Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates - #1

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-b113f28f9d
Closed

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-b113f28f9d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 2 updates in the / directory: vitest and esbuild.

Updates vitest from 1.6.1 to 3.2.6

Release notes

Sourced from vitest's releases.

v3.2.6

   🐞 Bug Fixes

    View changes on GitHub

v3.2.5

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

    View changes on GitHub

v3.2.3

   🚀 Features

... (truncated)

Commits
  • b6d56f8 chore: release v3.2.6
  • 16f120d fix: pin last supported vite-node version
  • 2cbad0a chore: release v3.2.5
  • 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
  • c666d14 chore: release v3.2.4
  • 8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
  • 8abd7cc chore(deps): update tinypool (#8174)
  • 93f3200 fix(deps): update all non-major dependencies (#8123)
  • 0c3be6f fix(coverage): ignore SCSS in browser mode (#8161)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.


Updates esbuild from 0.19.12 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.






Updates postcss from 8.5.6 to 8.5.25



Release notes

Sourced from postcss's releases.




8.5.25


    

  • Fixed 8.5.17 visitor regression.
    • 

  • Fixed list.split() for non-string values (by @​amir-rezaei).
    • 



8.5.24


    

  • Preserve the BOM after the processing (by @​hdimer).
    • 



8.5.23


    

  • Do not load source map without opts.from for security reasons.
    • 



8.5.22



8.5.21



8.5.20



8.5.19


    

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
    • 



8.5.18


    

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).
    • 



8.5.17


    

  • Fixed Maximum call stack size exceeded error.
    • 

  • Fixed Prototype hijacking for postcss.fromJSON().
    • 

  • Fixed Input#origin() for unmapped end position (by @​chatman-media).
    • 



8.5.16



8.5.15


    

  • Fixed declaration parsing performance (by @​homanp).
    • 



8.5.14



8.5.13


    

  • Fixed postcss-scss commend regression.
    • 



8.5.12


    

  • Fixed reading any file via user-generated CSS.
    • 






... (truncated)





Changelog

Sourced from postcss's changelog.




8.5.25


    

  • Fixed 8.5.17 visitor regression.
    • 

  • Fixed list.split() for non-string values (by @​amir-rezaei).
    • 



8.5.24


    

  • Preserve the BOM after the processing (by @​hdimer).
    • 



8.5.23


    

  • Do not load source map without opts.from for security reasons.
    • 



8.5.22



8.5.21



8.5.20



8.5.19


    

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).
    • 



8.5.18


    

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).
    • 



8.5.17


    

  • Fixed Maximum call stack size exceeded error.
    • 

  • Fixed Prototype hijacking for postcss.fromJSON().
    • 

  • Fixed Input#origin() for unmapped end position (by @​chatman-media).
    • 



8.5.16



8.5.15





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.






Updates rollup from 4.46.2 to 4.62.3



Release notes

Sourced from rollup's releases.




v4.62.3


4.62.3


2026-07-26


Bug Fixes


    

  • Sanitize illegal characters preserved modules input base (#6439)
    • 



Pull Requests



v4.62.2


4.62.2


2026-06-19


Bug Fixes


    

  • Do not add spurious side-effect-free external imports to chunks when using minChunkSize (#6411)
    • 



Pull Requests





... (truncated)





Changelog

Sourced from rollup's changelog.




4.62.3


2026-07-26


Bug Fixes


    

  • Sanitize illegal characters preserved modules input base (#6439)
    • 



Pull Requests



4.62.2


2026-06-19


Bug Fixes


    

  • Do not add spurious side-effect-free external imports to chunks when using minChunkSize (#6411)
    • 



Pull Requests






... (truncated)





Commits

    

  • a80a197 4.62.3
    • 

  • e87e19b Update audit resolve
    • 

  • 72f98e9 Fix build:docs after rollup update (#6460)
    • 

  • e3821cd fix: make isLegal idempotent by not using a global-flag regex (#6432)
    • 

  • db0c477 Sanitize input base before computing preserved module chunk names (#6439)
    • 

  • a65f21c chore(deps): update dependency magic-string to v1 (#6457)
    • 

  • a43aae4 docs: fix broken commonjs namedExports link in troubleshooting (#6455)
    • 

  • 41c28d7 chore(deps): lock file maintenance (#6459)
    • 

  • 894136e chore(deps): update dtolnay/rust-toolchain digest to 4cda84d (#6446)
    • 

  • fad0ba3 fix(deps): update swc monorepo (major) (#6458)
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for rollup since your current version.





Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.






Updates vite from 5.4.19 to 7.3.6



Release notes

Sourced from vite's releases.




v7.3.6


Please refer to CHANGELOG.md for details.


v7.3.5


Please refer to CHANGELOG.md for details.


v7.3.3


Please refer to CHANGELOG.md for details.


v7.3.2


Please refer to CHANGELOG.md for details.


v7.3.1


Please refer to CHANGELOG.md for details.


v7.3.0


Please refer to CHANGELOG.md for details.


v7.2.7


Please refer to CHANGELOG.md for details.


v7.2.6


Please refer to CHANGELOG.md for details.


v7.2.5


Please refer to CHANGELOG.md for details.


Note: 7.2.5 failed to publish so it is skipped on npm


v7.2.4


Please refer to CHANGELOG.md for details.


v7.2.3


Please refer to CHANGELOG.md for details.


v7.2.2


Please refer to CHANGELOG.md for details.


v7.2.1


Please refer to CHANGELOG.md for details.


v7.2.0


Please refer to CHANGELOG.md for details.


v7.2.0-beta.1


Please refer to CHANGELOG.md for details.


v7.2.0-beta.0


Please refer to CHANGELOG.md for details.





... (truncated)





Changelog

Sourced from vite's changelog.




7.3.6 (2026-06-25)


Features



7.3.5 (2026-06-01)


Bug Fixes



Miscellaneous Chores



7.3.4 (2026-06-01)


Bug Fixes



7.3.3 (2026-05-07)


Bug Fixes



7.3.2 (2026-04-06)


Bug Fixes



7.3.1 (2026-01-07)


Features


    

  • add ignoreOutdatedRequests option to optimizeDeps (#21364) (9d39d37)
    • 



7.3.0 (2025-12-15)


Features


    

  • deps: update esbuild from ^0.25.0 to ^0.27.0 (#21183) (cff26ec)
    • 



7.2.7 (2025-12-08)


Bug Fixes



7.2.6 (2025-12-01)


7.2.5 (2025-12-01)





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
    • 




    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          build(deps): bump the npm_and_yarn group across 1 directory with 5 up…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          4be986a
        
      

    

  

    

      
…dates

Bumps the npm_and_yarn group with 2 updates in the / directory: [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [esbuild](https://github.com/evanw/esbuild).


Updates `vitest` from 1.6.1 to 3.2.6
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest)

Updates `esbuild` from 0.19.12 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.19.12...v0.28.1)

Updates `postcss` from 8.5.6 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.25)

Updates `rollup` from 4.46.2 to 4.62.3
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.46.2...v4.62.3)

Updates `vite` from 5.4.19 to 7.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 3.2.6
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.62.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            


    

    

      
    

    


      


          @Shinrai
Shinrai




          closed this


      Aug 3, 2026

    

  


    







      

  
      



  

  @dependabot


    @github




  



    

      

  

    

      
          
      

      
            dependabot
    Bot

      

      

      commented

        on behalf of github

        Aug 3, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

  Author


    

  





      


        



  
    

      
          
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.


To ignore these dependencies, configure ignore rules in dependabot.yml


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
          

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

        
    deleted the
    
      
        dependabot/npm_and_yarn/npm_and_yarn-b113f28f9d
    
    branch

        August 3, 2026 03:53        
        
      

    










      

  
      



  

  @Shinrai






  



    

      

  

    

      
          
      

      
            Shinrai
    

      

      

      commented


        Aug 3, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        

  
    Contributor


        

    

  





      


        



  
    

      
          
Superseded by the v4 onboarding + esbuild alignment now on next (carried to master by release PR #5).


This group wanted vitest ^1.0.0 → ^3.2.6 and esbuild ^0.19.0 → ^0.28.1. next already carries vitest ^4.1.10 (newer than the 3.2.6 target) and esbuild ^0.28.1 (the exact target). Both are met or exceeded, so closing as already applied.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    
















  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews







    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

    None yet







      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      1 participant
    

    

        
          @Shinrai