chore(deps): update dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
cargo:wasm-bindgen-cli (source)	tools	patch	0.2.126 → 0.2.127
clap	workspace.dependencies	patch	4.6.5 → 4.6.6
cssnano	devDependencies	patch	8.0.2 → 8.0.5
cssnano	dependencies	patch	8.0.2 → 8.0.5
esbuild	devDependencies	patch	0.28.1 → 0.28.2
esbuild	dependencies	patch	0.28.1 → 0.28.2
similar	workspace.dependencies	patch	3.1.1 → 3.1.2
thiserror	workspace.dependencies	patch	2.0.19 → 2.0.20
wasm-bindgen (source)	workspace.dependencies	patch	0.2.126 → 0.2.127
wasm-bindgen-test	workspace.dependencies	patch	0.3.76 → 0.3.77
web-sys (source)	workspace.dependencies	patch	0.3.103 → 0.3.104

---

Release Notes

wasm-bindgen/wasm-bindgen (cargo:wasm-bindgen-cli)

v0.2.127

Compare Source

Added

• Navigation API
  to web-sys #​5247

• Added riscv64gc-unknown-linux-gnu release artifacts.
  #​5265

• Added JsNullable<T>, modeling WebIDL nullable types (T | null). Both
  null and undefined are treated as absent, per WebIDL's ECMAScript
  conversion rules; the canonical empty value produced from Rust is null.
  web-sys now uses JsNullable<T> instead of JsOption<T> for nullable
  types nested inside generics (e.g. Promise<GpuError?> from
  GPUDevice.popErrorScope()), fixing spec-defined null resolutions being
  treated as present values under JsOption<T>'s strict undefined-only
  semantics. JsNullable<T> participates in the same upcast lattice as
  JsOption<T> (including contravariant closure argument casts), and
  additionally upcasts from Null and from JsOption<T> itself. Imported
  extern types now also upcast into JsOption<JsValue> and
  JsNullable<JsValue>, so catch-all nullable closures can be used where a
  typed callback is expected.
  #​5234

Changed

• Emscripten output now marks public exports (free functions, classes, enums,
  and namespace roots) with the __export: true and __force: true symbol
  attributes on their addToLibrary entries, instead of mutating
  EXPORTED_FUNCTIONS and pushing to extraLibraryFuncs at library-load time.
  The $initBindgen init closure is kept via __force: true, and private
  symbols (including namespace leaves) carry neither attribute — they remain
  reachable through __deps. Requires an emscripten with __export/__force
  symbol-attribute support.

• Updated WebGPU bindings to the August 2026 spec, including the new
  GPUCommandEncoder::copy_buffer_to_buffer overloads and setImmediates.
  #​5246

• Unstable API overload names now elide name tokens shared by every overload
  variant: LockManager::request_with_callback is now request, and
  request_with_options_and_callback is now request_with_options.
  #​5246

Fixed

• The name property of the JS error thrown for panic=unwind is now set from
  a string literal instead of PanicError.name, so it survives minification.
  #​5260

• Fixed Emscripten builds using pthreads failing to link.
  #​5254

• __wbg_load in web targets now throws a clear error including the HTTP
  status and URL when given a non-ok fetch Response, instead of surfacing a
  misleading MIME-type or Wasm-magic-number error.
  #​5256

• Restored __stack_pointer when an exception unwinds out of a wasm export,
  preventing repeated panic = "unwind" calls from leaking shadow-stack frames
  until the shadow stack is exhausted and calls trap. Node reports
  memory access out of bounds; poisoned instances can instead report
  Module terminated.
  #​5244

• slice_to_array on a &mut slice (which silently discarded JS's writes) or
  on a slice with a generic element type is now a compile error, and strings
  and arrays received by JS (e.g. a Vec<String> return value) no longer make
  a redundant copy of the freshly built value.
  #​5261

• Fixed async imports with non-JS-handle resolved types (e.g.
  async fn f() -> u32;) silently producing garbage since 0.2.109: the
  descriptor named the resolved type instead of the Promise handle that
  actually crosses the ABI.
  #5249

• Fixed catch imports returning i64/u64 throwing a TypeError (and
  panicking in __wbindgen_exn_store) when the JS import throws, since the
  handleError catch path returned undefined which cannot be converted to
  a Wasm i64.
  #​5238

• js_namespace is now part of an imported function's and imported static's
  generated shim name. Two imports with identical Rust signatures that differed
  only in their js_namespace hashed to the same __wbg_<name>_<hash>
  symbol, so they were treated as one binding and one of the two call sites
  silently invoked the wrong JS value.
  #​5250

• Macro hygiene fixes - slice_to_array now works in #![no_std] crates.
  Generated code no longer names core or std unqualified.
  #​5251

• Fixed length prefixes in descriptor strings to count chars rather than
  UTF-8 bytes, so non-ASCII names in js_name/typescript_type no longer
  panic the CLI or mis-bind the generated bindings.
  #​5248

• Fixed threaded Wasm memory layout to reserve wasm-bindgen's internal thread
  page after the module's original initial memory instead of at __heap_base,
  avoiding overlap with allocators that resolve __heap_base/__heap_end at
  link time and treat that range as preexisting heap space.
  #​5225

• Emscripten output now reaches wasm exports through emscripten's wasmExports
  object using bracket (string-literal) access (wasmExports['__wbindgen_start'])
  instead of a local wasm alias with dot access. wasmExports['name'] is the
  form emcc's DCE graph roots and its import/export minifier renames in the JS
  and the wasm together, so the glue now survives and stays consistent under
  -O3/-Os (previously the export names were minified without updating the JS
  call sites, e.g. __wbindgen_start is not defined).

• The emscripten detection marker static is no longer leaked as public API.
  #​5220
  #​5222

clap-rs/clap (clap)

v4.6.6

Compare Source

evanw/esbuild (esbuild)

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#​4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#​4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#​4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#​4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#​4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})
  }
  
  // Old output (with --minify-syntax --target=es6)
  function foo() {
    bar(void 0 || (x = {}));
  }
  
  // New output (with --minify-syntax --target=es6)
  function foo() {
    let x;
    bar(x || (x = {}));
  }

• Fix a potential deadlock when the JavaScript API is used incorrectly (#​4503, #​4506)

  The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

  Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

  This fix was submitted by @​ZuBB.

• Handle target collisions (#​4509)

  It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.

• Force .mp3 files to use the audio/mpeg MIME type (#​4485)

  MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

• Add a new TypeScript syntax warning

  TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

  ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]
  
      example.ts:1:28:
        1 │ console.log(1 + 2 as number * 3)
          ╵                             ^
  
    This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
    precedence in this case. Surround the inner expression in parentheses to silence this warning:
  
      example.ts:1:12:
        1 │ console.log(1 + 2 as number * 3)
          │             ~~~~~~~~~~~~~~~
          ╵             (             )

  See microsoft/TypeScript#63527 for more information.

• Add support for formatting errors for Visual Studio (#​4460)

  Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

  With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:

  $ esbuild example.ts --log-style=visualstudio
  /Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator
  

  This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.

• Fix a bug with CSS gamut mapping (#​4488)

  Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

  This fix was submitted by @​chatman-media.

mitsuhiko/similar (similar)

v3.1.2

Compare Source

• Fixed Algorithm::Lcs deadline fallback emitting edits twice, which produced
  out-of-bounds DiffOp ranges and panics when consuming timed-out diffs. #​97
• Fixed Algorithm::Lcs reporting identical subranges with zero-based indices
  instead of preserving the supplied range offsets. #​98
• Fixed Algorithm::Lcs and Algorithm::Hunt emitting zero-length delete
  operations when both inputs are empty. #​99

dtolnay/thiserror (thiserror)

v2.0.20

Compare Source

• Suppress redundant_field_names clippy lint in generated code (#​454)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --package wasm-bindgen@0.2.126 --precise 0.2.127
    Updating crates.io index
error: failed to select a version for the requirement `wasm-bindgen = "=0.2.126"`
candidate versions found which didn't match: 0.2.127
location searched: crates.io index
required by package `web-sys v0.3.103`
    ... which satisfies dependency `web-sys = "^0.3.103"` (locked to 0.3.103) of package `csskit_wasm v0.0.28 (/tmp/renovate/repos/github/csskit/csskit/crates/csskit_wasm)`

[github-actions]

✅ CI passed

Job	Result
Build & Test (win32-x64, win32-arm64, linux-x64, linux-arm64, darwin-x64, darwin-arm64)	✅ success
Build & Test (default features)	✅ success
Build & Test (nightly)	✅ success
Build each library	✅ success
Build benches	✅ success
Acceptance Tests	✅ success
Fuzz Corpus Replay	✅ success