Improvements

3.259.0 (2026-08-20)

Features

Bug Fixes

Improvements

3.258.0 (2026-08-17)

Features

Bug Fixes

Improvements

v1.51.0

Version v1.51.0

Biome CLI v2.5.9

2.5.9

Patch Changes

2.5.9

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Aug 24, 2026 •

edited

Loading