Skip to content

chore(deps): bump the npm-minor-and-patch group across 1 directory with 9 updates - #3159

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-27e7321c1e
Closed

chore(deps): bump the npm-minor-and-patch group across 1 directory with 9 updates#3159
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-and-patch-27e7321c1e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-and-patch group with 9 updates in the / directory:

Package From To
@vitest/spy 4.1.10 4.1.11
turbo 2.9.14 2.10.12
@vitejs/plugin-react 6.0.5 6.1.1
rollup 4.62.4 4.63.1
css-loader 7.1.4 7.1.5
webpack 5.109.2 5.110.1
uuid 14.0.1 14.0.2
sharp 0.35.3 0.35.4
cypress 15.20.1 15.21.1

Updates @vitest/spy from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/spy's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates turbo from 2.9.14 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

... (truncated)

Commits

Updates @vitejs/plugin-react from 6.0.5 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits
  • 04cac50 release: plugin-react@6.1.1 (#1440)
  • 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
  • 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
  • 61006e6 fix(deps): update all non-major dependencies (#1433)
  • e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
  • fb2d6f3 fix(deps): update all non-major dependencies (#1427)
  • 39b3173 release: plugin-react@6.1.0 (#1428)
  • f1340b0 feat(react): add native React Compiler support (#1419)
  • 9ab698e fix(deps): update all non-major dependencies (#1375)
  • See full diff in compare view

Updates rollup from 4.62.4 to 4.63.1

Release notes

Sourced from rollup's releases.

v4.63.1

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

v4.63.0

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

v4.62.5

4.62.5

2026-08-20

Bug Fixes

  • Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.63.1

2026-08-28

Bug Fixes

  • Revert function return value tracking until the most recent issue is understood (#6490)

Pull Requests

4.63.0

2026-08-25

Features

  • Allow to analyze function return values in many more cases (#6065)

Pull Requests

4.62.5

2026-08-20

Bug Fixes

  • Resolve an issue where compact mode could result in invalid module concatenations (#6468)

Pull Requests

Commits

Updates css-loader from 7.1.4 to 7.1.5

Release notes

Sourced from css-loader's releases.

v7.1.5

7.1.5 (2026-08-28)

Bug Fixes

  • strip BOM before processing with postcss (#1684) (bd20834)
Changelog

Sourced from css-loader's changelog.

7.1.5 (2026-08-28)

Bug Fixes

  • strip BOM before processing with postcss (#1684) (bd20834)
Commits
  • be04ec2 chore(release): 7.1.5
  • 405bdde docs: deprecate css-loader in favor of webpack's built-in CSS support (#1683)
  • bd20834 fix: strip BOM before processing with postcss (#1684)
  • 488cdb1 chore(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#1663)
  • fd4cb47 chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#1659)
  • 4bf84fa docs: clarify style-loader usage in Getting Started (#1656)
  • d7441e5 chore(deps): bump immutable from 5.1.3 to 5.1.5 (#1654)
  • ca53a77 chore(deps): bump minimatch (#1653)
  • See full diff in compare view

Updates webpack from 5.109.2 to 5.110.1

Release notes

Sourced from webpack's releases.

v5.110.1

Patch Changes

v5.110.0

Minor Changes

  • Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

  • Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

  • Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

  • Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

  • Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

  • Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

  • Give externals the original request of a context module element. (by @​alexander-akait in #21780)

  • Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

  • Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

  • Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

  • Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

  • Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

  • Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

  • Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

  • Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

  • Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

  • Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

  • Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

  • Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #21841)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.1

Patch Changes

5.110.0

Minor Changes

  • Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

  • Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

  • Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

  • Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

  • Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

  • Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

  • Give externals the original request of a context module element. (by @​alexander-akait in #21780)

  • Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

  • Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

  • Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

  • Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

  • Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

  • Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

  • Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

  • Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

  • Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

  • Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

  • Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

... (truncated)

Commits
  • 0b2952e chore(release): new release (#21846)
  • 2a1fda4 fix: throw a SyntaxError from a module that failed to parse (#21847)
  • 281efa6 test(css): cover a loader-added BOM in the css pipeline (#21848)
  • 36ded2c fix: accept the optimization.minimize true shorthand after normalization (#21...
  • c150225 fix(cache): accept a managedPaths RegExp without a capture group, and speed u...
  • 3a7c0e6 chore(release): new release (#21545)
  • 75891c8 chore(changesets): union same-subject entries (#21841)
  • 6b96de7 feat(config): emit no development source map for library builds (#21839)
  • ff0c832 feat(css,html): reach embedded source from cssMinify and htmlMinify (#21838)
  • 06bedfb chore(deps): bump test/wpt in the dependencies group (#21836)
  • Additional commits viewable in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

  • v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
  • v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
  • v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)
Commits
  • fd59f02 chore(main): release 14.0.2 (#967)
  • f3c564e docs: point the Node support permalink at the CI version matrix (#974)
  • b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
  • 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
  • ea83515 docs: cleanup API summary (#968)
  • ac36860 chore: pin publint version in CI (#966)
  • a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
  • See full diff in compare view

Updates sharp from 0.35.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 31, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-27e7321c1e branch from e8df3b3 to 399b3ad Compare August 31, 2026 21:57
@dependabot
chore(deps): bump the npm-minor-and-patch group across 1 directory wi…
f92334b 
…th 9 updates

Bumps the npm-minor-and-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@vitest/spy](https://github.com/vitest-dev/vitest/tree/HEAD/packages/spy) | `4.1.10` | `4.1.11` |
| [turbo](https://github.com/vercel/turborepo) | `2.9.14` | `2.10.12` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.1` |
| [rollup](https://github.com/rollup/rollup) | `4.62.4` | `4.63.1` |
| [css-loader](https://github.com/webpack/css-loader) | `7.1.4` | `7.1.5` |
| [webpack](https://github.com/webpack/webpack) | `5.109.2` | `5.110.1` |
| [uuid](https://github.com/uuidjs/uuid) | `14.0.1` | `14.0.2` |
| [sharp](https://github.com/lovell/sharp) | `0.35.3` | `0.35.4` |
| [cypress](https://github.com/cypress-io/cypress) | `15.20.1` | `15.21.1` |



Updates `@vitest/spy` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/spy)

Updates `turbo` from 2.9.14 to 2.10.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.9.14...v2.10.12)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `rollup` from 4.62.4 to 4.63.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.62.4...v4.63.1)

Updates `css-loader` from 7.1.4 to 7.1.5
- [Release notes](https://github.com/webpack/css-loader/releases)
- [Changelog](https://github.com/webpack/css-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/css-loader@v7.1.4...v7.1.5)

Updates `webpack` from 5.109.2 to 5.110.1
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.2...v5.110.1)

Updates `uuid` from 14.0.1 to 14.0.2
- [Release notes](https://github.com/uuidjs/uuid/releases)
- [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md)
- [Commits](uuidjs/uuid@v14.0.1...v14.0.2)

Updates `sharp` from 0.35.3 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.3...v0.35.4)

Updates `cypress` from 15.20.1 to 15.21.1
- [Release notes](https://github.com/cypress-io/cypress/releases)
- [Changelog](https://github.com/cypress-io/cypress/blob/develop/CHANGELOG.md)
- [Commits](cypress-io/cypress@v15.20.1...v15.21.1)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@vitest/spy"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: css-loader
  dependency-version: 7.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: cypress
  dependency-version: 15.21.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: rollup
  dependency-version: 4.63.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: turbo
  dependency-version: 2.10.12
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: uuid
  dependency-version: 14.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: webpack
  dependency-version: 5.110.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-and-patch-27e7321c1e branch from 849423c to f92334b Compare August 31, 2026 22:40
@HughParry HughParry mentioned this pull request Sep 1, 2026
Merged
@HughParry

HughParry commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Superseded by #3164, which lands this bump together with the other nine open dependabot PRs against a single lockfile.

@HughParry HughParry closed this Sep 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-and-patch-27e7321c1e branch September 1, 2026 11:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@forgetso forgetso Awaiting requested review from forgetso forgetso is a code owner
@goastler goastler Awaiting requested review from goastler goastler is a code owner
@HughParry HughParry Awaiting requested review from HughParry HughParry is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@HughParry