Bump the npm_and_yarn group across 1 directory with 15 updates by dependabot[bot] · Pull Request #26 · fuzdev/zzz

dependabot · 2026-08-20T08:15:15Z

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package	From	To
@hono/node-server	`1.19.6`	`1.19.15`
hono	`4.10.7`	`4.13.3`
@sveltejs/kit	`2.55.0`	`2.70.3`
svelte	`5.54.0`	`5.56.9`
vitest	`4.0.15`	`4.1.11`
brace-expansion	`1.1.12`	`1.1.18`
esbuild	`0.25.12`	`0.28.2`
vite	`7.1.5`	`7.3.6`
flatted	`3.3.3`	`3.4.4`
js-yaml	`4.1.0`	`4.3.1`
picomatch	`4.0.3`	`4.0.5`
postcss	`8.5.6`	`8.5.26`
rollup	`4.50.1`	`4.62.4`
ws	`8.18.3`	`8.21.3`

Updates @hono/node-server from 1.19.6 to 1.19.15

Release notes

Sourced from @hono/node-server's releases.

v1.19.14

What's Changed

fix: add custom inspect to lightweight Request/Response to prevent TypeError on console.log by @usualoma in honojs/node-server#340

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

chore: ignore claude setting by @yusukebe in honojs/node-server#314

fix: request draining for early 413 responses by @usualoma in honojs/node-server#329

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

fix: do not overwrite Content-Length in the fast path pattern if Content-Length already exists. by @usualoma in honojs/node-server#309

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

v1.19.9

What's Changed

fix(globals): Stop overwriting global.fetch by @usualoma in honojs/node-server#295

Full Changelog: honojs/node-server@v1.19.8...v1.19.9

v1.19.8

What's Changed

docs: add guide for listening to UNIX domain socket by @TransparentLC in honojs/node-server#292

fix(serve-static): Use Readable.toWeb in serveStatic by @otya128 in honojs/node-server#293

New Contributors

@TransparentLC made their first contribution in honojs/node-server#292

... (truncated)

Commits

See full diff in compare view

Updates hono from 4.10.7 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252

fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250

fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247

feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197

fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204

fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199

fix(client): serialize multiple cookies correctly in honojs/hono#5202

fix(etag): stabilize digest across stream chunks in honojs/hono#5205

fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209

perf(cors): pre-join static array header options during initialization in honojs/hono#5210

fix(client): send falsy JSON bodies in honojs/hono#5215

feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

fix(trie-router): count every slash a pattern consumes by @Jaybhade in honojs/hono#5189

fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in honojs/hono#4988

fix(etag): skip unsafe methods or error responses on non-* case by @na-trium-144 in honojs/hono#5196

New Contributors

@Jaybhade made their first contribution in honojs/hono#5189

@Sriharsha-dev369 made their first contribution in honojs/hono#4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

... (truncated)

Commits

0293343 4.13.3
5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
7195c24 fix(etag): copy pending stream bytes (#5239)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates @sveltejs/kit from 2.55.0 to 2.70.3

Release notes

Sourced from @sveltejs/kit's releases.

@sveltejs/kit@2.70.3

Patch Changes

fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

@sveltejs/kit@2.70.2

Patch Changes

fix: prevent quadratic backtracking in Accept header content negotiation (#1)

@sveltejs/kit@2.70.1

Patch Changes

docs: update links to hooks documentation (#16417)

@sveltejs/kit@2.70.0

Minor Changes

feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

@sveltejs/kit@2.69.3

Patch Changes

fix: detect destructured load and actions exports during type generation (#16329)

fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

@sveltejs/kit@2.69.2

Patch Changes

fix: set define values on globalThis when running Vitest (#16246)

@sveltejs/kit@2.69.1

Patch Changes

fix: prevent prototype pollution when deleting file inputs (#16218)

fix: prevent unhandled promise rejection (#16219)

@sveltejs/kit@2.69.0

Minor Changes

... (truncated)

Changelog

Sourced from @sveltejs/kit's changelog.

2.70.3

Patch Changes

fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

2.70.2

Patch Changes

fix: prevent quadratic backtracking in Accept header content negotiation (82712fc)

2.70.1

Patch Changes

docs: update links to hooks documentation (#16417)

2.70.0

Minor Changes

feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

2.69.3

Patch Changes

fix: detect destructured load and actions exports during type generation (#16329)

fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

2.69.2

Patch Changes

fix: set define values on globalThis when running Vitest (#16246)

2.69.1

Patch Changes

fix: prevent prototype pollution when deleting file inputs (#16218)

... (truncated)

Commits

39e8e1f Version Packages (#16771)
b61018d fix: avoid eagerly reading $app/state dependencies during module
1ad0d43 chore: get Vercel split platform tests running (#16666)
a297aff Version Packages (#16571)
82712fc Merge commit from fork
4c2355f Version Packages (#16418)
c1665b9 docs: update hooks page (#16417)
4da36e6 Version Packages (#16343)
78f28f1 feat: move defineEnvVars to @sveltejs/kit/env (#16378)
ffa0e3b fix: don't disable CSRF protection in builds with a non-production NODE_ENV (...
Additional commits viewable in compare view

Updates svelte from 5.54.0 to 5.56.9

Release notes

Sourced from svelte's releases.

svelte@5.56.9

Patch Changes

fix: skip controlled each fast path while another batch is pending (#18625)

fix: better whitespace handling inside printer (#18638)

fix: don't duplicate comments in attributes (#18636)

fix: preserve CSS comments in the AST printer (#18637)

svelte@5.56.8

Patch Changes

fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

fix: preserve select selection when spread attributes omit value (#18561)

svelte@5.56.7

Patch Changes

chore: provide indent option for print (#18474)

svelte@5.56.6

Patch Changes

perf: skip unnecessary blocker analysis when compiling components without top-level await (#18548)

fix: rerun derived that had an abort controller on reconnection (#18551)

svelte@5.56.5

Patch Changes

chore: drop dead code that make TSGO fail (#18496)

fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

fix: skip unnecessary derived effect in earlier batch (#18525)

fix: avoid declaration tag warning in event handlers (#18500)

fix: abort deriveds own AbortSignal when it disconnects (#18400)

fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

fix: correctly transform declaration tags during SSR (#18492)

fix: transform computed keys in keyed {#each} destructuring patterns (#18521)

fix: chain preprocessor sourcemaps with an empty sources[0] instead of dropping them (#18518)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.9

Patch Changes

fix: skip controlled each fast path while another batch is pending (#18625)

fix: better whitespace handling inside printer (#18638)

fix: don't duplicate comments in attributes (#18636)

fix: preserve CSS comments in the AST printer (#18637)

5.56.8

Patch Changes

fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

fix: preserve select selection when spread attributes omit value (#18561)

5.56.7

Patch Changes

chore: provide indent option for print (#18474)

5.56.6

Patch Changes

perf: skip unnecessary blocker analysis when compiling components without top-level await (#18548)

fix: rerun derived that had an abort controller on reconnection (#18551)

5.56.5

Patch Changes

chore: drop dead code that make TSGO fail (#18496)

fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

fix: skip unnecessary derived effect in earlier batch (#18525)

fix: avoid declaration tag warning in event handlers (#18500)

fix: abort deriveds own AbortSignal when it disconnects (#18400)

fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

... (truncated)

Commits

20b341f Version Packages (#18628)
ee6dff8 fix: better whitespace handling inside printer (#18638)
a1d5035 fix: preserve CSS comments in the AST printer (#18637)
3ed9db4 fix: don't duplicate comments in attributes (#18636)
26786e9 fix: skip controlled each fast path while another batch is pending (#18625)
44a7813 Version Packages (#18572)
3dde011 fix: call onerror and provide a working reset when hydrating a failed bou...
2bace30 fix: preserve select selection with spread attributes (#18561)
b29d700 Version Packages (#18560)
b791cac chore: provide indent option for print (#18474)
Additional commits viewable in compare view

Updates vitest from 4.0.15 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

... (truncated)

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
447763a 1.1.16
d74e630 fix: v1 backport for CVE-2026-13149 (#122)
2203f4f 1.1.15
0b09384 Backport v5.0.6 change to v1 (#111)
10c05fc 1.1.14
Additional commits viewable in compare view

Updates devalue from 5.6.4 to 5.9.0

Release notes

Sourced from devalue's releases.

v5.9.0

Minor Changes

07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it

07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)

5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

48cc81f: fix: serialize DataView subviews with the correct byte offset and length

cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated

29a3382: fix: uneval now produces valid output for a repeated empty Map or Set

8c0db06: fix: serialize Temporal values referenced more than once in uneval

3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval

756265a: fix: preserve shared-reference identity for Map keys in uneval

faa8a05: fix: emit uneval reconstructions before the statements that reference them

06129ad: fix: do not grow sparse arrays by one slot in uneval

v5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Minor Changes

c5115b0: feat: add stringifyAsync for async serialization

v5.7.1

Patch Changes

8becc7c: fix: handle regexes consistently in uneval's value and reference formats

v5.7.0

Minor Changes

df2e284: feat: use native alternatives to encode/decode base64

498656e: feat: add DataView support

a210130: feat: whitelist Float16Array

df2e284: feat: simplify TypedArray slices

Patch Changes

5590634: fix: get uneval type handling up to parity with stringify

57f73fc: fix: correctly support boxed bigints and sentinel values

Changelog

Sourced from devalue's changelog.

5.9.0

Minor Changes

07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it

07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)

5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

48cc81f: fix: serialize DataView subviews with the correct byte offset and length

cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated

29a3382: fix: uneval now produces valid output for a repeated empty Map or Set

8c0db06: fix: serialize Temporal values referenced more than once in uneval

3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval

756265a: fix: preserve shared-reference identity for Map keys in uneval

faa8a05: fix: emit uneval reconstructions before the statements that reference them

06129ad: fix: do not grow sparse arrays by one slot in uneval

5.8.1

Patch Changes

206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

c5115b0: feat: add stringifyAsync for async serialization

5.7.1

Patch Changes

8becc7c: fix: handle regexes consistently in uneval's value and reference formats

5.7.0

Minor Changes

df2e284: feat: use native alternatives to encode/decode base64

498656e: feat: add DataView support

a210130: feat: whitelist Float16Array

df2e284: feat: simplify TypedArray slices

Patch Changes

5590634: fix: get uneval type handling up to parity with stringify

57f73fc: fix: correctly support boxed bigints and sentinel values

Commits

e82bc08 Version Packages (#174)
07d6a38 feat: pluggable operations for parse (#173)
5b53532 feat: pluggable operations for stringify (#172)
d4e10da Version Packages (#167)
faa8a05 fix: uneval loses a repeated typed array/DataView referenced inside a cycle (...
3770846 fix: emit valid JS for BigInt64Array and BigUint64Array in uneval (#171)
b9ed985 chore(ci): set permissions on ci workflow (#157)
cd6da94 fix: resolve circular references through custom revivers (#154)
06129ad fix: uneval grows sparse arrays by one slot when first hole is past index 0 (...
756265a fix: preserve shared-reference identity for Map keys in uneval (#164)
Additional commits viewable in compare view

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x
 bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2
Allow import path specifiers starting with #/ (#4361)

Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

This change was contributed by @hybrist.
Automatically add the -webkit-mask prefix (#4357, #4358)

This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:
/* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}
This change was contributed by @BPJEnnova.
Additional minification of switch statements (#4176, #4359)

This release contains additional minification patterns for reducing switch statements. Here is an example:
// Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Updates vite from 7.1.5 to 7.3.6

Release notes

Sourced from vite's releases.

v7.3.6

Please refer to CHANGELOG.md for details.

v7.3.5

Please refer to CHANGELOG.md for details.

v7.3.3

Please refer to CHANGELOG.md for details.

v7.3.2

Please refer to CHANGELOG.md for details.

v7.3.1

Please refer to CHANGELOG.md for details.

v7.3.0

Please refer to CHANGELOG.md for details.

v7.2.7

Please refer to CHANGELOG.md for details.

v7.2.6

Please refer to CHANGELOG.md for details.

v7.2.5

Please refer to CHANGELOG.md for details.

Note: 7.2.5 failed to publish so it is skipped on npm

v7.2.4

Please refer to CHANGELOG.md for details.

v7.2.3

Please refer to CHANGELOG.md for details.

v7.2.2

Please refer to CHANGELOG.md for details.

v7.2.1

Please refer to CHANGELOG.md for details.

v7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0-beta.1

Please refer to CHANGELOG.md for details.

v7.2.0-beta.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.3.6 (2026-06-25)

Features

allow esbuild 0.28 (#22743) (a24931e)

7.3.5 (2026-06-01)

Bug Fixes

backport #22572, reject windows alternate paths (#22574) (8c18556)

deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

Miscellaneous Chores

skip v7.3.4 release (8a6a0c9)

7.3.4 (2026-06-01)

Bug Fixes

backport #22572, reject windows alternate paths (#22574) (

Bumps the npm_and_yarn group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.6` | `1.19.15` | | [hono](https://github.com/honojs/hono) | `4.10.7` | `4.13.3` | | [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `2.55.0` | `2.70.3` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.54.0` | `5.56.9` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.15` | `4.1.11` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.18` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.12` | `0.28.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.5` | `7.3.6` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.1` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.5` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.26` | | [rollup](https://github.com/rollup/rollup) | `4.50.1` | `4.62.4` | | [ws](https://github.com/websockets/ws) | `8.18.3` | `8.21.3` | Updates `@hono/node-server` from 1.19.6 to 1.19.15 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](https://github.com/honojs/node-server/commits) Updates `hono` from 4.10.7 to 4.13.3 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.10.7...v4.13.3) Updates `@sveltejs/kit` from 2.55.0 to 2.70.3 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/@sveltejs/kit@2.70.3/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.70.3/packages/kit) Updates `svelte` from 5.54.0 to 5.56.9 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.9/packages/svelte) Updates `vitest` from 4.0.15 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) Updates `brace-expansion` from 1.1.12 to 1.1.18 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.18) Updates `devalue` from 5.6.4 to 5.9.0 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v5.6.4...v5.9.0) Updates `esbuild` from 0.25.12 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.25.12...v0.28.2) Updates `vite` from 7.1.5 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite) Updates `flatted` from 3.3.3 to 3.4.4 - [Commits](WebReflection/flatted@v3.3.3...v3.4.4) Updates `js-yaml` from 4.1.0 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.3.1) Updates `picomatch` from 4.0.3 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.5) Updates `postcss` from 8.5.6 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.26) Updates `rollup` from 4.50.1 to 4.62.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.50.1...v4.62.4) Updates `vite` from 7.1.5 to 7.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.6/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.6/packages/vite) Updates `ws` from 8.18.3 to 8.21.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.18.3...8.21.3) --- updated-dependencies: - dependency-name: "@hono/node-server" dependency-version: 1.19.15 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@sveltejs/kit" dependency-version: 2.70.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: svelte dependency-version: 5.56.9 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.9.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.62.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-20T11:49:06Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 20, 2026

ryanatkn closed this Aug 20, 2026

Navigation Menu

Uh oh!

Uh oh!

Bump the npm_and_yarn group across 1 directory with 15 updates - #26

Bump the npm_and_yarn group across 1 directory with 15 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f0103df39e

dependabot Bot commented on behalf of github Aug 20, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 20, 2026

v1.19.14

What's Changed

v1.19.13

Security Fix

v1.19.12

What's Changed

v1.19.11

What's Changed

v1.19.10

Security Fix

v1.19.9

What's Changed

v1.19.8

What's Changed

New Contributors

v4.13.3

What's Changed

v4.13.2

What's Changed

v4.13.1

What's Changed

New Contributors

v4.13.0

Performance improvements

@​sveltejs/kit@​2.70.3

Patch Changes

@​sveltejs/kit@​2.70.2

Patch Changes

@​sveltejs/kit@​2.70.1

Patch Changes

@​sveltejs/kit@​2.70.0

Minor Changes

Patch Changes

@​sveltejs/kit@​2.69.3

Patch Changes

@​sveltejs/kit@​2.69.2

Patch Changes

@​sveltejs/kit@​2.69.1

Patch Changes

@​sveltejs/kit@​2.69.0

Minor Changes

2.70.3

Patch Changes

2.70.2

Patch Changes

2.70.1

Patch Changes

2.70.0

Minor Changes

Patch Changes

2.69.3

Patch Changes

2.69.2

Patch Changes

2.69.1

Patch Changes

svelte@5.56.9

Patch Changes

svelte@5.56.8

Patch Changes

svelte@5.56.7

Patch Changes

svelte@5.56.6

Patch Changes

svelte@5.56.5

Patch Changes

5.56.9

Patch Changes

5.56.8

Patch Changes

5.56.7

Patch Changes

5.56.6

Patch Changes

5.56.5

Patch Changes

`@sveltejs/kit@2`.70.3

`@sveltejs/kit@2`.70.2

`@sveltejs/kit@2`.70.1

`@sveltejs/kit@2`.70.0

`@sveltejs/kit@2`.69.3

`@sveltejs/kit@2`.69.2

`@sveltejs/kit@2`.69.1

`@sveltejs/kit@2`.69.0