chore(deps): bump the npm_and_yarn group across 4 directories with 15 updates

[dependabot]

Bumps the npm_and_yarn group with 11 updates in the / directory:

Package	From	To
ws	8.19.0	8.21.1
postcss	8.5.6	8.5.25
vite	5.4.21	8.2.0
vitest	2.1.9	4.1.10
@ai-sdk/provider-utils	3.0.0	5.0.18
brace-expansion	1.1.12	1.1.18
flatted	3.3.3	3.4.4
js-yaml	4.1.1	4.3.1
path-to-regexp	0.1.12	8.4.2
picomatch	2.3.1	removed
shell-quote	1.8.3	1.9.0

Bumps the npm_and_yarn group with 5 updates in the /demo-projects/synth directory:

Package	From	To
postcss	8.5.6	8.5.25
vite	7.3.1	7.3.5
esbuild	0.27.2	0.28.1
picomatch	4.0.3	4.0.5
rollup	4.57.1	4.62.4

Bumps the npm_and_yarn group with 6 updates in the /demo-projects/dataviz/viz-b directory:

Package	From	To
postcss	8.5.6	8.5.25
vite	7.3.1	8.2.0
minimatch	3.1.2	3.1.5
brace-expansion	1.1.12	1.1.18
flatted	3.3.3	3.4.4
js-yaml	4.1.1	4.3.1

Bumps the npm_and_yarn group with 2 updates in the /demo-projects/dataviz/viz-a directory: postcss and vite.

Updates ws from 8.19.0 to 8.21.1

Release notes

Sourced from ws's releases.

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

... (truncated)

Commits

• ae1de54 [dist] 8.21.1
• 8e9511b [ci] Trust Coveralls Homebrew tap
• f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
• 8df8265 [ci] Update actions/checkout action to v7
• a2f4e7c [fix] Count empty fragments toward the limit (#2329)
• e79f912 [pkg] Approve install scripts for bufferutil and utf-8-validate
• 4ea355d [doc] Document 32-bit signed integer coercion for option values
• 2120f4c [example] Remove uuid dependency
• 4c534a6 [security] Add latest vulnerability to SECURITY.md
• bca91ad [dist] 8.21.0
• Additional commits viewable in compare view

Updates postcss from 8.5.6 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

... (truncated)

Commits

• 08c989c Release 8.5.25 version
• 24f6814 Fix 8.5.17 visitor regression
• f2fa53f Add supply chain security requirement to PostCSS plugin guide
• 10edf0b fix: return empty array for empty string in list.split (#2121)
• 0ebe8ad Release 8.5.24 version
• 73218c6 Update dependencies
• 9a114f6 Preserve the BOM when stringifying (#2119)
• 9069261 Fix types check
• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates vite from 5.4.21 to 8.2.0

Release notes

Sourced from vite's releases.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.0 (2026-07-30)

Features

• add input to server.fs.allow (#23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
• config: include column in config incompatibility location (#23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
• deps: update all non-major dependencies (#23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)
• module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)
• server: strip base in indexHtml module graph lookup (#22932) (fa005d1)
• support resolving top-level input option with plugins (#23101) (41df81a)

Documentation

• config: correct cacheDir default fallback description (#23060) (aafa103)

Tests

• config CJS module vars in ESM case (#23010) (d8cd388)

8.2.0-beta.0 (2026-07-22)

Features

• add input option (#22642) (9beae37)
• config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)
• css: export PostCSS config type for type-safe configs (#22792) (302c755)
• dev: label network URLs with their interface name (#22830) (78accc4)
• optimizer: support aube lockfile (#22813) (6319827)
• optimizer: support nub lockfile (#22891) (65d3604)
• update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)
• wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

• build: map CSS chunks in chunk import maps (fix #22946) (#22947) (e16ff3a)
• config: exclude virtual modules from native config compat check (#22979) (2ced1fe)
• css: rewrite urls in OnceExit-injected content (#22983) (abb793e)
• deps: update all non-major dependencies (#22985) (04f345b)
• deps: update dependency magic-string to v1 (#22998) (c60b4d7)
• hmr: remove hot data after prune (#23002) (be96316)
• resolve root to real path (#22832) (55bba7b)

Performance Improvements

... (truncated)

Commits

• 24a611f release: v7.2.4
• 2d66b7b fix: revert "perf(deps): replace debug with obug (#21107)"
• a668014 release: v7.2.3
• acfe939 perf(deps): replace debug with obug (#21107)
• 4f8171e fix(deps): update all non-major dependencies (#21128)
• 5029720 chore(deps): update rolldown-related dependencies (#21127)
• 5909efd fix: allow multiple bindCLIShortcuts calls with shortcut merging (#21103)
• 39a0a15 chore(deps): update rolldown-related dependencies (#21095)
• 6a34ac3 fix(deps): update all non-major dependencies (#21096)
• 02ceaec chore(deps): update dependency @​rollup/plugin-commonjs to v29 (#21099)
• Additional commits viewable in compare view

Updates vitest from 2.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in vitest-dev/vitest#10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in vitest-dev/vitest#10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

... (truncated)

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• a7a61e7 chore: release v4.1.9 (#10598)
• 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
• 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
• a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
• e61f2dd chore: release v4.1.8
• e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• a09d472 chore: release v4.1.7
• a8fd24c chore: release v4.1.6
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates vitest from 2.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in vitest-dev/vitest#10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in vitest-dev/vitest#10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

... (truncated)

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• a7a61e7 chore: release v4.1.9 (#10598)
• 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
• 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
• a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
• e61f2dd chore: release v4.1.8
• e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• a09d472 chore: release v4.1.7
• a8fd24c chore: release v4.1.6
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates @ai-sdk/provider-utils from 3.0.0 to 5.0.18

Release notes

Sourced from @​ai-sdk/provider-utils's releases.

@​ai-sdk/svelte@​4.0.240

Patch Changes

• ai@6.0.240

@​ai-sdk/svelte@​4.0.239

Patch Changes

• ai@6.0.239

@​ai-sdk/react@​4.0.51

Patch Changes

• ai@7.0.48

@​ai-sdk/vue@​4.0.48

Patch Changes

• ai@7.0.48

@​ai-sdk/vue@​4.0.47

Patch Changes

• Updated dependencies [5fc7da5]
• Updated dependencies [93b2acd]
  • @​ai-sdk/provider-utils@​5.0.18
  • ai@7.0.47

@​ai-sdk/vue@​4.0.46

Patch Changes

• ai@7.0.46

@​ai-sdk/vue@​4.0.45

Patch Changes

• Updated dependencies [d6ce0ee]
• Updated dependencies [fa95504]
• Updated dependencies [349afe7]
  • ai@7.0.45
  • @​ai-sdk/provider-utils@​5.0.17

@​ai-sdk/vue@​4.0.44

Patch Changes

• Updated dependencies [015acb4]
  • ai@7.0.44

@​ai-sdk/gateway@​4.0.37

Patch Changes

... (truncated)

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.18

Patch Changes

• 5fc7da5: chore: centralize empty language model usage creation in provider utilities.
• 93b2acd: chore: centralize response metadata conversion

5.0.17

Patch Changes

• fa95504: feat(ai): support experimental tool callers in ToolLoopAgent

5.0.16

Patch Changes

• d8210b6: chore: centralize record type guards in provider-utils
• b192878: feat: add experimental_toolCaller routing to generateText for code mode

5.0.15

Patch Changes

• 1659cd5: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
• 6a5bdff: Fix validated Node.js downloads when the HTTP connector requests a single DNS address.

5.0.14

Patch Changes

• 0c464d9: feat(provider-utils): add a typed serialization error
• c49380c: feat: add experimental streaming speech translation models (openai.translation('gpt-realtime-translate') over the OpenAI Realtime translations WebSocket and google.translation('gemini-3.5-live-translate-preview') over the Gemini Live API). connectToWebSocket in @ai-sdk/provider-utils now passes close code and reason to onClose (additive, optional parameter).

5.0.13

Patch Changes

• Updated dependencies [1e2f324]
  • @​ai-sdk/provider@​4.0.4

5.0.12

Patch Changes

• 02ffdcb: fix(provider-utils): bound media-type sniffing decode for ID3-prefixed input

  Media-type detection stripped ID3 tags before the ~18-byte prefix cap, decoding the entire base64 attachment (plus a full-size copy) whenever the data began with ID3/SUQz. This turned the intended O(1) sniff into an O(N) decode of the whole attachment. Detection now decodes at most a bounded prefix and skips the ID3 tag within that bound, keeping cost O(1) in input size on all paths (image, audio, and combined).

• 76cb673: fix: detect MP4 audio from its ftyp box during transcription

... (truncated)

Commits

• e84b8bc Version Packages (#18291)
• 5fc7da5 chore: centralize empty language model usage creation in provider utils (#18209)
• 93b2acd chore: centralize response metadata conversion (#18212)
• e464a0c Version Packages (#18237)
• fa95504 feat(ai): support experimental tool callers in ToolLoopAgent (#18231)
• eb3d1af Version Packages (#18208)
• b192878 feat: add experimental_toolCaller routing to generateText for code mode (#18219)
• d8210b6 chore: centralize record type guards in provider-utils (#18167)
• a56fbc0 Version Packages (#18083)
• 6a5bdff fix(provider-utils): preserve DNS lookup callback shape (#18096)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ai-sdk/provider-utils since your current version.

Updates brace-expansion from 1.1.12 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

Commits

• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• 2203f4f 1.1.15
• 0b09384 Backport v5.0.6 change to v1 (#111)
• 10c05fc 1.1.14
• Additional commits viewable in compare view

Updates esbuild from 0.21.5 to 0.27.4

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 ...

  Description has been truncated

[dependabot]

Superseded by #6.