Bump the npm_and_yarn group across 1 directory with 5 updates #1

dependabot · 2025-11-15T18:21:35Z

Bumps the npm_and_yarn group with 3 updates in the / directory: vite, form-data and js-yaml.

Updates vite from 4.5.2 to 7.2.2

Release notes

v7.2.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.2.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0-beta.1

Please refer to CHANGELOG.md for details.

v7.2.0-beta.0

Please refer to CHANGELOG.md for details.

v7.1.12

Please refer to CHANGELOG.md for details.

v7.1.11

Please refer to CHANGELOG.md for details.

v7.1.10

Please refer to CHANGELOG.md for details.

v7.1.9

Please refer to CHANGELOG.md for details.

v7.1.8

Please refer to CHANGELOG.md for details.

v7.1.7

Please refer to CHANGELOG.md for details.

v7.1.6

Please refer to CHANGELOG.md for details.

v7.1.5

Please refer to CHANGELOG.md for details.

v7.1.4

Please refer to CHANGELOG.md for details.

v7.1.3

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.2.2 (2025-11-07)

Bug Fixes

revert "refactor: use fs.cpSync (#21019)" (#21081) (728c8ee)

7.2.1 (2025-11-06)

Bug Fixes

worker: some worker asset was missing (#21074) (82d2d6c)

Code Refactoring

build: rename indexOfMatchInSlice to findPreloadMarker (#21054) (f83264f)

7.2.0 (2025-11-05)

Bug Fixes

css: fallback to sass when sass-embedded platform binary is missing (#21002) (b1fd616)

module-runner: make getBuiltins response JSON serializable (#21029) (ad5b3bf)

types: add undefined to optional properties for exactOptionalProperties type compatibility (#21040) (2833c55)

Miscellaneous Chores

deps: update rolldown-related dependencies (#21047) (e3a6a83)

7.2.0-beta.1 (2025-10-29)

Bug Fixes

increase stream reset rate limit for HTTP2 (#21024) (4f44f22)

optimizer: externalize virtual modules for html like files (#21001) (e5af352)

Documentation

clarify the values are escaped automatically (#21017) (246df13)

Code Refactoring

use fs.cpSync (#21019) (a2df778)

7.2.0-beta.0 (2025-10-28)

Features

add import.meta.resolve support for ESM config (bundle config loader) (#20962) (f86789a)

add perEnvironmentWatchChangeDuringDev (#20996) (a5e98e6)

add vite client connect events (#20978) (543d87c)

build: emit license (#18546) (b42c3fb)

dev: support HTTP2 even if proxy feature is used (#20869) (fc21af7)

lib: enable minification but keep pure annotations for es output with terser (#20522) (df997d0)

optimizer: add rush lockfile support (#20833) (718ca2d)

utils: support multiple certificates in resolveServerUrls (#20707) (24513e5)

... (truncated)

Commits

572aaca release: v7.2.2
728c8ee fix: revert "refactor: use fs.cpSync (#21019)" (#21081)
a532e68 release: v7.2.1
82d2d6c fix(worker): some worker asset was missing (#21074)
f83264f refactor(build): rename indexOfMatchInSlice to findPreloadMarker (#21054)
8293de0 release: v7.2.0
2833c55 fix(types): add undefined to optional properties for exactOptionalProperties ...
e3a6a83 chore(deps): update rolldown-related dependencies (#21047)
b1fd616 fix(css): fallback to sass when sass-embedded platform binary is missing (#21...
ad5b3bf fix(module-runner): make getBuiltins response JSON serializable (#21029)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vite since your current version.

Updates esbuild from 0.18.20 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

208f539 publish 0.25.12 to npm
5f03afd update release notes
6b2ee78 minify: remove css rules containing empty :is()
f361deb add some additional known static methods
07aa646 automatically mark "RegExp.escape()" calls as pure
9039c46 simplify some call expression checks
188944d add some additional known static methods
d3c67f9 fix #4310: add Iterator and other known globals
4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
26b29ed fix #4315: @media deduplication bug edge case
Additional commits viewable in compare view

Updates form-data from 4.0.0 to 4.0.4

Release notes

Sourced from form-data's releases.

v4.0.4

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2

v4.0.2 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available [#396](https://github.com/form-data/form-data/issues/396)

Commits

... (truncated)

Changelog

Sourced from form-data's changelog.

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available [#396](https://github.com/form-data/form-data/issues/396)

Commits

Merge tags v2.5.3 and v3.0.3 92613b9

[Tests] migrate from travis to GHA 806eda7

[Tests] migrate from travis to GHA 8fdb3bc

... (truncated)

Commits

41996f5 v4.0.4
316c82b [meta] actually ensure the readme backup isn’t published
2300ca1 [meta] fix readme capitalization
811f682 [meta] add auto-changelog
5e34080 [Tests] fix linting errors
1d11a76 [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
58c25d7 [Dev Deps] update @ljharb/eslint-config
3d17230 [Fix] Switch to using crypto random for boundary values
d8d67dc v4.0.3
e6e83cc [meta] remove local commit hooks
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
See full diff in compare view

Updates rollup from 3.28.1 to 4.53.2

Release notes

Sourced from rollup's releases.

v4.53.2

4.53.2

2025-11-10

Bug Fixes

Do not throw when using invalid escape sequences in template literals (#6177)

Pull Requests

#6177: handle TemplateElement with null cooked value (@TrickyPi)

v4.53.1

4.53.1

2025-11-07

Bug Fixes

Fix install script (#6172)

