Bump the npm_and_yarn group across 10 directories with 7 updates by dependabot[bot] · Pull Request #389 · HeapReaper/Kiyomi

dependabot · 2026-02-25T22:57:51Z

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
@hotwired/turbo	`8.0.13`	`8.0.21`
vite	`5.4.14`	`5.4.21`
basic-ftp	`5.0.5`	`5.2.0`
esbuild	`0.21.5`	`0.27.3`
form-data	`4.0.1`	`4.0.5`
js-yaml	`4.1.0`	`4.1.1`
tar-fs	`3.0.6`	`3.1.1`

Bumps the npm_and_yarn group with 1 update in the /Modules/Financials directory: vite.
Bumps the npm_and_yarn group with 1 update in the /Modules/Flights directory: vite.
Bumps the npm_and_yarn group with 1 update in the /Modules/Home directory: vite.
Bumps the npm_and_yarn group with 1 update in the /Modules/Logging directory: vite.
Bumps the npm_and_yarn group with 1 update in the /Modules/Mail directory: vite.
Bumps the npm_and_yarn group with 1 update in the /Modules/Panel directory: vite.
Bumps the npm_and_yarn group with 1 update in the /Modules/Settings directory: vite.
Bumps the npm_and_yarn group with 1 update in the /Modules/Tests directory: vite.
Bumps the npm_and_yarn group with 1 update in the /Modules/Users directory: vite.

Updates @hotwired/turbo from 8.0.13 to 8.0.21

Release notes

Sourced from @hotwired/turbo's releases.

v8.0.21

What's Changed

Remove SubmitEvent polyfill by @seanpdoyle in hotwired/turbo#909

Remove requestSubmit polyfill by @seanpdoyle in hotwired/turbo#908

Bump multer from 1.4.2 to 2.0.2 by @dependabot[bot] in hotwired/turbo#1451

Add [method] and [scroll] attributes for Refresh Stream by @seanpdoyle in hotwired/turbo#1208

Functional Tests: Replace chai with Playwright Assertions by @seanpdoyle in hotwired/turbo#1454

Fix regression with empty target attribute (#1444) by @yujiteshima in hotwired/turbo#1455

Functional Tests: Rendering - Replace chai with Playwright by @seanpdoyle in hotwired/turbo#1458

Rendering Functional Tests: Replace chai with Playwright by @seanpdoyle in hotwired/turbo#1459

Frame Functional Tests: Replace chai with Playwright by @seanpdoyle in hotwired/turbo#1461

Build: Remove circular dependency by @seanpdoyle in hotwired/turbo#1453

Visit Functional Tests: Replace chai with Playwright by @seanpdoyle in hotwired/turbo#1463

Fix UUID generation to include all hex digits by @kaisersakhi in hotwired/turbo#1425

Fix #577: Send the Turbo-Frame header as referenced by data-turbo-frame attribute on form submission by @inkstak in hotwired/turbo#579

Add support for data-turbo-frame="_parent" in nested frames by @anthonyfranco in hotwired/turbo#1446

Use new format instead of legacy by @loqimean in hotwired/turbo#1016

Remove duplicate siblings when using before/after actions by @tpaulshippy in hotwired/turbo#1290

Update html[dir] attribute during navigation by @alhajrahmoun in hotwired/turbo#1418

Loading Functional Tests: Replace assert with expect by @seanpdoyle in hotwired/turbo#1466

Remove deprecated support for [data-turbo-cache="false"] by @seanpdoyle in hotwired/turbo#1470

Remove deprecated Turbo.clearCache() function by @seanpdoyle in hotwired/turbo#1471

Playwright Root: use expect instead of assert by @seanpdoyle in hotwired/turbo#1467

Simplify same page anchor visits by @domchristie in hotwired/turbo#1285

PrefetchCache: extract and re-use LRUCache from SnapshotCache by @seanpdoyle in hotwired/turbo#1469

Playwright: replace assert with expect by @seanpdoyle in hotwired/turbo#1465

Bump js-yaml from 4.1.0 to 4.1.1 by @dependabot[bot] in hotwired/turbo#1468

Remove chai: Replace all calls with Playwright's expect by @seanpdoyle in hotwired/turbo#1473

Tests: Flaky [autofocus] assertions by @seanpdoyle in hotwired/turbo#1474

Prevent slow turbo frame requests from resetting cookies by @domchristie in hotwired/turbo#1399

Fix noscript style evaluation during navigation (#1464) by @yujiteshima in hotwired/turbo#1475

