[Snyk] Upgrade web-tree-sitter from 0.25.10 to 0.26.11

[peterj]

Snyk has created this PR to upgrade web-tree-sitter from 0.25.10 to 0.26.11.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 10 versions ahead of your current version.

• The recommended version was released a month ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: web-tree-sitter

• 0.26.11 - 2026-07-12
  

  What's Changed

  • fix(deps): zig manifest for wasmtime is missing windows hashes by @ tree-sitter-ci-bot[bot] in #5720
  • fix(xtask): eliminate silent errors in zig fetch by @ WillLillis in #5724
  • fix(query): short-circuit longest-match dedup for disjoint states by @ tree-sitter-ci-bot[bot] in #5726
  • fix(query): various anchor fixes by @ tree-sitter-ci-bot[bot] in #5727
  • Fix C++ compilation errors in array macros. by @ tree-sitter-ci-bot[bot] in #5735
  • fix(rust): address new clippy lints by @ WillLillis in #5743
  • fix(generate): strip non-ASCII case folds by @ tree-sitter-ci-bot[bot] in #5744
  • fix(ci): re-set executable permission on release artifacts before zipping by @ clason in #5746
  • release v0.26.11 by @ clason in #5748

  Full Changelog: v0.26.10...v0.26.11

• 0.26.10 - 2026-06-28
  

  What's Changed

  • fix(lib): update doc comment for ts_parser_parse by @ WillLillis in #5642
  • fix(lib): use correct TREE_SITTER_HIDE_SYMBOLS macro name in alloc.h by @ tree-sitter-ci-bot[bot] in #5643
  • fix(cli): improve soundness of cst range calculation by @ WillLillis in #5650
  • fix(lib): Consider subtree lookahead bytes when determining whether the parser can reuse a node. by @ tree-sitter-ci-bot[bot] in #5656
  • fix(cli): display warning to user if parser test corpus dir isn't found by @ tree-sitter-ci-bot[bot] in #5669
  • fix: add DESCRIPTION to grammar Makefile template by @ WillLillis in #5672
  • fix(cli): infinite loop in highlight test by @ WillLillis in #5674
  • fix(lib): address strict aliasing violations in TreeCursor type by @ WillLillis in #5693
  • build(deps): bump wasmtime-c-api to v36.0.12 by @ clason in #5709
  • fix(dsl): forbid invalid field names by @ WillLillis in #5710
  • Fix issues with queries matching a parent node with anchored children (siblings) by @ tree-sitter-ci-bot[bot] in #5712
  • test(query): regression test for anchored siblings inside a parent by @ tree-sitter-ci-bot[bot] in #5716
  • release v0.26.10 by @ WillLillis in #5717

  Full Changelog: v0.26.9...v0.26.10

• 0.26.9 - 2026-05-19
  

  What's Changed

  • ci(actions): bump actions/cache to v5 by @ tree-sitter-ci-bot[bot] in #5482
  • build(deps): bump wasmtime-c-api to v36.0.7 by @ WillLillis in #5514
  • fix(loader): allow filenames with dots by @ tree-sitter-ci-bot[bot] in #5538
  • fix(rust): fix new clippy lints by @ WillLillis in #5539
  • test: bump c test fixture to v0.24.2 by @ tree-sitter-ci-bot[bot] in #5542
  • fix(generate): pass default optimization level in generate_parser_for_grammar by @ tree-sitter-ci-bot[bot] in #5543
  • feat(dist): enable install via cargo binstall (#5533) by @ clason in #5544
  • Prevent a buffer over-read when parsing 4-byte UTF-16 characters. by @ tree-sitter-ci-bot[bot] in #5549
  • fix(query): overflow in capture pool ids + some perf by @ tree-sitter-ci-bot[bot] in #5555
  • docs: note zero point unbounded behavior in query functions by @ WillLillis in #5563
  • build(deps): bump wasmtime-c-api to v36.0.8 by @ clason in #5574
  • fix(cli): account for process versions > 5 in the parse command's pretty debug output. by @ tree-sitter-ci-bot[bot] in #5577
  • fix(generate): improve error message for nonterminals used in immediate token rule by @ tree-sitter-ci-bot[bot] in #5583
  • fix(generate): rewrite parse_grammar with forward DFS by @ WillLillis in #5584
  • fix(wasm): load supertype tables for ABI 15 grammars by @ tree-sitter-ci-bot[bot] in #5606
  • build(deps): bump wasmtime-c-api to v36.0.9 by @ clason in #5611
  • Validate Wasm language memory reads by @ tree-sitter-ci-bot[bot] in #5613
  • release v0.26.9 by @ clason in #5612

  Full Changelog: v0.26.8...v0.26.9

• 0.26.8 - 2026-03-31
  

  What's Changed

  • fix(generate): allow disabling qjs-rt feature from CLI by @ WillLillis in #5448
  • fix(lib): document invariants that must be upheld for TSInputEdit by @ WillLillis in #5452
  • fix(cli): correct typo in parse command's help text by @ WillLillis in #5465
  • perf(cli): misc. improvements by @ tree-sitter-ci-bot[bot] in #5476
  • Fix wasm loading of languages w/ multiple reserved word sets by @ tree-sitter-ci-bot[bot] in #5477
  • generate: avoid panicking when a supertype only has hidden external token children by @ tree-sitter-ci-bot[bot] in #5478
  • release v0.26.8 by @ clason in #5479

  Full Changelog: v0.26.7...v0.26.8

• 0.26.7 - 2026-03-14
  

  Notable Changes

  • A regression in v0.26.6 with quantified alternations was fixed.
  • Release artifacts for the tree-sitter CLI are now published as zip archives (in addition to gzipped executables, which are planned for removal in a future minor release).

  What's Changed

  • fix: skip missing Makefile in version command by @ tree-sitter-ci-bot[bot] in #5386
  • fix(wasm): pass target triple to clang (#5385) by @ clason in #5390
  • chore(parser): return NULL, not false, for incomplete parse by @ tree-sitter-ci-bot[bot] in #5398
  • fix(loader): link with libc on OpenBSD to compile parser by @ tree-sitter-ci-bot[bot] in #5399
  • refactor(query): remove alternative_is_immediate by @ tree-sitter-ci-bot[bot] in #5412
  • fix(query): don't add copies for quantifier steps outside alternations by @ tree-sitter-ci-bot[bot] in #5414
  • revert allowing dashes in parser name by @ tree-sitter-ci-bot[bot] in #5433
  • ci(release): publish zip archives by @ clason in #5434
  • release v0.26.7 by @ clason in #5435

  Full Changelog: v0.26.6...v0.26.7

• 0.26.6 - 2026-02-25
  

  What's Changed

  • lib: clean up strict aliasing fixes in array.h by @ tree-sitter-ci-bot[bot] in #5311
  • feat: allow - in grammar names by @ tree-sitter-ci-bot[bot] in #5318
  • fix(cli): allow for both debug logs and graphs by @ tree-sitter-ci-bot[bot] in #5319
  • web: add default export to CJS bundle by @ tree-sitter-ci-bot[bot] in #5323
  • fix(query): prevent cross-branch capture contamination in alternations with quantifiers by @ tree-sitter-ci-bot[bot] in #5320
  • ci: speed it up by @ WillLillis in #5325
  • use provided by RedoxOS byte orders implementations by @ tree-sitter-ci-bot[bot] in #5346
  • build(deps): bump wasmtime to v36.0.5 LTS by @ clason in #5351
  • fix(lib): cast NULL in ts_subtree_children macro by @ tree-sitter-ci-bot[bot] in #5353
  • ci: backport release check workflow by @ WillLillis in #5358
  • ci: retrigger crates check on PR updates by @ tree-sitter-ci-bot[bot] in #5361
  • cli: init -u fixes by @ WillLillis in #5367
  • build(deps): bump wasmtime to v36.0.6 by @ clason in #5370
  • 0.26.6 by @ clason in #5372

  Full Changelog: v0.26.5...v0.26.6

• 0.26.5 - 2026-02-01
  No content.
• 0.26.4 - 2026-02-01
  

  What's Changed

  • fix(cli): trailing whitespace after multiline text nodes in CST by @ tree-sitter-ci-bot[bot] in #5135
  • fix(cli): correct discrepancy with cst for --no-ranges by @ tree-sitter-ci-bot[bot] in #5139
  • Fix Playground Query by @ tree-sitter-ci-bot[bot] in #5159
  • fix(cli): cst printing improvements by @ tree-sitter-ci-bot[bot] in #5165
  • fix(cli): set language in cwd for all usages of highlight command by @ tree-sitter-ci-bot[bot] in #5181
  • feat(cli): concurrent builds of the same grammar on different locations on disk by @ tree-sitter-ci-bot[bot] in #5182
  • fix(cli): canonicalize build --output path by @ tree-sitter-ci-bot[bot] in #5185
  • fix(cli): increase verbosity of tree-sitter init -u updates by @ tree-sitter-ci-bot[bot] in #5188
  • fix(cli): restore test summary output for tree-sitter test by @ tree-sitter-ci-bot[bot] in #5203
  • fix(wasm): add common definitions to stdlib by @ tree-sitter-ci-bot[bot] in #5208
  • fix(wasm): update wasm-stdlib.h by @ tree-sitter-ci-bot[bot] in #5210
  • Fix python free-threading compatibility by @ tree-sitter-ci-bot[bot] in #5214
  • fix(build): define _BSD_SOURCE by @ tree-sitter-ci-bot[bot] in #5226
  • fix(wasm): regenerate stdlib with wasm-opt by @ tree-sitter-ci-bot[bot] in #5239
  • fix(cli): warn user when nm can't be run to verify the symbols inside the parser being built by @ tree-sitter-ci-bot[bot] in #5246
  • fix(lib): address strict aliasing violations with Array type by @ tree-sitter-ci-bot[bot] in #5254
  • misc Windows fixes by @ tree-sitter-ci-bot[bot] in #5260
  • fix(wasm): correct several bugs in realloc by @ WillLillis in #5264
  • fix(generate): error if a supertype is defined as a terminal by @ tree-sitter-ci-bot[bot] in #5277
  • Action overflow by @ tree-sitter-ci-bot[bot] in #5278
  • fix(loader): account for nm/ld fix on newer powerpc linux toolchains by @ WillLillis in #5284
  • backport: wasm realloc optimization fix by @ WillLillis in #5286
  • fix(cli): use --edits value for fuzz tests by @ tree-sitter-ci-bot[bot] in #5288
  • 0.26.4 by @ WillLillis in #5289

  Full Changelog: v0.26.3...v0.26.4

• 0.26.3 - 2025-12-13
  

  What's Changed

  • docs(cli): fix wrong file path for Java bindings test by @ Marcono1234 in #5117
  • ci(release): use node 24 by @ ObserverOfTime in #5120
  • build(deps): cargo update by @ clason in #5125
  • 0.26.3 by @ clason in #5126

  Full Changelog: v0.26.2...v0.26.3

• 0.26.0 - 2025-09-19
• 0.25.10 - 2025-09-22

from web-tree-sitter GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[peterj]

This upgrade introduces a significant breaking change related to the Application Binary Interface (ABI) for language parsers.

Breaking Change:

web-tree-sitter version 0.26.x requires language parsers (.wasm files) to be generated with a compatible version of the tree-sitter-cli (v0.26.x or later). Loading .wasm files that were built with older versions of the CLI (e.g., v0.20.x) will fail. [7] This is due to the removal of a deprecated function that older parsers relied on. [7]

Recommendation:

Before or after this upgrade, you must rebuild all custom or third-party language .wasm files using a recent version of the tree-sitter-cli to ensure they are compatible with the new ABI. If you are using pre-compiled WASM files from a package, ensure that package has been updated to support tree-sitter v0.26.x.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.