Pull Requests

#6172: fix: move patch-package from postinstall to prepare script (@mshima)

v4.53.0

4.53.0

2025-11-07

Features

Improve rendering performance by caching generated variable names (#5947)

Pull Requests

#5947: refactor: store safe variable names in cache for subsequent usage (@Aslemammad, @lukastaegert, @Service account user)

#6149: chore(deps): update dependency vite to v7.1.11 [security] (@renovate[bot], @Service account user)

#6151: fix(deps): update swc monorepo (major) (@renovate[bot], @Service account user)

#6152: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @Service account user)

#6153: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @Service account user)

#6155: Fix tests: Do not swallow warnings for multi-format tests (@lukastaegert, @Service account user)

#6159: chore(deps): update dependency eslint-plugin-unicorn to v62 (@renovate[bot])

#6160: chore(deps): update github artifact actions (major) (@renovate[bot])

#6161: fix(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

#6164: chore(deps): update dependency @rollup/plugin-alias to v6 (@renovate[bot])

#6165: chore(deps): update dependency @rollup/plugin-commonjs to v29 (@renovate[bot])

#6166: fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)

#6167: chore(deps): lock file maintenance minor/patch updates (@renovate[bot], @lukastaegert)

... (truncated)

Changelog

Sourced from rollup's changelog.

rollup changelog

3.29.4

2023-09-28

Bug Fixes

Fix static analysis when an exported function uses callbacks (#5158)

Pull Requests

#5158: Deoptimize all parameters when losing track of a function ( @lukastaegert)

3.29.3

2023-09-24

Bug Fixes

Fix a bug where code was wrongly tree-shaken after mutating function parameters (#5153)

Pull Requests

#5145: docs: improve the docs repl appearance in the light mode ( @TrickyPi)

#5148: chore(deps): update dependency @vue/eslint-config-typescript to v12 (@renovate[bot])

#5149: chore(deps): lock file maintenance minor/patch updates ( @renovate[bot])

#5153: Fully deoptimize first level path when deoptimizing nested parameter paths (@lukastaegert)

3.29.2

2023-09-15

Bug Fixes

Export TreeshakingPreset type (#5131)

Pull Requests

#5131: fix: exports TreeshakingPreset (@moltar)

#5134: docs: steps to enable symlinks on windows (@thebanjomatic)

#5137: chore(deps): lock file maintenance minor/patch updates ( @renovate[bot])

3.29.1

2023-09-10

Bug Fixes

Fix time measurement of plugin hooks in watch mode (#5114)

... (truncated)

Commits

d8b0150 4.53.2
4f43f03 handle TemplateElement with null cooked value (#6177)
e3bdcdf 4.53.1
96b5453 fix: move patch-package from postinstall to prepare script (#6172)
ecff532 4.53.0
05a6c01 refactor: store safe variable names in cache for subsequent usage (#5947)
5cf4264 fix(deps): update swc monorepo (major) (#6166)
75c4346 chore(deps): lock file maintenance minor/patch updates (#6167)
1ba7efe chore(deps): update dependency @rollup/plugin-alias to v6 (#6164)
e64d220 chore(deps): update dependency @rollup/plugin-commonjs to v29 (#6165)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for rollup since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 3 updates in the / directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [form-data](https://github.com/form-data/form-data) and [js-yaml](https://github.com/nodeca/js-yaml). Updates `vite` from 4.5.2 to 7.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.2.2/packages/vite) Updates `esbuild` from 0.18.20 to 0.25.12 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.18.20...v0.25.12) Updates `form-data` from 4.0.0 to 4.0.4 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.0...v4.0.4) Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `rollup` from 3.28.1 to 4.53.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-3.md) - [Commits](rollup/rollup@v3.28.1...v4.53.2) --- updated-dependencies: - dependency-name: vite dependency-version: 7.2.2 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.53.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 15, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 5 updates #1

Bump the npm_and_yarn group across 1 directory with 5 updates #1

Uh oh!

dependabot bot commented on behalf of github Nov 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the npm_and_yarn group across 1 directory with 5 updates #1

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 5 updates #1

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 15, 2025

v7.2.2

[email protected]

v7.2.1

[email protected]

v7.2.0

v7.2.0-beta.1

v7.2.0-beta.0

v7.1.12

v7.1.11

v7.1.10

v7.1.9

v7.1.8

v7.1.7

v7.1.6

v7.1.5

v7.1.4

v7.1.3

7.2.2 (2025-11-07)

Bug Fixes

7.2.1 (2025-11-06)

Bug Fixes

Code Refactoring

7.2.0 (2025-11-05)

Bug Fixes

Miscellaneous Chores

7.2.0-beta.1 (2025-10-29)

Bug Fixes

Documentation

Code Refactoring

7.2.0-beta.0 (2025-10-28)

Features

v0.25.12

Changelog: 2023

0.19.11

v4.0.4

v4.0.4 - 2025-07-16

Commits

v4.0.3

v4.0.3 - 2025-06-05

Fixed

Commits

v4.0.2

v4.0.2 - 2025-02-14

Merged

Fixed

Commits

v4.0.4 - 2025-07-16

Commits

v4.0.3 - 2025-06-05

Fixed

Commits

v4.0.2 - 2025-02-14

Merged

Fixed

Commits

[4.1.1] - 2025-11-12

Security

v4.53.2

4.53.2

Bug Fixes

Pull Requests

v4.53.1

4.53.1

Bug Fixes

Pull Requests

v4.53.0

4.53.0

Features

Pull Requests

rollup changelog

3.29.4

Bug Fixes

Pull Requests

3.29.3