build(deps): bump the npm_and_yarn group with 4 updates #92

dependabot · 2025-09-03T01:41:41Z

Bumps the npm_and_yarn group with 4 updates: vite, brace-expansion, esbuild and @tanstack/react-start.

Updates vite from 6.3.5 to 7.0.0

Release notes

create-vite@7.0.0

Please refer to CHANGELOG.md for details.

plugin-legacy@7.0.0

Please refer to CHANGELOG.md for details.

v7.0.0

Please refer to CHANGELOG.md for details.

v7.0.0-beta.2

Please refer to CHANGELOG.md for details.

v7.0.0-beta.1

Please refer to CHANGELOG.md for details.

plugin-legacy@7.0.0-beta.1

Please refer to CHANGELOG.md for details.

plugin-legacy@7.0.0-beta.0

Please refer to CHANGELOG.md for details.

v7.0.0-beta.0

Please refer to CHANGELOG.md for details.

create-vite@6.5.0

Please refer to CHANGELOG.md for details.

create-vite@6.4.1

Please refer to CHANGELOG.md for details.

create-vite@6.4.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.0.0 (2025-06-24)

Today, we're excited to announce the release of the next Vite major:

Vite 7.0 announcement blog post

Docs (translations: 简体中文, 日本語, Español, Português, 한국어, Deutsch, فارسی)

Migration Guide

⚠ BREAKING CHANGES

ssr: don't access Object variable in ssr transformed code (#19996)

remove experimental.skipSsrTransform option (#20038)

remove HotBroadcaster (#19988)

css: always use sass compiler API (#19978)

bump build.target and name it baseline-widely-available (#20007)

bump required node version to 20.19+, 22.12+ and remove cjs build (#20032)

css: remove sass legacy API support (#19977)

remove deprecated HotBroadcaster related types (#19987)

remove deprecated no-op type only properties (#19985)

remove node 18 support (#19972)

remove deprecated hook-level enforce/transform from transformIndexHtml hook (#19349)

remove deprecated splitVendorChunkPlugin (#19255)

Features

types: use terser types from terser package (#20274) (a5799fa)

apply some middlewares before configurePreviewServer hook (#20224) (b989c42)

apply some middlewares before configureServer hook (#20222) (f5cc4c0)

add base option to import.meta.glob (#20163) (253d6c6)

add this.meta.viteVersion (#20088) (f55bf41)

allow passing down resolved config to vite's createServer (#19894) (c1ae9bd)

buildApp hook (#19971) (5da659d)

build: provide names for asset entrypoints (#19912) (c4e01dc)

bump build.target and name it baseline-widely-available (#20007) (4a8aa82)

client: support opening fileURL in editor (#20040) (1bde4d2)

make PluginContext available for Vite-specific hooks (#19936) (7063839)

resolve environments plugins at config time (#20120) (f6a28d5)

stabilize css.preprocessorMaxWorkers and default to true (#19992) (70aee13)

stabilize optimizeDeps.noDiscovery (#19984) (6d2dcb4)

Bug Fixes

deps: update all non-major dependencies (#20271) (6b64d63)

keep import.meta.url in bundled Vite (#20235) (3bf3a8a)

module-runner: export ssrExportNameKey (#20266) (ac302a7)

module-runner: expose normalizeModuleId (#20277) (9b98dcb)

deps: update all non-major dependencies (#20181) (d91d4f7)

deps: update all non-major dependencies (#20212) (a80339b)

... (truncated)

Commits

eafd28a chore: rearrange 7.0 changelog (#20280)
b85f322 release: v7.0.0
9b98dcb fix(module-runner): expose normalizeModuleId (#20277)
a5799fa feat(types): use terser types from terser package (#20274)
f7377c3 chore(deps): update rolldown-related dependencies (#20270)
6b64d63 fix(deps): update all non-major dependencies (#20271)
ac302a7 fix(module-runner): export ssrExportNameKey (#20266)
b135918 chore: typos in comments (#20259)
3f46901 perf(utils): improve performance of numberToPos (#20244)
3bf3a8a fix: keep import.meta.url in bundled Vite (#20235)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v1.1.12

pkg: publish on tag 1.x c460dbd

fmt ccb8ac6

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

44f33b4 1.1.12
c460dbd pkg: publish on tag 1.x
ccb8ac6 fmt
c3c73c8 Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)
See full diff in compare view

Updates esbuild from 0.20.2 to 0.25.9

Release notes

Sourced from esbuild's releases.

v0.25.9
Better support building projects that use Yarn on Windows (#3131, #3663)

With this release, you can now use esbuild to bundle projects that use Yarn Plug'n'Play on Windows on drives other than the C: drive. The problem was as follows:

Yarn in Plug'n'Play mode on Windows stores its global module cache on the C: drive

Some developers put their projects on the D: drive

Yarn generates relative paths that use ../.. to get from the project directory to the cache directory

Windows-style paths don't support directory traversal between drives via .. (so D:\.. is just D:)

I didn't have access to a Windows machine for testing this edge case

Yarn works around this edge case by pretending Windows-style paths beginning with C:\ are actually Unix-style paths beginning with /C:/, so the ../.. path segments are able to navigate across drives inside Yarn's implementation. This was broken for a long time in esbuild but I finally got access to a Windows machine and was able to debug and fix this edge case. So you should now be able to bundle these projects with esbuild.
Preserve parentheses around function expressions (#4252)

The V8 JavaScript VM uses parentheses around function expressions as an optimization hint to immediately compile the function. Otherwise the function would be lazily-compiled, which has additional overhead if that function is always called immediately as lazy compilation involves parsing the function twice. You can read V8's blog post about this for more details.

Previously esbuild did not represent parentheses around functions in the AST so they were lost during compilation. With this change, esbuild will now preserve parentheses around function expressions when they are present in the original source code. This means these optimization hints will not be lost when bundling with esbuild. In addition, esbuild will now automatically add this optimization hint to immediately-invoked function expressions. Here's an example:
// Original code
const fn0 = () => 0
const fn1 = (() => 1)
console.log(fn0, function() { return fn1() }())
// Old output
const fn0 = () => 0;
const fn1 = () => 1;
console.log(fn0, function() {
return fn1();
}());
// New output
const fn0 = () => 0;
const fn1 = (() => 1);
console.log(fn0, (function() {
return fn1();
})());
Note that you do not want to wrap all function expressions in parentheses. This optimization hint should only be used for functions that are called on initial load. Using this hint for functions that are not called on initial load will unnecessarily delay the initial load. Again, see V8's blog post linked above for details.
Update Go from 1.23.10 to 1.23.12 (#4257, #4258)

This should have no effect on existing code as this version change does not change Go's operating system support. It may remove certain false positive reports (specifically CVE-2025-4674 and CVE-2025-47907) from vulnerability scanners that only detect which version of the Go compiler esbuild uses.
v0.25.8

Fix another TypeScript parsing edge case (#4248)

This fixes a regression with a change in the previous release that tries to more accurately parse TypeScript arrow functions inside the ?: operator. The regression specifically involves parsing an arrow function containing a #private identifier inside the middle of a ?: ternary operator inside a class body. This was fixed by propagating private identifier state into the parser clone used to speculatively parse the arrow function body. Here is an example of some affected code:

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

195e05c publish 0.25.9 to npm
3dac33f fix #3131, fix #3663: yarnpnp + windows + D drive
0f2c5c8 mock fs now supports multiple volumes on windows
100a51e split out yarnpnp snapshot tests
13aace3 remove C: assumption from windows snapshot tests
f1f413f fix #4252: preserve parentheses around functions
1bc8091 fix #4257, close #4258: go 1.23.10 => 1.23.12
bc52135 move the go compiler version to go.version
a0af5d1 makefile: use ESBUILD_VERSION consistently
8c71947 publish 0.25.8 to npm
Additional commits viewable in compare view

Updates @tanstack/react-start from 1.115.2 to 1.131.31

Release notes

Sourced from @tanstack/react-start's releases.

v1.131.31

Version 1.131.31 - 8/31/25, 11:50 AM

Changes

Fix

react-router, solid-router: reduce useNavigate reactivity on path changes (#5037) (fb04daf) by Nico Lynzaad

Packages

@tanstack/solid-router@1.131.31

@tanstack/react-router@1.131.31

@tanstack/react-router-ssr-query@1.131.31

@tanstack/zod-adapter@1.131.31

@tanstack/valibot-adapter@1.131.31

@tanstack/arktype-adapter@1.131.31

@tanstack/router-devtools@1.131.31

@tanstack/solid-router-devtools@1.131.31

@tanstack/react-router-devtools@1.131.31

@tanstack/router-plugin@1.131.31

@tanstack/router-vite-plugin@1.131.31

@tanstack/solid-start-client@1.131.31

@tanstack/solid-start-server@1.131.31

@tanstack/react-start-client@1.131.31

@tanstack/react-start-server@1.131.31

@tanstack/start-plugin-core@1.131.31

@tanstack/solid-start@1.131.31

@tanstack/solid-start-plugin@1.131.31

@tanstack/react-start@1.131.31

@tanstack/react-start-plugin@1.131.31

v1.131.30

Version 1.131.30 - 8/30/25, 1:22 PM

Changes

Refactor

router-core: slightly faster replaceEqualDeep (#5046) (eb6bcea) by @Sheraff

router-core: slightly faster deepEqual (#5051) (48551b3) by @Sheraff

Packages

@tanstack/router-core@1.131.30

@tanstack/solid-router@1.131.30

@tanstack/react-router@1.131.30

@tanstack/react-router-ssr-query@1.131.30

@tanstack/router-ssr-query-core@1.131.30

@tanstack/zod-adapter@1.131.30

... (truncated)

Commits

79fe58f release: v1.131.31
d872397 release: v1.131.30
a98c89c release: v1.131.28
83ab173 release: v1.131.27
f2190d7 release: v1.131.26
fa3f8fa release: v1.131.25
472cac4 release: v1.131.24
b953a37 release: v1.131.23
72b65cf release: v1.131.22
cb6d34a release: v1.131.21
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the npm_and_yarn group with 4 updates: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [brace-expansion](https://github.com/juliangruber/brace-expansion), [esbuild](https://github.com/evanw/esbuild) and [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start). Updates `vite` from 6.3.5 to 7.0.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@7.0.0/packages/vite) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Updates `esbuild` from 0.20.2 to 0.25.9 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.20.2...v0.25.9) Updates `@tanstack/react-start` from 1.115.2 to 1.131.31 - [Release notes](https://github.com/TanStack/router/releases) - [Commits](https://github.com/TanStack/router/commits/v1.131.31/packages/react-start) --- updated-dependencies: - dependency-name: vite dependency-version: 7.0.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@tanstack/react-start" dependency-version: 1.131.31 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2025-09-03T01:41:55Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	surface	`3a20d5c`	Sep 03 2025, 01:41 AM

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 3, 2025

cif force-pushed the main branch from 26ada59 to d91b1f0 Compare October 12, 2025 03:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the npm_and_yarn group with 4 updates #92

build(deps): bump the npm_and_yarn group with 4 updates #92

Uh oh!

dependabot bot commented on behalf of github Sep 3, 2025 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Sep 3, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

build(deps): bump the npm_and_yarn group with 4 updates #92

Are you sure you want to change the base?

build(deps): bump the npm_and_yarn group with 4 updates #92

Uh oh!

Conversation

dependabot bot commented on behalf of github Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

create-vite@7.0.0

plugin-legacy@7.0.0

v7.0.0

v7.0.0-beta.2

v7.0.0-beta.1

plugin-legacy@7.0.0-beta.1

plugin-legacy@7.0.0-beta.0

v7.0.0-beta.0

create-vite@6.5.0

create-vite@6.4.1

create-vite@6.4.0

7.0.0 (2025-06-24)

⚠ BREAKING CHANGES

Features

Bug Fixes

v1.1.12

v0.25.9

v0.25.8

Changelog: 2024

0.24.2

0.24.1

v1.131.31

Changes

Fix

Packages

v1.131.30

Changes

Refactor

Packages

Uh oh!

cloudflare-workers-and-pages bot commented Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Sep 3, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Sep 3, 2025 •

edited

Loading