Skip to content

chore(deps): bump the npm-non-major group across 2 directories with 19 updates - #1684

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-non-major-5566834287
Closed

chore(deps): bump the npm-non-major group across 2 directories with 19 updates#1684
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-non-major-5566834287

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-non-major group with 10 updates in the / directory:

Package From To
@aws-sdk/credential-providers 3.1113.0 3.1114.0
@primer/react 38.35.1 38.36.0
isomorphic-git 1.41.5 1.41.7
parse-diff 0.11.1 0.12.0
@vitejs/plugin-react 6.0.5 6.1.0
vite 8.2.1 8.2.2
@esbuild/darwin-arm64 0.27.7 0.28.2
@esbuild/darwin-x64 0.27.7 0.28.2
@esbuild/linux-x64 0.27.2 0.28.2
@esbuild/win32-x64 0.27.2 0.28.2

Bumps the npm-non-major group with 9 updates in the /website directory:

Package From To
axios 1.18.1 1.19.0
react 19.2.5 19.2.8
react-dom 19.2.5 19.2.8
eslint 10.3.0 10.8.1
@docusaurus/core 3.10.1 3.10.2
@docusaurus/plugin-google-gtag 3.10.1 3.10.2
@docusaurus/preset-classic 3.10.1 3.10.2
@docusaurus/theme-mermaid 3.10.1 3.10.2
@mermaid-js/layout-elk 0.1.9 0.2.3

Updates @aws-sdk/credential-providers from 3.1113.0 to 3.1114.0

Release notes

Sourced from @​aws-sdk/credential-providers's releases.

v3.1114.0

3.1114.0(2026-08-19)

New Features
  • client-eks: Adds support for EKS cluster certificate authorities (CA) (a1316eae)
  • client-bedrock-agentcore-control: AgentCore Memory now supports Flexible Namespaces (65c89d6d)
  • client-batch: AWS Batch now supports managing CloudWatch Container Insights on compute environments via CreateComputeEnvironment and UpdateComputeEnvironment. (f77fc37f)
  • client-redshift: Amazon Redshift enhanced System Table retention that allows customers to store their system table data directly in S3 Tables in customer's account instead of Redshift Managed Storage (a46d1f96)
  • client-bedrock-agentcore: AgentCore Memory now supports Flexible Namespaces and Non-Conversational Payloads in CreateEvent API (a0d8fb6d)
  • client-medialive: AWS Elemental MediaLive now supports video cropping and output positioning. Use cropRectangle and outputPositionRectangle to position the encoded video within the output frame, with the surrounding area filled with black. (2bf1331a)
  • client-account-access: Adds throttling exceptions to operation outputs that were previously inconsistent with other operations. (1e39b385)
  • client-vpc-lattice: Amazon VPC Lattice now supports modification of private DNS options on Service Network VPC Associations (92c89b27)
  • client-redshift-serverless: Amazon Redshift Enhanced System Table Retention that allows customers to store their system table data directly in S3 Tables in customer's account instead of Redshift Managed Storage (73ad53c3)
  • lib-transfer-manager: add file based download api and worker thread based download. (#8259) (b2d60357)

For list of updated packages, view updated-packages.md in assets-3.1114.0.zip

Changelog

Sourced from @​aws-sdk/credential-providers's changelog.

3.1114.0 (2026-08-19)

Note: Version bump only for package @​aws-sdk/credential-providers

Commits

Updates @primer/react from 38.35.1 to 38.36.0

Release notes

Sourced from @​primer/react's releases.

@​primer/react@​38.36.0

Minor Changes

Patch Changes

  • #8276 5069f8a Thanks @​copilot-swe-agent! - Portal: Render nothing while server rendering and during hydration instead of accessing the DOM during render, fixing server rendering support. Client-only renders are unchanged and still mount portaled content in the same commit.

