chore(deps): bump the toolchain group across 1 directory with 4 updates #469

dependabot · 2025-05-28T05:51:10Z

Bumps the toolchain group with 4 updates in the / directory: esbuild, vitest, @vitejs/plugin-react and vite.

Updates esbuild from 0.25.3 to 0.25.5

Release notes

v0.25.5
Fix a regression with browser in package.json (#4187)

The fix to #4144 in version 0.25.3 introduced a regression that caused browser overrides specified in package.json to fail to override relative path names that end in a trailing slash. That behavior change affected the [email protected] package. This regression has been fixed, and now has test coverage.
Add support for certain keywords as TypeScript tuple labels (#4192)

Previously esbuild could incorrectly fail to parse certain keywords as TypeScript tuple labels that are parsed by the official TypeScript compiler if they were followed by a ? modifier. These labels included function, import, infer, new, readonly, and typeof. With this release, these keywords will now be parsed correctly. Here's an example of some affected code:
type Foo = [
  value: any,
  readonly?: boolean, // This is now parsed correctly
]
Add CSS prefixes for the stretch sizing value (#4184)

This release adds support for prefixing CSS declarations such as div { width: stretch }. That CSS is now transformed into this depending on what the --target= setting includes:
div {
  width: -webkit-fill-available;
  width: -moz-available;
  width: stretch;
}
v0.25.4
Add simple support for CORS to esbuild's development server (#4125)

Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

Some examples:
CLI:
esbuild --servedir=. --cors-origin=https://example.com
JS:
const ctx = await esbuild.context({})
await ctx.serve({
  servedir: '.',
  cors: {

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.25.5
Fix a regression with browser in package.json (#4187)

The fix to #4144 in version 0.25.3 introduced a regression that caused browser overrides specified in package.json to fail to override relative path names that end in a trailing slash. That behavior change affected the [email protected] package. This regression has been fixed, and now has test coverage.
Add support for certain keywords as TypeScript tuple labels (#4192)

Previously esbuild could incorrectly fail to parse certain keywords as TypeScript tuple labels that are parsed by the official TypeScript compiler if they were followed by a ? modifier. These labels included function, import, infer, new, readonly, and typeof. With this release, these keywords will now be parsed correctly. Here's an example of some affected code:
type Foo = [
  value: any,
  readonly?: boolean, // This is now parsed correctly
]
Add CSS prefixes for the stretch sizing value (#4184)

This release adds support for prefixing CSS declarations such as div { width: stretch }. That CSS is now transformed into this depending on what the --target= setting includes:
div {
  width: -webkit-fill-available;
  width: -moz-available;
  width: stretch;
}
0.25.4
Add simple support for CORS to esbuild's development server (#4125)

Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

Some examples:
CLI:
esbuild --servedir=. --cors-origin=https://example.com
JS:
const ctx = await esbuild.context({})
await ctx.serve({

... (truncated)

Commits

ea453bf publish 0.25.5 to npm
223ddc6 fix #4187: browser package.json regression
b2c8251 fix #4192: typescript tuple label parser edge case
28cf2f3 fix #4184: css prefixes for stretch
bee1b09 fix comment indents
9ddfe5f run make update-compat-table
c339f34 fix a misplaced comment
218d29e publish 0.25.4 to npm
e66cd0b dev server: simple support for CORS requests (#4171)
8bf3368 js api: validate some options as arrays of strings
Additional commits viewable in compare view

Updates vitest from 3.1.2 to 3.1.4

Release notes

Sourced from vitest's releases.

v3.1.4

   🐞 Bug Fixes

Apply browser CLI options only if the project has the browser set in the config already - by @sheremet-va in vitest-dev/vitest#8002 (64f2b)

    View changes on GitHub

v3.1.3

   🐞 Bug Fixes

Correctly resolve vitest import if inline: true is set - by @sheremet-va in vitest-dev/vitest#7856 (a83f3)

Fix fixture parsing with lowered async with esbuild 0.25.3 - by @hi-ogawa in vitest-dev/vitest#7921 (c5c85)

Remove event-catcher code - by @sheremet-va in vitest-dev/vitest#7898 (deb1b)

Reset mocks on test retry/repeat - by @sheremet-va in vitest-dev/vitest#7897 (2fa76)

Ignore failures on writeToCache - by @orgads in vitest-dev/vitest#7893 (8c7f7)

browser: Correctly inherit CLI options - by @sheremet-va in vitest-dev/vitest#7858 (03660)

deps: Update all non-major dependencies - in vitest-dev/vitest#7867 (67ef7)

reporters: --merge-reports to show each total run times - by @AriPerkkio in vitest-dev/vitest#7877 (d613b)

    View changes on GitHub

Commits

ac88181 chore: release v3.1.4
64f2b43 fix: apply browser CLI options only if the project has the browser set in the...
6e8d937 chore: release v3.1.3
8c7f75a fix: ignore failures on writeToCache (#7893)
d613b81 fix(reporters): --merge-reports to show each total run times (#7877)
2fa763a fix: reset mocks on test retry/repeat (#7897)
573cb16 ci: fix flaky browser tests (#7887)
03660f9 fix(browser): correctly inherit CLI options (#7858)
a83f3bf fix: correctly resolve vitest import if inline: true is set (#7856)
See full diff in compare view

Updates @vitejs/plugin-react from 4.4.1 to 4.5.0

Release notes

Sourced from @vitejs/plugin-react's releases.

[email protected]

Add filter for rolldown-vite #470

Added filter so that it is more performant when running this plugin with rolldown-powered version of Vite.

Skip HMR for JSX files with hooks #480

This removes the HMR warning for hooks with JSX.

Changelog

Sourced from @vitejs/plugin-react's changelog.

4.5.0 (2025-05-23)

Add filter for rolldown-vite #470

Added filter so that it is more performant when running this plugin with rolldown-powered version of Vite.

Skip HMR for JSX files with hooks #480

This removes the HMR warning for hooks with JSX.

Commits

476e705 release: [email protected]
02b1ede fix(hmr): skip HMR for JSX files with hooks (#480)
5a94bd7 feat: add filter (#470)
7517103 fix(react): inject __self and __source by babel for rolldown-vite (#467)
ec1dfb3 chore: fix link in changelog (#463)
See full diff in compare view

Updates vite from 6.3.4 to 6.3.5

Release notes

Sourced from vite's releases.

v6.3.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.3.5 (2025-05-05)

fix(ssr): handle uninitialized export access as undefined (#19959) (fd38d07), closes #19959

Commits

84e4647 release: v6.3.5
fd38d07 fix(ssr): handle uninitialized export access as undefined (#19959)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the toolchain group with 4 updates in the / directory: [esbuild](https://github.com/evanw/esbuild), [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `esbuild` from 0.25.3 to 0.25.5 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.25.3...v0.25.5) Updates `vitest` from 3.1.2 to 3.1.4 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.1.4/packages/vitest) Updates `@vitejs/plugin-react` from 4.4.1 to 4.5.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/[email protected]/packages/plugin-react) Updates `vite` from 6.3.4 to 6.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.3.5/packages/vite) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.25.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: toolchain - dependency-name: vitest dependency-version: 3.1.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: toolchain - dependency-name: "@vitejs/plugin-react" dependency-version: 4.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: toolchain - dependency-name: vite dependency-version: 6.3.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: toolchain ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 28, 2025

dependabot bot requested a review from a team as a code owner May 28, 2025 05:51

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 28, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the toolchain group across 1 directory with 4 updates #469

chore(deps): bump the toolchain group across 1 directory with 4 updates #469

dependabot bot commented on behalf of github May 28, 2025 •

edited

Loading

Uh oh!

Uh oh!

chore(deps): bump the toolchain group across 1 directory with 4 updates #469

Are you sure you want to change the base?

chore(deps): bump the toolchain group across 1 directory with 4 updates #469

Conversation

dependabot bot commented on behalf of github May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.25.5

v0.25.4

0.25.5

0.25.4

v3.1.4

🐞 Bug Fixes

View changes on GitHub

v3.1.3

🐞 Bug Fixes

View changes on GitHub

[email protected]

Add filter for rolldown-vite #470

Skip HMR for JSX files with hooks #480

4.5.0 (2025-05-23)

Add filter for rolldown-vite #470

Skip HMR for JSX files with hooks #480

v6.3.5

6.3.5 (2025-05-05)

Uh oh!

Uh oh!

dependabot bot commented on behalf of github May 28, 2025 •

edited

Loading

Add `filter` for rolldown-vite #470

Add `filter` for rolldown-vite #470