Skip to content

Bump the npm_and_yarn group across 2 directories with 10 updates#6

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-4b75f64891
Open

Bump the npm_and_yarn group across 2 directories with 10 updates#6
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-4b75f64891

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 17, 2025 •
edited
Loading

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
js-yaml 3.14.1 3.14.2
brace-expansion 2.0.1 2.0.2
brace-expansion 1.1.11 1.1.12
braces 3.0.2 3.0.3
form-data 4.0.0 4.0.5
nanoid 3.3.7 3.3.11
rollup 3.29.4 3.29.5
serialize-javascript 6.0.1 6.0.2
ws 8.15.1 8.18.3

Bumps the npm_and_yarn group with 3 updates in the /demo directory: brace-expansion, esbuild and vite.

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide to see details for all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • dump() with skipInvalid=true now serializes invalid items in collections as null.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

Updates brace-expansion from 2.0.1 to 2.0.2

Release notes

Sourced from brace-expansion's releases.

v2.0.2

  • pkg: publish on tag 2.x 14f1d91
  • fmt ed7780a
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

Updates brace-expansion from 1.1.11 to 1.1.12

Release notes

Sourced from brace-expansion's releases.

v2.0.2

  • pkg: publish on tag 2.x 14f1d91
  • fmt ed7780a
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

Updates braces from 3.0.2 to 3.0.3

Commits

Updates form-data from 4.0.0 to 4.0.5

Release notes

Sourced from form-data's releases.

v4.0.4

v4.0.4 - 2025-07-16

Commits

  • [meta] add auto-changelog 811f682
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
  • [Fix] Switch to using crypto random for boundary values 3d17230
  • [Tests] fix linting errors 5e34080
  • [meta] actually ensure the readme backup isn’t published 316c82b
  • [Dev Deps] update @ljharb/eslint-config 58c25d7
  • [meta] fix readme capitalization 2300ca1

v4.0.3

v4.0.3 - 2025-06-05

Fixed

Commits

  • [eslint] use a shared config 426ba9a
  • [eslint] fix some spacing issues 2094191
  • [Refactor] use hasown 81ab41b
  • [Fix] validate boundary type in setBoundary() method 8d8e469
  • [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
  • [Dev Deps] remove unused deps 870e4e6
  • [meta] remove local commit hooks e6e83cc
  • [Dev Deps] update eslint 4066fd6
  • [meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2

v4.0.2 - 2025-02-14

Merged

Fixed

Commits

... (truncated)

Changelog

Sourced from form-data's changelog.

v4.0.5 - 2025-11-17

Commits

  • [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
  • [Dev Deps] update @ljharb/eslint-config, eslint 5822467
  • [Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

  • [meta] add auto-changelog 811f682
  • [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
  • [Fix] Switch to using crypto random for boundary values 3d17230
  • [Tests] fix linting errors 5e34080
  • [meta] actually ensure the readme backup isn’t published 316c82b
  • [Dev Deps] update @ljharb/eslint-config 58c25d7
  • [meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

Commits

  • [eslint] use a shared config 426ba9a
  • [eslint] fix some spacing issues 2094191
  • [Refactor] use hasown 81ab41b
  • [Fix] validate boundary type in setBoundary() method 8d8e469
  • [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
  • [Dev Deps] remove unused deps 870e4e6
  • [meta] remove local commit hooks e6e83cc
  • [Dev Deps] update eslint 4066fd6
  • [meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2 - 2025-02-14

Merged

Fixed

... (truncated)

Commits
  • 68ff7dd v4.0.5
  • 5822467 [Dev Deps] update @ljharb/eslint-config, eslint
  • 76d0dee [Fix] set Symbol.toStringTag in the proper place
  • 16e0076 [Tests] Switch to newer v8 prediction library; enable node 24 testing
  • 41996f5 v4.0.4
  • 316c82b [meta] actually ensure the readme backup isn’t published
  • 2300ca1 [meta] fix readme capitalization
  • 811f682 [meta] add auto-changelog
  • 5e34080 [Tests] fix linting errors
  • 1d11a76 [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for form-data since your current version.


Updates nanoid from 3.3.7 to 3.3.11

Release notes

Sourced from nanoid's releases.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.
Changelog

Sourced from nanoid's changelog.

3.3.11

  • Fixed React Native support.

3.3.10

3.3.9

  • Reduced npm package size.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).
Commits

Updates rollup from 3.29.4 to 3.29.5

Release notes

Sourced from rollup's releases.

v3.29.5

3.29.5

2024-09-21

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

Changelog

Sourced from rollup's changelog.

rollup changelog

Commits

Updates serialize-javascript from 6.0.1 to 6.0.2

Release notes

Sourced from serialize-javascript's releases.

v6.0.2

  • fix: serialize URL string contents to prevent XSS (#173) f27d65d
  • Bump @​babel/traverse from 7.10.1 to 7.23.7 (#171) 02499c0
  • docs: update readme with URL support (#146) 0d88527
  • chore: update node version and lock file e2a3a91
  • fix typo (#164) 5a1fa64

yahoo/serialize-javascript@v6.0.1...v6.0.2

Commits

Updates ws from 8.15.1 to 8.18.3

Release notes

Sourced from ws's releases.

8.18.3

Bug fixes

  • Fixed a spec violation where the Sec-WebSocket-Version header was not added to the HTTP response if the client requested version was either invalid or unacceptable (#2291).

8.18.2

Bug fixes

  • Fixed an issue that, during message decompression when the maximum size was exceeded, led to the emission of an inaccurate error and closure of the connection with an improper close code (#2285).

8.18.1

Bug fixes

  • The length of the UNIX domain socket paths in the tests has been shortened to make them work when run via CITGM (021f7b8b).

8.18.0

Features

  • Added support for Blob (#2229).

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';

</tr></table>

... (truncated)

Commits

Updates brace-expansion from 2.0.1 to 2.0.2

Release notes

Sourced from brace-expansion's releases.

v2.0.2

  • pkg: publish on tag 2.x 14f1d91
  • fmt ed7780a
  • Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

Updates esbuild from 0.21.5 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12

  • Fix a minification regression with CSS media queries (#4315)

    The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.

  • Update the list of known JavaScript globals (#4310)

    This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

    From ES2017:

    • Atomics
    • SharedArrayBuffer

    From ES2020:

    • BigInt64Array
    • BigUint64Array

    From ES2021:

    • FinalizationRegistry
    • WeakRef

    From ES2025:

    • Float16Array
    • Iterator

    Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:

    // This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}

  • Add support for the new @view-transition CSS rule (#4313)

    With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):

    /* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@​view-transition { navigation: auto; types: check; }
/* New output */
@​view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits

    

  • 208f539 publish 0.25.12 to npm
    • 

  • 5f03afd update release notes
    • 

  • 6b2ee78 minify: remove css rules containing empty :is()
    • 

  • f361deb add some additional known static methods
    • 

  • 07aa646 automatically mark "RegExp.escape()" calls as pure
    • 

  • 9039c46 simplify some call expression checks
    • 

  • 188944d add some additional known static methods
    • 

  • d3c67f9 fix #4310: add Iterator and other known globals
    • 

  • 4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
    • 

  • 26b29ed fix #4315: @media deduplication bug edge case
    • 

  • Additional commits viewable in compare view
    • 







Updates vite from 5.4.11 to 7.2.2



Release notes

Sourced from vite's releases.




v7.2.2


Please refer to CHANGELOG.md for details.


plugin-legacy@7.2.1


Please refer to CHANGELOG.md for details.


v7.2.1


Please refer to CHANGELOG.md for details.


plugin-legacy@7.2.0


Please refer to CHANGELOG.md for details.


v7.2.0


Please refer to CHANGELOG.md for details.


v7.2.0-beta.1


Please refer to CHANGELOG.md for details.


v7.2.0-beta.0


Please refer to CHANGELOG.md for details.


v7.1.12


Please refer to CHANGELOG.md for details.


v7.1.11


Please refer to CHANGELOG.md for details.


v7.1.10


Please refer to CHANGELOG.md for details.


v7.1.9


Please refer to CHANGELOG.md for details.


v7.1.8


Please refer to CHANGELOG.md for details.


v7.1.7


Please refer to CHANGELOG.md for details.


v7.1.6


Please refer to CHANGELOG.md for details.


v7.1.5


Please refer to CHANGELOG.md for details.


v7.1.4


Please refer to CHANGELOG.md for details.


v7.1.3


Please refer to CHANGELOG.md for details.





... (truncated)





Changelog

Sourced from vite's changelog.




7.2.2 (2025-11-07)


Bug Fixes



7.2.1 (2025-11-06)


Bug Fixes



Code Refactoring


    

  • build: rename indexOfMatchInSlice to findPreloadMarker (#21054) (f83264f)
    • 



7.2.0 (2025-11-05)


Bug Fixes


    

  • css: fallback to sass when sass-embedded platform binary is missing (#21002) (b1fd616)
    • 

  • module-runner: make getBuiltins response JSON serializable (#21029) (ad5b3bf)
    • 

  • types: add undefined to optional properties for exactOptionalProperties type compatibility (#21040) (2833c55)
    • 



Miscellaneous Chores



7.2.0-beta.1 (2025-10-29)


Bug Fixes


    

  • increase stream reset rate limit for HTTP2 (#21024) (4f44f22)
    • 

  • optimizer: externalize virtual modules for html like files (#21001) (e5af352)
    • 



Documentation


    

  • clarify the values are escaped automatically (#21017) (246df13)
    • 



Code Refactoring



7.2.0-beta.0 (2025-10-28)


Features


    

  • add import.meta.resolve support for ESM config (bundle config loader) (#20962) (f86789a)
    • 

  • add perEnvironmentWatchChangeDuringDev (#20996) (a5e98e6)
    • 

  • add vite client connect events (#20978) (543d87c)
    • 

  • build: emit license (#18546) (b42c3fb)
    • 

  • dev: support HTTP2 even if proxy feature is used (#20869) (fc21af7)
    • 

  • lib: enable minification but keep pure annotations for es output with terser (#20522) (df997d0)
    • 

  • optimizer: add rush lockfile support (#20833) (718ca2d)
    • 

  • utils: support multiple certificates in resolveServerUrls (#20707) (24513e5)
    • 






... (truncated)





Commits

    

  • 572aaca release: v7.2.2
    • 

  • 728c8ee fix: revert "refactor: use fs.cpSync (#21019)" (#21081)
    • 

  • a532e68 release: v7.2.1
    • 

  • 82d2d6c fix(worker): some worker asset was missing (#21074)
    • 

  • f83264f refactor(build): rename indexOfMatchInSlice to findPreloadMarker (#21054)
    • 

  • 8293de0 release: v7.2.0
    • 

  • 2833c55 fix(types): add undefined to optional properties for exactOptionalProperties ...
    • 

  • e3a6a83 chore(deps): update rolldown-related dependencies (#21047)
    • 

  • b1fd616 fix(css): fallback to sass when sass-embedded platform binary is missing (#21...
    • 

  • ad5b3bf fix(module-runner): make getBuiltins response JSON serializable (#21029)
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vite since your current version.






Updates nanoid from 3.3.7 to 3.3.11



Release notes

Sourced from nanoid's releases.




3.3.11


    

  • Fixed React Native support.
    • 



3.3.10



3.3.9


    

  • Reduced npm package size.
    • 








Changelog

Sourced from nanoid's changelog.




