ci(deps): bump oxc-parser from 0.130.0 to 0.138.0

[dependabot]

Bumps oxc-parser from 0.130.0 to 0.138.0.

Release notes

Sourced from oxc-parser's releases.

oxc crates_v0.138.0

💥 BREAKING CHANGES

• 94fbacb ast: [BREAKING] Only export AstBuilder and NONE in builder module (#23876) (overlookmotel)
• 8de5122 ecmascript: [BREAKING] Switch to new AstBuilder (#23834) (overlookmotel)
• dc0ef38 transformer: [BREAKING] Switch to new AstBuilder (#23831) (overlookmotel)
• 88f4455 str: [BREAKING] Str and Ident methods take &GetAllocator (#23781) (overlookmotel)
• 36009dd allocator: [BREAKING] GetAllocator::allocator take &self (#23676) (overlookmotel)
• bd74f9d allocator: [BREAKING] Rename AllocatorAccessor trait to GetAllocator (#23675) (overlookmotel)

🚀 Features

• 326fe25 transformer_plugins: Support typeof define keys (#23605) (Alexander Lichter)
• f2091b3 ast: Unify old and new AstBuilders (#23875) (overlookmotel)
• cd1fd12 codegen: Expose Codegen::print_string API (#23785) (camc314)
• 785461b ast: Add custom builder methods to AST types (#23651) (overlookmotel)
• 05d1357 ast: Add AST creation methods to AST types (#23650) (overlookmotel)
• 2580eda str: Add Str::from_str_in and Ident::from_str_in methods (#23767) (overlookmotel)
• 6883fcf minifier: Fold write-once falsy var to false in boolean context (#23540) (Dunqing)
• fcbf993 allocator: Add Vec::from_value_in method (#23718) (overlookmotel)
• 989ddb7 allocator: Add Vec::from_box_in method (#23717) (overlookmotel)
• 9d1aa7f allocator: Improve PartialEq for Vec (#23716) (overlookmotel)

🐛 Bug Fixes

• beac5d2 parser: Fix clippy warnings (#23943) (overlookmotel)
• dcc9a73 minifier: Treat Object.isExtensible/isFrozen/isSealed as pure (#23916) (Dunqing)
• da0e5bf minifier: Don't reorder a closed-over TDZ read when inlining a var (#23771) (Dunqing)
• 0b3021f allocator: Remove Vec::from_box_in (#23873) (overlookmotel)
• 0ab64ec ast: Silence deprecation warnings within files defining deprecated AstBuilder methods (#23889) (overlookmotel)
• 8c07cad all: Enable disable_old_builder Cargo feature for oxc_ast crate in tests (#23888) (overlookmotel)
• 3800f01 ast: Legacy AstBuilder methods take self not &self (#23891) (overlookmotel)
• 869ac20 semantic/cfg: Connect for update exit to loop test (#23791) (camc314)
• d3e92d5 semantic/cfg: Connect while branches from condition exit (#23790) (camc314)
• 025045d ast: ExportNamedDeclaration plain builder methods return boxed nodes (#23783) (overlookmotel)
• 7537c58 ast: Fix name of AstBuilder method for Expression::V8IntrinsicExpression (#23766) (overlookmotel)
• 3f574f5 traverse: Fix unsoundness in Traverse walk functions (#23745) (overlookmotel)
• 585760f parser: String in AST reference arena (#23721) (overlookmotel)
• 7231d55 allocator: Fix unsound lifetime extension in Box::new_in (#23685) (overlookmotel)

⚡ Performance

• d5c916a semantic: Flatten hoisting_variables to avoid per-scope map allocation (#23927) (Lawrence Lin)
• e71609d minifier: Bail member-expr folding before the side-effect walk (#23924) (Lawrence Lin)
• e1f89ab minifier: Reduce string allocations folding addition (#23846) (overlookmotel)
• 9f6ee3b isolated-declarations: Pool scope maps to avoid per-scope alloc/rehash (#23761) (Boshen)
• 0b07c4c semantic: Avoid heap alloc for catch-clause binding ids (#23911) (Lawrence Lin)
• c5eef8b regular_expression: Skip capturing-group pre-parse when pattern has no ( (#23908) (Lawrence Lin)
• b4f5b4b isolated_declarations: Remove redundant clone of formal parameter pattern (#23912) (Lawrence Lin)
• 53d083f isolated_declarations: Use TakeIn not CloneIn (#23847) (overlookmotel)

... (truncated)

Changelog

Sourced from oxc-parser's changelog.

[0.138.0] - 2026-06-29

🛡️ Security

• 3cdd18f deps: Update npm packages (#23690) (renovate[bot])

[0.137.0] - 2026-06-18

💥 BREAKING CHANGES

• 7a76cd3 estree: [BREAKING] Make whether to include TS fields a runtime option (#23574) (overlookmotel)

🚀 Features

• 53509a8 minifier: Treeshake pure typed arrays and Set/Map array literals (#23469) (Dunqing)

🐛 Bug Fixes

• ae02b4e ci/parser: Use minimal for vitest reporter (#23457) (camc314)

[0.136.0] - 2026-06-15

⚡ Performance

• da1a6c6 diagnostics: Migrate to allocation-optimized oxc-miette (#23094) (Boshen)

Commits

• 8bf69a3 release(crates): oxc v0.138.0 (#23934)
• 2ab679a chore(napi/parser): enable noImplicitAny (#23830)
• 14509ac chore(napi/parser): run matches parseSync test on all bench files (#23823)
• 90e902e chore(napi/parser): re-enable antd.js test cases (#23822)
• 4b121ab test(napi/parser): run async tests sequentially (#23820)
• c9517f7 refactor(napi/parser): add some missing TS type annotations (#23817)
• 5201522 refactor(allocator): Vec construction methods take &GetAllocator (#23755)
• d1f18cd refactor(all): import arena Box and Vec as ArenaBox / ArenaVec (#23747)
• 8c6481b refactor(allocator): export ArenaBox and ArenaVec aliases (#23746)
• 3cdd18f chore(deps): update npm packages (#23690)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[jpr5]

Closing — npm dependency updates on this repo are now human-controlled (Dependabot npm removed). Reopen manually if you want a specific bump.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.