Bump the npm_and_yarn group across 1 directory with 5 updates #1

dependabot · 2025-06-16T14:34:34Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
brace-expansion	`1.1.11`	`1.1.12`
esbuild	`0.21.5`	`0.25.5`
vite	`5.4.19`	`6.3.5`
vitest	`1.6.1`	`3.2.3`
@vitest/ui	`1.6.1`	`3.2.3`

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
ccb8ac6 fmt
c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Updates esbuild from 0.21.5 to 0.25.5

Release notes

Sourced from esbuild's releases.

v0.25.5
Fix a regression with browser in package.json (#4187)

The fix to #4144 in version 0.25.3 introduced a regression that caused browser overrides specified in package.json to fail to override relative path names that end in a trailing slash. That behavior change affected the [email protected] package. This regression has been fixed, and now has test coverage.
Add support for certain keywords as TypeScript tuple labels (#4192)

Previously esbuild could incorrectly fail to parse certain keywords as TypeScript tuple labels that are parsed by the official TypeScript compiler if they were followed by a ? modifier. These labels included function, import, infer, new, readonly, and typeof. With this release, these keywords will now be parsed correctly. Here's an example of some affected code:
type Foo = [
  value: any,
  readonly?: boolean, // This is now parsed correctly
]
Add CSS prefixes for the stretch sizing value (#4184)

This release adds support for prefixing CSS declarations such as div { width: stretch }. That CSS is now transformed into this depending on what the --target= setting includes:
div {
  width: -webkit-fill-available;
  width: -moz-available;
  width: stretch;
}
v0.25.4
Add simple support for CORS to esbuild's development server (#4125)

Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

Some examples:
CLI:
esbuild --servedir=. --cors-origin=https://example.com
JS:
const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

ea453bf publish 0.25.5 to npm
223ddc6 fix #4187: browser package.json regression
b2c8251 fix #4192: typescript tuple label parser edge case
28cf2f3 fix #4184: css prefixes for stretch
bee1b09 fix comment indents
9ddfe5f run make update-compat-table
c339f34 fix a misplaced comment
218d29e publish 0.25.4 to npm
e66cd0b dev server: simple support for CORS requests (#4171)
8bf3368 js api: validate some options as arrays of strings
Additional commits viewable in compare view

Updates vite from 5.4.19 to 6.3.5

Release notes

Sourced from vite's releases.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0-beta.2

Please refer to CHANGELOG.md for details.

v6.3.0-beta.1

Please refer to CHANGELOG.md for details.

v6.3.0-beta.0

Please refer to CHANGELOG.md for details.

v6.2.7

Please refer to CHANGELOG.md for details.

v6.2.6

Please refer to CHANGELOG.md for details.

v6.2.5

Please refer to CHANGELOG.md for details.

v6.2.4

Please refer to CHANGELOG.md for details.

v6.2.3

Please refer to CHANGELOG.md for details.

v6.2.2

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

refactor: remove duplicate plugin context type (#19935) (d6d01c2), closes #19935

6.3.3 (2025-04-24)

fix: ignore malformed uris in tranform middleware (#19853) (e4d5201), closes #19853

fix(assets): ensure ?no-inline is not included in the asset url in the production environment (#1949 (16a73c0), closes #19496

fix(css): resolve relative imports in sass properly on Windows (#19920) (ffab442), closes #19920

fix(deps): update all non-major dependencies (#19899) (a4b500e), closes #19899

fix(ssr): fix execution order of re-export (#19841) (ed29dee), closes #19841

fix(ssr): fix live binding of default export declaration and hoist exports getter (#19842) (80a91ff), closes #19842

perf: skip sourcemap generation for renderChunk hook of import-analysis-build plugin (#19921) (55cfd04), closes #19921

test(ssr): test ssrTransform re-export deps and test stacktrace with first line (#19629) (9399cda), closes #19629

6.3.2 (2025-04-18)

fix: match default asserts case insensitive (#19852) (cbdab1d), closes #19852

fix: open first url if host does not match any urls (#19886) (6abbdce), closes #19886

fix(css): respect css.lightningcss option in css minification process (#19879) (b5055e0), closes #19879

fix(deps): update all non-major dependencies (#19698) (bab4cb9), closes #19698

feat(css): improve lightningcss messages (#19880) (c713f79), closes #19880

6.3.1 (2025-04-17)

fix: avoid using Promise.allSettled in preload function (#19805) (35c7f35), closes #19805

fix: backward compat for internal plugin transform calls (#19878) (a152b7c), closes #19878

6.3.0 (2025-04-16)

fix(hmr): avoid infinite loop happening with hot.invalidate in circular deps (#19870) (d4ee5e8), closes #19870

fix(preview): use host url to open browser (#19836) (5003434), closes #19836

... (truncated)

Commits

84e4647 release: v6.3.5
fd38d07 fix(ssr): handle uninitialized export access as undefined (#19959)
b040d54 release: v6.3.4
c22c43d fix: check static serve file inside sirv (#19965)
efc5eab fix(optimizer): return plain object when using require to import externals ...
d6d01c2 refactor: remove duplicate plugin context type (#19935)
db9eb97 release: v6.3.3
e4d5201 fix: ignore malformed uris in tranform middleware (#19853)
55cfd04 perf: skip sourcemap generation for renderChunk hook of import-analysis-build...
ffab442 fix(css): resolve relative imports in sass properly on Windows (#19920)
Additional commits viewable in compare view

Updates vitest from 1.6.1 to 3.2.3

Release notes

Sourced from vitest's releases.

v3.2.3

   🚀 Features

browser: Use base url instead of vitest - by @sheremet-va in vitest-dev/vitest#8126 (1d8eb)

ui: Show test annotations and metadata in the test report tab - by @sheremet-va in vitest-dev/vitest#8093 (c69be)

   🐞 Bug Fixes

Rerun tests when project's setup file is changed - by @sheremet-va in vitest-dev/vitest#8097 (0f335)

Revert expect.any return type - by @sheremet-va in vitest-dev/vitest#8129 (47514)

Run only the name plugin last, not all config plugins - by @sheremet-va in vitest-dev/vitest#8130 (83862)

pool:

Throw if user's tests use process.send() - by @AriPerkkio in vitest-dev/vitest#8125 (dfe81)

runner:

Fast sequential task updates missing - by @AriPerkkio in vitest-dev/vitest#8121 (7bd11)

Comments between fixture destructures - by @AriPerkkio in vitest-dev/vitest#8127 (dc469)

vite-node:

Unable to handle errors where sourcemap mapping empty - by @blake-newman and @hi-ogawa in vitest-dev/vitest#8071 (8aa25)

    View changes on GitHub

v3.2.2

   🚀 Features

Support rolldown-vite - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#7509 (c8d62)

   🐞 Bug Fixes

browser:

Calculate prepare time from createTesters call on the main thread - by @sheremet-va in vitest-dev/vitest#8101 (142c7)

Optimize build output and always prebundle vitest - by @sheremet-va (00a39)

Make custom locators available in vitest-browser-* packages - by @sheremet-va in vitest-dev/vitest#8103 (247ef)

expect:

Ensure we can always self toEqual - by @dubzzz in vitest-dev/vitest#8094 (02ec8)

reporter:

Allow dot reporter to work in non interactive terminals - by @bstephen1 and @AriPerkkio in vitest-dev/vitest#7994 (6db9f)

    View changes on GitHub

v3.2.1

   🐞 Bug Fixes

Use sha1 instead of md5 for hashing - by @sheremet-va (e4c73)

expect:

Fix chai import in dts - by @hi-ogawa in vitest-dev/vitest#8077 (a7593)

Export DeeplyAllowMatchers - by @sheremet-va in vitest-dev/vitest#8078 (30ab4)

    View changes on GitHub

v3.2.0

... (truncated)

Commits

b87ee3e chore: release v3.2.3
83862d4 fix: run only the name plugin last, not all config plugins (#8130)
dc469f2 fix(runner): comments between fixture destructures (#8127)
1d8ebf9 feat(browser): use base url instead of vitest (#8126)
dfe81a6 fix(pool): throw if user's tests use process.send() (#8125)
0f33506 fix: rerun tests when project's setup file is changed (#8097)
7ddcd33 chore: release v3.2.2
33f7120 Revert "fix(browser): optimize build output and always prebundle vitest"
00a3916 fix(browser): optimize build output and always prebundle vitest
142c735 fix(browser): calculate prepare time from createTesters call on the main th...
Additional commits viewable in compare view

Updates @vitest/ui from 1.6.1 to 3.2.3

Release notes

Sourced from @vitest/ui's releases.

v3.2.3

   🚀 Features

browser: Use base url instead of vitest - by @sheremet-va in vitest-dev/vitest#8126 (1d8eb)

ui: Show test annotations and metadata in the test report tab - by @sheremet-va in vitest-dev/vitest#8093 (c69be)

   🐞 Bug Fixes

Rerun tests when project's setup file is changed - by @sheremet-va in vitest-dev/vitest#8097 (0f335)

Revert expect.any return type - by @sheremet-va in vitest-dev/vitest#8129 (47514)

Run only the name plugin last, not all config plugins - by @sheremet-va in vitest-dev/vitest#8130 (83862)

pool:

Throw if user's tests use process.send() - by @AriPerkkio in vitest-dev/vitest#8125 (dfe81)

runner:

Fast sequential task updates missing - by @AriPerkkio in vitest-dev/vitest#8121 (7bd11)

Comments between fixture destructures - by @AriPerkkio in vitest-dev/vitest#8127 (dc469)

vite-node:

Unable to handle errors where sourcemap mapping empty - by @blake-newman and @hi-ogawa in vitest-dev/vitest#8071 (8aa25)

    View changes on GitHub

v3.2.2

   🚀 Features

Support rolldown-vite - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#7509 (c8d62)

   🐞 Bug Fixes

browser:

Calculate prepare time from createTesters call on the main thread - by @sheremet-va in vitest-dev/vitest#8101 (142c7)

Optimize build output and always prebundle vitest - by @sheremet-va (00a39)

Make custom locators available in vitest-browser-* packages - by @sheremet-va in vitest-dev/vitest#8103 (247ef)

expect:

Ensure we can always self toEqual - by @dubzzz in vitest-dev/vitest#8094 (02ec8)

reporter:

Allow dot reporter to work in non interactive terminals - by @bstephen1 and @AriPerkkio in vitest-dev/vitest#7994 (6db9f)

    View changes on GitHub

v3.2.1

   🐞 Bug Fixes

Use sha1 instead of md5 for hashing - by @sheremet-va (e4c73)

expect:

Fix chai import in dts - by @hi-ogawa in vitest-dev/vitest#8077 (a7593)

Export DeeplyAllowMatchers - by @sheremet-va in vitest-dev/vitest#8078 (30ab4)

    View changes on GitHub

v3.2.0

... (truncated)

Commits

b87ee3e chore: release v3.2.3
c69be1f feat(ui): show test annotations and metadata in the test report tab (#8093)
7ddcd33 chore: release v3.2.2
f858f3b chore: release v3.2.1
59200ae chore: release v3.2.0
cce98d3 chore(deps): update all non-major dependencies (#8067)
b03f209 feat: annotation API (#7953)
3bdf05d fix: ensure errors keep their message and stack after toJSON serialisation ...
910892e chore: simplify working with UI package in dev (#8044)
ba87a62 chore: release v3.2.0-beta.3
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.12` | | [esbuild](https://github.com/evanw/esbuild) | `0.21.5` | `0.25.5` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.19` | `6.3.5` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `1.6.1` | `3.2.3` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `1.6.1` | `3.2.3` | Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Updates `esbuild` from 0.21.5 to 0.25.5 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.25.5) Updates `vite` from 5.4.19 to 6.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.3.5/packages/vite) Updates `vitest` from 1.6.1 to 3.2.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.3/packages/vitest) Updates `@vitest/ui` from 1.6.1 to 3.2.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.3/packages/ui) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.3.5 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 3.2.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@vitest/ui" dependency-version: 3.2.3 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 16, 2025

dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-f8e322b26c branch from 52f0334 to 1d50d98 Compare July 3, 2025 10:49

dependabot bot had a problem deploying to github-pages July 3, 2025 10:50 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 5 updates #1

Bump the npm_and_yarn group across 1 directory with 5 updates #1

Uh oh!

dependabot bot commented on behalf of github Jun 16, 2025 •

edited

Loading

Uh oh!

Uh oh!

Bump the npm_and_yarn group across 1 directory with 5 updates #1

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 5 updates #1

Uh oh!

Conversation

dependabot bot commented on behalf of github Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.1.12

v0.25.5

v0.25.4

Changelog: 2024

0.24.2

0.24.1

v6.3.5

v6.3.4

v6.3.3

v6.3.2

v6.3.1

v6.3.0

v6.3.0-beta.2

v6.3.0-beta.1

v6.3.0-beta.0

v6.2.7

v6.2.6

v6.2.5

v6.2.4

v6.2.3

v6.2.2

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

6.3.3 (2025-04-24)

6.3.2 (2025-04-18)

6.3.1 (2025-04-17)

6.3.0 (2025-04-16)

v3.2.3

🚀 Features

🐞 Bug Fixes

v3.2.2

🚀 Features

🐞 Bug Fixes

v3.2.1

🐞 Bug Fixes

v3.2.0

v3.2.3

🚀 Features

🐞 Bug Fixes

v3.2.2

🚀 Features

🐞 Bug Fixes

v3.2.1

🐞 Bug Fixes

v3.2.0

Uh oh!

Uh oh!

dependabot bot commented on behalf of github Jun 16, 2025 •

edited

Loading