build: update all non-major dependencies (main)

[angular-robot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@nginfra/angular-linking>@babel/core (source)	8.0.1 → 8.0.5
firebase-tools	15.28.2 → 15.30.0
magic-string	1.2.3 → 1.3.1
pnpm (source)	11.25.0 → 11.26.0
sass	1.103.1 → 1.104.0

---

• If you want to rebase/retry this PR, check this box

---

Release Notes

babel/babel (@​nginfra/angular-linking>@​babel/core)

v8.0.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​18218 fix(parser): do not form html entity for invalid codepoint (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​18215 fix(parser): remove non-decimal prefix from bigint (@​JLHwung)
  • #​18063 Disallow new import prop access (@​JLHwung)
• babel-plugin-transform-destructuring
  • #​18214 fix: only collapse the empty-object check when it targets the declared binding (@​Kjubikstronk)
• babel-plugin-transform-typescript
  • #​18190 fix(ts): improve variable handling in namespace (@​JLHwung)
  • #​18207 [ts] Allow merging enum into a namespace (@​nicolo-ribaudo)
• babel-node
  • #​18217 Fix import path for babel-node.js (@​drubetti)
• babel-plugin-bugfix-safari-rest-destructuring-rhs-array
  • #​18213 fix(bugfix): bound check before array access (@​JLHwung)
• babel-traverse
  • #​18183 fix(remove): unwrap single sequence expression (@​JLHwung)
  • #​18153 Handle null in getAll{Prev,Next}Siblings (@​JLHwung)
• babel-plugin-transform-block-scoping
  • #​18194 fix: improve for loop closure environment check (@​JLHwung)
  • #​18193 fix: assign closure body after handling return (@​JLHwung)
  • #​18088 Fix initialization of nested for loop head declarations (@​journey-ad)
• babel-generator
  • #​18202 fix(generator): keep parens for ?. chain in tag (@​JLHwung)
• babel-register
  • #​18137 fix(babel-register): preserve app-managed graceful shutdown (@​jibin7jose)
• Other
  • #​18140 chore: fix @​babel/eslint-plugin peer deps (@​JLHwung)
• babel-cli, babel-helper-transform-fixture-test-runner, babel-register
  • #​18131 fix(register): do not inherit parent execArgv (@​JLHwung)
• babel-standalone
  • #​18095 Add types for @babel/standalone (@​liuxingbaoyu)

📝 Documentation

• #​18187 Add AI policy (@​nicolo-ribaudo)

🏠 Internal

• babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env
  • #​18145 refactor: replace semver with verkit (@​sxzz)
• babel-node
  • #​18177 Update node flags list (@​nicolo-ribaudo)
• babel-types
  • #​18103 Simplify AST validators (@​fisker)

🏃‍♀️ Performance

• babel-parser
  • #​18176 perf: Improve @babel/parser (@​liuxingbaoyu)

firebase/firebase-tools (firebase-tools)

v15.30.0

Compare Source

• Updated the Firebase SQL Connect local toolkit to v3.4.19, which includes the following changes:
  • [fixed] Bug fixes and performance improvements for the PostgreSQL emulator.
• [fixed] Clean up managed service accounts when all functions in a codebase are deleted.
• Corrected Cloud Tasks emulator Queue ID validation error message to match Cloud Tasks naming rules.
• Repurposed the local dataconnect_execute tool as dataconnect_execute_in_emulator to run GraphQL queries and mutations on the local SQL Connect emulator.
• Configured the SQL Connect (Data Connect) OneMCP proxy server in ONEMCP_SERVERS with a selection of remote tools.
• Configured the Mcp-Param-Region HTTP header workaround in OneMcpServer for MCP routing support.
• [fixed] Retry IAM policy updates on replication lag and concurrency conflicts.
• [fixed] Prevent deadlock and stale source tokens during Cloud Functions deployment retries.
• [fixed] Retry Cloud Functions creation on HTTP 400 service account propagation errors.

v15.29.0

Compare Source

• Added support for the FIREBASE_DEBUG_PATH environment variable to customize the debug log output location.
• Add humanReadableDescription field to MCP tools and use it in --generate-tool-list output.
• Fixed an issue where the Functions emulator replaced an IPC failure with an unrelated TypeError about stream chunk types, hiding why the runtime became unreachable (#​10876).
• [Added] Add -f, --force option to firebase ext:migrate.
• [Fixed] Fix parameter type preservation and optional system parameter handling during extension updates in firebase ext:migrate

Rich-Harris/magic-string (magic-string)

v1.3.1

Compare Source

pnpm/pnpm (pnpm)

v11.26.0: pnpm 11.26

Compare Source

Minor Changes

• Catalogs can now resolve workspace dependencies through the workspace: protocol.

• pnpm remove and pnpm update now accept --trust-lockfile, --no-trust-lockfile, --trust-policy, --trust-policy-exclude, and --trust-policy-ignore-after. pnpm remove checks the whole lockfile against the active policies unless --trust-lockfile is set.

• Added pnpm change check for CI validation of package versions against the versioning.epics bands and versioning.fixed groups in pnpm-workspace.yaml.

Patch Changes

• Fetch and tarball errors and retry logs now hide URL credentials, query strings, and fragments that could expose secrets.

• Fixed a race during config dependency updates that could redirect a lockfile write through a symlink #​14322.

• pnpm add --allow-build=!<pkg> now correctly denies builds, including in global installs. pnpm approve-builds <pkg> and pnpm approve-builds !<pkg> now save decisions even when the package is not awaiting approval, with a warning #​14067.

• Fixed pnpm audit --fix failing without a value or when followed by another flag. pnpm audit --fix=override now respects saveExact and savePrefix when writing overrides #​13261, #​11523.

• pnpm audit now excludes ignored advisories from vulnerability totals and severity counts, and reports them separately #​14535.

• pnpm deploy no longer requires injectWorkspacePackages. If a workspace dependency's peer has multiple possible versions, deployment reports ERR_PNPM_DEPLOY_AMBIGUOUS_PEER with the conflicting versions. Pin the peer with overrides to deploy without injection #​9386.

• Fixed concurrent installs sharing a store occasionally failing with an ENOENT error while importing a package file #​14353.

• Fixed installation failures when a linked local dependency provides a peer dependency also provided by an ancestor, including with pnpm deploy --legacy.

• pnpm install --node-linker=hoisted no longer downloads skipped optional dependencies when node_modules already exists #​14139.

• Fixed pnpm install rejecting a symlinked lockfile when config dependencies are unchanged. Updates to config dependencies also preserve lockfiles with a byte order mark. Writes through symlinked lockfiles remain blocked #​14372.

• pnpm install now relinks workspace packages when publishConfig.linkDirectory changes. Frozen installs require the lockfile to be regenerated #​14488.

• Auto-installed optional peers now satisfy their declared range even when the workspace root uses a version outside that range #​13867.

• Fixed global virtual store paths for dependency cycles to consistently account for the runtime engine when dependencies have allowed builds #​14341.

• Standalone installations now preserve the bundled node-gyp files needed to build native dependencies.

• Downloaded runtimes are now available to dependency lifecycle scripts during installation.

• Node.js downloads from nodeDownloadMirrors now use URL-scoped npm credentials, including bearer tokens, basic auth, and tokenHelper #​14334.

• Fixed globalDir and globalBinDir handling in global configuration and environment variables, including ~/ expansion. This fixes pnpm add -g failing after pnpm config set -g global-bin-dir #​14336.

• The JavaScript pnpm can again switch to the project's pinned pnpm version on hosts without a matching native binary. If the requested version requires an unavailable native binary, the error now identifies the unsupported host #​13622.

• Global pnpm config commands now skip project package manager version switching, allowing authentication to be configured before downloading the pinned version #​14463.

• pnpm self-update, pnpm with, and automatic version switching no longer wait through registry retries when a configured registry has no signatures and registry.npmjs.org is unavailable #​14483.

• Fixed argument forwarding on Windows with shellEmulator enabled. Trailing backslashes, line breaks, and literal shell expressions are preserved #​14548.

• Relative scriptShell paths now resolve from the workspace root. Bare command names such as bash still use PATH #​14422.

• pnpm import now preserves the project-local lockfile when lockfileDir points elsewhere and restores the destination lockfile on failure. Branch lockfile imports leave the shared lockfile unchanged #​14563.

• catalogMode and --save-catalog no longer move local paths, tarballs, or workspace:<path> specifiers into catalogs #​14437.

• --side-effects-cache, --no-side-effects-cache, and PNPM_CONFIG_SIDE_EFFECTS_CACHE now toggle only the local cache, preserving any remote cache configured in sideEffectsCache.

• pnpm unpublish now handles registry two-factor authentication challenges through web authentication or a one-time password prompt #​14464.

• pnpm outdated and pnpm update now follow GitHub Actions references using self-repository syntax, such as uses: $/.github/actions/setup.

• pnpm remove now accepts --unsafe-perm.

Platinum Sponsors

Gold Sponsors

sass/dart-sass (sass)

v1.104.0

Compare Source

• Potentially breaking compatibility fix: Colors now convert the special
  values NaN and negative zero, as well as infinity and negative infinity for
  polar-hue channels, to 0 as per the CSS spec.

• The special value negative zero is now serialized as -0 instead of 0 for
  greater compatibility when using it in CSS calculations.