chore(deps): bump esbuild and vite in /web by dependabot[bot] · Pull Request #1 · GoogleCloudPlatform/scion

dependabot · 2026-03-10T02:26:31Z

Bumps esbuild to 0.27.3 and updates ancestor dependency vite. These dependencies need to be updated together.

Updates esbuild from 0.21.5 to 0.27.3

Release notes

v0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

9129e00 publish 0.27.3 to npm
e20e411 small fix to release notes
0dc0f2d fix #4322: parse and print CSS @scope rules
55fe391 update firefox css gradient support
2c35297 update gradient lowering transform
9209e44 Update Go to 1.25.7 (#4388)
e8d861b close #4374: compat table for the using feature
19b8887 no longer need williamkapke/node-compat-table
7e44218 the kangax/compat-table repo moved to a new url
23b9338 run make update-compat-table
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Updates vite from 5.4.21 to 7.3.1

Release notes

Sourced from vite's releases.

v7.3.1

Please refer to CHANGELOG.md for details.

v7.3.0

Please refer to CHANGELOG.md for details.

v7.2.7

Please refer to CHANGELOG.md for details.

v7.2.6

Please refer to CHANGELOG.md for details.

v7.2.5

Please refer to CHANGELOG.md for details.

Note: 7.2.5 failed to publish so it is skipped on npm

v7.2.4

Please refer to CHANGELOG.md for details.

v7.2.3

Please refer to CHANGELOG.md for details.

v7.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@7.2.1

Please refer to CHANGELOG.md for details.

v7.2.1

Please refer to CHANGELOG.md for details.

plugin-legacy@7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0-beta.1

Please refer to CHANGELOG.md for details.

v7.2.0-beta.0

Please refer to CHANGELOG.md for details.

v7.1.12

Please refer to CHANGELOG.md for details.

v7.1.11

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.3.1 (2026-01-07)

Features

add ignoreOutdatedRequests option to optimizeDeps (#21364) (9d39d37)

7.3.0 (2025-12-15)

Features

deps: update esbuild from ^0.25.0 to ^0.27.0 (#21183) (cff26ec)

7.2.7 (2025-12-08)

Bug Fixes

plugin shortcut support (#21211) (721f163)

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

config: handle shebang properly (#21158) (df5a30d)

deps: update all non-major dependencies (#21146) (a3cd262)

deps: update all non-major dependencies (#21175) (72e398a)

fix external: true merging (#21164) (5ef557a)

shortcuts not rebound after server restart (#21166) (3765f7b)

Performance Improvements

deps: replace debug with obug (#21137) (203a551)

Documentation

clarify manifest.json imports field is JS chunks only (#21136) (46d3077)

Miscellaneous Chores

deps: update rolldown-related dependencies (#21174) (74559c9)

7.2.4 (2025-11-20)

Bug Fixes

revert "perf(deps): replace debug with obug (#21107)" (2d66b7b)

7.2.3 (2025-11-20)

Bug Fixes

allow multiple bindCLIShortcuts calls with shortcut merging (#21103) (5909efd)

deps: update all non-major dependencies (#21096) (6a34ac3)

deps: update all non-major dependencies (#21128) (4f8171e)

Performance Improvements

... (truncated)

Commits

95e8923 release: v7.3.1
9d39d37 feat: add ignoreOutdatedRequests option to optimizeDeps (#21364)
acf7e05 release: v7.3.0
cff26ec feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (#21183)
317b3b2 release: v7.2.7
721f163 fix: plugin shortcut support (#21211)
bda5dbb release: v7.2.6
3aa7527 release: v7.2.5
72e398a fix(deps): update all non-major dependencies (#21175)
3765f7b fix: shortcuts not rebound after server restart (#21166)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [esbuild](https://github.com/evanw/esbuild) to 0.27.3 and updates ancestor dependency [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). These dependencies need to be updated together. Updates `esbuild` from 0.21.5 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.27.3) Updates `vite` from 5.4.21 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.1/packages/vite) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: indirect - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

Agent-to-Agent Orchestration (#1): - Add hub_access_scopes field to ScionConfig (api/types.go) allowing templates to declare JWT scopes for agent-to-agent operations - Architect template pre-configured with grove:agent:create, grove:agent:lifecycle, grove:agent:notify scopes - Scopes flow through token generation, enabling lead-agent patterns Live Activity Feed (GoogleCloudPlatform#3): - New SSE endpoint: GET /api/v1/activity-feed?grove_id=<id> - Streams all agent events (status, created, deleted, broker) in a grove - Enriches raw events into ActivityFeedItem with typed fields - 15-second heartbeat keepalive - Backend for "mission control" multi-agent monitoring view Cost Dashboard API (GoogleCloudPlatform#5): - New endpoint: GET /api/v1/groves/{groveId}/cost-summary - Returns CostSummary with total cost, tokens, and breakdowns - ByModel: aggregated cost per model (claude-opus, gemini-flash, etc.) - ByAgent: per-agent cost with turns and token counts - Designed to consume harness-native cost data from sciontool Webhook Integration (GoogleCloudPlatform#9): - New WebhookDispatcher with HMAC-SHA256 signed payloads - Configurable webhook endpoints with event pattern filtering - Exponential backoff retry (3 attempts: 1s, 2s, 4s) - Delivery success/failure metrics - Supports Slack, Discord, and generic webhook endpoints - X-Scion-Signature header for verification https://claude.ai/code/session_01TDLLMgpR2ZbfyPzgYqnJ1k

