build(deps): bump the npm_and_yarn group across 3 directories with 21 updates by dependabot[bot] · Pull Request #6 · ConductionNL/openbuild

dependabot · 2026-07-23T15:26:41Z

Bumps the npm_and_yarn group with 15 updates in the / directory:

Package	From	To
@babel/core	`7.29.0`	`7.29.6`
@cyclonedx/cyclonedx-npm	`4.2.1`	`5.0.0`
vite	`5.4.21`	`6.4.3`
vitest	`1.6.1`	`4.1.10`
postcss	`7.0.39`	`8.5.14`
axios	`1.16.0`	`1.18.1`
body-parser	`1.20.5`	`1.20.6`
fast-uri	`3.1.2`	`3.1.4`
immutable	`5.1.5`	`5.1.9`
js-cookie	`3.0.5`	`3.0.8`
shell-quote	`1.8.4`	`1.10.0`
tar	`7.5.15`	`7.5.21`
webpack-dev-server	`5.2.4`	`5.2.6`
websocket-driver	`0.7.4`	`0.7.5`
ws	`8.20.1`	`8.21.1`

Bumps the npm_and_yarn group with 1 update in the /lib/Resources/template directory: @cyclonedx/cyclonedx-npm.
Bumps the npm_and_yarn group with 12 updates in the /docs directory:

Package	From	To
dompurify	`3.3.1`	`3.4.12`
postcss	`8.5.6`	`8.5.22`
body-parser	`1.20.4`	`1.20.6`
fast-uri	`3.1.0`	`3.1.4`
qs	`6.14.2`	`6.15.3`
shell-quote	`1.8.3`	`1.10.0`
webpack-dev-server	`5.2.3`	`5.2.6`
websocket-driver	`0.7.4`	`0.7.5`
ws	`7.5.10`	`7.5.13`
@babel/plugin-transform-modules-systemjs	`7.29.0`	`7.29.7`
mermaid	`11.12.3`	`11.16.0`
svgo	`3.3.2`	`3.3.4`

Updates @babel/core from 7.29.0 to 7.29.6

Release notes

Sourced from @babel/core's releases.

v7.29.6 (2026-05-25)

🐛 Bug Fix

babel-generator

#18014 Catchup source map position in preserveFormat (@nicolo-ribaudo)

babel-core

#18001 [7.x packport]Improve input source map handling (@JLHwung)

babel-core, babel-generator

#17998 Preserve original identifier names from input sourcemaps (#17992) (@Andarist)

Committers: 3

Huáng Jùnliàng (@JLHwung)

Mateusz Burzyński (@Andarist)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.29.5 (2026-05-05)

🏠 Internal

babel-preset-env

Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

babel-plugin-transform-modules-systemjs

#17974 [7.x backport]fix(systemjs): improve module string name support (@JLHwung)

Committers: 1

Huáng Jùnliàng (@JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

babel-parser

#17923 Support flow extends bound (@JLHwung)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#17931 fix(decorators): replace super within all removed static elements (@JLHwung)

babel-register

#17915 Fix thread synchronization issues in @babel/register (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

#17788 Add bugfix plugin for Safari array rest destructuring bug (@JLHwung)

💅 Polish

babel-parser

#17782 Improve trailing comma comment handling (@JLHwung)

📝 Documentation

#17847 Replace npmjs.com links with npmx.dev (@nicolo-ribaudo)

... (truncated)

Commits

04ea6b2 v7.29.6
99f498a [7.x packport]Improve input source map handling (#18001)
feba0a3 Preserve original identifier names from input sourcemaps (#17992) (#17998)
See full diff in compare view

Updates @cyclonedx/cyclonedx-npm from 4.2.1 to 5.0.0

Release notes

Sourced from @cyclonedx/cyclonedx-npm's releases.

5.0.0

[!IMPORTANT]
This release includes a fix for a known security vulnerability.

BREAKING Changes

Reworked npm handling – npm is now executed explicitly rather than through a subshell.
The behavior when npm_execpath is present remains unchanged.

Fixed

Eliminated a potential shell‑injection vulnerability in the --workspace argument (via #1476)
See GHSA-v75r-vx73-82pj

#1476: CycloneDX/cyclonedx-node-npm#1476

What's Changed

chore(deps-dev): bump jest from 30.2.0 to 30.3.0 in the jest group across 1 directory by @dependabot[bot] in CycloneDX/cyclonedx-node-npm#1430

chore(ci): fix dogfooding tests by @jkowalleck in CycloneDX/cyclonedx-node-npm#1443

Pin GitHub Actions to immutable SHAs while preserving tag-based update flow by @Copilot in CycloneDX/cyclonedx-node-npm#1442

chore(ci): node26 by @jkowalleck in CycloneDX/cyclonedx-node-npm#1461

fix: eliminate possible shell-injection in --workspace argument by @jkowalleck in CycloneDX/cyclonedx-node-npm#1476

New Contributors

@Copilot made their first contribution in CycloneDX/cyclonedx-node-npm#1442

Full Changelog: CycloneDX/cyclonedx-node-npm@v4.2.1...v5.0.0

Changelog

Sourced from @cyclonedx/cyclonedx-npm's changelog.

5.0.0 - 2026-06-16

BREAKING Changes

Reworked npm handling - npm is now executed explicitly rather than through a subshell.
The behavior when npm_execpath is present remains unchanged.

Fixed

Eliminated a potential shell‑injection vulnerability in the --workspace argument (via #1476)
See GHSA-v75r-vx73-82pj

Tests

Added regression test for shell injections (via #1476)

#1476: CycloneDX/cyclonedx-node-npm#1476

Commits

756bde1 5.0.0
ec6794c chore: prep v5.0.0
affffbd chore: prep v5.0.0
f5307ff chore: prep v5.0.0
9f64625 fix: eliminate possible shell-injection in --workspace argument (#1476)
79704d5 docs
2b92576 chore: fix dev-setup on windows
a8c35f3 chore: fixdev-setup on windows
d443352 chore(ci): node26 (#1461)
41b8204 Update CONTRIBUTING.md
Additional commits viewable in compare view

Updates vite from 5.4.21 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

6.3.4 (2025-04-30)

fix: check static serve file inside sirv (#19965) (c22c43d), closes #19965

fix(optimizer): return plain object when using require to import externals in optimized dependenci (efc5eab), closes #19940

... (truncated)

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
Additional commits viewable in compare view

Updates vitest from 1.6.1 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in vitest-dev/vitest#10138 (31882)

Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in vitest-dev/vitest#10196 (2847d)

browser: Simplify orchestrator otel carrier - by @hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

Stringify diff objects only once - by @sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

... (truncated)

Commits

db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
a8fd24c chore: release v4.1.6
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates postcss from 7.0.39 to 8.5.14

Release notes

Sourced from postcss's releases.

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

8.5.2

Fixed end position of rules with semicolon (by @romainmenke).

8.5.1

Fixed backwards compatibility for complex cases (by @romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

Fixed package.json→exports compatibility with some tools (by @JounQin).

8.5.4

Fixed Parcel compatibility issue (by @git-sumitchaudhary).

8.5.3

Added more details to Unknown word error (by @hiepxanh).

Fixed types (by @romainmenke).

Fixed docs (by @catnipan).

... (truncated)

Commits

3ec1394 Release 8.5.14 version
f2bb827 Update dependencies
d75953d Merge pull request #2084 from 43081j/raw-raws-rawing
68bd213 fix: always call raw to retrieve raw values
af58cf1 Release 8.5.13 version
f227dbd Temporary ignore pnpm 11 config
d3abd40 Update dependencies
dd06c3e Revert stringifier changes because of the conflict with postcss-scss
ae889c8 Try to fix CI
e0093e4 Move to pnpm 11
Additional commits viewable in compare view

Updates axios from 1.16.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)

Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)

Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)

AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@webdevelopersrinu (#10913)

@sijie-Z (#10993)

@bartlomieju (#11023)

@JSap0914 (#11019)

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

... (truncated)

Commits

a209bfb chore(release): prepare release 1.18.1 (#11027)
fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
cf1306a docs: add Deno to install instructions (#11023)
b32880a fix: incorrect use of error (#11021)
1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
30499d6 fix: various runtime crashes and type definition mismatches (#10959)
20ce9c4 fix(http): defer env proxy handling to Node (#10942)
e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
Additional commits viewable in compare view

Updates body-parser from 1.20.5 to 1.20.6

Release notes

Sourced from body-parser's releases.

1.20.6

Important: Security

Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

fix: improve limit option validation by @Phillip9587 in expressjs/body-parser#741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

Changelog

Sourced from body-parser's changelog.

1.20.6 / 2026-07-09

Security fix for GHSA-v422-hmwv-36x6

fix: improve limit option validation (#698)

Invalid limit values (e.g. unparseable strings or NaN) now throw instead of being silently ignored, which previously disabled size limit enforcement

null and undefined fall back to the default 100kb limit

Commits

5cc4fb8 1.20.6 (#746)
3492672 fix: improve limit option validation (#741)
See full diff in compare view

Updates esbuild from 0.21.5 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

208f539 publish 0.25.12 to npm

… updates Bumps the npm_and_yarn group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.0` | `7.29.6` | | [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm) | `4.2.1` | `5.0.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `6.4.3` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `1.6.1` | `4.1.10` | | [postcss](https://github.com/postcss/postcss) | `7.0.39` | `8.5.14` | | [axios](https://github.com/axios/axios) | `1.16.0` | `1.18.1` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.5` | `1.20.6` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.4` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.1.5` | `5.1.9` | | [js-cookie](https://github.com/js-cookie/js-cookie) | `3.0.5` | `3.0.8` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.4` | `1.10.0` | | [tar](https://github.com/isaacs/node-tar) | `7.5.15` | `7.5.21` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.4` | `5.2.6` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` | | [ws](https://github.com/websockets/ws) | `8.20.1` | `8.21.1` | Bumps the npm_and_yarn group with 1 update in the /lib/Resources/template directory: [@cyclonedx/cyclonedx-npm](https://github.com/CycloneDX/cyclonedx-node-npm). Bumps the npm_and_yarn group with 12 updates in the /docs directory: | Package | From | To | | --- | --- | --- | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.12` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.22` | | [body-parser](https://github.com/expressjs/body-parser) | `1.20.4` | `1.20.6` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.0` | `3.1.4` | | [qs](https://github.com/ljharb/qs) | `6.14.2` | `6.15.3` | | [shell-quote](https://github.com/ljharb/shell-quote) | `1.8.3` | `1.10.0` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.3` | `5.2.6` | | [websocket-driver](https://github.com/faye/websocket-driver-node) | `0.7.4` | `0.7.5` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `7.5.13` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.29.0` | `7.29.7` | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.12.3` | `11.16.0` | | [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.4` | Updates `@babel/core` from 7.29.0 to 7.29.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) Updates `@cyclonedx/cyclonedx-npm` from 4.2.1 to 5.0.0 - [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases) - [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md) - [Commits](CycloneDX/cyclonedx-node-npm@v4.2.1...v5.0.0) Updates `vite` from 5.4.21 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `vitest` from 1.6.1 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `postcss` from 7.0.39 to 8.5.14 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@7.0.39...8.5.14) Updates `axios` from 1.16.0 to 1.18.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.0...v1.18.1) Updates `body-parser` from 1.20.5 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) Updates `esbuild` from 0.21.5 to 0.25.12 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.25.12) Updates `fast-uri` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) Updates `immutable` from 5.1.5 to 5.1.9 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9) Updates `js-cookie` from 3.0.5 to 3.0.8 - [Release notes](https://github.com/js-cookie/js-cookie/releases) - [Commits](js-cookie/js-cookie@v3.0.5...v3.0.8) Updates `shell-quote` from 1.8.4 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) Updates `tar` from 7.5.15 to 7.5.21 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.15...v7.5.21) Updates `webpack-dev-server` from 5.2.4 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.4...v5.2.6) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) Updates `ws` from 8.20.1 to 8.21.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.1) Updates `@cyclonedx/cyclonedx-npm` from 4.2.1 to 6.0.0 - [Release notes](https://github.com/CycloneDX/cyclonedx-node-npm/releases) - [Changelog](https://github.com/CycloneDX/cyclonedx-node-npm/blob/main/HISTORY.md) - [Commits](CycloneDX/cyclonedx-node-npm@v4.2.1...v5.0.0) Updates `dompurify` from 3.3.1 to 3.4.12 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.1...3.4.12) Updates `postcss` from 8.5.6 to 8.5.22 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@7.0.39...8.5.14) Updates `body-parser` from 1.20.4 to 1.20.6 - [Release notes](https://github.com/expressjs/body-parser/releases) - [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md) - [Commits](expressjs/body-parser@1.20.5...1.20.6) Updates `fast-uri` from 3.1.0 to 3.1.4 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) Updates `qs` from 6.14.2 to 6.15.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.2...v6.15.3) Updates `shell-quote` from 1.8.3 to 1.10.0 - [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md) - [Commits](ljharb/shell-quote@v1.8.4...v1.10.0) Updates `webpack-dev-server` from 5.2.3 to 5.2.6 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.4...v5.2.6) Updates `websocket-driver` from 0.7.4 to 0.7.5 - [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md) - [Commits](faye/websocket-driver-node@0.7.4...0.7.5) Updates `ws` from 7.5.10 to 7.5.13 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.1) Updates `@babel/plugin-transform-modules-systemjs` from 7.29.0 to 7.29.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-modules-systemjs) Updates `mermaid` from 11.12.3 to 11.16.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.3...mermaid@11.16.0) Updates `svgo` from 3.3.2 to 3.3.4 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v3.3.2...v3.3.4) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@cyclonedx/cyclonedx-npm" dependency-version: 5.0.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 5.1.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-cookie dependency-version: 3.0.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@cyclonedx/cyclonedx-npm" dependency-version: 6.0.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.22 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: body-parser dependency-version: 1.20.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: shell-quote dependency-version: 1.10.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: websocket-driver dependency-version: 0.7.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 7.5.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/plugin-transform-modules-systemjs" dependency-version: 7.29.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mermaid dependency-version: 11.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 3.3.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-23T20:26:14Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-07-24T07:07:34Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-07-25T13:05:39Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-07-27T19:44:07Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-07-27T22:10:37Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-07-30T14:53:13Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-01T12:55:07Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-02T08:50:51Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-02T16:29:33Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-02T20:12:59Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-03T20:54:43Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-04T09:23:48Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-04T14:00:53Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-05T13:02:15Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-05T15:43:47Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

