chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #12 · WaveSpeedAI/wavespeed-cli

dependabot · 2026-10-17T09:28:03Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
@vitest/mocker	`4.1.6`	`5.0.5`
esbuild	`0.27.7`	`0.28.2`
fast-uri	`3.1.2`	`3.1.8`
postcss	`8.5.14`	`8.5.30`
source-map-js	`1.2.1`	`1.2.2`
vite	`8.0.13`	`8.3.4`

Updates @vitest/mocker from 4.1.6 to 5.0.5

Release notes

Sourced from @vitest/mocker's releases.

v5.0.5

   🐞 Bug Fixes

Keep vite default fs.deny with api token file - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)

Handle quoted file names in --changed - by @sheremet-va in vitest-dev/vitest#11583 (14921)

Add data to the import.meta.hot stub - by @sheremet-va in vitest-dev/vitest#11590 (3a828)

Set skip in skipIf, ignore undefined options - by @sheremet-va in vitest-dev/vitest#11591 (d523a)

Skip builtin loading in async leak detector - by @sheremet-va in vitest-dev/vitest#11598 (fe86a)

Keep the import frame in native loader errors - by @sheremet-va in vitest-dev/vitest#11599 (9697b)

Run hook cleanups when a later hook fails - by @sheremet-va in vitest-dev/vitest#11605 (6c5a4)

Release mocks of finished test files - by @sheremet-va in vitest-dev/vitest#11607 (e9c3d)

Abort all running tests on cancel - by @sheremet-va in vitest-dev/vitest#11606 (6621a)

browser:

Ignore synthetic pagehide events - by @sheremet-va in vitest-dev/vitest#11582 (ca081)

Run plugin buildStart on server creation - by @sheremet-va in vitest-dev/vitest#11593 (ea611)

Drop late connections of closed sessions - by @sheremet-va in vitest-dev/vitest#11600 (f161e)

Wait 30s for the browser to close - by @sheremet-va in vitest-dev/vitest#11601 (6498b)

Run global setup once with instances - by @sheremet-va in vitest-dev/vitest#11596 (8dd67)

reporter:

End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker/issues/39); on worker crash - by @AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

v5.0.4

   🚀 Features

experimental:

Tag cache directories with CACHEDIR.TAG - by @lifeiscontent in vitest-dev/vitest#11461 (a8ea3)

Support test.ui.theme option - by @sheremet-va in vitest-dev/vitest#11499 (1da66)

Highlight selector multiple matches in trace view - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11489 (5abba)

Print how many tests were affected and a total when running --changed - by @sheremet-va in vitest-dev/vitest#11424 (a2336)

Add an option to cache dependencies instead of statically parsing them - by @sheremet-va in vitest-dev/vitest#11515 (c0601)

Add fit and zoom controls to trace viewer - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11490 (f5dd9)

   🐞 Bug Fixes

Fail the run on git and location filter errors - by @sheremet-va in vitest-dev/vitest#11430 (30d03)

Enable fsModuleCache by default - by @sheremet-va in vitest-dev/vitest#11435 (ad208)

Track project files and mocks with --changed - by @sheremet-va in vitest-dev/vitest#11432 (b0f2b)

Refactor caching, fix : in project and change the shape of results cache - by @sheremet-va in vitest-dev/vitest#11453 (9673c)

Keep full $ string values when taskTitleValueFormatTruncate is 0 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11485 (4f7e1)

Resolve node builtins in client environments - by @sheremet-va in vitest-dev/vitest#11417 (56b31)

Fix module graph builtin externals after #11421 - by @hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11491 and vitest-dev/vitest#11421 (008e1)

Wrap module mocks during in-source testing - by @sheremet-va in vitest-dev/vitest#11505 (36d19)

Handle line endings in snapshot - by @sheremet-va in vitest-dev/vitest#11522 (4c468)

Respect root in projects - by @sheremet-va in vitest-dev/vitest#11521 (26642)

Resolve mocks in directories with spaces - by @sheremet-va in vitest-dev/vitest#11539 (caaef)

api:

Publish the api token atomically - by @umairnawaz333 in vitest-dev/vitest#11323 (6f990)

browser:

... (truncated)

Commits

7a825db chore: release v5.0.5 (#11609)
6a11cf6 chore: release v5.0.4 (#11554)
58c86ed chore(deps): update all non-major dependencies (#11550)
5c95521 fix(browser): clean up unmocked and pending mocks (#11537)
cd423ba fix(mocker): fix native loader mocking edge cases (#11540)
36d19cb fix: wrap module mocks during in-source testing (#11505)
fe025b2 chore(deps): update dependency msw to v3 (#11482)
b0f2b3b fix: track project files and mocks with --changed (#11432)
33cadea chore: release v5.0.3 (#11409)
15cc006 fix: don't print an interceptor warning in browser mode (#11377)
Additional commits viewable in compare view

Updates esbuild from 0.27.7 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
  let x

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

... (truncated)

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
Additional commits viewable in compare view

Updates postcss from 8.5.14 to 8.5.30

Release notes

Sourced from postcss's releases.

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

... (truncated)

Commits

f1aca7e Release 8.5.30 version
9d83445 Update dependencies
6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
1fd8f88 Add missed changes in changelog
a7a1f34 Release 8.5.29 version
b55a36d Update dependencies
7647a81 Escape </style> in output of non-Root nodes (#2163)
7ac9026 Do not split list.comma() and list.space() on separators inside comments (#2162)
ebffa97 Add postcss-smooth-corners plugin
57d6401 Speed up source map cleaning
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Updates vite from 8.0.13 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)

build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)

bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)

client: skip rewriting unchanged adopted styles (#23697) (fa71469)

css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)

deps: update all non-major dependencies (#23648) (8a4c19c)

deps: update rolldown-related dependencies (#23649) (794516d)

dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)

don't treat modules ending with js-like query as js (#23687) (fcb6f12)

html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)

html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)

optimizer: scan deep imports with custom extensions (#23678) (8579189)

remove input option unescaping for now (#23694) (facc2fb)

server: match static aliases on path boundaries (#23643) (b28db28)

watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)

html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)

server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)

server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)

bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)

bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)

deps: update all non-major dependencies (#23601) (9944fa6)

deps: update rolldown-related dependencies (#23602) (88c1741)

html: resolve percent-encoded srcset urls (#23609) (53f1ce7)

limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)

build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)

bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)

client: skip rewriting unchanged adopted styles (#23697) (fa71469)

css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)

deps: update all non-major dependencies (#23648) (8a4c19c)

deps: update rolldown-related dependencies (#23649) (794516d)

dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)

don't treat modules ending with js-like query as js (#23687) (fcb6f12)

html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)

html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)

optimizer: scan deep imports with custom extensions (#23678) (8579189)

remove input option unescaping for now (#23694) (facc2fb)

server: match static aliases on path boundaries (#23643) (b28db28)

watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)

html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)

server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)

server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)

bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)

bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)

deps: update all non-major dependencies (#23601) (9944fa6)

deps: update rolldown-related dependencies (#23602) (88c1741)

html: resolve percent-encoded srcset urls (#23609) (53f1ce7)

limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Commits

b6c20f6 release: v8.3.4 (#23702)
b28db28 fix(server): match static aliases on path boundaries (#23643)
bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
facc2fb fix: remove input option unescaping for now (#23694)
70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have ...

Description has been truncated

…dates Bumps the npm_and_yarn group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.6` | `5.0.5` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.7` | `0.28.2` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.8` | | [postcss](https://github.com/postcss/postcss) | `8.5.14` | `8.5.30` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.13` | `8.3.4` | Updates `@vitest/mocker` from 4.1.6 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/mocker) Updates `esbuild` from 0.27.7 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.7...v0.28.2) Updates `fast-uri` from 3.1.2 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.8) Updates `postcss` from 8.5.14 to 8.5.30 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.14...8.5.30) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `vite` from 8.0.13 to 8.3.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 5.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.30 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.3.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 17, 2026

dependabot Bot mentioned this pull request Oct 17, 2026

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates #9

Closed

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates - #12

chore(deps): bump the npm_and_yarn group across 1 directory with 6 updates#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-fe54fa2b9a

dependabot Bot commented on behalf of github Oct 17, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 17, 2026

v5.0.5

🐞 Bug Fixes

View changes on GitHub

v5.0.4

🚀 Features

🐞 Bug Fixes

v0.28.2

0.28.2

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

8.5.30

8.5.29

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.30

8.5.29

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

v1.2.2

1.2.2

v8.3.4

Features

Bug Fixes

Performance Improvements

Code Refactoring

v8.3.3

Bug Fixes

v8.3.2

Bug Fixes

8.3.4 (2026-10-08)

Features

Bug Fixes

Performance Improvements

Code Refactoring

8.3.3 (2026-10-06)

Bug Fixes

8.3.2 (2026-10-01)

Bug Fixes

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants