chore(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates by dependabot[bot] · Pull Request #1525 · ant-design/ant-design-mini

dependabot · 2026-06-01T14:13:35Z

Bumps the npm_and_yarn group with 3 updates in the / directory: esbuild, gh-pages and vitest.

Updates esbuild from 0.19.12 to 0.28.0

Release notes

v0.28.0
Add support for with { type: 'text' } imports (#4435)

The import text proposal has reached stage 3 in the TC39 process, which means that it's recommended for implementation. It has also already been implemented by Deno and Bun. So with this release, esbuild also adds support for it. This behaves exactly the same as esbuild's existing text loader. Here's an example:
import string from './example.txt' with { type: 'text' }
console.log(string)
Add integrity checks to fallback download path (#4343)

Installing esbuild via npm is somewhat complicated with several different edge cases (see esbuild's documentation for details). If the regular installation of esbuild's platform-specific package fails, esbuild's install script attempts to download the platform-specific package itself (first with the npm command, and then with a HTTP request to registry.npmjs.org as a last resort).

This last resort path previously didn't have any integrity checks. With this release, esbuild will now verify that the hash of the downloaded binary matches the expected hash for the current release. This means the hashes for all of esbuild's platform-specific binary packages will now be embedded in the top-level esbuild package. Hopefully this should work without any problems. But just in case, this change is being done as a breaking change release.

Update the Go compiler from 1.25.7 to 1.26.1

This upgrade should not affect anything. However, there have been some significant internal changes to the Go compiler, so esbuild could potentially behave differently in certain edge cases:

It now uses the new garbage collector that comes with Go 1.26.

The Go compiler is now more aggressive with allocating memory on the stack.

The executable format that the Go linker uses has undergone several changes.

The WebAssembly build now unconditionally makes use of the sign extension and non-trapping floating-point to integer conversion instructions.

You can read the Go 1.26 release notes for more information.
v0.27.7
Fix lowering of define semantics for TypeScript parameter properties (#4421)

The previous release incorrectly generated class fields for TypeScript parameter properties even when the configured target environment does not support class fields. With this release, the generated class fields will now be correctly lowered in this case:
// Original code
class Foo {
  constructor(public x = 1) {}
  y = 2
}
// Old output (with --loader=ts --target=es2021)
class Foo {
constructor(x = 1) {
this.x = x;
__publicField(this, "y", 2);
}
x;
}
// New output (with --loader=ts --target=es2021)
class Foo {

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

6a794df publish 0.28.0 to npm
64ee0ea fix #4435: support with { type: text } imports
ef65aee fix sort order in snapshots_packagejson.txt
1a26a8e try to fix test-old-ts, also shuffle CI tasks
556ce6c use '' instead of null to omit build hashes
8e675a8 ci: allow missing binary hashes for tests
7067763 Reapply "update go 1.25.7 => 1.26.1"
39473a9 fix #4343: integrity check for binary download
2025c9f publish 0.27.7 to npm
c6b586e fix typo in Makefile for @esbuild/win32-x64
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Updates gh-pages from 3.2.3 to 6.3.0

Release notes

Sourced from gh-pages's releases.

v6.3.0

What's Changed

Bump chai from 4.3.10 to 4.5.0 by @dependabot in tschaub/gh-pages#584

Bump mocha from 10.7.3 to 10.8.2 by @dependabot in tschaub/gh-pages#583

Bump mocha from 10.8.2 to 11.0.1 by @dependabot in tschaub/gh-pages#590

Bump eslint-config-tschaub from 14.1.2 to 15.1.0 by @dependabot in tschaub/gh-pages#587

Bump commander from 11.1.0 to 13.0.0 by @dependabot in tschaub/gh-pages#591

Support filenames starting with - by @sherlockdoyle in tschaub/gh-pages#593

New Contributors

@sherlockdoyle made their first contribution in tschaub/gh-pages#593

Full Changelog: tschaub/gh-pages@v6.2.0...v6.3.0

v6.2.0

What's Changed

fix: update instruction for next.js by @multivoltage in tschaub/gh-pages#541

Bump mocha from 10.2.0 to 10.3.0 by @dependabot in tschaub/gh-pages#545

Bump eslint from 8.56.0 to 8.57.0 by @dependabot in tschaub/gh-pages#548

Bump tmp from 0.2.1 to 0.2.3 by @dependabot in tschaub/gh-pages#549

Bump mocha from 10.3.0 to 10.4.0 by @dependabot in tschaub/gh-pages#550

Bump dir-compare from 4.2.0 to 5.0.0 by @dependabot in tschaub/gh-pages#555

Bump sinon from 17.0.1 to 17.0.2 by @dependabot in tschaub/gh-pages#557

Bump sinon from 17.0.2 to 18.0.0 by @dependabot in tschaub/gh-pages#561

Bump braces from 3.0.2 to 3.0.3 by @dependabot in tschaub/gh-pages#563

Bump mocha from 10.4.0 to 10.6.0 by @dependabot in tschaub/gh-pages#569

Bump mocha from 10.6.0 to 10.7.0 by @dependabot in tschaub/gh-pages#571

Bump mocha from 10.7.0 to 10.7.3 by @dependabot in tschaub/gh-pages#573

Bump async from 3.2.5 to 3.2.6 by @dependabot in tschaub/gh-pages#576

Bump eslint from 8.57.0 to 8.57.1 by @dependabot in tschaub/gh-pages#579

Bump sinon from 18.0.0 to 19.0.2 by @dependabot in tschaub/gh-pages#578

Update globby by @tschaub in tschaub/gh-pages#581

New Contributors

@multivoltage made their first contribution in tschaub/gh-pages#541

Full Changelog: tschaub/gh-pages@v6.1.1...v6.2.0

v6.1.1

Fixes

fix: Add missing cname option not passed to the config by @WillBAnders in tschaub/gh-pages#535

Dependency Updates

Bump eslint from 8.53.0 to 8.55.0 by @dependabot in tschaub/gh-pages#538

Bump fs-extra from 11.1.1 to 11.2.0 by @dependabot in tschaub/gh-pages#537

Bump eslint from 8.55.0 to 8.56.0 by @dependabot in tschaub/gh-pages#539

New Contributors

@WillBAnders made their first contribution in tschaub/gh-pages#535

... (truncated)

Changelog

Sourced from gh-pages's changelog.

v6.3.0

This relesae includes a fix for filenames starting with - and a number of dependency updates. See below for details.

#593 - Handle filenames starting with a dash (@sherlockdoyle)

#591 - Bump commander from 11.1.0 to 13.0.0 (@tschaub)

#587 - Bump eslint-config-tschaub from 14.1.2 to 15.1.0 (@tschaub)

#590 - Bump mocha from 10.8.2 to 11.0.1 (@tschaub)

#583 - Bump mocha from 10.7.3 to 10.8.2 (@tschaub)

#584 - Bump chai from 4.3.10 to 4.5.0 (@tschaub)

v6.2.0

Assorted dependency updates and a documentation change.

#581 - Update globby (@tschaub)

#578 - Bump sinon from 18.0.0 to 19.0.2 (@tschaub)

#579 - Bump eslint from 8.57.0 to 8.57.1 (@tschaub)

#576 - Bump async from 3.2.5 to 3.2.6 (@tschaub)

#573 - Bump mocha from 10.7.0 to 10.7.3 (@tschaub)

#571 - Bump mocha from 10.6.0 to 10.7.0 (@tschaub)

#569 - Bump mocha from 10.4.0 to 10.6.0 (@tschaub)

#563 - Bump braces from 3.0.2 to 3.0.3 (@tschaub)

#561 - Bump sinon from 17.0.2 to 18.0.0 (@tschaub)

#557 - Bump sinon from 17.0.1 to 17.0.2 (@tschaub)

#555 - Bump dir-compare from 4.2.0 to 5.0.0 (@tschaub)

#550 - Bump mocha from 10.3.0 to 10.4.0 (@tschaub)

#549 - Bump tmp from 0.2.1 to 0.2.3 (@tschaub)

#548 - Bump eslint from 8.56.0 to 8.57.0 (@tschaub)

#545 - Bump mocha from 10.2.0 to 10.3.0 (@tschaub)

#541 - fix: update instruction for next.js (@multivoltage)

v6.1.1

This release fixes an issue with the --cname option.

#535 - fix: Add missing cname option not passed to the config (@WillBAnders)

#539 - Bump eslint from 8.55.0 to 8.56.0 (@tschaub)

v6.1.0

This release adds support for --nojekyll and --cname options.

#531 - Bump sinon from 15.2.0 to 17.0.1 (@tschaub)

#529 - Bump async from 3.2.4 to 3.2.5 (@tschaub)

#524 - Bump commander from 11.0.0 to 11.1.0 (@tschaub)

#530 - Bump eslint from 8.49.0 to 8.53.0 (@tschaub)

#520 - Bump chai from 4.3.8 to 4.3.10 (@tschaub)

#527 - Bump actions/setup-node from 3 to 4 (@tschaub)

#533 - Add --nojekyll and --cname options (@tschaub)

... (truncated)

Commits

ed6cd8e 6.3.0
7bfced0 Log changes
fe4756c Merge pull request #593 from sherlockdoyle/fix-592
7e44de2 fixes #592
b3478f0 Merge pull request #591 from tschaub/dependabot/npm_and_yarn/commander-13.0.0
1208c2e Remove extra argument
fbf8432 Bump commander from 11.1.0 to 13.0.0
4be5ff0 Merge pull request #587 from tschaub/dependabot/npm_and_yarn/eslint-config-ts...
b18ebf0 Updates to work with ESLint 9
b7862ca Bump eslint-config-tschaub from 14.1.2 to 15.1.0
Additional commits viewable in compare view

Updates vitest from 1.6.1 to 4.1.8

Release notes

Sourced from vitest's releases.

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

browser: Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in vitest-dev/vitest#10138 (31882)

Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, Codex and @sheremet-va in vitest-dev/vitest#10196 (2847d)

browser: Simplify orchestrator otel carrier - by @hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

Stringify diff objects only once - by @sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

coverage: Istanbul to support instrumenter option - by @BartWaardenburg and @AriPerkkio in vitest-dev/vitest#10119 (0e0ff)

   🐞 Bug Fixes

--project negation excludes browser instances - by @felamaslen in vitest-dev/vitest#10131 (9423d)

Project color label on html reporter - by @hi-ogawa in vitest-dev/vitest#10142 (596f7)

Fix vi.defineHelper called as object method - by @hi-ogawa in vitest-dev/vitest#10163 (122c2)

Alias agent reporter to minimal - by @sheremet-va in vitest-dev/vitest#10157 (663b9)

Respect diff config options in soft assertions - by @Copilot, sheremet-va and @sheremet-va in vitest-dev/vitest#8696 (9787d)

Respect diff config options in soft assertions " - by @sheremet-va in vitest-dev/vitest#8696 (7dc6d)

ast-collect: Recognize _vi_import prefix in static test discovery - by @Yejneshwar in vitest-dev/vitest#10129 (32546)

coverage: Descriptive error message when reports directory is removed during test run - by @DaveT1991 and @AriPerkkio in vitest-dev/vitest#10117 (14133)

snapshot: Increase default snapshot max output length - by @hi-ogawa and Codex in vitest-dev/vitest#10150 (21e66)

ui: Fix jsx/tsx syntax highlight - by @hi-ogawa in vitest-dev/vitest#10152 (f1b1f)

web-worker: Support MessagePort objects referenced inside postMessage data - by @whitphx and Claude Opus 4.6 (1M context) in vitest-dev/vitest#9927 and vitest-dev/vitest#10124 (7ad7d)

api: Make test-specification options writable - by @sheremet-va in vitest-dev/vitest#10154 (6abd5)

    View changes on GitHub

... (truncated)

Commits

e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
a8fd24c chore: release v4.1.6
18af98c fix(browser): simplify orchestrator otel carrier (#10285)
3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
e399846 chore: release v4.1.5
7dc6d54 Revert "fix: respect diff config options in soft assertions (#8696)"
9787ded fix: respect diff config options in soft assertions (#8696)
325463a fix(ast-collect): recognize _vi_import prefix in static test discovery (#10...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…3 updates Bumps the npm_and_yarn group with 3 updates in the / directory: [esbuild](https://github.com/evanw/esbuild), [gh-pages](https://github.com/tschaub/gh-pages) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `esbuild` from 0.19.12 to 0.28.0 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.19.12...v0.28.0) Updates `gh-pages` from 3.2.3 to 6.3.0 - [Release notes](https://github.com/tschaub/gh-pages/releases) - [Changelog](https://github.com/tschaub/gh-pages/blob/main/changelog.md) - [Commits](tschaub/gh-pages@v3.2.3...v6.3.0) Updates `vitest` from 1.6.1 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: gh-pages dependency-version: 6.3.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.8 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-06-01T14:13:54Z

Deploying ant-design-mini with Cloudflare Pages

Latest commit:	`84745a2`
Status:	🚫 Build failed.

View logs

github-actions · 2026-06-01T14:13:54Z

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

socket-security · 2026-06-01T14:14:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	esbuild@0.19.12 ⏵ 0.28.0		⁺²	⁺¹

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 1, 2026

dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Jun 1, 2026

Navigation Menu

Repository navigation

chore(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates - #1525

chore(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates#1525
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-8c39be6376

dependabot Bot commented on behalf of github Jun 1, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 1, 2026

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

socket-security Bot commented Jun 1, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 1, 2026

v0.28.0

v0.27.7

Changelog: 2024

0.24.2

0.24.1

v6.3.0

What's Changed

New Contributors

v6.2.0

What's Changed

New Contributors

v6.1.1

Fixes

Dependency Updates

New Contributors

v6.3.0

v6.2.0

v6.1.1

v6.1.0

v4.1.8

🐞 Bug Fixes

View changes on GitHub

v4.1.7

🐞 Bug Fixes

View changes on GitHub

v4.1.6

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v4.1.5

🚀 Experimental Features

🐞 Bug Fixes

View changes on GitHub

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 1, 2026

Deploying ant-design-mini with Cloudflare Pages

Uh oh!

github-actions Bot commented Jun 1, 2026

Uh oh!

socket-security Bot commented Jun 1, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants