Bump the npm_and_yarn group across 1 directory with 16 updates by dependabot[bot] · Pull Request #28 · fuzdev/zzz

dependabot · 2026-09-03T12:59:30Z

Bumps the npm_and_yarn group with 15 updates in the / directory:

Package	From	To
@hono/node-server	`1.19.6`	`1.19.15`
hono	`4.10.7`	`4.13.5`
@sveltejs/kit	`2.55.0`	`2.70.3`
svelte	`5.54.0`	`5.57.0`
vitest	`4.0.15`	`4.1.11`
brace-expansion	`1.1.12`	`1.1.18`
esbuild	`0.25.12`	`0.28.2`
vite	`7.1.5`	`7.3.6`
flatted	`3.3.3`	`3.4.4`
js-yaml	`4.1.0`	`4.3.2`
picomatch	`4.0.3`	`4.0.7`
postcss	`8.5.6`	`8.5.27`
postcss-selector-parser	`7.1.0`	`7.1.6`
rollup	`4.50.1`	`4.63.1`
ws	`8.18.3`	`8.21.3`

Updates @hono/node-server from 1.19.6 to 1.19.15

Release notes

Sourced from @hono/node-server's releases.

v1.19.14

What's Changed

fix: add custom inspect to lightweight Request/Response to prevent TypeError on console.log by @usualoma in honojs/node-server#340

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

chore: ignore claude setting by @yusukebe in honojs/node-server#314

fix: request draining for early 413 responses by @usualoma in honojs/node-server#329

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

fix: do not overwrite Content-Length in the fast path pattern if Content-Length already exists. by @usualoma in honojs/node-server#309

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

fix(globals): Stop overwriting global.fetch by @usualoma in honojs/node-server#295

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

docs: add guide for listening to UNIX domain socket by @TransparentLC in honojs/node-server#292

fix(serve-static): Use Readable.toWeb in serveStatic by @otya128 in honojs/node-server#293

New Contributors

@TransparentLC made their first contribution in honojs/node-server#292

... (truncated)

Commits

See full diff in compare view

Updates hono from 4.10.7 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222

fix(client): skip undefined header and cookie values in honojs/hono#5244

fix(client): skip an undefined entry inside a query array in honojs/hono#5272

fix(client): skip an undefined entry inside a form array in honojs/hono#5280

fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256

fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255

fix(client): omit empty query delimiter in honojs/hono#5283

fix(request): drop stale content length for cloned FormData in honojs/hono#5282

fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288

fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246

fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

06880c4 4.13.5
531e9c5 Merge commit from fork
3a67f7f Merge commit from fork
9c28d72 Merge commit from fork
017000d 4.13.4
5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
612b59c fix(request): drop stale content length for cloned FormData (#5282)
73794bd fix(client): omit empty query delimiter (#5283)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates @sveltejs/kit from 2.55.0 to 2.70.3

Release notes

Sourced from @sveltejs/kit's releases.

@sveltejs/kit@2.70.3

Patch Changes

fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

@sveltejs/kit@2.70.2

Patch Changes

fix: prevent quadratic backtracking in Accept header content negotiation (#1)

@sveltejs/kit@2.70.1

Patch Changes

docs: update links to hooks documentation (#16417)

@sveltejs/kit@2.70.0

Minor Changes

feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

@sveltejs/kit@2.69.3

Patch Changes

fix: detect destructured load and actions exports during type generation (#16329)

fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

@sveltejs/kit@2.69.2

Patch Changes

fix: set define values on globalThis when running Vitest (#16246)

@sveltejs/kit@2.69.1

Patch Changes

fix: prevent prototype pollution when deleting file inputs (#16218)

fix: prevent unhandled promise rejection (#16219)

@sveltejs/kit@2.69.0

Minor Changes

... (truncated)

Changelog

Sourced from @sveltejs/kit's changelog.