rubenvdlinde · 2026-08-08T10:51:17Z

Triage 2026-08-08 (openbuild dedupe sweep) — the advisories are still real; this PR can no longer deliver them.

Read the diff rather than the title. This PR's package.json change is against a Vue 2 tree:

-    "@vitejs/plugin-vue2": "^2.3.4",
-    "@vue/test-utils": "^1.3.6",
-    "vue-template-compiler": "^2.7.16",
-    "vue-loader": "^15.11.1 <16.0.0",

origin/development today is Vue 3 — vue: ^3.5.13, @vitejs/plugin-vue: ^5.2.1, @vue/test-utils: ^2.4.6, @conduction/nextcloud-vue: 2.2.0-vue3.3. Measured divergence: git rev-list --left-right --count origin/development...pull/6/head = 269 / 1. The lockfiles describe two different dependency graphs, which is why GitHub reports mergeable: UNKNOWN.

Its CI is also not evidence: only exporter-e2e and lint-check ever ran on it. The Code Quality workflow — which is what builds the frontend and runs the unit suite — never executed against these versions. A dependency bump that no build exercises is not a verified bump; that shape left an image unbuildable for two months elsewhere in this fleet.

The advisories are not superseded. npm audit on origin/development's lockfile, 2026-08-08: 37 total (3 critical, 11 high, 18 moderate, 5 low); production-only 11 (1 high). Still open and named in this PR: vitest (critical), vite (high), @cyclonedx/cyclonedx-npm (high), dompurify, qs, webpack-dev-server, ws.

So this stays open, not closed as superseded, until a replacement bump exists that is (a) cut from current development and (b) proved by an actual npm run build + npm run test:unit against the new versions. Baseline for that proof, measured on development at c70f7b8d9: vitest run → 140 files / 1366 tests passed; webpack --mode production → compiled, 3 warnings, exit 0.

Blocker on the replacement, stated precisely: vitest 1 → 4 and vite 5 → 6 are major bumps under a 140-file suite, so the replacement has to demonstrate the suite still runs, not merely that npm ci resolves.

dependabot · 2026-08-08T12:55:23Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-09T20:51:39Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

rubenvdlinde · 2026-08-10T03:53:51Z

Rebasing this before it can be assessed — and flagging that it is not a routine bump.

Measured 2026-08-10:

284 commits behind development (opened 2026-07-23). Both lockfiles were generated against a tree that no longer exists, so they have to be regenerated, not merged.
No CI check has ever run on it. gh pr checks returns nothing at all — so there is no evidence in either direction about whether this bump works. A dependency bump that no build has exercised is not a verified bump.
It carries three major-version jumps, not just patches:

package	from	to
`vitest`	^1.6.1	^4.1.10
`@vitest/coverage-v8`	^1.6.1	^4.1.10
`vite`	^5.4.0	^6.4.3
`@cyclonedx/cyclonedx-npm`	^4.2.1	^6.0.0 (root) / ^5.0.0 (template)
`vue-loader` peer range	`<16.0.0`	`<18.0.0`

vitest 1 → 4 is a three-major jump under the whole frontend suite — currently 140 files / 1375 tests. That is the part that needs a real run rather than a green badge.

@dependabot rebase

Once it has rebased I will confirm on the run itself that:

Frontend Build and Frontend Tests (unit) actually executed and are not a cache hit — the changed lockfile should bust the npm cache key, and I will check the install step really resolved rather than restoring.
The unit count is still 1375, not a smaller number that happens to be green. A suite that collects fewer tests after a runner major-bump looks identical to a passing one in the summary.
npm ci did not silently drop peers — npm 11 prunes lockfile peers, so a lockfile regenerated by a different npm major can quietly change the installed tree.

rubenvdlinde · 2026-08-10T04:54:20Z

Dependabot's rebase failed ("tried to update this pull request, but something went wrong"), and the checks tell a second, worse story.