3.3.11


    

  • Fixed React Native support.
    • 



3.3.10



3.3.9


    

  • Reduced npm package size.
    • 



3.3.8


    

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).
    • 








Commits






Updates vite from 5.4.11 to 7.2.2



Release notes

Sourced from vite's releases.




v7.2.2


Please refer to CHANGELOG.md for details.


plugin-legacy@7.2.1


Please refer to CHANGELOG.md for details.


v7.2.1


Please refer to CHANGELOG.md for details.


plugin-legacy@7.2.0


Please refer to CHANGELOG.md for details.


v7.2.0


Please refer to CHANGELOG.md for details.


v7.2.0-beta.1


Please refer to CHANGELOG.md for details.


v7.2.0-beta.0


Please refer to CHANGELOG.md for details.


v7.1.12


Please refer to CHANGELOG.md for details.


v7.1.11


Please refer to CHANGELOG.md for details.


v7.1.10


Please refer to CHANGELOG.md for details.


v7.1.9


Please refer to CHANGELOG.md for details.


v7.1.8


Please refer to CHANGELOG.md for details.


v7.1.7


Please refer to CHANGELOG.md for details.


v7.1.6


Please refer to CHANGELOG.md for details.


v7.1.5


Please refer to CHANGELOG.md for details.


v7.1.4


Please refer to CHANGELOG.md for details.


v7.1.3


Please refer to CHANGELOG.md for details.





... (truncated)





Changelog

Sourced from vite's changelog.




7.2.2 (2025-11-07)


Bug Fixes



7.2.1 (2025-11-06)


Bug Fixes



Code Refactoring


    

  • build: rename indexOfMatchInSlice to findPreloadMarker (#21054) (f83264f)
    • 



7.2.0 (2025-11-05)


Bug Fixes


    

  • css: fallback to sass when sass-embedded platform binary is missing (#21002) (b1fd616)
    • 

  • module-runner: make getBuiltins response JSON serializable (#21029) (ad5b3bf)
    • 

  • types: add undefined to optional properties ...

    Description has been truncated
    

    

    Note
    
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
    


    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          Bump the npm_and_yarn group across 2 directories with 10 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          5bc5388
        
      

    

  

    

      
Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.1` | `2.0.2` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.12` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [form-data](https://github.com/form-data/form-data) | `4.0.0` | `4.0.5` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.7` | `3.3.11` |
| [rollup](https://github.com/rollup/rollup) | `3.29.4` | `3.29.5` |
| [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.1` | `6.0.2` |
| [ws](https://github.com/websockets/ws) | `8.15.1` | `8.18.3` |

Bumps the npm_and_yarn group with 3 updates in the /demo directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [esbuild](https://github.com/evanw/esbuild) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `brace-expansion` from 2.0.1 to 2.0.2
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2)

Updates `brace-expansion` from 1.1.11 to 1.1.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `form-data` from 4.0.0 to 4.0.5
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.0...v4.0.5)

Updates `nanoid` from 3.3.7 to 3.3.11
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.7...3.3.11)

Updates `rollup` from 3.29.4 to 3.29.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG-3.md)
- [Commits](rollup/rollup@v3.29.4...v3.29.5)

Updates `serialize-javascript` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v6.0.1...v6.0.2)

Updates `ws` from 8.15.1 to 8.18.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.15.1...8.18.3)

Updates `brace-expansion` from 2.0.1 to 2.0.2
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.0.1...v2.0.2)

Updates `esbuild` from 0.21.5 to 0.25.12
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.21.5...v0.25.12)

Updates `vite` from 5.4.11 to 7.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.2.2/packages/vite)

Updates `nanoid` from 3.3.7 to 3.3.11
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.7...3.3.11)

Updates `vite` from 5.4.11 to 7.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: form-data
  dependency-version: 4.0.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 3.29.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serialize-javascript
  dependency-version: 6.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.18.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.2.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-version: 3.3.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.2.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Nov 17, 2025

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews






    
    

    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
      

  

    

      0 participants