  • #8260 24d0831 Thanks @​liuliu-dev! - UnderlineNav: Keep item icons visible by default at the medium breakpoint and above

Commits
  • 1c86446 Release tracking (#8287)
  • fd73a89 chore(deps-dev): bump @​hono/node-server from 1.19.14 to 1.19.17 (#8301)
  • a88cc69 Add additional Tooltip support to ActionList and NavList (#8303)
  • 5069f8a Fix Portal server rendering by deferring the portal mount to the client (#8276)
  • 956f0eb chore(deps): bump github/gh-aw-actions/setup from 0.83.4 to 0.85.0 (#8282)
  • 24d0831 UnderlineNav: Show item icons above medium by default (#8260)
  • e272959 chore(deps-dev): bump rolldown from 1.2.0 to 1.2.2 in the rolldown group acro...
  • b5916c6 chore(deps): bump masci/datadog from 2.0.4 to 2.0.5 (#8283)
  • b41536e chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.0 (#8281)
  • 718918c chore(deps): bump github/codeql-action from 4.37.3 to 4.37.6 (#8280)
  • Additional commits viewable in compare view

Updates isomorphic-git from 1.41.5 to 1.41.7

Release notes

Sourced from isomorphic-git's releases.

v1.41.7

1.41.7 (2026-08-19)

Bug Fixes

  • return best merge bases for DAG histories (#2412) (a7f747f)
Commits

Updates parse-diff from 0.11.1 to 0.12.0

Commits

Updates @vitejs/plugin-react from 6.0.5 to 6.1.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

  • deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

  • bundled-dev: handle lazy request error (#23291) (3ba026d)
  • bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
  • config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
  • css: don't pass empty targets to lightningcss (#23295) (2804636)
  • define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
  • deps: update all non-major dependencies (#23217) (ba958bd)
  • deps: update rolldown-related dependencies (#23218) (83ecb2c)
  • module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
  • optimizer: close custom extension analysis bundles (#23207) (8fb7675)
  • reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
  • respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
  • ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
  • vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

Miscellaneous Chores

Code Refactoring

  • use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
  • use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

  • define: close rolldown bundler after generate (#23231) (b4d66fe)
  • module-runner: add TLA circular import case (#23299) (4a261f2)
  • module-runner: simplify server-hmr tests (#23300) (599b44b)
  • ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

  • use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)
Commits
  • de1111a release: v8.2.2
  • cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
  • 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
  • 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
  • 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
  • 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
  • 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
  • 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
  • 599b44b test(module-runner): simplify server-hmr tests (#23300)
  • 4a261f2 test(module-runner): add TLA circular import case (#23299)
  • Additional commits viewable in compare view

Updates @esbuild/darwin-arm64 from 0.27.7 to 0.28.2

Release notes

Sourced from @​esbuild/darwin-arm64's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from @​esbuild/darwin-arm64's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates @esbuild/darwin-x64 from 0.27.7 to 0.28.2

Release notes

Sourced from @​esbuild/darwin-x64's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from @​esbuild/darwin-x64's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates @esbuild/linux-x64 from 0.27.2 to 0.28.2

Release notes

Sourced from @​esbuild/linux-x64's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from @​esbuild/linux-x64's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates @esbuild/win32-x64 from 0.27.2 to 0.28.2

Release notes

Sourced from @​esbuild/win32-x64's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from @​esbuild/win32-x64's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates axios from 1.18.1 to 1.19.0

Release notes

Sourced from axios's releases.

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

  • Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

  • Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)
  • Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
  • HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

  • Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
  • Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
  • Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
  • Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
  • URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11024, #11038)
  • Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
  • Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
  • Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
  • Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

  • Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055,

@dependabot
chore(deps): bump the npm-non-major group across 2 directories with 1…
25d1482 
…9 updates

Bumps the npm-non-major group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/credential-providers](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages/credential-providers) | `3.1113.0` | `3.1114.0` |
| [@primer/react](https://github.com/primer/react) | `38.35.1` | `38.36.0` |
| [isomorphic-git](https://github.com/isomorphic-git/isomorphic-git) | `1.41.5` | `1.41.7` |
| [parse-diff](https://github.com/sergeyt/parse-diff) | `0.11.1` | `0.12.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |
| [@esbuild/darwin-arm64](https://github.com/evanw/esbuild) | `0.27.7` | `0.28.2` |
| [@esbuild/darwin-x64](https://github.com/evanw/esbuild) | `0.27.7` | `0.28.2` |
| [@esbuild/linux-x64](https://github.com/evanw/esbuild) | `0.27.2` | `0.28.2` |
| [@esbuild/win32-x64](https://github.com/evanw/esbuild) | `0.27.2` | `0.28.2` |

Bumps the npm-non-major group with 9 updates in the /website directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.18.1` | `1.19.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.8` |
| [eslint](https://github.com/eslint/eslint) | `10.3.0` | `10.8.1` |
| [@docusaurus/core](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus) | `3.10.1` | `3.10.2` |
| [@docusaurus/plugin-google-gtag](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-plugin-google-gtag) | `3.10.1` | `3.10.2` |
| [@docusaurus/preset-classic](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-preset-classic) | `3.10.1` | `3.10.2` |
| [@docusaurus/theme-mermaid](https://github.com/facebook/docusaurus/tree/HEAD/packages/docusaurus-theme-mermaid) | `3.10.1` | `3.10.2` |
| [@mermaid-js/layout-elk](https://github.com/mermaid-js/mermaid) | `0.1.9` | `0.2.3` |



Updates `@aws-sdk/credential-providers` from 3.1113.0 to 3.1114.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages/credential-providers/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1114.0/packages/credential-providers)

Updates `@primer/react` from 38.35.1 to 38.36.0
- [Release notes](https://github.com/primer/react/releases)
- [Commits](https://github.com/primer/react/compare/@primer/react@38.35.1...@primer/react@38.36.0)

Updates `isomorphic-git` from 1.41.5 to 1.41.7
- [Release notes](https://github.com/isomorphic-git/isomorphic-git/releases)
- [Commits](isomorphic-git/isomorphic-git@v1.41.5...v1.41.7)

Updates `parse-diff` from 0.11.1 to 0.12.0
- [Commits](sergeyt/parse-diff@0.11.1...0.12.0)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

Updates `@esbuild/darwin-arm64` from 0.27.7 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.7...v0.28.2)

Updates `@esbuild/darwin-x64` from 0.27.7 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.7...v0.28.2)

Updates `@esbuild/linux-x64` from 0.27.2 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.27.2...v0.28.2)

Updates `@esbuild/win32-x64` from 0.27.2 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.27.2...v0.28.2)

Updates `axios` from 1.18.1 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.19.0)

Updates `react` from 19.2.5 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.5 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `eslint` from 10.3.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.3.0...v10.8.1)

Updates `@docusaurus/core` from 3.10.1 to 3.10.2
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus)

Updates `@docusaurus/plugin-google-gtag` from 3.10.1 to 3.10.2
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-plugin-google-gtag)

Updates `@docusaurus/preset-classic` from 3.10.1 to 3.10.2
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-preset-classic)

Updates `@docusaurus/theme-mermaid` from 3.10.1 to 3.10.2
- [Release notes](https://github.com/facebook/docusaurus/releases)
- [Changelog](https://github.com/facebook/docusaurus/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/docusaurus/commits/v3.10.2/packages/docusaurus-theme-mermaid)

Updates `@mermaid-js/layout-elk` from 0.1.9 to 0.2.3
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/@mermaid-js/layout-elk@0.1.9...@mermaid-js/layout-elk@0.2.3)

Updates `axios` from 1.18.1 to 1.19.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.18.1...v1.19.0)

Updates `eslint` from 10.3.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.3.0...v10.8.1)

Updates `react` from 19.2.5 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.5 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

---
updated-dependencies:
- dependency-name: "@aws-sdk/credential-providers"
  dependency-version: 3.1114.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: "@primer/react"
  dependency-version: 38.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: isomorphic-git
  dependency-version: 1.41.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: parse-diff
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: "@esbuild/darwin-arm64"
  dependency-version: 0.28.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: "@esbuild/darwin-x64"
  dependency-version: 0.28.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: "@esbuild/linux-x64"
  dependency-version: 0.28.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: "@esbuild/win32-x64"
  dependency-version: 0.28.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: "@docusaurus/core"
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: "@docusaurus/plugin-google-gtag"
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: "@docusaurus/preset-classic"
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: "@docusaurus/theme-mermaid"
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: "@mermaid-js/layout-elk"
  dependency-version: 0.2.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: axios
  dependency-version: 1.19.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-non-major
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-non-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added automated dependencies Pull requests that update a dependency file labels Aug 23, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 23, 2026 09:38
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file automated labels Aug 23, 2026
@netlify

netlify Bot commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for endearing-brigadeiros-63f9d0 ready!

Name Link
🔨 Latest commit 25d1482
🔍 Latest deploy log https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6a8abf911eecab000870c9ca
😎 Deploy Preview https://deploy-preview-1684.git-proxy.preview.finos.org
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@github-actions

github-actions Bot commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:

  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.

View full job summary

@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 23, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-non-major-5566834287 branch August 23, 2026 14:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated dependencies Pull requests that update a dependency file maintenance

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants