Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 8 updates#4

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b4b10ba2a0
Open

build(deps): bump the npm_and_yarn group across 1 directory with 8 updates#4
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-b4b10ba2a0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 24, 2025

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
vite 5.4.19 5.4.20
vitest 1.6.1 2.1.9
esbuild 0.25.0 0.25.1
undici 5.29.0 6.21.2
cookie 0.7.2 1.0.0
path-to-regexp 8.2.0 8.3.0
express 4.21.0 4.21.1
serve-static 1.16.2 2.1.0

Updates vite from 5.4.19 to 5.4.20

Release notes

Sourced from vite's releases.

v5.4.20

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.20 (2025-09-08)

Commits

Updates vitest from 1.6.1 to 2.1.9

Release notes

Sourced from vitest's releases.

v2.1.9

This release includes security patches for:

   🐞 Bug Fixes

    View changes on GitHub

v2.1.8

   🐞 Bug Fixes

    View changes on GitHub

v2.1.7

   🐞 Bug Fixes

  • Revert support for Vite 6  -  by @​sheremet-va (fbe5c)
    • This introduced some breaking changes (vitest-dev/vitest#6992). We will enable support for it later. In the meantime, you can still use pnpm.overrides or yarn resolutions to override the vite version in the vitest package - the APIs are compatible.
    View changes on GitHub

v2.1.6

🚀 Features

  • Support Vite 6
    View changes on GitHub

v2.1.5

   🐞 Bug Fixes

... (truncated)

Commits

Updates esbuild from 0.25.0 to 0.25.1

Release notes

Sourced from esbuild's releases.

v0.25.1

  • Fix incorrect paths in inline source maps (#4070, #4075, #4105)

    This fixes a regression from version 0.25.0 where esbuild didn't correctly resolve relative paths contained within source maps in inline sourceMappingURL data URLs. The paths were incorrectly being passed through as-is instead of being resolved relative to the source file containing the sourceMappingURL comment, which was due to the data URL not being a file URL. This regression has been fixed, and this case now has test coverage.

  • Fix invalid generated source maps (#4080, #4082, #4104, #4107)

    This release fixes a regression from version 0.24.1 that could cause esbuild to generate invalid source maps. Specifically under certain conditions, esbuild could generate a mapping with an out-of-bounds source index. It was introduced by code that attempted to improve esbuild's handling of "null" entries in source maps (i.e. mappings with a generated position but no original position). This regression has been fixed.

    This fix was contributed by @​jridgewell.

  • Fix a regression with non-file source map paths (#4078)

    The format of paths in source maps that aren't in the file namespace was unintentionally changed in version 0.25.0. Path namespaces is an esbuild-specific concept that is optionally available for plugins to use to distinguish paths from file paths and from paths meant for other plugins. Previously the namespace was prepended to the path joined with a : character, but version 0.25.0 unintentionally failed to prepend the namespace. The previous behavior has been restored.

  • Fix a crash with switch optimization (#4088)

    The new code in the previous release to optimize dead code in switch statements accidentally introduced a crash in the edge case where one or more switch case values include a function expression. This is because esbuild now visits the case values first to determine whether any cases are dead code, and then visits the case bodies once the dead code status is known. That triggered some internal asserts that guard against traversing the AST in an unexpected order. This crash has been fixed by changing esbuild to expect the new traversal ordering. Here's an example of affected code:

    switch (x) {
  case '':
    return y.map(z => z.value)
  case y.map(z => z.key).join(','):
    return []
}

  • Update Go from 1.23.5 to 1.23.7 (#4076, #4077)

    This should have no effect on existing code as this version change does not change Go's operating system support. It may remove certain reports from vulnerability scanners that detect which version of the Go compiler esbuild uses.

    This PR was contributed by @​MikeWillCook.

Changelog

Sourced from esbuild's changelog.

