chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates by dependabot[bot] · Pull Request #5 · bugraceylan/image-compressor

dependabot · 2026-09-15T07:55:49Z

Bumps the npm_and_yarn group with 11 updates in the / directory:

Package	From	To
vite	`6.3.5`	`6.4.3`
@humanfs/node	`0.16.6`	`0.16.8`
brace-expansion	`1.1.12`	`1.1.21`
minimatch	`3.1.2`	`3.1.5`
flatted	`3.3.3`	`3.4.4`
js-yaml	`4.1.0`	`4.3.2`
nanoid	`3.3.11`	`3.3.19`
picomatch	`4.0.2`	`4.0.7`
picomatch	`2.3.1`	`2.3.2`
postcss	`8.5.6`	`8.5.28`
rollup	`4.44.1`	`4.63.3`
tar	`7.4.3`	`7.5.22`

Updates vite from 6.3.5 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163

fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

6.3.6 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (0ab19ea), closes #20736

fix: upgrade sirv to 3.0.2 (#20735) (e11d240), closes #20735

test: detect ts support via process.features (#20544) (7d99229), closes #20544

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
6b3fad0 release: v6.4.2
ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
5487f4f release: v6.4.1
1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
f12697c release: v6.4.0
ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

Updates @humanfs/node from 0.16.6 to 0.16.8

Release notes

Sourced from @humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

node: v0.16.7

0.16.7 (2024-11-27)

Bug Fixes

Add directory to package.json (f691b60)

Changelog

Sourced from @humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)

Include type dependencies at runtime (956ce7a), closes #145

Dependencies

The following workspace dependencies were updated

dependencies

@humanfs/core bumped from ^0.19.1 to ^0.19.2

0.16.7 (2024-11-27)

Bug Fixes

Add directory to package.json (f691b60)

Commits

e96070e chore: release main (#146)
22bbaa4 Merge commit from fork
956ce7a fix: Include type dependencies at runtime
257b7b5 chore: release main (#142)
f691b60 fix: Add directory to package.json
7b81d9a chore(deps): Upgrading retry dependency in node package. (#140)
See full diff in compare view

Updates brace-expansion from 1.1.12 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

Backport v5.0.6 change to v1 (#111) 0b09384

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

7bba978 3.1.5
bd25942 docs: add warning about ReDoS
1a9c27c fix partial matching of globstar patterns
1a2e084 3.1.4
ae24656 update lockfile
b100374 limit recursion for **, improve perf considerably
26ffeaa lockfile update
9eca892 lock node version to 14
00c323b 3.1.3
30486b2 update CI matrix and actions
Additional commits viewable in compare view

Updates flatted from 3.3.3 to 3.4.4

Commits

e6f5ca7 3.4.4
47f14fa removed E_STRICT from PHP
4050568 fixced go-lang issues in CI
4303f4d Merge pull request #101 from mfinelli/gocriticfixes
106735b updated package-lock.json
670a1bd 3.4.3
50a61a9 Fix #104 - allow null as replacer value
8aa64f4 solved crytical errors over dependencies
b85577f Fix go-critic errors
bb8c63c Merge pull request #100 from WebReflection/WebReflection-patch-1
Additional commits viewable in compare view

Updates js-yaml from 4.1.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

... (truncated)

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
Additional commits viewable in compare view

Updates nanoid from 3.3.11 to 3.3.19

Release notes

Sourced from nanoid's releases.

3.3.19

Fixed killing the app by setting huge user ID.

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Changelog

Sourced from nanoid's changelog.

3.3.19

Fixed killing the app by setting huge user ID (by @geoffrey-diederichs).

3.3.18

Fixed infinite loop on async for React Native (by @OvergrowthBeards-JB).

3.3.17

Fixed infinite loop on zero size.

3.3.16

Fixed infinite loop on negative size (by @greymoth-jp).

3.3.15

Fixed npm provenance error.

3.3.14

Fixed random pool corruption on big ID sizes.

3.3.13

Reduced npm package size.

3.3.12

Fixed breaking Nano ID by requesting big ID.

Commits

eb63bd6 Release 3.3.19 version
9067e03 Sync CJS and ESM
9ad9805 Release 3.3.18 version
55e50a0 Update CI action
e10f8d4 Update index.native.js (#606)
73d6716 Release 3.3.17 version
f9d13f1 Sync 0 size behaviour with PostCSS 5
9760e11 Release 3.3.16 version
e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
96dd086 Update CI action
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates picomatch from 4.0.2 to 4.0.7

Release notes

Sourced from picomatch's releases.

4.0.7

What's Changed

fix: handle terminal globstars in parenthesized patterns by @mrmlnc in micromatch/picomatch#198

Full Changelog: micromatch/picomatch@4.0.6...4.0.7

4.0.6

What's Changed

fix: scan full pattern when tokens are requested by @mrmlnc in micromatch/picomatch#197

fix: return complete pattern parts from scan by @mrmlnc in micromatch/picomatch#199

Full Changelog: micromatch/picomatch@4.0.5...4.0.6

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

New Contributors

@Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

Changelog

Sourced from picomatch's changelog.

4.0.7 (2026-08-24)

Fixed

Fixed terminal globstars in parenthesized patterns (#142, e279bd7).

4.0.6 (2026-08-24)

Fixed

scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#62, 5f5819d).

scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#58, f201165).

4.0.5 (2026-07-02)

Fixed

Preserved every branch when safely rewriting repeated extglobs (#182, 6289307).

Honored the windows option when matching basenames (#183, ab8bc4d).

4.0.4 (2026-03-23)

Security

Prevented regular expression denial of service (ReDoS) from crafted repeated or nested extglob quantifiers by safely rewriting or treating risky patterns as literals. The new maxExtglobRecursion option defaults to 0; positive numeric values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 5eceecd).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 4516eb5).

4.0.3 (2025-07-15)

Fixed

Avoided an exception when a glob pattern contains constructor (#144, a9e2dd2).

Commits

6bb4067 4.0.7
fdfb155 Merge pull request #198 from micromatch/issue-142
38c6b7a 4.0.6
ada9d3f Merge pull request #199 from micromatch/issue-58
9b74f6f Merge pull request #197 from micromatch/issue-62
f201165 fix: return complete pattern parts from scan
e279bd7 fix: handle terminal globstars in parenthesized patterns
5f5819d fix: scan full pattern when tokens are requested
4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
Additional commits viewable in compare view

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

4.0.7

What's Changed

fix: handle terminal globstars in parenthesized patterns by @mrmlnc in micromatch/picomatch#198

Full Changelog: micromatch/picomatch@4.0.6...4.0.7

4.0.6

What's Changed

fix: scan full pattern when tokens are requested by @mrmlnc in micromatch/picomatch#197

fix: return complete pattern parts from scan by @mrmlnc in micromatch/picomatch#199

Full Changelog: micromatch/picomatch@4.0.5...4.0.6

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

New Contributors

@Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

Changelog

Sourced from picomatch's changelog.

4.0.7 (2026-08-24)

Fixed

Fixed terminal globstars in parenthesized patterns (#142, e279bd7).

4.0.6 (2026-08-24)

Fixed

scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#62, 5f5819d).

scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#58, f201165).

4.0.5 (2026-07-02)

Fixed

Preserved every branch when safely rewriting repeated extglobs (#182, 6289307).

Honored the windows option when matching basenames (#183, ab8bc4d).

4.0.4 (2026-03-23)

Security

Prevented regular expression denial of service (ReDoS) from crafted repeated or nested extglob quantifiers by safely rewriting or treating risky patterns as literals. The new maxExtglobRecursion option defaults to 0; positive numeric values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 5eceecd).

Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 4516eb5).

4.0.3 (2025-07-15)

Fixed

Avoided an exception when a glob pattern contains constructor (#144, a9e2dd2).

Commits

6bb4067 4.0.7
fdfb155 Merge pull request #198 from micromatch/issue-142
38c6b7a 4.0.6
ada9d3f Merge pull request #199 from micromatch/issue-58
9b74f6f Merge pull request #197 from micromatch/issue-62
f201165 fix: return complete pattern parts from scan
e279bd7 fix: handle terminal globstars in parenthesized patterns
5f5819d fix: scan full pattern when tokens are requested
4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

... (truncated)

Commits

e544bff Release 8.5.28 version
f8fc252 Typo
5039fd7 Add missed release notes
ae40ca4 Release 8.5.27 version
62b1626 Fix linter
1dba938 Update dependencies
3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
6d23bc3 Fix link
508e997 Add GitHub Sponsors link
e993739 Add CodeRabbit sponsor (#2145)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates rollup from 4.44.1 to 4.63.3

Release notes

Sourced from rollup's releases.

v4.63.3

4.63.3

2026-09-14

Bug Fixes

Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)

Always report and recover from failures on invalidation in watch mode (#6506)

Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

Pull Requests

#6473: fix(browser): match node's basename and extname (@luantaraschi, @lukastaegert)

#6506: fix(watch): await the rerun so listener failures surface as ERROR events (@yoominho91, @irontaek, @lukastaegert)

#6514: Remove the whole CRLF pair when suppressing ASI (@NgoQuocViet2001)

#6515: chore(deps): lock file maintenance (@renovate[bot])

v4.63.2

4.63.2

2026-09-12

Bug Fixes

Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

#6498: chore(deps): lock file maintenance (@renovate[bot])

#6503: fix(deps): update minor/patch updates (@renovate[bot])

#6504: chore(deps): update dependency eslint-plugin-unicorn to v74 (@renovate[bot])

#6505: pin mocha to v11 (@renovate[bot], @lukastaegert)

#6508: docs: fix AGENTS.md 'Generated files' rule to reference real paths (@Larslllllll, @lukastaegert)

#6510: chore(deps): lock file maintenance (@renovate[bot])

#6511: Fix nested log filters for primitive values (@jakezwang, @lukastaegert)

#6512: chore(deps): update dtolnay/rust-toolchain digest to 6bed076 (@renovate[bot], @lukastaegert)

#6513: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)

v4.63.1

4.63.1

2026-08-28

Bug Fixes

Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.63.3

2026-09-14

Bug Fixes

Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)

Always report and recover from failures on invalidation in watch mode (#6506)

Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

Pull Requests

#6473: fix(browser): match node's basename and extname (@luantaraschi, @lukastaegert)

#6506: fix(watch): await the rerun so listener failures surface as ERROR events (@yoominho91, @irontaek, @lukastaegert)

#6514: Remove the whole CRLF pair when suppressing ASI (@NgoQuocViet2001)

#6515: chore(deps): lock file maintenance (@renovate[bot])

4.63.2

2026-09-12

Bug Fixes

Fix a bug when filtering logs for nested properties via the CLI (#6511)

Pull Requests

#6498: chore(deps): lock file maintenance (@renovate[bot])

#6503: fix(deps): update minor/patch updates (@renovate[bot])

#6504: chore(deps): update dependency eslint-plugin-unicorn to v74 (@renovate[bot])

#6505: pin mocha to v11 (@renovate[bot], @lukastaegert)

#6508: docs: fix AGENTS.md 'Generated files' rule to reference real paths (@Larslllllll, @lukastaegert)

#6510: chore(deps): lock file maintenance (@renovate[bot])

#6511: Fix nested log filters for primitive values (@jakezwang, @lukastaegert)

#6512: chore(deps): update dtolnay/rust-toolchain digest to 6bed076 (@renovate[bot], @lukastaegert)

#6513: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)

4.63.1

2026-08-28

Bug Fixes

Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

#6489: fix(deps): update minor/patch updates (@renovate[bot])

#6490: Revert improve function return value tracking (@lukastaegert)

... (truncated)

Commits

250deca 4.63.3
01ab3f8 fix(watch): await the rerun so listener failures surface as ERROR events (#6506)
3cf1a0f Remove the whole CRLF pair when suppressing ASI (#6514)
63381e2 Refine instructions
8da2d50 fix(browser): match node's basename and extname (#6473)
59d1e86 chore(deps): lock file maintenance (#6515)
43ed4ec 4.63.2
47282da chore(deps): update dtolnay/rust-toolchain digest ...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.3.5` | `6.4.3` | | [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) | `0.16.6` | `0.16.8` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.21` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.4` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.2` | | [nanoid](https://github.com/ai/nanoid) | `3.3.11` | `3.3.19` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.2` | `4.0.7` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.28` | | [rollup](https://github.com/rollup/rollup) | `4.44.1` | `4.63.3` | | [tar](https://github.com/isaacs/node-tar) | `7.4.3` | `7.5.22` | Updates `vite` from 6.3.5 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `@humanfs/node` from 0.16.6 to 0.16.8 - [Release notes](https://github.com/humanwhocodes/humanfs/releases) - [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md) - [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node) Updates `brace-expansion` from 1.1.12 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) Updates `flatted` from 3.3.3 to 3.4.4 - [Commits](WebReflection/flatted@v3.3.3...v3.4.4) Updates `js-yaml` from 4.1.0 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.3.2) Updates `nanoid` from 3.3.11 to 3.3.19 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.11...3.3.19) Updates `picomatch` from 4.0.2 to 4.0.7 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.2...4.0.7) Updates `picomatch` from 2.3.1 to 2.3.2 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.2...4.0.7) Updates `postcss` from 8.5.6 to 8.5.28 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.28) Updates `rollup` from 4.44.1 to 4.63.3 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.44.1...v4.63.3) Updates `tar` from 7.4.3 to 7.5.22 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.4.3...v7.5.22) --- updated-dependencies: - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@humanfs/node" dependency-version: 0.16.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-version: 3.3.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.28 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.63.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-version: 7.5.22 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2026

Navigation Menu

chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates - #5

chore(deps): bump the npm_and_yarn group across 1 directory with 11 updates#5
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-ed7651b392

dependabot Bot commented on behalf of github Sep 15, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 15, 2026

v6.4.3

v6.4.2

6.4.3 (2026-06-01)

6.4.2 (2026-04-06)

6.4.1 (2025-10-20)

6.4.0 (2025-10-15)

6.3.7 (2025-10-14)

6.3.6 (2025-09-08)

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

node: v0.16.7

0.16.7 (2024-11-27)

Bug Fixes

0.16.8 (2026-04-17)

Bug Fixes

Dependencies

0.16.7 (2024-11-27)

Bug Fixes

v1.1.15

4.3.2 - 2026-08-26

Changed

Security

4.3.1 - 2026-07-31

Security

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

3.3.19

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

3.3.19

3.3.18

3.3.17

3.3.16

3.3.15

3.3.14

3.3.13

3.3.12

4.0.7

What's Changed

4.0.6

What's Changed

4.0.5

What's Changed

New Contributors

4.0.4

What's Changed

4.0.3

What's Changed

New Contributors

4.0.7 (2026-08-24)

Fixed

4.0.6 (2026-08-24)

Fixed

4.0.5 (2026-07-02)

Fixed

4.0.4 (2026-03-23)

Security

4.0.3 (2025-07-15)

Fixed

4.0.7

What's Changed

4.0.6

What's Changed

4.0.5

What's Changed