chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates

[dependabot]

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
esbuild	0.25.8	0.28.1
form-data	4.0.5	4.0.6
js-yaml	4.1.1	4.3.0
brace-expansion	5.0.5	5.0.8
@opentelemetry/core	2.6.0	2.10.0
fast-uri	3.1.2	3.1.4
find-my-way	9.5.0	9.7.0
postcss	8.5.10	8.5.22
vite	8.0.10	8.1.5

Updates esbuild from 0.25.8 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by @​hybrist.

• Automatically add the -webkit-mask prefix (#4357, #4358)

  This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

  /* Original code */
  main {
    mask: url(x.png) center/5rem no-repeat
  }
  /* Old output (with --target=chrome110) */
  main {
  mask: url(x.png) center/5rem no-repeat;
  }
  /* New output (with --target=chrome110) */
  main {
  -webkit-mask: url(x.png) center/5rem no-repeat;
  mask: url(x.png) center/5rem no-repeat;
  }

  This change was contributed by @​BPJEnnova.

• Additional minification of switch statements (#4176, #4359)

  This release contains additional minification patterns for reducing switch statements. Here is an example:

  // Original code
  switch (x) {
    case 0:
      foo()
      break
    case 1:
    default:
      bar()
  }

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

• [Fix] escape CR, LF, and " in field names and filenames 8dff42c
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e
• [Deps] update hasown, mime-types 92ae0eb
• [Dev Deps] update js-randomness-predictor 67b0f65

Commits

• 64190db v4.0.6
• 92ae0eb [Deps] update hasown, mime-types
• f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
• 8dff42c [Fix] escape CR, LF, and " in field names and filenames
• 67b0f65 [Dev Deps] update js-randomness-predictor
• See full diff in compare view

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

• Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

• Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before rendering.
• Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• 590dbab 4.2.0 released
• f944dc5 Add package.json funding field
• f692719 Changelog update
• Additional commits viewable in compare view

Updates brace-expansion from 5.0.5 to 5.0.8

Commits

• 96a63c0 5.0.8
• a1bd339 Merge commit from fork
• 592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
• bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
• e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
• 5bf809e Remove Node.js 18 support (#110)
• 8cb5716 Bump markdown-it from 14.1.0 to 14.2.0 (#113)
• 43122df Bump sigstore from 4.1.0 to 4.1.1 (#119)
• 69bd65a Bump @​sigstore/verify from 3.1.0 to 3.1.1 (#118)
• b3bfbf0 Bump @​sigstore/core from 3.1.0 to 3.2.1 (#117)
• Additional commits viewable in compare view

Updates @opentelemetry/core from 2.6.0 to 2.10.0

Release notes

Sourced from @​opentelemetry/core's releases.

v2.10.0

2.10.0

🚀 Features

• feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
• feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
• feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
  • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

• fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
• fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

• chore: build on Node 26 in CI #6887 @​overbalance
• chore: bump to typescript@5.2.2 @​pichlermarc

v2.9.0

2.9.0

💥 Breaking Changes

• docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

• feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
  • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
• feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
• feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
  • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
  • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
  • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
• feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

• fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

• perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
• perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

... (truncated)

Changelog

Sourced from @​opentelemetry/core's changelog.

2.10.0

🚀 Features

• feat(sdk-logs): implement log processor metrics #6554 @​anuraaga
• feat(otlp-exporter): implement exporter metrics #6480 @​anuraaga
• feat(propagator-jaeger): Notice: The @opentelemetry/propagator-jaeger package will be removed in SDK 3.x, planned for approximately September 2026. @​pichlermarc
  • The Jaeger propagator has been deprecated by the OpenTelemetry specification in favor of W3CTraceContextPropagator. This package will be removed in a future release.

🐛 Bug Fixes

• fix(sdk-trace): reject SimpleSpanProcessor.forceFlush() when a pending export fails #6771 @​LarryHu0217
• fix(sdk-trace): include trace IDs at the ratio 1 upper bound in TraceIdRatioBasedSampler #6890 @​LarryHu0217

🏠 Internal

• chore: build on Node 26 in CI #6887 @​overbalance
• chore: bump to typescript@5.2.2 @​pichlermarc

2.9.0

💥 Breaking Changes

• docs(shim-opentracing): Notice: The @opentelemetry/shim-opentracing package will be removed in SDK 3.x, planned for approximately September 2026.
  • The OpenCensus and OpenTracing compatibility requirements in the OpenTelemetry specification have been deprecated.

