Bump the npm_and_yarn group across 1 directory with 4 updates #5

dependabot · 2024-11-18T22:02:43Z

Bumps the npm_and_yarn group with 4 updates in the / directory: next, rollup, vite and ws.

Updates next from 14.1.3 to 15.0.3

Release notes

v15.0.3

Core Changes

Read page name from work store in server module map proxy: #71669

codemod: should not transform when param is not used: #71664

[dynamicIO] complete refactor to prerender: #71687

fix: metadata image route normalize path posix for windows: #71673

next-codemod(upgrade): optional catch when missing dev script: #71598

Avoid server action function indirection in Turbopack: #71628

fix: exclude basePath in findSourceMapURL: #71719

fix: stack frame text color in dark mode: #71656

Fix: revert the bad node binary handling: #71723

next-codemod: add empty pnpm-workspace.yaml to test fixtures to bypass PNPM workspace checks: #71726

warn on sync access if dynamicIO is not enabled: #71696

Update React from 69d4b800-20241021 to 45804af1-20241021: #71718

next-upgrade: do not add --turbopack flag when --turbo exists in next dev: #71730

feat: stitch errors with react owner stack: #70393

[dynamicIO] update data access error and documentation: #71738

Test cached form action with revalidate: #71591

Upgrade React from 45804af1-20241021 to 28668d39-20241023: #71745

Fix race condition when setting client reference manifests: #71741

Fix fetch with no-store inside of use cache: #71754

Remove the bottom collapse button in dev overlay: #71658

[dynamicIO] unify cache filling and lazy-module warming: #71749

Don't filter out source location frames through RSC: #71752

fix undefined default export error msg: #71762

Upgrade React from 28668d39-20241023 to 1631855f-20241023: #71769

Enable owner stack in experimental build: #71716

feat: add experiment for sharpjs cpu flags: #71733

fix: handle server component replay error in error overlay: #71772

Don't error asking for prebuilt bundles: #71778

Replace turbopack://[project]/... sourcemap uris with file://... in development: #71489

misc: update source map paths for bundled Next.js runtime: #71779

[dynamicIO] refine error message and docs: #71781

next-upgrade: change --turbo to --turbopack if applicable: #71737

Show all diff when uncollapse: #71792

Sourcemap errors in terminal by default : #71444

Fully enable custom error callbacks for app router: #71794

Simplify Server Action Webpack plugin: #71721

ensure DIO development segment errors are cleared after correcting: #71811

Include sourceframe in errors logged in the terminal during development: #71803

[dynamicIO] update prerender cache scoping and cache warming for validation: #71822

only force stack frame color in tty: #71860

Add test for fetch with auth in use cache: #71768

Fix race with hot-reloader-client clearing overlay errors: #71771

Fix dynamic tracking in dev: #71867

Revert "Sourcemap errors in terminal by default (#71444)": #71868

Fix fetch caching inside of "use cache": #71793

Trace upload: only send traces for current session: #71838

Reland "Sourcemap errors in terminal by default": #71877

... (truncated)

Commits

7dc7be2 v15.0.3
74b4d2d v15.0.3-canary.9
be40adb Add missing closing \</AppOnly> (#72453)
224447c Getting Started Docs: Improve "Project Structure" page (#72399)
5f0adad chore(turbopack): Update dashmap from 5.x to 6.x (#72433)
f668af2 [ppr] Fixed deployment tests (#72428)
856521b docs(parallel-routes): update 11-parallel-routes.mdx example for modal closin...
9d31638 docs(route-handlers): add TS/JS switcher to Route Resolution section in `...
200fdc1 [Turbopack] remove unneeded type annotation (#72390)
74a19b7 docs: unify the header deps by removing # (#72391)
Additional commits viewable in compare view

Updates rollup from 4.12.1 to 4.27.3

Release notes

Sourced from rollup's releases.

v4.27.3

4.27.3

2024-11-18

Bug Fixes

Revert object property tree-shaking for now (#5736)

Pull Requests

#5736: Revert object tree-shaking until some issues have been resolved (@lukastaegert)

v4.27.2

4.27.2

2024-11-15

Bug Fixes

Ensure unused variables in patterns are always deconflicted if rendered (#5728)