0.25.10

  • Fix a panic in a minification edge case (#4287)

    This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):

    function identity(x) { return x }
identity({ y: identity(123) })

  • Fix @supports nested inside pseudo-element (#4265)

    When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

    The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

    However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:

    /* Original code */
::placeholder {
  color: red;
  body & { color: green }
  @supports (color: blue) { color: blue }
}
/* Old output (with --supported:nesting=false) */
::placeholder {
color: red;
}
body :is() {
color: green;
}
@​supports (color: blue) {
{
color: blue;
}
}
/* New output (with --supported:nesting=false) */
::placeholder {
color: red;
}
body :is() {
color: green;
}
@​supports (color: blue) {
::placeholder {
color: blue;

... (truncated)

Commits

Updates undici from 5.29.0 to 6.21.2

Release notes

Sourced from undici's releases.

v6.21.2

What's Changed

New Contributors

Full Changelog: nodejs/undici@v6.21.1...v6.21.2

v6.21.1

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

Full Changelog: nodejs/undici@v6.21.0...v6.21.1

v6.21.0

What's Changed

Full Changelog: nodejs/undici@v6.20.1...v6.21.0

v6.20.1

What's Changed

Full Changelog: nodejs/undici@v6.20.0...v6.20.1

v6.20.0

... (truncated)

Commits

Updates cookie from 0.7.2 to 1.0.0

Release notes

Sourced from cookie's releases.

v1.0.0

Breaking changes

  • Use modern JS features, ship TypeScript definition (#175) 1cc64ff
    • Adds __esModule marker, imports need to use import { parse, serialize } or import * as cookie
  • Minimum node.js v18
  • Uses null prototype object for parse return value
  • Changes strict and priority to match the lower case strings (i.e. low, not LOW or Low)
  • Require maxAge to be an integer using Number.isInteger check
  • Delegates decode implementation details to decode option (i.e. error handling and quote parsing is defined by decode)
    • Delegate quote parsing to decode (#180) c4a2597
    • Shift try/catch to decode (#179) 93a5b97
  • Improve arg/option error messages (#162) e206fd5 @​MaoShizhong

Other

  • Remove hasOwnProperty, use undefined check for performance (#183) 8f3ee9e @​gurgunday

jshttp/cookie@v0.7.2...v1.0.0

Commits

Updates path-to-regexp from 8.2.0 to 8.3.0

Release notes

Sourced from path-to-regexp's releases.

8.3.0

Changed

  • Add custom error class (#398) 2a7f2a4
  • Allow plain objects for TokenData (#391) 687a9bb
  • Escape text should escape backslash (#390) a4a8552
  • Improved error messages and stack size (#363) a6bdf40

Other

  • Minifying the parser
    • PR (#401) 9df2448
    • PR (#395) 4a91505
    • Shaving some bytes d63f44b
    • Remove optional operator 973d15c

pillarjs/path-to-regexp@v8.2.0...v8.3.0

Commits

Updates express from 4.21.0 to 4.21.1

Release notes

Sourced from express's releases.

4.21.1

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

Changelog

Sourced from express's changelog.

4.21.1 / 2024-10-08

Commits

Updates serve-static from 1.16.2 to 2.1.0

Release notes

Sourced from serve-static's releases.

2.1.0

What's Changed

New Contributors

Full Changelog: expressjs/serve-static@v1.15.0...2.1.0

2.0.0-beta.1

  • Change dotfiles option default to 'ignore'
  • Drop support for Node.js 0.8
  • Remove hidden option; use dotfiles option instead
  • deps: send@1.0.0-beta.1
    • Use mime-types for file to content type mapping
    • deps: debug@3.1.0
Changelog

Sourced from serve-static's changelog.

2.1.0 / 2024-09-10

  • Changes from 1.16.0
  • deps: send@^1.2.0

2.0.0 / 2024-08-23

  • deps:
    • parseurl@^1.3.3
    • excape-html@^1.0.3
    • encodeurl@^2.0.0
    • supertest@^6.3.4
    • safe-buffer@^5.2.1
    • nyc@^17.0.0
    • mocha@^10.7.0
  • Changes from 1.x

2.0.0-beta.2 / 2024-03-20

  • deps: send@1.0.0-beta.2

2.0.0-beta.1 / 2022-02-05

  • Change dotfiles option default to 'ignore'
  • Drop support for Node.js 0.8
  • Remove hidden option; use dotfiles option instead
  • Remove mime export; use mime-types package instead
  • deps: send@1.0.0-beta.1
    • Use mime-types for file to content type mapping
    • deps: debug@3.1.0