🚀 Features

• feat(sdk-metrics): add maxExportBatchSize option to PeriodicExportingMetricReader #6655 @​psx95
  • Optimized PeriodicExportingMetricReader.forceFlush to prevent redundant concurrent export cycles. Concurrent calls to forceFlush will now await any ongoing export and reuse a fresh export cycle if one is started concurrently by another caller. This ensures the latest metrics are always exported efficiently without triggering duplicate collection and export cycles.
• feat(sdk-trace): implement span processor metrics #6504 @​anuraaga
• feat(sdk-trace): add a new "sdk-trace" package to hold the Trace SDK, without environment variable configuration handling that belongs elsewhere #6775 @​trentm
  • "sdk-trace" will eventually replace all of "sdk-trace-base", "sdk-trace-node", and "sdk-trace-web".
  • The BatchSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new BatchSpanProcessor(exporter, { maxQueueSize: 1000 }), after new BatchSpanProcessor({ exporter, maxQueueSize: 1000 }). #6817
  • The SimpleSpanProcessor constructor call signature has changed in "sdk-trace". For example, before new SimpleSpanProcessor(exporter), after new SimpleSpanProcessor({ exporter, selfObsMeterProvider: ... }). #6504
• feat(sdk-trace): add AlwaysRecordSampler #6188 @​majanjua-amzn

🐛 Bug Fixes

• fix(propagator-jaeger): do not throw on malformed percent-encoded uber-trace-id / uberctx-* headers during extract @​pichlermarc

🏠 Internal

• perf(sdk-metrics): defer allocation of HrTime to accumulation creation #6839 @​legendecas
• chore(*): migrate use of sdk-trace-base and sdk-trace-node to sdk-trace #6851 @​trentm
• perf(sdk-metrics): optionally capture active context for sync instruments #6848 @​legendecas

2.8.0

🚀 Features

... (truncated)

Commits

• 76fa6b5 chore: prepare next release (#6942)
• 3787896 chore(deps): update dependency webpack-cli to v7.2.1 (#6934)
• be5f757 fix(deps): update dependency body-parser to v2.3.0 [security] (#6941)
• f6d8fbe chore(deps): lock file maintenance (#6559)
• 9612732 chore: remove examples/dice from workspaces (#6937)
• 7107906 chore: start using min-release-age in .npmrc, disable minimumReleaseAge for r...
• a7e5d11 chore(deps): update dependency webpack to v5.108.4 (#6933)
• af7a82d chore(deps): update dependency msw to v2.15.0 (#6831)
• b9f57c6 chore(deps): update dependency @​types/webpack-env to v1.18.8 (#6877)
• cbb4abf chore(deps): update ubuntu docker tag to v26 (#6635)
• Additional commits viewable in compare view

Updates fast-uri from 3.1.2 to 3.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

• Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

• 6aeece6 Bumped v3.1.4
• 2d50fba fix: reject literal backslash in URI authority
• 0549fe3 Bumped v3.1.3
• 2a6d357 Merge commit from fork
• See full diff in compare view

Updates find-my-way from 9.5.0 to 9.7.0

Release notes

Sourced from find-my-way's releases.

v9.7.0

What's Changed

• fix: backtrack on regex param mismatch by @​mcollina in delvedor/find-my-way#427
• fix: apply root path fallback for optional params in off() by @​aquie00t in delvedor/find-my-way#428
• ci: add node v26 to test matrix by @​aquie00t in delvedor/find-my-way#435
• perf(host): cache regex lookup results in HostStorage by @​aquie00t in delvedor/find-my-way#436
• chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group by @​dependabot[bot] in delvedor/find-my-way#437
• chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 by @​dependabot[bot] in delvedor/find-my-way#438
• chore: bump @​types/node from 25.9.4 to 26.1.0 in the dev-dependencies group by @​dependabot[bot] in delvedor/find-my-way#440
• fix: prevent done from being called multiple times on async constraint errors by @​deepview-autofix in delvedor/find-my-way#425
• fix: align isParamSafe state in findRoute with _on by @​deepview-autofix in delvedor/find-my-way#424
• chore: bump actions/checkout from 6 to 7 by @​dependabot[bot] in delvedor/find-my-way#439
• fix: avoid crash on undefined regex capture during route lookup by @​bianyifan in delvedor/find-my-way#441

New Contributors

• @​aquie00t made their first contribution in delvedor/find-my-way#428
• @​deepview-autofix made their first contribution in delvedor/find-my-way#425
• @​bianyifan made their first contribution in delvedor/find-my-way#441

Full Changelog: delvedor/find-my-way@v9.6.0...v9.7.0

v9.6.0

What's Changed

• chore: bump borp from 0.21.0 to 1.0.0 in the dev-dependencies group by @​dependabot[bot] in delvedor/find-my-way#419
• perf: optimize bitmask handler retrieval using Math.clz32 by @​gurgunday in delvedor/find-my-way#420
• chore: bump fastify/github-action-merge-dependabot from 3.11.2 to 3.12.0 by @​dependabot[bot] in delvedor/find-my-way#429
• chore: bump pre-commit from 1.2.2 to 2.0.0 in the dev-dependencies group by @​dependabot[bot] in delvedor/find-my-way#430
• feat: add onMaxParamLength to support 414 URI Too Long by @​oldregime in delvedor/find-my-way#432

New Contributors

• @​oldregime made their first contribution in delvedor/find-my-way#432

Full Changelog: delvedor/find-my-way@v9.5.0...v9.6.0

Commits

• 827248e Bumped v9.7.0
• b9d7bf1 Merge branch 'main' of github.com:delvedor/find-my-way
• b7b5657 fix: avoid crash on undefined regex capture during route lookup (#441)
• 4263d82 chore: bump actions/checkout from 6 to 7 (#439)
• 66d3015 fix: align isParamSafe state in findRoute with _on (#424)
• 75e4728 fix: prevent done from being called multiple times on async constraint errors...
• 902a02d chore: bump @​types/node in the dev-dependencies group (#440)
• b803e4e chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 (#438)
• e63cb77 chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group (#437)
• 992c1df perf(host): cache regex lookup results in HostStorage (#436)
• Additional commits viewable in compare view

Updates postcss from 8.5.10 to 8.5.22

Release notes

Sourced from postcss's releases.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

Changelog

Sourced from postcss's changelog.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

... (truncated)

Commits

• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• d197327 Fix childless at-rule losing its semicolon before a comment (#2115)
• 0e360b7 Fix mismatched JSDoc comments on Position (#2114)
• c4ac725 Release 8.5.20 version
• c30586d Fix missing space when AtRule#params is set after parsing (#2113)
• 5bfc3b9 Update dependencies
• 24733fd Move back to latest 11 pnpm
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates vite from 8.0.10 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

• bundled-dev: avoid duplicated buildEnd (#22931) (8100320)
• client: overlay error message format align rolldown (#22869) (5a72b87)
• deps: update all non-major dependencies (#22921) (fef682d)
• deps: update rolldown-related dependencies (#22922) (3c345e4)
• module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)
• optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)
• ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

• build: fix incorrect @default for build.cssMinify (#22948) (c88c236)
• build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

• avoid scanner scanning all files under __tests__ (#22912) (c961cae)

8.1.4 (2026-07-09)

Features

• legacy: prefer oxc as minifier (fix #21973) (#22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)
• deps: update all non-major dependencies (#22865) (d4295a9)
• deps: update rolldown-related dependencies (#22866) (7cf07e4)
• html: avoid backtracking in import-only check (#22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#22876) (ea22fb3)

Tests

... (truncated)

Commits

• 5e7fe12 release: v8.1.5
• 6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
• 5a72b87 fix(client): overlay error message format align rolldown (#22869)
• f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
• 8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
• c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
• b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
• fef682d fix(deps): update all non-major dependencies (#22921)
• 3c345e4 fix(deps): update rolldown-related dependencies (#22922)
• 369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as ...

Description has been truncated

[claude]

LGTM — this is a mechanical dependency version bump (npm_and_yarn group) with no source code changes.

Extended reasoning...

Overview

This PR only touches package.json and package-lock.json, bumping 9 transitive/direct dev and runtime dependencies (esbuild, form-data, js-yaml, brace-expansion, @opentelemetry/core, fast-uri, find-my-way, postcss, vite) to newer patch/minor versions. No application source code is modified.

Security risks

None from the diff itself. Several of the bumped packages (esbuild 0.28.1, js-yaml 4.3.0) actually include upstream security fixes (esbuild: local dev-server path traversal and Deno install integrity checks; js-yaml: backported maxTotalMergeKeys merge-key DoS guard), so this bump is net-positive for security. All are within semver-compatible ranges already declared in package.json (caret ranges), and lockfile integrity hashes are present for each updated package.

Level of scrutiny

Low. This is a standard automated dependency-bump PR with no logic changes, no new files, and no changes to build/test/deploy configuration. The correct level of scrutiny here is confirming the version bumps are within declared ranges and that no unexpected packages were swapped in — which they are not.

Other factors

No prior reviews exist on this PR. The bug-hunting pass found no issues, consistent with there being no non-dependency code to introduce bugs. CI (lockfile-based install and existing test suite) is the appropriate verification gate for this kind of change rather than manual code review.

[coveralls]

Coverage Report for CI Build 30105307657

Coverage decreased (-0.01%) to 80.438%

Details

• Coverage decreased (-0.01%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 2 coverage regressions across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

2 previously-covered lines in 1 file lost coverage.

File	Lines Losing Coverage	Coverage
src/internal/queue/queue.ts	2	42.04%

---

Coverage Stats

Relevant Lines:	12864
Covered Lines:	10787
Line Coverage:	83.85%
Relevant Branches:	7579
Covered Branches:	5657
Branch Coverage:	74.64%
Branches in Coverage %:	Yes
Coverage Strength:	415.88 hits per line

---

💛 - Coveralls

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.