Pull Requests

#5728: Fix more variable deconflicting issues (@lukastaegert)

v4.27.1

4.27.1

2024-11-15

Bug Fixes

Fix some situations where parameter declarations could put Rollup into an infinite loop (#5727)

Pull Requests

#5727: Debug out-of-memory issues with Rollup v4.27.0 (@lukastaegert)

v4.27.0

4.27.0

2024-11-15

Features

Tree-shake unused properties in object literals (#5420)

Bug Fixes

... (truncated)

Changelog

Sourced from rollup's changelog.

4.27.3

2024-11-18

Bug Fixes

Revert object property tree-shaking for now (#5736)

Pull Requests

#5736: Revert object tree-shaking until some issues have been resolved (@lukastaegert)

4.27.2

2024-11-15

Bug Fixes

Ensure unused variables in patterns are always deconflicted if rendered (#5728)

Pull Requests

#5728: Fix more variable deconflicting issues (@lukastaegert)

4.27.1

2024-11-15

Bug Fixes

Fix some situations where parameter declarations could put Rollup into an infinite loop (#5727)

Pull Requests

#5727: Debug out-of-memory issues with Rollup v4.27.0 (@lukastaegert)

4.27.0

2024-11-15

Features

Tree-shake unused properties in object literals (#5420)

Bug Fixes

Change hash length limit to 21 to avoid inconsistent hash length (#5423)

Pull Requests

... (truncated)

Commits

7c0b1f8 4.27.3
10bc150 Revert object tree-shaking (#5420) until some issues have been resolved (#5736)
a503a4d 4.27.2
6c68455 Fix more variable deconflicting issues (#5728)
aaf38b7 4.27.1
faeb905 Debug out-of-memory issues with Rollup v4.27.0 (#5727)
c035068 4.27.0
b58e48b fix(deps): update swc monorepo (major) (#5724)
50697b8 Reduce max hash size to 21 (#5723)
a9acb57 feat: implement object tree-shaking (#5420)
Additional commits viewable in compare view

Updates vite from 5.1.5 to 5.4.11

Release notes

Sourced from vite's releases.

v5.4.11

Please refer to CHANGELOG.md for details.

v5.4.10

Please refer to CHANGELOG.md for details.

v5.4.9

Please refer to CHANGELOG.md for details.

v5.4.8

Please refer to CHANGELOG.md for details.

v5.4.7

Please refer to CHANGELOG.md for details.

v5.4.6

Please refer to CHANGELOG.md for details.

v5.4.5

Please refer to CHANGELOG.md for details.

v5.4.4

Please refer to CHANGELOG.md for details.

v5.4.3

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.3

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.2

Please refer to CHANGELOG.md for details.

v5.4.2

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.1

Please refer to CHANGELOG.md for details.

v5.4.1

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.0

Please refer to CHANGELOG.md for details.

create-vite@5.4.0

Please refer to CHANGELOG.md for details.

v5.4.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

5.4.11 (2024-11-11)

5.4.10 (2024-10-23)

fix: backport #18367,augment hash for CSS files to prevent chromium erroring by loading previous fil (7d1a3bc), closes #18367 #18412

5.4.9 (2024-10-14)

fix: bump launch-editor-middleware to v2.9.1 (#18348) (508d9ab), closes #18348

fix(css): fix lightningcss dep url resolution with custom root (#18125) (eae00b5), closes #18125

fix(data-uri): only match ids starting with data: (#18241) (96084d6), closes #18241

fix(deps): bump tsconfck (#18322) (dc5434c), closes #18322

fix(hmr): don't try to rewrite imports for direct CSS soft invalidation (#18252) (851b258), closes #18252

fix(ssr): (backport #18150) fix source map remapping with multiple sources (#18204) (262a879), closes #18204

chore: update all url references of vitejs.dev to vite.dev (#18276) (c23558a), closes #18276

chore: update license copyright (#18278) (1864eb1), closes #18278

docs: update homepage (#18274) (ae44163), closes #18274

5.4.8 (2024-09-25)

fix(css): backport #18113, fix missing source file warning with sass modern api custom importer (#18 (7d47fc1), closes #18183

fix(css): backport #18128, ensure sass compiler initialized only once (#18184) (8464d97), closes #18128 #18184

5.4.7 (2024-09-20)

fix: treat config file as ESM in Deno (#18158) (b5908a2), closes #18158

5.4.6 (2024-09-16)

fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115) (179b177), closes #18115

fix: fs raw query (#18112) (6820bb3), closes #18112

5.4.5 (2024-09-13)

fix(preload): backport #18098, throw error preloading module as well (#18099) (faa2405), closes #18098 #18099

... (truncated)

Commits

c54c860 release: v5.4.11
5f52bc8 release: v5.4.10
7d1a3bc fix: backport #18367,augment hash for CSS files to prevent chromium erroring ...
898d61f release: v5.4.9
508d9ab fix: bump launch-editor-middleware to v2.9.1 (#18348)
dc5434c fix(deps): bump tsconfck (#18322)
851b258 fix(hmr): don't try to rewrite imports for direct CSS soft invalidation (#18252)
96084d6 fix(data-uri): only match ids starting with data: (#18241)
eae00b5 fix(css): fix lightningcss dep url resolution with custom root (#18125)
c23558a chore: update all url references of vitejs.dev to vite.dev (#18276)
Additional commits viewable in compare view

Updates ws from 8.16.0 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits

976c53c [dist] 8.18.0
59b9629 [feature] Add support for Blob (#2229)
0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
15f11a0 [security] Add new DoS vulnerability to SECURITY.md
3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the npm_and_yarn group with 4 updates in the / directory: [next](https://github.com/vercel/next.js), [rollup](https://github.com/rollup/rollup), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [ws](https://github.com/websockets/ws). Updates `next` from 14.1.3 to 15.0.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.1.3...v15.0.3) Updates `rollup` from 4.12.1 to 4.27.3 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.12.1...v4.27.3) Updates `vite` from 5.1.5 to 5.4.11 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.11/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.11/packages/vite) Updates `ws` from 8.16.0 to 8.18.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.16.0...8.18.0) --- updated-dependencies: - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: rollup dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label Nov 18, 2024

dependabot bot mentioned this pull request Nov 18, 2024

Bump the npm_and_yarn group across 1 directory with 2 updates #4

Closed

brynary merged commit dbce13e into main Apr 13, 2025

dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-8da703ea4b branch April 13, 2025 15:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 4 updates #5

Bump the npm_and_yarn group across 1 directory with 4 updates #5

Uh oh!

dependabot bot commented on behalf of github Nov 18, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump the npm_and_yarn group across 1 directory with 4 updates #5

Bump the npm_and_yarn group across 1 directory with 4 updates #5

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v15.0.3

Core Changes

v4.27.3

4.27.3

Bug Fixes

Pull Requests

v4.27.2

4.27.2

Bug Fixes

Pull Requests

v4.27.1

4.27.1

Bug Fixes

Pull Requests

v4.27.0

4.27.0

Features

Bug Fixes

4.27.3

Bug Fixes

Pull Requests

4.27.2

Bug Fixes

Pull Requests

4.27.1

Bug Fixes

Pull Requests

4.27.0

Features

Bug Fixes

Pull Requests

v5.4.11

v5.4.10

v5.4.9

v5.4.8

v5.4.7

v5.4.6

v5.4.5

v5.4.4

v5.4.3

plugin-legacy@5.4.3

plugin-legacy@5.4.2

v5.4.2

plugin-legacy@5.4.1

v5.4.1

plugin-legacy@5.4.0

create-vite@5.4.0

v5.4.0

5.4.11 (2024-11-11)

5.4.10 (2024-10-23)

5.4.9 (2024-10-14)

5.4.8 (2024-09-25)

5.4.7 (2024-09-20)

5.4.6 (2024-09-16)

5.4.5 (2024-09-13)

8.18.0

Features

8.17.1

Bug fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Nov 18, 2024 •

edited

Loading