2.70.3

Patch Changes

fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

2.70.2

Patch Changes

fix: prevent quadratic backtracking in Accept header content negotiation (82712fc)

2.70.1

Patch Changes

docs: update links to hooks documentation (#16417)

2.70.0

Minor Changes

feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

2.69.3

Patch Changes

fix: detect destructured load and actions exports during type generation (#16329)

fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

2.69.2

Patch Changes

fix: detect destructured load and actions exports during type generation (#16329)

fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

fix: exclude deleted cookies from cookies.getAll() so it stays consistent with cookies.get() (#16297)

fix: reset failed <svelte:boundary> on client navigation so a stale +error.svelte is torn down (#16296)

... (truncated)

Commits

39e8e1f Version Packages (#16771)
b61018d fix: avoid eagerly reading $app/state dependencies during module
1ad0d43 chore: get Vercel split platform tests running (#16666)
a297aff Version Packages (#16571)
82712fc Merge commit from fork
4c2355f Version Packages (#16418)
c1665b9 docs: update hooks page (#16417)
4da36e6 Version Packages (#16343)
78f28f1 feat: move defineEnvVars to @sveltejs/kit/env (#16378)
ffa0e3b fix: don't disable CSRF protection in builds with a non-production NODE_ENV (...
Additional commits viewable in compare view

Updates svelte from 5.54.0 to 5.57.0

Release notes

Sourced from svelte's releases.

svelte@5.57.0

Minor Changes

feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server (#18648)

feat: add has function to createContext (#18472)

feat: support defaultValue on <select> (#18591)

feat: add getOrInsert/getOrInsertComputed to SvelteMap (#18728)

Patch Changes

fix: block template store subscriptions on the promise that assigns the store (#18582)

fix: route $derived teardown errors through invoke_error_boundary (#18486)

fix: track SvelteDate snapshots in reactions (#18700)

fix: remove <svelte:head> anchors on unmount (#18697)

fix: warn on undeclared shorthand event handlers on <svelte:window>, <svelte:document> and <svelte:body> (#18480)

perf: reuse the cached value in the <option>/<select> value guard (#18713)

fix: prevent malformed AST output for <select> with static value attribute (#18449)

fix: apply ownership mutation ignores to binding assignments (#18718)

fix: prevent onoutroend from firing twice when compilerOptions.hmr is true (#18655)

fix: preserve whitespace after inline elements when printing (#18685)

perf: fold SSR block-open markers into the branch's first push (#18712)

fix: run onDestroy callbacks when a server render throws (#18585)

fix: report derived_invalid_export for export let x = $derived(...) in runes mode (#18692)

fix: never apply class hash to elements inside <svelte:head> (#18160)

fix: keep defaultChecked on hydrated radio inputs with spread attributes (#18701)

fix: accept onfocusin/onfocusout in a11y_mouse_events_have_key_events (#18689)

perf: O(n²)→O(n) Map lookups for legacy $: reactive statement ordering (#18602)

fix: distinct memoizer on style/class directives (#18466)

fix: measure nested transitions before applying their starting styles (#18647)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.57.0

Minor Changes

feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server (#18648)

feat: add has function to createContext (#18472)

feat: support defaultValue on <select> (#18591)

feat: add getOrInsert/getOrInsertComputed to SvelteMap (#18728)

Patch Changes

fix: block template store subscriptions on the promise that assigns the store (#18582)

fix: route $derived teardown errors through invoke_error_boundary (#18486)

fix: track SvelteDate snapshots in reactions (#18700)

fix: remove <svelte:head> anchors on unmount (#18697)

fix: warn on undeclared shorthand event handlers on <svelte:window>, <svelte:document> and <svelte:body> (#18480)

perf: reuse the cached value in the <option>/<select> value guard (#18713)

fix: prevent malformed AST output for <select> with static value attribute (#18449)

fix: apply ownership mutation ignores to binding assignments (#18718)

fix: prevent onoutroend from firing twice when compilerOptions.hmr is true (#18655)

fix: preserve whitespace after inline elements when printing (#18685)

perf: fold SSR block-open markers into the branch's first push (#18712)

fix: run onDestroy callbacks when a server render throws (#18585)

fix: report derived_invalid_export for export let x = $derived(...) in runes mode (#18692)

fix: never apply class hash to elements inside <svelte:head> (#18160)

fix: keep defaultChecked on hydrated radio inputs with spread attributes (#18701)

fix: accept onfocusin/onfocusout in a11y_mouse_events_have_key_events (#18689)

perf: O(n²)→O(n) Map lookups for legacy $: reactive statement ordering (#18602)

fix: distinct memoizer on style/class directives (#18466)

... (truncated)

Commits

7bc0a70 Version Packages (#18682)
6374a2a chore: move @types/trusted-types to devDependencies (#18730)
4ae5eb3 feat: add has function to createContext (#18472)
5034b59 chore: bump playwright (#18729)
74197cc feat: add getOrInsert/getOrInsertComputed to SvelteMap (#18728)
edbe11e fix: properly apply static textarea value attribute during CSR (#18727)
05b6916 fix: omit bind:focused from SSR output (#18724)
7c6f36a fix: keep boolean attributes with an empty string value when rendering attrib...
2e8b57b fix: render selected options for \<select multiple> with an array value ...
864de81 fix: keep the current selection of a \<select> when its defaultValue is ap...
Additional commits viewable in compare view

Updates vitest from 4.0.15 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates devalue from 5.6.4 to 5.9.2

Release notes

Sourced from devalue's releases.

v5.9.2

Patch Changes

8b2a456: fix: reject out-of-bounds indices

v5.9.1

Patch Changes

39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references

686e379: fix: emit valid JS for Node Buffer in uneval

376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it

07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)

5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

48cc81f: fix: serialize DataView subviews with the correct byte offset and length

cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated

29a3382: fix: uneval now produces valid output for a repeated empty Map or Set

8c0db06: fix: serialize Temporal values referenced more than once in uneval

3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval

756265a: fix: preserve shared-reference identity for Map keys in uneval

faa8a05: fix: emit uneval reconstructions before the statements that reference them

06129ad: fix: do not grow sparse arrays by one slot in uneval

v5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Minor Changes

c5115b0: feat: add stringifyAsync for async serialization

v5.7.1

Patch Changes

8becc7c: fix: handle regexes consistently in uneval's value and reference formats

v5.7.0

Minor Changes

df2e284: feat: use native alternatives to encode/decode base64

... (truncated)

Changelog

Sourced from devalue's changelog.

5.9.2

Patch Changes

8b2a456: fix: reject out-of-bounds indices

5.9.1

Patch Changes

39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references

686e379: fix: emit valid JS for Node Buffer in uneval

376b65c: fix: preserve -0 in float typed arrays in uneval

5.9.0

Minor Changes

07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it

07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)

5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

48cc81f: fix: serialize DataView subviews with the correct byte offset and length

cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated

29a3382: fix: uneval now produces valid output for a repeated empty Map or Set

8c0db06: fix: serialize Temporal values referenced more than once in uneval

3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval

756265a: fix: preserve shared-reference identity for Map keys in uneval

faa8a05: fix: emit uneval reconstructions before the statements that reference them

06129ad: fix: do not grow sparse arrays by one slot in uneval

5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

c5115b0: feat: add stringifyAsync for async serialization

5.7.1

Patch Changes

8becc7c: fix: handle regexes consistently in uneval's value and reference formats

5.7.0

Minor Changes

df2e284: feat: use native alternatives to encode/decode base64

... (truncated)

Commits

a3d30d9 Version Packages (#180)
8b2a456 Merge commit from fork
3e01a6c Version Packages (#179)
686e379 fix: emit valid JS for Node Buffer in uneval (#175)
39457ce fix: uneval emits valid JS for graphs with more than 65534 repeated reference...
376b65c fix: preserve -0 in float typed arrays in uneval (#178)
e82bc08 Version Packages (#174)
07d6a38 feat: pluggable operations for parse (#173)
5b53532 feat: pluggable operations for stringify (#172)
d4e10da Version Packages (#167)
Additional commits viewable in compare view

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2
Allow import path specifiers starting with #/ (#4361)

Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

This change was contributed by @hybrist.
Automatically add the -webkit-mask prefix (#4357, #4358)

This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:
/* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}
This change was contributed by @BPJEnnova.
Additional minification of switch statements (#4176, #4359)

This release contains additional minification patterns for reducing switch statements. Here is an example:
// Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Updates vite from 7.1.5 to 7.3.6

Release notes

Sourced from vite's releases.

v7.3.6

Please refer to CHANGELOG.md for details.

v7.3.5

Please refer to CHANGELOG.md for details.

v7.3.3

Please refer to CHANGELOG.md for details.

v7.3.2

Please refer to CHANGELOG.md for details.

v7.3.1

Please refer to CHANGELOG.md for details.

v7.3.0

Please refer to CHANGELOG.md for details.

v7.2.7

Please refer to CHANGELOG.md for details.

v7.2.6

Please refer to CHANGELOG.md for details.

v7.2.5

Please refer to CHANGELOG.md for details.

Note: 7.2.5 failed to publish so it is skipped on npm

v7.2.4

Please refer to CHANGELOG.md for details.

v7.2.3

Please refer to CHANGELOG.md for details.

v7.2.2

Please refer to CHANGELOG.md for details.

v7.2.1

Please refer to CHANGELOG.md for details.

v7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0-beta.1

Please refer to CHAN...
Description has been truncated

Bumps the npm_and_yarn group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.6` | `1.19.15` | | [hono](https://github.com/honojs/hono) | `4.10.7` | `4.13.5` | | [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `2.55.0` | `2.70.3` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.54.0` | `5.57.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.15` | `4.1.11` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.18` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.12` | `0.28.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.5` | `7.3.6` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.2` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.7` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.27` | | [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.0` | `7.1.6` | | [rollup](https://github.com/rollup/rollup) | `4.50.1` | `4.63.1` | | [ws](https://github.com/websockets/ws) | `8.18.3` | `8.21.3` | Updates `@hono/node-server` from 1.19.6 to 1.19.15 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](https://github.com/honojs/node-server/commits) Updates `hono` from 4.10.7 to 4.13.5 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.10.7...v4.13.5) Updates `@sveltejs/kit` from 2.55.0 to 2.70.3 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/version-3/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.70.3/packages/kit) Updates `svelte` from 5.54.0 to 5.57.0 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.0/packages/svelte) Updates `vitest` from 4.0.15 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `brace-expansion` from 1.1.12 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `devalue` from 5.6.4 to 5.9.2 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.6.4...v5.9.2) Updates `esbuild` from 0.25.12 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.25.12...v0.28.2) Updates `vite` from 7.1.5 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite) Updates `flatted` from 3.3.3 to 3.4.4 - [Commits](WebReflection/flatted@v3.3.3...v3.4.4) Updates `js-yaml` from 4.1.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.3.2) Updates `picomatch` from 4.0.3 to 4.0.7 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.7) Updates `postcss` from 8.5.6 to 8.5.27 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.27) Updates `postcss-selector-parser` from 7.1.0 to 7.1.6 - [Release notes](https://github.com/postcss/postcss-selector-parser/releases) - [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md) - [Commits](postcss/postcss-selector-parser@v7.1.0...7.1.6) Updates `rollup` from 4.50.1 to 4.63.1 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.50.1...v4.63.1) Updates `vite` from 7.1.5 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite) Updates `ws` from 8.18.3 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.3...8.21.3) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 1.19.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@sveltejs/kit" dependency-version: 2.70.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: svelte dependency-version: 5.57.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.9.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.27 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss-selector-parser dependency-version: 7.1.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.63.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-03T16:56:57Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 3, 2026

ryanatkn closed this Sep 3, 2026

Navigation Menu

Uh oh!

Uh oh!

Bump the npm_and_yarn group across 1 directory with 16 updates - #28

Bump the npm_and_yarn group across 1 directory with 16 updates#28
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-49fef3b838

dependabot Bot commented on behalf of github Sep 3, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 3, 2026

v1.19.14

What's Changed

v1.19.13

Security Fix

v1.19.12

What's Changed

v1.19.11

What's Changed

v1.19.10

Security Fix

v1.19.9

What's Changed

v1.19.8

What's Changed

New Contributors

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v4.13.3

What's Changed

@​sveltejs/kit@​2.70.3

Patch Changes

@​sveltejs/kit@​2.70.2

Patch Changes

@​sveltejs/kit@​2.70.1

Patch Changes

@​sveltejs/kit@​2.70.0

Minor Changes

Patch Changes

@​sveltejs/kit@​2.69.3

Patch Changes

@​sveltejs/kit@​2.69.2

Patch Changes

@​sveltejs/kit@​2.69.1

Patch Changes

@​sveltejs/kit@​2.69.0

Minor Changes

2.70.3

Patch Changes

2.70.2

Patch Changes

2.70.1

Patch Changes

2.70.0

Minor Changes

Patch Changes

2.69.3

Patch Changes

2.69.2

Patch Changes

svelte@5.57.0

Minor Changes

Patch Changes

5.57.0

Minor Changes

Patch Changes

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v4.1.10

🐞 Bug Fixes

View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

🐞 Bug Fixes

View changes on GitHub

v4.1.7

🐞 Bug Fixes

View changes on GitHub

v1.1.15

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

`@sveltejs/kit@2`.70.3

`@sveltejs/kit@2`.70.2

`@sveltejs/kit@2`.70.1

`@sveltejs/kit@2`.70.0

`@sveltejs/kit@2`.69.3

`@sveltejs/kit@2`.69.2

`@sveltejs/kit@2`.69.1

`@sveltejs/kit@2`.69.0