Chore(deps): bump the npm_and_yarn group across 26 directories with 16 updates

[dependabot]

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package	From	To
@octokit/plugin-paginate-rest	2.21.3	9.2.2
undici	6.21.0	6.23.0
vite	5.4.20	5.4.21
wrangler	3.94.0	3.114.17
tar-fs	2.1.3	2.1.4
esbuild	0.17.6	0.25.0
lodash	4.17.21	4.17.23
valibot	0.41.0	1.2.0

Bumps the npm_and_yarn group with 1 update in the /examples/auth directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/auth-router-provider directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/basic directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/basic-data-router directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/custom-filter-link directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/custom-link directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/custom-query-parsing directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/data-router directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/error-boundaries directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/lazy-loading directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/lazy-loading-router-provider directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/modal directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/modal-route-with-outlet directory: vite.
Bumps the npm_and_yarn group with 2 updates in the /examples/multi-app directory: vite and cookie.
Bumps the npm_and_yarn group with 1 update in the /examples/navigation-blocking directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/notes directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/route-objects directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/scroll-restoration directory: vite.
Bumps the npm_and_yarn group with 1 update in the /examples/search-params directory: vite.
Bumps the npm_and_yarn group with 2 updates in the /examples/ssr directory: vite and cookie.
Bumps the npm_and_yarn group with 3 updates in the /examples/ssr-data-router directory: vite, cookie and @remix-run/router.
Bumps the npm_and_yarn group with 1 update in the /examples/view-transitions directory: vite.
Bumps the npm_and_yarn group with 1 update in the /packages/create-react-bridging directory: esbuild.
Bumps the npm_and_yarn group with 1 update in the /packages/react-bridging-dev directory: valibot.
Bumps the npm_and_yarn group with 6 updates in the /tutorial directory:

Package	From	To
vite	5.4.20	5.4.21
esbuild	0.17.6	0.27.3
@babel/traverse	7.15.4	7.29.0
@babel/helpers	7.15.4	7.28.6
json5	2.2.0	2.2.3
rollup	2.58.3	2.79.2

Updates @octokit/plugin-paginate-rest from 2.21.3 to 9.2.2

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v9.2.2

9.2.2 (2025-02-15)

Bug Fixes

• ReDos regex vulnerability, reported by @​DayShift (#660) (e1e4489)

v9.2.1

9.2.1 (2024-03-01)

Bug Fixes

• pkg: pin @octokit/core peerDependency to v5 (#599) (5b84386)

v9.2.0

9.2.0 (2024-02-22)

Features

• new /orgs/{org}/organization-roles/{role_id}/teams and /orgs/{org}/organization-roles/{role_id}/users endpoints (#594) (75aeaaf)

v9.1.5

9.1.5 (2023-12-04)

Bug Fixes

• bump octokit/types minor version (#581) (65baec4)

v9.1.4

9.1.4 (2023-11-12)

Bug Fixes

• deps: bump @octokit/types (#575) (27db9ae)

v9.1.3

9.1.3 (2023-11-09)

Bug Fixes

• deps: bump @octokit/types (#574) (0940cb7)

v9.1.2

9.1.2 (2023-10-26)

... (truncated)

Commits

• e1e4489 fix: ReDos regex vulnerability, reported by @​DayShift (#660)
• 5b84386 fix(pkg): pin @octokit/core peerDependency to v5 (#599)
• fa01f94 ci(action): update actions/add-to-project action to v0.6.0 (#598)
• 75aeaaf feat: new /orgs/{org}/organization-roles/{role_id}/teams and `/orgs/{org}/o...
• 54d6bcf chore(deps): update dependency prettier to v3.2.5
• 1bfa2f8 chore(deps): update dependency npm-run-all2 to v6
• eb4a8fe chore(deps): replace dependency npm-run-all with npm-run-all2 ^5.0.0
• 11ef779 chore(deps): update dependency esbuild to ^0.20.0
• 2b6cc98 ci(action): update peter-evans/create-or-update-comment action to v4
• d7c9de5 chore(deps): update dependency prettier to v3.2.4 (#588)
• Additional commits viewable in compare view

Updates undici from 6.21.0 to 6.23.0

Release notes

Sourced from undici's releases.

v6.23.0

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

Full Changelog: nodejs/undici@v6.22.0...v6.23.0

v6.22.0

What's Changed

• fix: fix wrong stream canceled up after cloning (v6) by @​snyamathi in nodejs/undici#4414
• [Backport v6.x] fix: fix EnvHttpProxyAgent for the Node.js bundle by @​github-actions[bot] in nodejs/undici#4432
• feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180) by @​metcoder95 in nodejs/undici#4433
• feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#4180) (#4340) by @​metcoder95 in nodejs/undici#4445
• Backport 4472 to v6.x by @​Uzlopak in nodejs/undici#4480

Full Changelog: nodejs/undici@v6.21.3...v6.22.0

v6.21.3

What's Changed

• [Backport v6.x] append crlf to formdata body by @​github-actions in nodejs/undici#4210

Full Changelog: nodejs/undici@v6.21.2...v6.21.3

v6.21.2

What's Changed

• fix(types): add missing DNS interceptor by @​slagiewka in nodejs/undici#4024
• [v6.x] fix wpts on windows by @​mcollina in nodejs/undici#4093
• Removed clients with unrecoverable errors from the Pool nodejs/undici#4088

New Contributors

• @​slagiewka made their first contribution in nodejs/undici#4024

Full Changelog: nodejs/undici@v6.21.1...v6.21.2

v6.21.1

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

• fix(#3736): back-port 183f8e9 to v6.x by @​ggoodman in nodejs/undici#3855
• fix(#3817): send servername for SNI on TLS (#3821) [backport] by @​metcoder95 in nodejs/undici#3864
• fix: sending formdata bodies with http2 (#3863) [backport] by @​metcoder95 in nodejs/undici#3866
• [Backport v6.x] fix: Fixed the issue that there is no running request when http2 goaway by @​github-actions in nodejs/undici#3877
• types: [backport] Update return type of RetryCallback (#3851) by @​metcoder95 in nodejs/undici#3876

... (truncated)

Commits

• fbc31e2 Bumped v6.23.0
• 3477c94 chore: release flow using provenance
• d3aafea fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
• f9c9185 Bumped v6.22.0
• f670f2a feat: make UndiciErrors reliable to instanceof (#4472) (#4480)
• 422e397 feat(ProxyAgent) improve Curl-y behavior in HTTP->HTTP Proxy connections (#41...
• 4a06ffe feat(ProxyAgent): match Curl behavior in HTTP->HTTP Proxy connections (#4180)...
• 4cb3974 fix: fix EnvHttpProxyAgent for the Node.js bundle (#4064) (#4432)
• 44c23e5 fix: fix wrong stream canceled up after cloning (v6) (#4414)
• da0e823 Bumped v6.21.4
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Updates vite from 5.4.20 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970
• chore: update CHANGELOG (ca88ed7)

Commits

• adce3c2 release: v5.4.21
• cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
• ca88ed7 chore: update CHANGELOG
• See full diff in compare view

Updates wrangler from 3.94.0 to 3.114.17

Release notes

Sourced from wrangler's releases.

wrangler@3.114.17

Patch Changes

• #11891 6d5557b Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy

  Pass user provided values from --commit-hash safely to underlying git command.

Changelog

Sourced from wrangler's changelog.

3.114.17

Patch Changes

• #11891 6d5557b Thanks @​emily-shen! - Use argument array when executing git commands with wrangler pages deploy

  Pass user provided values from --commit-hash safely to underlying git command.

3.114.16

Patch Changes

• #11689 9bab0a0 Thanks @​ascorbic! - Display a warning when authentication errors occur and the account_id in your Wrangler configuration does not match any of your authenticated accounts. This helps identify configuration issues where you may have the wrong account ID set in your wrangler.toml or wrangler.jsonc file.

• #10737 c41a078 Thanks @​workers-devprod! - Allow WRANGLER_SEND_ERROR_REPORTS env var to override whether to report Wrangler crashes to Sentry

• #11134 bd39455 Thanks @​petebacondarwin! - Reduce the amount of arguments being passed in metrics capture.

  Now the argument values that are captured come from an allow list, and can be marked as ALLOW (capture the real value) or REDACT (capture as "").

• #11020 9cb702e Thanks @​dario-piotrowicz! - Fix observability.logs.persist being flagged as an unexpected field during the wrangler config file validation

• #11147 cf4993b Thanks @​FlorentCollin! - Improve the formatting of the D1 execute command to always show the duration in milliseconds with two decimal places.

• #11650 cc29ead Thanks @​ascorbic! - fix: respect TypeScript path aliases when resolving non-JS modules with module rules

  When importing non-JavaScript files (like .graphql, .txt, etc.) using TypeScript path aliases defined in tsconfig.json, Wrangler's module-collection plugin now correctly resolves these imports. Previously, path aliases were only respected for JavaScript/TypeScript files, causing imports like import schema from '~lib/schema.graphql' to fail when using module rules.

• #11179 7f779e9 Thanks @​ascorbic! - Log a more helpful error when attempting to "r2 object put" a non-existent file

• #11501 c78d942 Thanks @​edmundhung! - fix: prevent reporting SQLite error from wrangler d1 execute to Sentry

• #11262 b2683f7 Thanks @​workers-devprod! - Avoid using object lookup for OAuth Error classes

• #11107 d8037d3 Thanks @​workers-devprod! - Fixed conflict between --env and --expires flags in wrangler r2 object put.

  --e now aliases --env only, and NOT --expires.

• #10961 02d2ea9 Thanks @​devin-ai-integration! - Acquire Cloudflare Access tokens for additional requests made during a wrangler dev --remote session

• #11108 892ec4f Thanks @​emily-shen! - Fixed self-bindings (service bindings to the same worker) showing as [not connected] in wrangler dev. Self-bindings now correctly show as [connected] since a worker is always available to itself.

• #11138 3db872a Thanks @​devin-ai-integration! - Implement tail-based logging for wrangler dev remote mode, behind the --x-tail-tags flag. This will become the default in the future.

• #10889 204616c Thanks @​workers-devprod! - Clarify that wrangler check startup generates a local CPU profile

• #11491 ed8aaef Thanks @​edmundhung! - Explicitly close FileHandle in wrangler d1 execute to support Node 25

• #10962 203e599 Thanks @​devin-ai-integration! - Fixed duplicate warning messages appearing during wrangler dev when configuration changes or state transitions occur

... (truncated)

Commits

• f21ee75 Version Packages (#11895)
• 6d5557b fix: execute git commands in pages deploy safely (#11889) (#11891)
• 0e19ae9 Version Packages (#10906)
• 3db872a [v3 backport] Backport tail-based logging from #11135 and #11346 (#11138)
• 02d2ea9 Fix remote dev with Access (#10961)
• 9bab0a0 fix(wrangler): add warning when account_id mismatch detected on auth error (v...
• 4b18c6f Introduce internal isWorkerNotFoundError utility and avoid worker-not-found...
• ed8aaef fix(wrangler): close FileHandle in to support Node 25 (#11491)
• c78d942 V3 backport of #11467: prevent SQLite users error from being reported to Sent...
• cc29ead fix: respect TypeScript path aliases when resolving non-JS modules with modul...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for wrangler since your current version.

Updates tar-fs from 2.1.3 to 2.1.4

Commits

• f421a23 2.1.4
• c412fa1 refactor to same pattern as v3
• See full diff in compare view

Updates esbuild from 0.17.6 to 0.25.0

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.

• Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

  This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

  Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

  In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

  Thanks to @​sapphi-red for reporting this issue.

• Delete output files when a build fails in watch mode (#3643)

  It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.

• Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

  This release fixes the following problems:

  • Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.

    /* Original code */
    .parent {
      > .a,
      > .b1 > .b2 {
        color: red;
      }
    }
    /* Old output (with --supported:nesting=false) */
    .parent > :is(.a, .b1 > .b2) {
    color: red;
    }
    /* New output (with --supported:nesting=false) */
    .parent > .a,
    .parent > .b1 > .b2 {
    color: red;
    }

    Thanks to @​tim-we for working on a fix.

  • The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:

    /* Original code (color should be red) */

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11

• Fix TypeScript-specific class transform edge case (#3559)

  The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:

  // Original code
  class Foo extends Bar {
    #private = 1;
    public: any;
    constructor() {
      super();
    }
  }
  // Old output (with esbuild v0.19.9)
  class Foo extends Bar {
  constructor() {
  super();
  this.#private = 1;
  }
  #private;
  }
  // Old output (with esbuild v0.19.10)
  class Foo extends Bar {
  constructor() {
  this.#private = 1;
  super();
  }
  #private;
  }
  // New output
  class Foo extends Bar {
  #private = 1;
  constructor() {
  super();
  }
  }

• Minifier: allow reording a primitive past a side-effect (#3568)

  The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

• e9174d6 publish 0.25.0 to npm
• c27dbeb fix hosts in plugin-tests.js
• 6794f60 fix hosts in node-unref-tests.js
• de85afd Merge commit from fork
• da1de1b fix #4065: bitwise operators can return bigints
• f4e9d19 switch case liveness: default is always last
• 7aa47c3 fix #4028: minify live/dead switch cases better
• 22ecd30 minify: more constant folding for strict equality
• 4cdf03c fix #4053: reordering of .tsx in node_modules
• dc71977 fix #3692: 0 now picks a random ephemeral port
• Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.17.23

Commits

• dec55b7 Bump main to v4.17.23 (#6088)
• 19c9251 fix: setCacheHas JSDoc return type should be boolean (#6071)
• b5e6729 jsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)
• edadd45 Prevent prototype pollution on baseUnset function
• 4879a7a doc: fix autoLink function, conversion of source links (#6056)
• 9648f69 chore: remove yarn.lock file (#6053)
• dfa407d ci: remove legacy configuration files (#6052)
• 156e196 feat: add renovate setup (#6039)
• 933e106 ci: add pipeline for Bun (#6023)
• 072a807 docs: update links related to Open JS Foundation (#5968)
• Additional commits viewable in compare view

Updates valibot from 0.41.0 to 1.2.0

Release notes

Sourced from valibot's releases.

v1.2.0

Many thanks to @​EskiMojo14, @​makenowjust, @​ysknsid25 and @​jacekwilczynski for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add toBigint, toBoolean, toDate, toNumber and toString transformation actions (pull request #1212)
• Add examples action to add example values to a schema (pull request #1199)
• Add getExamples method to extract example values from a schema (pull request #1199)
• Add isbn validation action to validate ISBN-10 and ISBN-13 strings (pull request #1097)
• Add exports for RawCheckAddIssue, RawCheckContext, RawCheckIssueInfo, RawTransformAddIssue, RawTransformContext and RawTransformIssueInfo types for better developer experience with rawCheck and rawTransform actions (pull request #1359)
• Change build step to tsdown
• Fix ReDoS vulnerability in EMOJI_REGEX used by emoji action

v1.2.0 (to-json-schema)

Many thanks to @​cruzdanilo and @​Xiot for contributing to this release.

• Add support for title, description and examples in metadata action (pull request #1189)
• Add new override configurations to override default behaviour of JSON Schema conversion (pull request #1197)
• Add storage for global definitions with addGlobalDefs and getGlobalDefs (pull request #1197)
• Add new toJsonSchemaDefs function to convert Valibot schema definitions to JSON Schema definitions (pull request #1197)

v1.1.0

Many thanks to @​EltonLobo07, @​sacrosanctic, @​muningis, @​EskiMojo14, @​MOZGIII, @​vktrl and @​jasperteo for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add message method to overwrite local error message configuration of a schema (pull request #1103)
• Add summarize method to summarize issues into a pretty-printable multi-line string (pull request #1158)
• Add getTitle, getDescription and getMetadata methods to extract metadata of a schema (pull request #1154)
• Add minEntries and maxEntries validation action to validate number of object entries (pull request #1100)
• Add entries and notEntries validation action to validate number of object entries (pull request #1156)
• Add parseJson and stringifyJson transformation action to parse and stringify JSON (pull request #1137)
• Add flavor transformation action to flavor the output type of a schema (pull request #950)
• Add support for bigints to multipleOf validation action (pull request #1164)
• Change implementation of variant and variantAsync schema to improve performance by aborting validation of discriminators early (pull request #1110)
• Change name of NanoIDAction and NanoIDIssue interface to NanoIdAction and NanoIdIssue (pull request #1171)
• Fix internal MarkOptional type to fix input and output type of objects in edge cases (issue #1176)

v1.1.0 (to-json-schema)

Many thanks to @​sruenwg, @​muningis and @​EltonLobo07 for contributing to this release.

• Add support for minEntries and maxEntries action (pull request #1100)
• Add support for entries action (pull request #1156)
• Change Valibot peer dependency to v1.1.0
• Fix toJsonSchema to be independent of definition order (pull request #1133)
• Fix additionalItems for tuple schemas and add minItems (pull request #1126)

v1.0.0

This is a summary of the changes between v0 and v1. Many thanks to everyone who contributed to this release.

... (truncated)

Commits

• 053ae97 Bump version to 1.2.0 and update changelog
• de76d7c Merge pull request #1361 from open-circle/v1.2-blog-post
• c14f092 Add security fix for ReDoS vulnerability in emoji action and update release n...
• cfb799d Merge commit from fork
• 36fafd0 Add release notes blog post for Valibot v1.2 to website
• 83c07ca Merge pull request #1097 from ysknsid25/feat/add-isbn-validation
• 6957e0d Add beta annotation to JSDoc comment of isbn action
• 6c7f9c0 Add docs for new isbn action to website
• ca902e6 Refactor ISBN regex constants and update validation logic
• e7a4f17 Refactor and improve new isbn action and update changelog
• Additional commits viewable in compare view

Updates vite from 7.1.7 to 7.3.1

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970
• chore: update CHANGELOG (ca88ed7)

Commits

• adce3c2 release: v5.4.21
• cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
• ca88ed7 chore: update CHANGELOG
• See full diff in compare view

Updates vite from 7.1.7 to 7.3.1

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970
• chore: update CHANGELOG (ca88ed7)

Commits

• adce3c2 release: v5.4.21
• cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
• ca88ed7 chore: update CHANGELOG
• See full diff in compare view

Updates vite from 7.1.7 to 7.3.1

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970
• chore: update CHANGELOG (ca88ed7)

Commits

• adce3c2 release: v5.4.21
• cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
• ca88ed7 chore: update CHANGELOG
• See full diff in compare view

Updates vite from 7.1.7 to 7.3.1

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970
• chore: update CHANGELOG (ca88ed7)

Commits

• adce3c2 release: v5.4.21
• cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
• ca88ed7 chore: update CHANGELOG
• See full diff in Description has been truncated

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.