build: update all non-major dependencies (main)

[angular-robot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@nginfra/angular-linking>@babel/core (source)	8.0.1 → 8.0.5
firebase-tools	15.28.2 → 15.30.0
magic-string	1.2.3 → 1.3.1
pnpm (source)	11.25.0 → 11.27.0
sass	1.103.1 → 1.104.1

---

• If you want to rebase/retry this PR, check this box

---

Release Notes

babel/babel (@​nginfra/angular-linking>@​babel/core)

v8.0.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​18218 fix(parser): do not form html entity for invalid codepoint (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​18215 fix(parser): remove non-decimal prefix from bigint (@​JLHwung)
  • #​18063 Disallow new import prop access (@​JLHwung)
• babel-plugin-transform-destructuring
  • #​18214 fix: only collapse the empty-object check when it targets the declared binding (@​Kjubikstronk)
• babel-plugin-transform-typescript
  • #​18190 fix(ts): improve variable handling in namespace (@​JLHwung)
  • #​18207 [ts] Allow merging enum into a namespace (@​nicolo-ribaudo)
• babel-node
  • #​18217 Fix import path for babel-node.js (@​drubetti)
• babel-plugin-bugfix-safari-rest-destructuring-rhs-array
  • #​18213 fix(bugfix): bound check before array access (@​JLHwung)
• babel-traverse
  • #​18183 fix(remove): unwrap single sequence expression (@​JLHwung)
  • #​18153 Handle null in getAll{Prev,Next}Siblings (@​JLHwung)
• babel-plugin-transform-block-scoping
  • #​18194 fix: improve for loop closure environment check (@​JLHwung)
  • #​18193 fix: assign closure body after handling return (@​JLHwung)
  • #​18088 Fix initialization of nested for loop head declarations (@​journey-ad)
• babel-generator
  • #​18202 fix(generator): keep parens for ?. chain in tag (@​JLHwung)
• babel-register
  • #​18137 fix(babel-register): preserve app-managed graceful shutdown (@​jibin7jose)
• Other
  • #​18140 chore: fix @​babel/eslint-plugin peer deps (@​JLHwung)
• babel-cli, babel-helper-transform-fixture-test-runner, babel-register
  • #​18131 fix(register): do not inherit parent execArgv (@​JLHwung)
• babel-standalone
  • #​18095 Add types for @babel/standalone (@​liuxingbaoyu)

📝 Documentation

• #​18187 Add AI policy (@​nicolo-ribaudo)

🏠 Internal

• babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env
  • #​18145 refactor: replace semver with verkit (@​sxzz)
• babel-node
  • #​18177 Update node flags list (@​nicolo-ribaudo)
• babel-types
  • #​18103 Simplify AST validators (@​fisker)

🏃‍♀️ Performance

• babel-parser
  • #​18176 perf: Improve @babel/parser (@​liuxingbaoyu)

firebase/firebase-tools (firebase-tools)

v15.30.0

Compare Source

• Updated the Firebase SQL Connect local toolkit to v3.4.19, which includes the following changes:
  • [fixed] Bug fixes and performance improvements for the PostgreSQL emulator.
• [fixed] Clean up managed service accounts when all functions in a codebase are deleted.
• Corrected Cloud Tasks emulator Queue ID validation error message to match Cloud Tasks naming rules.
• Repurposed the local dataconnect_execute tool as dataconnect_execute_in_emulator to run GraphQL queries and mutations on the local SQL Connect emulator.
• Configured the SQL Connect (Data Connect) OneMCP proxy server in ONEMCP_SERVERS with a selection of remote tools.
• Configured the Mcp-Param-Region HTTP header workaround in OneMcpServer for MCP routing support.
• [fixed] Retry IAM policy updates on replication lag and concurrency conflicts.
• [fixed] Prevent deadlock and stale source tokens during Cloud Functions deployment retries.
• [fixed] Retry Cloud Functions creation on HTTP 400 service account propagation errors.

v15.29.0

Compare Source

• Added support for the FIREBASE_DEBUG_PATH environment variable to customize the debug log output location.
• Add humanReadableDescription field to MCP tools and use it in --generate-tool-list output.
• Fixed an issue where the Functions emulator replaced an IPC failure with an unrelated TypeError about stream chunk types, hiding why the runtime became unreachable (#​10876).
• [Added] Add -f, --force option to firebase ext:migrate.
• [Fixed] Fix parameter type preservation and optional system parameter handling during extension updates in firebase ext:migrate

Rich-Harris/magic-string (magic-string)

v1.3.1

Compare Source

pnpm/pnpm (pnpm)

v11.27.0: pnpm 11.27

Compare Source

Minor Changes

• nodeDownloadMirrors can now be set in the global config file (config.yaml) and through the PNPM_CONFIG_NODE_DOWNLOAD_MIRRORS environment variable, so a Node.js download mirror can be configured once for a machine instead of in every workspace #​12124, #​13611.

  PNPM_CONFIG_NODE_DOWNLOAD_MIRRORS='{"release":"https://npmmirror.com/mirrors/node/"}'

• Added a new setting trustPolicyExcludePrune (default: false). When enabled, pnpm add, pnpm update, and pnpm remove prune the entries of trustPolicyExclude in pnpm-workspace.yaml that the freshly written lockfile no longer resolves: versions that are gone are dropped (an entry is removed once none of its versions remain), and entries for packages that are no longer in the lockfile are removed too. Name patterns (@scope/*) are always kept. The cleanup is skipped when the install's lockfile does not cover the whole workspace (sharedWorkspaceLockfile: false), since entries another project still needs would look stale.

Patch Changes

• pnpm now reads the packageManager, devEngines.packageManager and runtime pins from the workspace root's package.json when lockfileDir is set. A project that moved its lockfile lost the pins it declared there #​14633.

• Fixed pnpm add -g, pnpm update -g, and pnpm remove -g mutating global bins or install directories after only partially reading an installed package group. If any declared package manifest is missing, malformed, or unreadable, pnpm now fails before activation or removal and leaves the existing global installation intact pnpm/pnpm#13796.

• fetch-timeout now limits how long a request may make no progress. The timer restarts on every chunk that arrives. A large download over a slow connection is no longer aborted while data is still coming in. A connection that stops delivering data still fails after fetch-timeout #​14604.

• pnpm peers check no longer reports a peer dependency declared as workspace:^, workspace:~, or a bare workspace: as unmet. pnpm reported these as unmet whatever version the linked workspace project supplied #​14770.

• A readPackage hook that edits its argument in place no longer changes what a later install in the same command resolves. A deprecated notice read from the lockfile no longer carries over to another install either #​13988.

• pnpm install now auto-installs missing transitive peers when workspace projects share a dependency at different depths. This also removes incomplete duplicate peer contexts from the lockfile. Fixes pnpm/pnpm#14840.

• GitHub Actions updates now stop if an action reference changes while its versions are being resolved. Unrelated workflow edits are preserved.

  GitHub Actions homepage links no longer expose server credentials. GitHub server URLs now require HTTPS, with HTTP allowed only for loopback hosts.

• pnpm licenses list now reports the runtime downloaded through devEngines.runtime with onFail: "download". The command previously failed with ERR_PNPM_UNSUPPORTED_PACKAGE_TYPE #​14172.

• pnpm no longer creates a project pnpm-lock.yaml when devEngines.packageManager.onFail is download and lockfile writing is turned off with lockfile: false or --no-lockfile. pnpm still switches to the pinned version #​14728.

• A registry or @scope:registry set in an .npmrc now wins over the registry a pnpm login credential stored in the global config.yaml points at. Previously, after logging in to one registry, installs in a project whose .npmrc named a private registry went to the logged-in registry instead. They now go to the registry the .npmrc names #​14614.

• A patch that gives a dependency a preinstall, install, or postinstall script, or a binding.gyp, now runs that build. pnpm asks for build approval first, so the package is listed under "Ignored build scripts" until it is allowed to build. pnpm 12 ran nothing, and pnpm 11 ran it without asking #​14648.

• Registries that share a host but differ by URL path — one JFrog Artifactory, Nexus, AWS CodeArtifact or GitLab Packages instance serving several repositories — now get a metadata cache directory each. Previously they shared one, so resolving a package from one of them could answer with another's versions, integrity hashes and tarball URLs and fail with ERR_PNPM_TARBALL_URL_MISMATCH #​13558.

  The URL scheme is part of the cache directory name too, so an http registry can no longer hand its metadata — which can be rewritten in transit — to a resolution configured for https at the same host.

  The first install after upgrading refetches registry metadata once. The package store is untouched.

  pnpm cache view now labels each entry with the full registry URL. It printed registry.npmjs.org before and prints https://registry.npmjs.org/ now.

  pnpm cache list-registries and pnpm cache list print the new directory names. Scripts that parse either command need updating.

• Updated the embedded Node.js release keys to the current canonical nodejs/release-keys list.

• pnpm sbom now omits package author fields when the manifest author name is empty or contains only whitespace pnpm/pnpm#14685. In a filtered or split workspace run, only a project with no author field inherits the workspace root's author.

• pnpm sbom --sbom-format spdx now writes creationInfo.created with whole seconds, such as 2026-09-08T10:38:21Z. The timestamp carried fractional seconds, which strict SPDX consumers rejected #​14684.

• Windows filesystem operations now retry permission errors for up to one second. Permanent permission errors previously delayed failure by a minute. Sharing and lock violations retain their one-minute retry budget pnpm/pnpm#14682.

• pnpm now writes node_modules/.package-map.json only when nodeExperimentalPackageMap is enabled. Nothing reads the file without that setting. An install that stops writing the map removes the one a previous install left.

• pnpm now unpacks a downloaded runtime archive into a randomly named directory inside the store. It previously used a predictable path, where another user of a shared store could plant a symlink and redirect the write outside the store (GHSA-vwc7-r8mq-g2x9).

Platinum Sponsors

Gold Sponsors

v11.26.0: pnpm 11.26

Compare Source

Minor Changes

• Catalogs can now resolve workspace dependencies through the workspace: protocol.

• pnpm remove and pnpm update now accept --trust-lockfile, --no-trust-lockfile, --trust-policy, --trust-policy-exclude, and --trust-policy-ignore-after. pnpm remove checks the whole lockfile against the active policies unless --trust-lockfile is set.

• Added pnpm change check for CI validation of package versions against the versioning.epics bands and versioning.fixed groups in pnpm-workspace.yaml.

Patch Changes

• Fetch and tarball errors and retry logs now hide URL credentials, query strings, and fragments that could expose secrets.

• Fixed a race during config dependency updates that could redirect a lockfile write through a symlink #​14322.

• pnpm add --allow-build=!<pkg> now correctly denies builds, including in global installs. pnpm approve-builds <pkg> and pnpm approve-builds !<pkg> now save decisions even when the package is not awaiting approval, with a warning #​14067.

• Fixed pnpm audit --fix failing without a value or when followed by another flag. pnpm audit --fix=override now respects saveExact and savePrefix when writing overrides #​13261, #​11523.

• pnpm audit now excludes ignored advisories from vulnerability totals and severity counts, and reports them separately #​14535.

• pnpm deploy no longer requires injectWorkspacePackages. If a workspace dependency's peer has multiple possible versions, deployment reports ERR_PNPM_DEPLOY_AMBIGUOUS_PEER with the conflicting versions. Pin the peer with overrides to deploy without injection #​9386.

• Fixed concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file #​14353.

• Fixed installation failures when a linked local dependency provides a peer dependency also provided by an ancestor, including with pnpm deploy --legacy.

• pnpm install --node-linker=hoisted no longer downloads skipped optional dependencies when node_modules already exists #​14139.

• Fixed pnpm install rejecting a symlinked lockfile when config dependencies are unchanged. Updates to config dependencies also preserve lockfiles with a byte order mark. Writes through symlinked lockfiles remain blocked #​14372.

• pnpm install now relinks workspace packages when publishConfig.linkDirectory changes. Frozen installs require the lockfile to be regenerated #​14488.

• Auto-installed optional peers now satisfy their declared range even when the workspace root uses a version outside that range #​13867.

• Fixed global virtual store paths for dependency cycles to consistently account for the runtime engine when dependencies have allowed builds #​14341.

• Standalone installations now preserve the bundled node-gyp files needed to build native dependencies.

• Downloaded runtimes are now available to dependency lifecycle scripts during installation.

• Node.js downloads from nodeDownloadMirrors now use URL-scoped npm credentials, including bearer tokens, basic auth, and tokenHelper #​14334.

• Fixed globalDir and globalBinDir handling in global configuration and environment variables, including ~/ expansion. This fixes pnpm add -g failing after pnpm config set -g global-bin-dir #​14336.

• The JavaScript pnpm can again switch to the project's pinned pnpm version on hosts without a matching native binary. If the requested version requires an unavailable native binary, the error now identifies the unsupported host #​13622.

• Global pnpm config commands now skip project package manager version switching, allowing authentication to be configured before downloading the pinned version #​14463.

• pnpm self-update, pnpm with, and automatic version switching no longer wait through registry retries when a configured registry has no signatures and registry.npmjs.org is unavailable #​14483.

• Fixed argument forwarding on Windows with shellEmulator enabled. Trailing backslashes, line breaks, and literal shell expressions are preserved #​14548.

• Relative scriptShell paths now resolve from the workspace root. Bare command names such as bash still use PATH #​14422.

• pnpm import now preserves the project-local lockfile when lockfileDir points elsewhere and restores the destination lockfile on failure. Branch lockfile imports leave the shared lockfile unchanged #​14563.

• catalogMode and --save-catalog no longer move local paths, tarballs, or workspace:<path> specifiers into catalogs #​14437.

• --side-effects-cache, --no-side-effects-cache, and PNPM_CONFIG_SIDE_EFFECTS_CACHE now toggle only the local cache, preserving any remote cache configured in sideEffectsCache.

• pnpm unpublish now handles registry two-factor authentication challenges through web authentication or a one-time password prompt #​14464.

• pnpm outdated and pnpm update now follow GitHub Actions references using self-repository syntax, such as uses: $/.github/actions/setup.

• pnpm remove now accepts --unsafe-perm.

Platinum Sponsors

Gold Sponsors

sass/dart-sass (sass)

v1.104.1

Compare Source

• Fix a bug where loud comments before @use rules could be emitted multiple
  times under certain circumstances.

• Fix a bug in which an invalid selector at the end of an indented syntax
  stylesheet would cause the parser to crash instead of emitting a useful error
  message.

Command Line Interface

• Many-to-many compilations no longer compile any files that appear in the
  output directory if the output directory is also within the source directory.
  This fixes a bug where --watch mode could enter an infinite loop recompiling
  the same CSS file over and over.

• Sass now sets the modification time of output files to the time compilation
  started rather than the time it ended. This ensures that, if a source file
  is modified during compilation, --watch and --update mode will recompile
  the outputs to include the new source file contents.

v1.104.0

Compare Source

• Potentially breaking compatibility fix: Colors now convert the special
  values NaN and negative zero, as well as infinity and negative infinity for
  polar-hue channels, to 0 as per the CSS spec.

• The special value negative zero is now serialized as -0 instead of 0 for
  greater compatibility when using it in CSS calculations.