Mention the correct element "data-turbo-suppress-warning" is expected on by @redross in hotwired/turbo#1424

New Contributors

@yujiteshima made their first contribution in hotwired/turbo#1455

@kaisersakhi made their first contribution in hotwired/turbo#1425

@inkstak made their first contribution in hotwired/turbo#579

@anthonyfranco made their first contribution in hotwired/turbo#1446

@loqimean made their first contribution in hotwired/turbo#1016

@tpaulshippy made their first contribution in hotwired/turbo#1290

@alhajrahmoun made their first contribution in hotwired/turbo#1418

@redross made their first contribution in hotwired/turbo#1424

Full Changelog: hotwired/turbo@v8.0.20...v8.0.21

v8.0.20

What's Changed

Fix: preserve removed turbo-frames with refresh=morph on page refreshes by @jorgemanrubia in hotwired/turbo#1452

... (truncated)

Commits

9f5b6c4 Bump version
d069101 Mention the correct element "data-turbo-suppress-warning" is expected on (#1424)
5eca98f Prevent noscript style evaluation during navigation (#1475)
899df35 Cancel frame requests when the frame is disconnected, disabled, or its src is...
e24e768 Tests: Flaky [autofocus] assertions
cf0c68f Remove chai: Replace all calls with Playwright's expect (#1473)
f34af4c Merge pull request #1468 from hotwired/dependabot/npm_and_yarn/js-yaml-4.1.1
18fe891 Playwright: replace assert with expect (#1465)
b65bf46 Merge pull request #1469 from seanpdoyle/debounced-prefetch
33a11f1 Merge pull request #1285 from domchristie/tidy_same_page_anchor_visits_2
Additional commits viewable in compare view

Updates vite from 5.4.14 to 5.4.21

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970

chore: update CHANGELOG (ca88ed7)

5.4.20 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (482000f), closes #20736

fix: port [email protected] changes to [email protected] (#20737) (4f1c35b), closes #20737

5.4.19 (2025-04-30)

fix: backport #19965, check static serve file inside sirv (#19966) (766947e), closes #19965 #19966

5.4.18 (2025-04-10)

fix: backport #19830, reject requests with # in request-target (#19831) (823675b), closes #19830 #19831

5.4.17 (2025-04-03)

fix: backport #19782, fs check with svg and relative paths (#19784) (84b2b46), closes #19782 #19784

5.4.16 (2025-03-31)

fix: backport #19761, fs check in transform middleware (#19762) (b627c50), closes #19761 #19762

5.4.15 (2025-03-24)

fix: backport #19702, fs raw query with query separators (#19703) (807d7f0), closes #19702 #19703

Commits

adce3c2 release: v5.4.21
cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
ca88ed7 chore: update CHANGELOG
997700f release: v5.4.20
482000f fix: apply fs.strict check to HTML files (#20736)
80a333a release: v5.4.19
766947e fix: backport #19965, check static serve file inside sirv (#19966)
731b77d release: v5.4.18
823675b fix: backport #19830, reject requests with # in request-target (#19831)
0a2518a release: v5.4.17
Additional commits viewable in compare view

Updates basic-ftp from 5.0.5 to 5.2.0

Release notes

Sourced from basic-ftp's releases.

5.2.0

Changed: Skip files with invalid name in downloadToDir.

5.1.0

Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)

Changelog

Sourced from basic-ftp's changelog.

5.2.0

Changed: Skip files with invalid name in downloadToDir.

5.1.0

Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)

Commits

5d41e45 Bump version
49c2e73 Update dependencies
2a2a0e6 Skip invalid filenames
65c90d9 Fix permissions for workflows
593cb78 Set permissions for workflow jobs
36adf11 Remove deprecated CodeQL check
9da4af0 Update changelog
6993039 Improve naming
0b8f756 Improve naming
67a53f2 Bump version
Additional commits viewable in compare view

Updates esbuild from 0.21.5 to 0.27.3

Release notes

Sourced from esbuild's releases.

v0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

9129e00 publish 0.27.3 to npm
e20e411 small fix to release notes
0dc0f2d fix #4322: parse and print CSS @scope rules
55fe391 update firefox css gradient support
2c35297 update gradient lowering transform
9209e44 Update Go to 1.25.7 (#4388)
e8d861b close #4374: compat table for the using feature
19b8887 no longer need williamkapke/node-compat-table
7e44218 the kangax/compat-table repo moved to a new url
23b9338 run make update-compat-table
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Updates form-data from 4.0.1 to 4.0.5

Release notes

Sourced from form-data's releases.

v4.0.4

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2

v4.0.2 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

[Fix] set Symbol.toStringTag when available [#396](https://github.com/form-data/form-data/issues/396)

Commits

... (truncated)

Changelog

Sourced from form-data's changelog.

v4.0.5 - 2025-11-17

Commits

[Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076

[Dev Deps] update @ljharb/eslint-config, eslint 5822467

[Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

[meta] add auto-changelog 811f682

[Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76

[Fix] Switch to using crypto random for boundary values 3d17230

[Tests] fix linting errors 5e34080

[meta] actually ensure the readme backup isn’t published 316c82b

[Dev Deps] update @ljharb/eslint-config 58c25d7

[meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

[Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

[eslint] use a shared config 426ba9a

[eslint] fix some spacing issues 2094191

[Refactor] use hasown 81ab41b

[Fix] validate boundary type in setBoundary() method 8d8e469

[Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1

[Dev Deps] remove unused deps 870e4e6

[meta] remove local commit hooks e6e83cc

[Dev Deps] update eslint 4066fd6

[meta] fix scripts to use prepublishOnly c4bbb13

v4.0.2 - 2025-02-14

Merged

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

[Fix] set Symbol.toStringTag when available [#573](https://github.com/form-data/form-data/issues/573)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

fix (npmignore): ignore temporary build files [#532](https://github.com/form-data/form-data/issues/532)

Fixed

[Fix] set Symbol.toStringTag when available (#573) [#396](https://github.com/form-data/form-data/issues/396)

... (truncated)

Commits

68ff7dd v4.0.5
5822467 [Dev Deps] update @ljharb/eslint-config, eslint
76d0dee [Fix] set Symbol.toStringTag in the proper place
16e0076 [Tests] Switch to newer v8 prediction library; enable node 24 testing
41996f5 v4.0.4
316c82b [meta] actually ensure the readme backup isn’t published
2300ca1 [meta] fix readme capitalization
811f682 [meta] add auto-changelog
5e34080 [Tests] fix linting errors
1d11a76 [Tests] handle predict-v8-randomness failures in node < 17 and node > 23
Additional commits viewable in compare view

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
See full diff in compare view

Updates tar-fs from 3.0.6 to 3.1.1

Commits

0aa57de 3.1.1
0bd54cd expand check
cb1c571 3.1.0
374460e add optional disablement of symlink validation (#119)
5bfe6df 3.0.10
63e12f9 bare support
2ceedf4 3.0.9
647447b check windows tweak (#115)
e4a7a40 3.0.8
504ca0f upgrade bare packages
Additional commits viewable in compare view

Updates vite from 4.5.14 to 7.3.1

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970

chore: update CHANGELOG (ca88ed7)

5.4.20 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (482000f), closes #20736

fix: port [email protected] changes to [email protected] (#20737) (4f1c35b), closes #20737

5.4.19 (2025-04-30)

fix: backport #19965, check static serve file inside sirv (#19966) (766947e), closes #19965 #19966

5.4.18 (2025-04-10)

fix: backport #19830, reject requests with # in request-target (#19831) (823675b), closes #19830 #19831

5.4.17 (2025-04-03)

fix: backport #19782, fs check with svg and relative paths (#19784) (84b2b46), closes #19782 #19784

5.4.16 (2025-03-31)

fix: backport #19761, fs check in transform middleware (#19762) (b627c50), closes #19761 #19762

5.4.15 (2025-03-24)

fix: backport #19702, fs raw query with query separators (#19703) (807d7f0), closes #19702 #19703

Commits

adce3c2 release: v5.4.21
cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
ca88ed7 chore: update CHANGELOG
997700f release: v5.4.20
482000f fix: apply fs.strict check to HTML files (#20736)
80a333a release: v5.4.19
766947e fix: backport #19965, check static serve file inside sirv (#19966)
731b77d release: v5.4.18
823675b fix: backport #19830, reject requests with # in request-target (#19831)
0a2518a release: v5.4.17
Additional commits viewable in compare view

Updates vite from 4.5.14 to 7.3.1

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.21 (2025-10-20)

fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970) (cad1d31), closes #20968 #20970

chore: update CHANGELOG (ca88ed7)

5.4.20 (2025-09-08)

fix: apply fs.strict check to HTML files (#20736) (482000f), closes #20736

fix: port [email protected] changes to [email protected] (#20737) (4f1c35b), closes #20737

5.4.19 (2025-04-30)

fix: backport #19965, check static serve file inside sirv (#19966) (766947e), closes #19965 #19966

5.4.18 (2025-04-10)

fix: backport #19830, reject requests with # in request-target (#19831) (823675b), closes #19830 #19831

5.4.17 (2025-04-03)

fix: backport #19782, fs check with svg and relative paths (#19784) (84b2b46), closes #19782 #19784

5.4.16 (2025-03-31)

fix: backport #19761, fs check in transform middleware (#19762) (b627c50), closes #19761 #19762

5.4.15 (2025-03-24)

fix: backport #19702, fs raw query with query separators (#19703) (807d7f0), closes #19702 #19703

Commits

adce3c2 release: v5.4.21
cad1d31 fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20970)
ca88ed7 chore: update CHANGELOG
997700f release: v5.4.20
482000f fix: apply fs.strict check to HTML files (#20736)
80a333a release: v5.4.19
766947e fix: backport #19965, check static serve file inside sirv (#19966)
731b77d release: v5.4.18
823675b fix: backport #19830, reject requests with # in request-target (#19831)
0a2518a release: v5.4.17
Additional commits viewable in compare view

Updates vite from 4.5.14 to 7.3.1

Release notes

Sourced from vite's releases.

v5.4.21

Please refer to CHANGELOG.md for details.

v5.4.20

Please refer to CHANGELOG.md for details.

v5.4.19

Please refer to

Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@hotwired/turbo](https://github.com/hotwired/turbo) | `8.0.13` | `8.0.21` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.14` | `5.4.21` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.0.5` | `5.2.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.21.5` | `0.27.3` | | [form-data](https://github.com/form-data/form-data) | `4.0.1` | `4.0.5` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [tar-fs](https://github.com/mafintosh/tar-fs) | `3.0.6` | `3.1.1` | Bumps the npm_and_yarn group with 1 update in the /Modules/Financials directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /Modules/Flights directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /Modules/Home directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /Modules/Logging directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /Modules/Mail directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /Modules/Panel directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /Modules/Settings directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /Modules/Tests directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 1 update in the /Modules/Users directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@hotwired/turbo` from 8.0.13 to 8.0.21 - [Release notes](https://github.com/hotwired/turbo/releases) - [Commits](hotwired/turbo@8.0.13...v8.0.21) Updates `vite` from 5.4.14 to 5.4.21 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `basic-ftp` from 5.0.5 to 5.2.0 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.0.5...v5.2.0) Updates `esbuild` from 0.21.5 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.27.3) Updates `form-data` from 4.0.1 to 4.0.5 - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.1...v4.0.5) Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `tar-fs` from 3.0.6 to 3.1.1 - [Commits](mafintosh/tar-fs@v3.0.6...v3.1.1) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) Updates `vite` from 4.5.14 to 7.3.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite) --- updated-dependencies: - dependency-name: "@hotwired/turbo" dependency-version: 8.0.21 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 5.4.21 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: basic-ftp dependency-version: 5.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar-fs dependency-version: 3.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.1 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Feb 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 10 directories with 7 updates#389

Bump the npm_and_yarn group across 10 directories with 7 updates#389
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-5e2ca41c9c

dependabot bot commented on behalf of github Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Feb 25, 2026

v8.0.21

What's Changed

New Contributors

v8.0.20

What's Changed

v5.4.21

v5.4.20

v5.4.19

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

5.2.0

5.1.0

5.2.0

5.1.0

v0.27.3

Changelog: 2024

0.24.2

0.24.1

v4.0.4

v4.0.4 - 2025-07-16

Commits

v4.0.3

v4.0.3 - 2025-06-05

Fixed

Commits

v4.0.2

v4.0.2 - 2025-02-14

Merged

Fixed

Commits

v4.0.5 - 2025-11-17

Commits

v4.0.4 - 2025-07-16

Commits

v4.0.3 - 2025-06-05

Fixed

Commits

v4.0.2 - 2025-02-14

Merged

Fixed

[4.1.1] - 2025-11-12

Security

v5.4.21

v5.4.20

v5.4.19

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

v5.4.21

v5.4.20

v5.4.19

5.4.21 (2025-10-20)

5.4.20 (2025-09-08)

5.4.19 (2025-04-30)

5.4.18 (2025-04-10)

5.4.17 (2025-04-03)

5.4.16 (2025-03-31)

5.4.15 (2025-03-24)

v5.4.21

v5.4.20

v5.4.19

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!