Skip to content

Comments

Bump the npm_and_yarn group across 1 directory with 11 updates#277

Closed
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-70207b2a4e
Closed

Bump the npm_and_yarn group across 1 directory with 11 updates#277
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-70207b2a4e

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 11, 2025

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
next 14.1.2 14.2.21
vite 5.2.10 5.4.12
vitest 1.5.2 1.6.1
@babel/helpers 7.23.1 7.26.10
@babel/runtime 7.23.1 7.26.10
@babel/traverse 7.23.0 7.26.10
dset 3.1.2 3.1.4
micromatch 4.0.5 4.0.8

Updates next from 14.1.2 to 14.2.21

Commits

Updates vite from 5.2.10 to 5.4.12

Release notes

Sourced from vite's releases.

v5.4.12

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v5.4.11

Please refer to CHANGELOG.md for details.

v5.4.10

Please refer to CHANGELOG.md for details.

v5.4.9

Please refer to CHANGELOG.md for details.

v5.4.8

Please refer to CHANGELOG.md for details.

v5.4.7

Please refer to CHANGELOG.md for details.

v5.4.6

Please refer to CHANGELOG.md for details.

v5.4.5

Please refer to CHANGELOG.md for details.

v5.4.4

Please refer to CHANGELOG.md for details.

v5.4.3

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.3

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.2

Please refer to CHANGELOG.md for details.

v5.4.2

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.1

Please refer to CHANGELOG.md for details.

v5.4.1

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

5.4.12 (2025-01-20)

  • fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (9da4abc)
  • fix!: default server.cors: false to disallow fetching from untrusted origins (dfea38f)
  • fix: verify token for HMR WebSocket connection (b71a5c8)
  • chore: add deps update changelog (ecd2375)

5.4.11 (2024-11-11)

  • fix(deps): update dependencies of postcss-modules (ceb15db), closes #18617

5.4.10 (2024-10-23)

  • fix: backport #18367,augment hash for CSS files to prevent chromium erroring by loading previous fil (7d1a3bc), closes #18367 #18412

5.4.9 (2024-10-14)

5.4.8 (2024-09-25)

5.4.7 (2024-09-20)

5.4.6 (2024-09-16)

... (truncated)

Commits
  • f428aa9 release: v5.4.12
  • 9da4abc fix!: check host header to prevent DNS rebinding attacks and introduce `serve...
  • b71a5c8 fix: verify token for HMR WebSocket connection
  • dfea38f fix!: default server.cors: false to disallow fetching from untrusted origins
  • ecd2375 chore: add deps update changelog
  • c54c860 release: v5.4.11
  • 5f52bc8 release: v5.4.10
  • 7d1a3bc fix: backport #18367,augment hash for CSS files to prevent chromium erroring ...
  • 898d61f release: v5.4.9
  • 508d9ab fix: bump launch-editor-middleware to v2.9.1 (#18348)
  • Additional commits viewable in compare view

Updates vitest from 1.5.2 to 1.6.1

Release notes

Sourced from vitest's releases.

v1.6.1

This release includes security patches for:

   🐞 Bug Fixes

    View changes on GitHub

v1.6.0

   🚀 Features

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v1.5.3

   🐞 Bug Fixes

... (truncated)

Commits

Updates @babel/helpers from 7.23.1 to 7.26.10

Release notes

Sourced from @​babel/helpers's releases.

v7.26.10 (2025-03-11)

Thanks @​jordan-choi and @​mmmsssttt404 for your first PRs!

This release includes a fix for GHSA-968p-4wvh-cqc8, a security vulnerability which affects the .replace method of transpiled regular expressions that use named capturing groups.

👓 Spec Compliance

🐛 Bug Fix

  • babel-parser, babel-template
  • babel-core
  • babel-parser, babel-plugin-transform-typescript
  • babel-traverse
  • babel-generator
  • babel-parser
  • babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

💅 Polish

  • babel-standalone

🏠 Internal

Committers: 6

v7.26.9 (2025-02-14)

🐛 Bug Fix

... (truncated)

Changelog

Sourced from @​babel/helpers's changelog.

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

  • babel-parser, babel-template
  • babel-core
  • babel-parser, babel-plugin-transform-typescript
  • babel-traverse
  • babel-generator
  • babel-parser
  • babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

💅 Polish

  • babel-standalone

🏠 Internal

v7.26.9 (2025-02-14)

🐛 Bug Fix

🏠 Internal

v7.26.7 (2025-01-24)

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol

... (truncated)

Commits

Updates @babel/runtime from 7.23.1 to 7.26.10

Release notes

Sourced from @​babel/runtime's releases.

v7.26.10 (2025-03-11)

Thanks @​jordan-choi and @​mmmsssttt404 for your first PRs!

This release includes a fix for GHSA-968p-4wvh-cqc8, a security vulnerability which affects the .replace method of transpiled regular expressions that use named capturing groups.

👓 Spec Compliance

🐛 Bug Fix

  • babel-parser, babel-template
  • babel-core
  • babel-parser, babel-plugin-transform-typescript
  • babel-traverse
  • babel-generator
  • babel-parser
  • babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

💅 Polish

  • babel-standalone

🏠 Internal

Committers: 6

v7.26.9 (2025-02-14)

🐛 Bug Fix

... (truncated)

Changelog

Sourced from @​babel/runtime's changelog.

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

  • babel-parser, babel-template
  • babel-core
  • babel-parser, babel-plugin-transform-typescript
  • babel-traverse
  • babel-generator
  • babel-parser
  • babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

💅 Polish

  • babel-standalone

🏠 Internal

v7.26.9 (2025-02-14)

🐛 Bug Fix

🏠 Internal

v7.26.7 (2025-01-24)

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol

... (truncated)

Commits

Updates @babel/traverse from 7.23.0 to 7.26.10

Release notes

Sourced from @​babel/traverse's releases.

v7.26.10 (2025-03-11)

Thanks @​jordan-choi and @​mmmsssttt404 for your first PRs!

This release includes a fix for GHSA-968p-4wvh-cqc8, a security vulnerability which affects the .replace method of transpiled regular expressions that use named capturing groups.

👓 Spec Compliance

🐛 Bug Fix

  • babel-parser, babel-template
  • babel-core
  • babel-parser, babel-plugin-transform-typescript
  • babel-traverse
  • babel-generator
  • babel-parser
  • babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

💅 Polish

  • babel-standalone

🏠 Internal

Committers: 6

v7.26.9 (2025-02-14)

🐛 Bug Fix

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

  • babel-parser, babel-template
  • babel-core
  • babel-parser, babel-plugin-transform-typescript
  • babel-traverse
  • babel-generator
  • babel-parser
  • babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

💅 Polish

  • babel-standalone

🏠 Internal

v7.26.9 (2025-02-14)

🐛 Bug Fix

🏠 Internal

v7.26.7 (2025-01-24)

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol

... (truncated)

Commits

Updates dset from 3.1.2 to 3.1.4

Release notes

Sourced from dset's releases.

v3.1.3

Patches

  • Add "types" export conditions for TypeScript "nodenext"/"node16" resolution: #40 Thank you @​Akkuma

Full Changelog: lukeed/dset@v3.1.2...v3.1.3

Commits

Updates esbuild from 0.20.2 to 0.21.5

Release notes

Sourced from esbuild's releases.

v0.21.5

  • Fix Symbol.metadata on classes without a class decorator (#3781)

    This release fixes a bug with esbuild's support for the decorator metadata proposal. Previously esbuild only added the Symbol.metadata property to decorated classes if there was a decorator on the class element itself. However, the proposal says that the Symbol.metadata property should be present on all classes that have any decorators at all, not just those with a decorator on the class element itself.

  • Allow unknown import attributes to be used with the copy loader (#37...

    Description has been truncated

@dependabot
Bump the npm_and_yarn group across 1 directory with 11 updates
e34e7ac 
Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `14.1.2` | `14.2.21` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.2.10` | `5.4.12` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `1.5.2` | `1.6.1` |
| [@babel/helpers](https://github.com/babel/babel/tree/HEAD/packages/babel-helpers) | `7.23.1` | `7.26.10` |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.23.1` | `7.26.10` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.23.0` | `7.26.10` |
| [dset](https://github.com/lukeed/dset) | `3.1.2` | `3.1.4` |
| [micromatch](https://github.com/micromatch/micromatch) | `4.0.5` | `4.0.8` |



Updates `next` from 14.1.2 to 14.2.21
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.1.2...v14.2.21)

Updates `vite` from 5.2.10 to 5.4.12
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.12/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.12/packages/vite)

Updates `vitest` from 1.5.2 to 1.6.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v1.6.1/packages/vitest)

Updates `@babel/helpers` from 7.23.1 to 7.26.10
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.26.10/packages/babel-helpers)

Updates `@babel/runtime` from 7.23.1 to 7.26.10
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.26.10/packages/babel-runtime)

Updates `@babel/traverse` from 7.23.0 to 7.26.10
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.26.10/packages/babel-traverse)

Updates `dset` from 3.1.2 to 3.1.4
- [Release notes](https://github.com/lukeed/dset/releases)
- [Commits](lukeed/dset@v3.1.2...v3.1.4)

Updates `esbuild` from 0.20.2 to 0.21.5
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.20.2...v0.21.5)

Updates `micromatch` from 4.0.5 to 4.0.8
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/micromatch@4.0.5...4.0.8)

Updates `nanoid` from 3.3.7 to 3.3.9
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.7...3.3.9)

Updates `rollup` from 4.16.4 to 4.35.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.16.4...v4.35.0)

---
updated-dependencies:
- dependency-name: next
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@babel/helpers"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/runtime"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dset
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: micromatch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from a team March 11, 2025 23:14
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 11, 2025
@dependabot dependabot bot requested a review from witoszekdev March 11, 2025 23:14
This was referenced Mar 11, 2025
Closed
Closed
@dependabot dependabot bot requested a review from andrzejewsky March 11, 2025 23:14
@dependabot dependabot bot mentioned this pull request Mar 11, 2025
Closed
@dependabot dependabot bot requested a review from kzuraw March 11, 2025 23:14
@dependabot dependabot bot mentioned this pull request Mar 11, 2025
Closed
@dependabot dependabot bot requested a review from lkostrowski March 11, 2025 23:14
@dependabot dependabot bot mentioned this pull request Mar 11, 2025
Closed
@dependabot dependabot bot requested a review from Cloud11PL March 11, 2025 23:15
This was referenced Mar 11, 2025
Closed
Closed
@github-actions
Copy link

github-actions bot commented Mar 11, 2025

Differences Found

⚠️ 4 packages or licenses were added.

Expand 
License	Package
Apache-2.0	@swc/counter
MIT	@rollup/rollup-freebsd-arm64
MIT	@rollup/rollup-freebsd-x64
MIT	@rollup/rollup-linux-loongarch64-gnu

Summary

Expand
License Name Package Count Packages
0BSD 1
Packages
  • tslib
MPL-2.0 1
Packages
  • axe-core
Public Domain 1
Packages
  • jsonify
Python-2.0 1
Packages
  • argparse
CC-BY-4.0 2
Packages
  • @saleor/macaw-ui
  • caniuse-lite
CC0-1.0 2
Packages
  • language-subtag-registry
  • type-fest
<<missing>> 3
Packages
  • busboy
  • saleor-app-template
  • streamsearch
BSD-3-Clause 12
Packages
  • @humanwhocodes/object-schema
  • @saleor/eslint-plugin-saleor-app
  • abab
  • asn1js
  • esquery
  • ieee754
  • immutable
  • signedsource
  • source-map
  • source-map-js
  • sprintf-js
  • tough-cookie
BSD-2-Clause 15
Packages
  • @typescript-eslint/parser
  • @typescript-eslint/typescript-estree
  • css-what
  • damerau-levenshtein
  • dotenv
  • entities
  • escodegen
  • eslint-scope
  • espree
  • esprima
  • esrecurse
  • estraverse
  • esutils
  • uri-js
  • webidl-conversions
Apache-2.0 22
Packages
  • @ampproject/remapping
  • @humanwhocodes/config-array
  • @humanwhocodes/module-importer
  • @opentelemetry/api
  • @opentelemetry/semantic-conventions
  • @swc/counter
  • @swc/helpers
  • aria-query
  • axobject-query
  • bser
  • detect-libc
  • doctrine
  • eslint-visitor-keys
  • fb-watchman
  • human-signals
  • json-to-pretty-yaml
  • remedial
  • retes
  • rxjs
  • typescript
  • And 2 more...
ISC 38
Packages
  • @saleor/app-sdk
  • ast-types-flow
  • cli-width
  • cliui
  • electron-to-chromium
  • eslint-import-resolver-typescript
  • fastq
  • flatted
  • fs.realpath
  • get-caller-file
  • glob
  • glob-parent
  • graceful-fs
  • inflight
  • inherits
  • isexe
  • lru-cache
  • minimatch
  • mute-stream
  • once
  • And 18 more...
MIT 745
Packages
  • @0no-co/graphql.web
  • @aashutoshrathi/word-wrap
  • @ardatan/relay-compiler
  • @ardatan/sync-fetch
  • @babel/code-frame
  • @babel/compat-data
  • @babel/core
  • @babel/generator
  • @babel/helper-annotate-as-pure
  • @babel/helper-compilation-targets
  • @babel/helper-create-class-features-plugin
  • @babel/helper-environment-visitor
  • @babel/helper-function-name
  • @babel/helper-member-expression-to-functions
  • @babel/helper-module-imports
  • @babel/helper-module-transforms
  • @babel/helper-optimise-call-expression
  • @babel/helper-plugin-utils
  • @babel/helper-replace-supers
  • @babel/helper-simple-access
  • And 725 more...

@witoszekdev witoszekdev closed this Dec 3, 2025
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 3, 2025

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-70207b2a4e branch December 3, 2025 12:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@witoszekdev witoszekdev Awaiting requested review from witoszekdev

@andrzejewsky andrzejewsky Awaiting requested review from andrzejewsky

@kzuraw kzuraw Awaiting requested review from kzuraw

@lkostrowski lkostrowski Awaiting requested review from lkostrowski

@Cloud11PL Cloud11PL Awaiting requested review from Cloud11PL

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@witoszekdev