1.16.0 / 2024-09-10

  • Remove link renderization in html while redirecting

1.15.0 / 2022-03-24

  • deps: send@0.18.0
    • Fix emitted 416 error missing headers property
    • Limit the headers removed for 304 response
    • deps: depd@2.0.0
    • deps: destroy@1.2.0
    • deps: http-errors@2.0.0
    • deps: on-finished@2.4.1

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 8 up…
e89ffaa 
…dates

Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.19` | `5.4.20` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `1.6.1` | `2.1.9` |
| [esbuild](https://github.com/evanw/esbuild) | `0.25.0` | `0.25.1` |
| [undici](https://github.com/nodejs/undici) | `5.29.0` | `6.21.2` |
| [cookie](https://github.com/jshttp/cookie) | `0.7.2` | `1.0.0` |
| [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `8.2.0` | `8.3.0` |
| [express](https://github.com/expressjs/express) | `4.21.0` | `4.21.1` |
| [serve-static](https://github.com/expressjs/serve-static) | `1.16.2` | `2.1.0` |



Updates `vite` from 5.4.19 to 5.4.20
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.20/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.20/packages/vite)

Updates `vitest` from 1.6.1 to 2.1.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v2.1.9/packages/vitest)

Updates `esbuild` from 0.25.0 to 0.25.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.25.0...v0.25.1)

Updates `undici` from 5.29.0 to 6.21.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.29.0...v6.21.2)

Updates `cookie` from 0.7.2 to 1.0.0
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.7.2...v1.0.0)

Updates `path-to-regexp` from 8.2.0 to 8.3.0
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.2.0...v8.3.0)

Updates `express` from 4.21.0 to 4.21.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.21.1/History.md)
- [Commits](expressjs/express@4.21.0...4.21.1)

Updates `serve-static` from 1.16.2 to 2.1.0
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.16.2...2.1.0)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 5.4.20
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 2.1.9
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.21.2
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 1.0.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 8.3.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 4.21.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 2.1.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 24, 2025
@codemaker-ai-app

codemaker-ai-app Bot commented Sep 24, 2025

Copy link
Copy Markdown

Hello from @codemakerai.

CodeMaker AI GitHub App integration.

Usage:

@codemakerai [command or prompt]

Assistant

All Assistant features are supported in GitHub. Assistant can answer general questions as well as questions directly
related to code. It also has code editing capabilities.

@codemakerai assistant prompt - the assistant prompt
@codemakerai prompt - the assistant prompt. Alias to assistant command.

Commands

Pull Request Commands - commands that can be posted as comments on the pull request:

@codemakerai help - prints this help message
@codemakerai review process - process the most recent code review and all it's comments
@codemakerai generate code [codepath] - generate code for all files in pull request, or only for matching code path.
@codemakerai generate docs [codepath] - generate documentation for all files in pull request, or only for matching code path.
@codemakerai replace code [codepath] - replace code for all files in pull request, or only for matching code path.
@codemakerai replace docs [codepath] - replace documentation for all files in pull request, or only for matching code path.
@codemakerai fix syntax - fixes the syntax in all files
@codemakerai commit undo - removes the most recent commit

Pull Request Code Review Commands - commands that can be posted as comments on the code review i.e. "Files changed" tab:

@codemakerai assistant prompt - the assistant prompt
@codemakerai explain - explains the code
@codemakerai review - reviews the code

Triggers

To automatically trigger certain actions on pull requests you can create and use the following GitHub labels.

codemakerai-pull-request-generate-documentation - automatically generates comments/documentation on Pull Request creation.
codemakerai-pull-request-syntax-autocorrection - automatically corrects syntax on Pull Request creation.
codemakerai-pull-request-review-process - automatically processes code review comments on Pull Request Review submission.

For in depth explanation of the features, please consult https://docs.codemaker.ai

In case of any issues please report them to https://community.codemaker.ai

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants