Skip to content

build(deps): bump the npm_and_yarn group across 4 directories with 7 updates#4

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-4cfbcd323e
Open

build(deps): bump the npm_and_yarn group across 4 directories with 7 updates#4
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-4cfbcd323e

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 16, 2025

Bumps the npm_and_yarn group with 1 update in the / directory: js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /wasm/hello-world directory: esbuild, vitest, braces and tmp.
Bumps the npm_and_yarn group with 4 updates in the /wasm/python directory: esbuild, vitest, braces and tmp.
Bumps the npm_and_yarn group with 4 updates in the /wasm/image-add-on directory: esbuild, vitest, braces and tmp.

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates esbuild from 0.20.1 to 0.27.0

Release notes

Sourced from esbuild's releases.

v0.27.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information.

  • Use Uint8Array.fromBase64 if available (#4286)

    With this release, esbuild's binary loader will now use the new Uint8Array.fromBase64 function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specify target when using this feature with Node (for example --target=node22) unless you're using Node v25+.

  • Update the Go compiler from v1.23.12 to v1.25.4 (#4208, #4311)

    This raises the operating system requirements for running esbuild:

    • Linux: now requires a kernel version of 3.2 or later
    • macOS: now requires macOS 12 (Monterey) or later

v0.26.0

  • Enable trusted publishing (#4281)

    GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

    Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

v0.25.12

  • Fix a minification regression with CSS media queries (#4315)

    The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.

  • Update the list of known JavaScript globals (#4310)

    This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

    From ES2017:

    • Atomics
    • SharedArrayBuffer

    From ES2020:

    • BigInt64Array
    • BigUint64Array

    From ES2021:

    • FinalizationRegistry
    • WeakRef

    From ES2025:

    • Float16Array
    • Iterator

    Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:

    // This can now be tree-shaken by esbuild:

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits





Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.






Updates vitest from 1.3.1 to 4.0.9



Release notes

Sourced from vitest's releases.




v4.0.9


   🚀 Experimental Features



   🐞 Bug Fixes



    View changes on GitHub


v4.0.8


   🐞 Bug Fixes



    View changes on GitHub


v4.0.7


   🐞 Bug Fixes



   🏎 Performance



    View changes on GitHub





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vitest since your current version.






Updates vitest from 1.3.1 to 4.0.9



Release notes

Sourced from vitest's releases.




v4.0.9


   🚀 Experimental Features



   🐞 Bug Fixes



    View changes on GitHub


v4.0.8


   🐞 Bug Fixes



    View changes on GitHub


v4.0.7


   🐞 Bug Fixes



   🏎 Performance



    View changes on GitHub





... (truncated)





Commits





Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vitest since your current version.






Updates braces from 3.0.2 to 3.0.3



Commits






Updates rollup from 4.12.0 to 4.53.2



Release notes

Sourced from rollup's releases.




v4.53.2


4.53.2


2025-11-10


Bug Fixes


    

  • Do not throw when using invalid escape sequences in template literals (#6177)
    • 



Pull Requests



v4.53.1


4.53.1


2025-11-07


Bug Fixes


    

  • Fix install script (#6172)
    • 



Pull Requests


    

  • #6172: fix: move patch-package from postinstall to prepare script (@​mshima)
    • 



v4.53.0


4.53.0


2025-11-07


Features


    

  • Improve rendering performance by caching generated variable names (#5947)
    • 



Pull Requests






... (truncated)





Changelog

Sourced from rollup's changelog.




4.53.2


2025-11-10


Bug Fixes


    

  • Do not throw when using invalid escape sequences in template literals (#6177)
    • 



Pull Requests



4.53.1


2025-11-07


Bug Fixes


    

  • Fix install script (#6172)
    • 



Pull Requests


    

  • #6172: fix: move patch-package from postinstall to prepare script (@​mshima)
    • 



4.53.0


2025-11-07


Features


    

  • Improve rendering performance by caching generated variable names (#5947)
    • 



Pull Requests



4.52.5





... (truncated)





Commits

    

  • d8b0150 4.53.2
    • 

  • 4f43f03 handle TemplateElement with null cooked value (#6177)
    • 

  • e3bdcdf 4.53.1
    • 

  • 96b5453 fix: move patch-package from postinstall to prepare script (#6172)
    • 

  • ecff532 4.53.0
    • 

  • 05a6c01 refactor: store safe variable names in cache for subsequent usage (#5947)
    • 

  • 5cf4264 fix(deps): update swc monorepo (major) (#6166)
    • 

  • 75c4346 chore(deps): lock file maintenance minor/patch updates (#6167)
    • 

  • 1ba7efe chore(deps): update dependency @​rollup/plugin-alias to v6 (#6164)
    • 

  • e64d220 chore(deps): update dependency @​rollup/plugin-commonjs to v29 (#6165)
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for rollup since your current version.






Removes tmp


Updates vite from 5.1.5 to 7.2.2



Release notes

Sourced from vite's releases.




v7.2.2


Please refer to CHANGELOG.md for details.


plugin-legacy@7.2.1


Please refer to CHANGELOG.md for details.


v7.2.1


Please refer to CHANGELOG.md for details.


plugin-legacy@7.2.0


Please refer to CHANGELOG.md for details.


v7.2.0


Please refer to CHANGELOG.md for details.


v7.2.0-beta.1


Please refer to CHANGELOG.md for details.


v7.2.0-beta.0


Please refer to CHANGELOG.md for details.


v7.1.12


Please refer to CHANGELOG.md for details.


v7.1.11


Please refer to CHANGELOG.md for details.


v7.1.10


Please refer to CHANGELOG.md for details.


v7.1.9


Please refer to CHANGELOG.md for details.


v7.1.8


Please refer to CHANGELOG.md for details.


v7.1.7


Please refer to CHANGELOG.md for details.


v7.1.6


Please refer to CHANGELOG.md for details.


v7.1.5


Please refer to CHANGELOG.md for details.


v7.1.4


Please refer to CHANGELOG.md for details.


v7.1.3


Please refer to CHANGELOG.md for details.





... (truncated)





Changelog

Sourced from vite's changelog.




7.2.2 (2025-11-07)


Bug Fixes



7.2.1 (2025-11-06)


Bug Fixes



Code Refactoring


    

  • build: rename indexOfMatchInSlice to findPreloadMarker (#21054) (f83264f)
    • 



7.2.0 (2025-11-05)


Bug Fixes


    

  • css: fallback to sass when sass-embedded platform binary is missing (#21002) (b1fd616)
    • 

  • module-runner: make getBuiltins response JSON serializable (#21029) (ad5b3bf)
    • 

  • types: add undefined to optional properties for exactOptionalProperties type compatibility (#21040) (2833c55)
    • 



Miscellaneous Chores



7.2.0-beta.1 (2025-10-29)


Bug Fixes


    

  • increase stream reset rate limit for HTTP2 (#21024) (4f44f22)
    • 

  • optimizer: externalize virtual modules for html like files (#21001) (e5af352)
    • 



Documentation


    

  • clarify the values are escaped automatically (#21017) (246df13)
    • 



Code Refactoring



7.2.0-beta.0 (2025-10-28)


Features


    

  • add import.meta.resolve support for ESM config (bundle config loader) (#20962) (f86789a)
    • 

  • add perEnvironmentWatchChangeDuringDev (#20996) (a5e98e6)
    • 

  • add vite client connect events (#20978) (543d87c)
    • 

  • build: emit license (#18546) (b42c3fb)
    • 

  • dev: support HTTP2 even if proxy feature is used (#20869) (fc21af7)
    • 

  • lib: enable minification but keep pure annotations for es output with terser (#20522) (df997d0)
    • 

  • optimizer: add rush lockfile support (#20833) (718ca2d)
    • 

  • utils: support multiple certificates in resolveServerUrls (#20707) (24513e5)
    • 






... (truncated)





Commits


    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          build(deps): bump the npm_and_yarn group across 4 directories with 7 …
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          9d00263
        
      

    

  

    

      
…updates

Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml).
Bumps the npm_and_yarn group with 4 updates in the /wasm/hello-world directory: [esbuild](https://github.com/evanw/esbuild), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest), [braces](https://github.com/micromatch/braces) and [tmp](https://github.com/raszi/node-tmp).
Bumps the npm_and_yarn group with 4 updates in the /wasm/python directory: [esbuild](https://github.com/evanw/esbuild), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest), [braces](https://github.com/micromatch/braces) and [tmp](https://github.com/raszi/node-tmp).
Bumps the npm_and_yarn group with 4 updates in the /wasm/image-add-on directory: [esbuild](https://github.com/evanw/esbuild), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest), [braces](https://github.com/micromatch/braces) and [tmp](https://github.com/raszi/node-tmp).


Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `esbuild` from 0.20.1 to 0.27.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.20.1...v0.27.0)

Updates `vitest` from 1.3.1 to 4.0.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.9/packages/vitest)

Updates `vitest` from 1.3.1 to 4.0.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.9/packages/vitest)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `rollup` from 4.12.0 to 4.53.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.12.0...v4.53.2)

Removes `tmp`

Updates `vite` from 5.1.5 to 7.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.2.2/packages/vite)

Updates `esbuild` from 0.20.1 to 0.27.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.20.1...v0.27.0)

Updates `vitest` from 1.3.1 to 4.0.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.9/packages/vitest)

Updates `vitest` from 1.3.1 to 4.0.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.9/packages/vitest)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `rollup` from 4.12.0 to 4.53.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.12.0...v4.53.2)

Removes `tmp`

Updates `vite` from 5.1.5 to 7.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.2.2/packages/vite)

Updates `esbuild` from 0.20.1 to 0.27.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.20.1...v0.27.0)

Updates `vitest` from 1.3.1 to 4.0.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.9/packages/vitest)

Updates `vitest` from 1.3.1 to 4.0.9
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.9/packages/vitest)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `rollup` from 4.12.0 to 4.53.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.12.0...v4.53.2)

Removes `tmp`

Updates `vite` from 5.1.5 to 7.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.27.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.0.9
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.0.9
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.53.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.27.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.0.9
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.0.9
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.53.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.27.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.0.9
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.0.9
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.53.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.2.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Nov 16, 2025

    

  



  

  

    
  


  

      


    @dependabot
dependabot
bot


    mentioned this pull request
    
      Nov 16, 2025
    





  


  

      
   Closed

  







  













  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews






    
    

    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
      

  

    

      0 participants