Two green checks, and no evidence at all about the bump

gh pr checks returns exactly two:

SUCCESS  lint-check
SUCCESS  exporter-e2e

The Code Quality workflow has never run on this PR. That is the workflow containing Frontend Build and Frontend Tests (unit) — the only two jobs that would actually exercise a vite/vitest major bump. So this PR currently presents as green while carrying zero signal about the thing it changes.

That is the failure mode worth naming: a dependency bump no build exercises is not a verified bump, and here it is dressed in two green ticks from jobs that never touch the frontend.

Still 284 commits behind

Re-measured after the failed rebase: git rev-list --left-right --count origin/development...pr/6 → 284 / 1. Both lockfiles were generated against a tree that no longer exists, and package.json on development has since gained check:nc-floor and check:gitignore scripts, so these lockfiles cannot simply be merged.

What this needs

@dependabot recreate

Recreating (rather than rebasing) regenerates the branch and both lockfiles from scratch against current development, which is the only way to get a lockfile that reflects the tree it will land on.

When it comes back I will confirm, on the run itself rather than the badge:

Code Quality actually ran — not just lint-check/exporter-e2e. If it does not trigger for dependabot on this repo, that is its own finding and the bump has to be verified another way.
Frontend Tests (unit) still collects 1375 tests. vitest 1 → 4 is a three-major jump; a suite that silently collects fewer tests after a runner upgrade looks identical to a passing one in the summary.
The install was a real resolve, not a cache restore. The changed lockfile should bust the npm cache key; npm 11 also prunes lockfile peers, so a lockfile regenerated under a different npm major can quietly change the installed tree.

Not merging it on two unrelated green checks.

dependabot · 2026-08-10T04:59:11Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot · 2026-08-10T13:08:49Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

rubenvdlinde · 2026-08-12T07:11:09Z

Stale, conflicting, and never exercised by a build

Three separate reasons this cannot be merged as it stands, and the third is the
one that matters:

Conflicting. Opened 2026-07-23; development has moved a long way since
(most recently fix(listeners): method_exists() cannot see OpenRegister's magic accessors — the slug resolver was dead #185, chore(security): phpcsutils 1.2.2 → 1.2.3 (CVE-2026-65954) #184 and feat(openbuild): English vocabulary across schema, code and tests #176 today).
21 updates across 3 directories, including four breaking majors —
vitest 1 → 4, @vitest/coverage-v8 1 → 4, vite 5 → 6,
@cyclonedx/cyclonedx-npm 4 → 5.
🔴 No build has ever exercised it. The only checks on this PR are
exporter-e2e and lint-check, both from run 30020571363. The Code Quality
workflow — frontend build, unit tests, E2E — has not run against this tree at
all. A dependency bump that no build exercises is not a verified bump; a green
tick from two unrelated jobs looks exactly like one that was checked.

vitest 1 → 4 in particular is not a bump, it is a migration: it crosses two
major API boundaries and this app's unit suite runs on it.

Requested a rebuild rather than closing

Commented @dependabot recreate so the PR is rebuilt against current
development, which clears the conflict and — more importantly — lets the full
workflow actually run against it. Closing it would have lost the record without
producing a verified alternative.

Even once it is green, the four majors above want splitting out of the group
and sequencing individually. A single grouped PR that turns 21 dependencies at
once gives no way to attribute a failure, and no way to land the 17 safe ones
while the 4 risky ones are worked out.

rubenvdlinde · 2026-08-12T07:11:12Z

@dependabot recreate

dependabot · 2026-08-12T08:16:29Z

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 23, 2026

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

v7.29.4 (2026-05-05)

🐛 Bug Fix

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

📝 Documentation

5.0.0

BREAKING Changes

Fixed

What's Changed

New Contributors

5.0.0 - 2026-06-16

v6.4.3

v6.4.2

v6.4.1

v6.4.0

v6.3.7

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

6.3.7 (2025-10-14)

6.3.6 (2025-09-08)

6.3.5 (2025-05-05)

6.3.4 (2025-04-30)

v4.1.10

🐞 Bug Fixes

View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

🐞 Bug Fixes

View changes on GitHub

v4.1.7

🐞 Bug Fixes

View changes on GitHub

v4.1.6

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

8.5.2

8.5.1

8.5 “Duke Alloces”

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.4

8.5.3

v1.18.1 — June 21, 2026

dependabot Bot commented on behalf of github Jul 23, 2026 •

edited

Loading