Complete rewrite of the quickstart command into a 7-step interactive wizard that handles the entire setup flow: Step 1 — Prerequisites: - Checks git and container runtime with version display - macOS-aware (checks for Apple container runtime first) Step 2 — Machine Init: - Auto-creates ~/.scion with templates and harness configs - Skips if already initialized Step 3 — Container Images (the #1 friction point): - Interactive menu with 4 options: - Use existing registry (just enter the path) - Build locally now (runs build-images.sh automatically) - Build via GitHub Actions (shows step-by-step instructions) - Skip for now (with clear remediation command) - Auto-configures image_registry after successful build Step 4 — API Credentials: - Detects existing keys with masked display (sk-a...xyz1) - Interactive provider selection (Anthropic/Google/OpenAI/Vertex) - Secure input via golang.org/x/term.ReadPassword (hidden typing) - Direct link to each provider's API key page - Offers to persist to shell RC file (.zshrc/.bashrc/.config/fish) - Shows Vertex AI setup commands for GCP users Step 5 — Project Grove: - Auto-detects if already initialized - One-key confirmation to init in current directory Step 6 — Shell Completions: - Auto-detects shell (zsh/bash/fish) - Auto-installs completions to correct directory - Falls back to manual instructions Step 7 — Summary: - Shows status dashboard (images/creds/grove) with remediation hints - Ready-to-paste first agent command if everything is configured DX improvements over previous version: - Clear screen + banner for immersive experience - Consistent check/cross/warning symbols for status - Masked API key display for security - Direct links to key provisioning pages - Shell RC persistence for API keys (no more copy-paste exports) - Image build integrated into the flow (not a separate step) - Status summary shows exactly what's missing and how to fix it https://claude.ai/code/session_01TDLLMgpR2ZbfyPzgYqnJ1k

… command Progress During scion start (#1 DX pain): - Add ProgressFunc callback to StartOptions (api/types.go) - Wire 5 progress steps through agent Start flow: "Preparing workspace..." → "Resolving credentials..." → "Checking container image..." → "Pulling image..." → "Starting container..." - CLI displays each step as it happens (cmd/common.go) - Add "Waiting for agent to initialize..." before tmux polling - Eliminates the 10-30 second silence that made users think CLI was hung - JSON output mode suppresses progress (clean machine output) Delete Confirmation (GoogleCloudPlatform#2 DX pain): - Add confirmation prompt before local agent deletion: "Delete 2 agent(s) (including git branches): agent-a, agent-b" "Are you sure? [y/N]" - Default is NO (safe by default) - --force / -f flag skips confirmation for scripts - JSON output mode skips confirmation (scripting compatibility) - Shows branch warning when --preserve-branch is NOT set Actionable Error Messages: - tmux timeout error now includes troubleshooting steps: "Check container logs: scion logs <name>" "Verify image exists: docker images | grep scion" "Check Docker is running: docker info" scion status Command: - New `scion status` — single health dashboard like `git status` - Shows: container runtime (version), image registry, credentials - Shows: current grove context with path - Shows: running agents with color-coded status indicators - Shows: contextual hints when things are missing - Green checkmarks for healthy, red crosses with fix commands for broken https://claude.ai/code/session_01TDLLMgpR2ZbfyPzgYqnJ1k

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 10, 2026

ptone merged commit 40b1b7b into main Mar 10, 2026
1 check passed

dependabot bot deleted the dependabot/npm_and_yarn/web/multi-2150d4f566 branch March 10, 2026 16:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump esbuild and vite in /web#1

chore(deps): bump esbuild and vite in /web#1
ptone merged 1 commit intomainfrom
dependabot/npm_and_yarn/web/multi-2150d4f566

dependabot bot commented on behalf of github Mar 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Mar 10, 2026

v0.27.3

Changelog: 2024

0.24.2

0.24.1

v7.3.1

v7.3.0

v7.2.7

v7.2.6

v7.2.5

v7.2.4

v7.2.3

v7.2.2

plugin-legacy@7.2.1

v7.2.1

plugin-legacy@7.2.0

v7.2.0

v7.2.0-beta.1

v7.2.0-beta.0

v7.1.12

v7.1.11

7.3.1 (2026-01-07)

Features

7.3.0 (2025-12-15)

Features

7.2.7 (2025-12-08)

Bug Fixes

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

7.2.4 (2025-11-20)

Bug Fixes

7.2.3 (2025-11-20)

Bug Fixes

Performance Improvements

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant