Bump the build-toolchain group across 1 directory with 4 updates

[dependabot]

Bumps the build-toolchain group with 4 updates in the / directory: terser, esbuild, vite-plus and vitest.

Updates terser from 5.49.2 to 5.50.0

Changelog

Sourced from terser's changelog.

v5.50.0

• Experimental TypeScript type stripping
• Fixed a crash in mozilla AST conversion of imports

Commits

• 0868263 5.50.0
• 6369c68 update changelog
• e32443b experimental type stripping (#1718)
• f41d858 Update actions/setup-node action to v7 (#1708)
• 9fdbd4d Update actions/checkout action to v7 (#1695)
• f1b0e04 fix crash in mozilla AST conversion of imports
• f1f0594 add mutation test
• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates vite-plus from 0.2.8 to 0.3.0

Release notes

Sourced from vite-plus's releases.

vite-plus v0.3.0: XDG install layout, tsup project migration, and Bun 1.4 support

Fresh installs now use a split directory layout instead of a single ~/.vite-plus root. Unix follows the XDG base directory specification, and Windows uses the standard %LOCALAPPDATA% and %APPDATA% folders. Existing ~/.vite-plus installs keep their current directory layout. vp migrate also converts tsup projects, and vp now sends Bun 1.4 package-manager commands to bun directly. The published npm package shrank by about half, and the upgrade check no longer delays each command.

Breaking Changes

• Fresh installs now use a split directory layout instead of a single root: XDG base directories on Unix, and the standard known folders on Windows. Existing ~/.vite-plus installs keep their current layout, and the installer does not move their files. VP_HOME still selects the single-root layout (#2346), by @​forehalo

  Category	Unix default	Windows default	Single-root (VP_HOME)
  bin	~/.local/share/vite-plus/bin	%LOCALAPPDATA%\vite-plus\bin	<root>/bin
  data	~/.local/share/vite-plus	%LOCALAPPDATA%\vite-plus\data	<root>
  cache	~/.cache/vite-plus	%LOCALAPPDATA%\vite-plus\cache	<root>/cache
  config	~/.config/vite-plus	%APPDATA%\vite-plus	<root>
  state	~/.local/state/vite-plus	%LOCALAPPDATA%\vite-plus\state	<root>

  The installer configures your shell for the new location, and CI that installs through setup-vp keeps the single-root layout automatically. Update each hard-coded ~/.vite-plus/bin path, such as a path in a Dockerfile.

  vp upgrade leaves an existing install where it is. To move one to the split layout, remove it and install again:

  vp implode
  unset VP_HOME VP_DATA_DIR VP_BIN_DIR VP_CACHE_DIR
  curl -fsSL https://vite.plus | bash

  On Windows, run vp implode, then Remove-Item Env:\VP_HOME, Env:\VP_DATA_DIR, Env:\VP_BIN_DIR, Env:\VP_CACHE_DIR -ErrorAction SilentlyContinue, then irm https://vite.plus/ps1 | iex. Also delete any persistent VP_HOME or VP_*_DIR definition from your shell profile or system environment, because a fresh install still honors them and VP_HOME selects the single-root layout.

  vp implode removes every Vite+ managed Node.js runtime, global package, configuration file, and cache. Stay on your current layout if you would rather not rebuild that state. See Move an existing install to the split directory layout.

Highlights

• vp migrate now converts tsup projects. It replaces the tsup dependency and script with vp pack. It also changes tsup.config.ts to a tsdown.config.ts that imports from vite-plus/pack (#2434), by @​KTrain5169
• Shell integrations now accept the global -C flag. vp -C <dir> env use changes the environment of your current shell. The -C<dir> and -C=<dir> forms also work. In zsh, Fish, Nushell, and PowerShell, vpr completion keeps the working directory when it changes the command to vp run (#2508), by @​simulacre7
• The published vite-plus npm package shrank from 1.05 MB to 516 kB, a 51% reduction. It now includes only Markdown files from the documentation workspace. It no longer includes VitePress tooling, images, or deployment files (#2480), by @​liangmiQwQ

Features

• With Bun 1.4 or later, Vite+ forwards these commands and flags to bun. Earlier Bun versions keep their fallback or unsupported behavior and report the required Bun version (#2513), by @​jong-kyung
  • vp dedupe runs bun dedupe, including --check
  • vp pm prune runs bun prune
  • vp pm audit --fix runs bun audit fix
  • vp add, vp remove, and vp update send --filter to bun
  • vp add --save-catalog sends --catalog to bun
• The upgrade check no longer delays fast commands. It runs in a separate process. It reports an available update during a later command, and commands no longer wait for the registry (#2380), by @​liangmiQwQ
• Upgrade the bundled toolchain (#2443, #2500, #2504, #2519, #2532), by @​voidzero-guard[bot]:
  • vite: 8.2.1 to 8.2.2
  • rolldown: 1.2.3 to 1.2.5
  • vitest: 4.1.10 to 4.1.11
  • oxlint: 1.77.0 to 1.79.0
  • oxfmt: 0.62.0 to 0.64.0

... (truncated)

Commits

• b2d15e3 release: v0.3.0: XDG install layout, tsup project migration, and Bun 1.4 supp...
• ce131be fix(cli): run root-only workspaces in place (#2533)
• 634bd07 fix(cli): improve workspace app target classification (#2530)
• 501cc3a feat(cli): tsup -> tsdown -> Vite+ migration (#2434)
• 916fae1 fix(cli): guide local users to global-only commands (#2522)
• 45acff9 fix(trampoline): reject unversioned shim pointers (#2526)
• f0bebb0 fix(installer): hide shell config warnings in CI (#2511)
• c25b6b2 fix(installer): enforce Windows setup requirements (#2505)
• 349a72b fix(cli): support GitLab setup-vp legacy layout (#2520)
• 2b16995 fix(cli): normalize staged concurrency options (#2501)
• Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	esbuild@​0.28.2
	vitest@​4.1.11
	terser@​5.50.0
	vite-plus@​0.3.0

View full report