Bump the npm_and_yarn group across 1 directory with 2 updates by dependabot[bot] · Pull Request #108 · LCSOGthb/Tools

dependabot · 2026-08-30T16:37:48Z

Bumps the npm_and_yarn group with 2 updates in the / directory: esbuild and vite.

Updates esbuild from 0.27.3 to 0.28.1

Release notes

v0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

bb9db84 publish 0.28.1 to npm
9ff053e security: add integrity checks to the Deno API
0a9bf21 enforce non-negative size in gzip parser
e2a1a71 security: forbid \\ in local dev server requests
83a2cbf fix #4482: don't inline using declarations
308ad74 fix #4471: renaming of nested var declarations
f013f5f fix some typos
aafd6e4 chore: fix some minor issues in comments (#4462)
15300c3 follow up: cjs evaluation fixes
1bda0c3 fix #4461, fix #4467: esm evaluation fixes
Additional commits viewable in compare view

Updates vite from 7.3.2 to 7.3.5

Release notes

Sourced from vite's releases.

v7.3.5

Please refer to CHANGELOG.md for details.

v7.3.3

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.5 (2026-06-01)

Bug Fixes

backport #22572, reject windows alternate paths (#22574) (8c18556)

deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

Miscellaneous Chores

skip v7.3.4 release (8a6a0c9)

7.3.4 (2026-06-01)

Bug Fixes

backport #22572, reject windows alternate paths (#22574) (8c18556)

deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

7.3.3 (2026-05-07)

Bug Fixes

avoid destructure lowering for newer safari (#22346) (5ab51c0)

Commits

077945c release: v7.3.5
8a6a0c9 chore: skip v7.3.4 release
8c18556 fix: backport #22572, reject windows alternate paths (#22574)
f20d64b fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
ca31424 release: v7.3.3
5ab51c0 fix: avoid destructure lowering for newer safari (#22346)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Updates esbuild from 0.27.3 to 0.28.1 and vite from 7.3.2 to 7.3.5 in the npm_and_yarn group. The esbuild bump fixes a dev-server path traversal vulnerability, a minifier bug with using declarations, and adds Deno install integrity checks. The vite bump rejects Windows alternate and UNC paths in dev middleware and fixes a Safari target issue.

^{Written for commit 1e34072. Summary will update on new commits.}

Bumps the npm_and_yarn group with 2 updates in the / directory: [esbuild](https://github.com/evanw/esbuild) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `esbuild` from 0.27.3 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.28.1) Updates `vite` from 7.3.2 to 7.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.5 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-08-30T16:37:51Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tools	Error		Aug 30, 2026 4:38pm

cr-gpt · 2026-08-30T16:37:52Z

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

codesherlock-ai · 2026-08-30T16:37:52Z

We could not run your PR Review. We noticed that you are part of an Org. We require everyone who is part of an Org to SignUp via GitHub so we can track your individual usage and maximize on your usage capacity. Enroll into CodeSherlock system by signing up via GitHub using the SignUp link. Also, please note — every user pays for their own usage.

semanticdiff-com · 2026-08-30T16:37:53Z

Review changes with

Changed Files

File	Status
pnpm-workspace.yaml	97% smaller
pnpm-lock.yaml	14% smaller

codereviewbot-ai · 2026-08-30T16:37:54Z

🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews.

codeant-ai · 2026-08-30T16:37:56Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

cloudflare-workers-and-pages · 2026-08-30T16:37:56Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	tools	`f8c1a0c`	Aug 30 2026, 04:38 PM

github-actions · 2026-08-30T16:38:00Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

npm/vite

7.3.6

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 7	Found 20/27 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	🟢 6	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Binary-Artifacts	⚠️ 1	binaries present in source code
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

Scanned Files

pnpm-lock.yaml

difflens · 2026-08-30T16:38:07Z

View changes in DiffLens

what-the-diff · 2026-08-30T16:38:08Z

PR Summary

Updated Dependency
The version for vite which is a tool used in our project, has been updated. The improvements in the new version can include bug fixes and performance enhancements which will help our application run more efficiently and reliably.

socket-security · 2026-08-30T16:38:09Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@7.3.6

View full report

…, Rustfmt, Scalafmt, StandardJS, StandardRB and swift-format This commit fixes the style issues introduced in 1e34072 according to the output from ClangFormat, dotnet-format, Prettier, RuboCop, Rustfmt, Scalafmt, StandardJS, StandardRB and swift-format. Details: #108

cr-gpt · 2026-08-30T16:38:15Z

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

difflens · 2026-08-30T16:38:17Z

View changes in DiffLens

codereviewbot-ai · 2026-08-30T16:38:17Z

🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews.

difflens · 2026-08-30T16:38:29Z

View changes in DiffLens

guardrails · 2026-08-30T16:38:33Z

⚠️ We detected 3 security issues in this pull request:

Hard-Coded Secrets (1)

Severity

Details

Docs

Medium

Title: Secret Keyword

Tools/artifacts/personal-tool-console/src/pages/home.tsx

Line 12 in f8c1a0c

passwordMode: 'strong',

📚

More info on how to fix Hard-Coded Secrets in General.

Insecure Processing of Data (2)

Severity

Details

Docs

Medium

Title: Unescaped user input in React dangerouslySetInnerHTML

Tools/artifacts/mockup-sandbox/src/components/ui/chart.tsx

Line 94 in f8c1a0c

.join("\n"),

📚

Medium

Title: Unescaped user input in React dangerouslySetInnerHTML

Tools/artifacts/personal-tool-console/src/components/ui/chart.tsx

Line 95 in f8c1a0c

.join("\n"),

📚

More info on how to fix Insecure Processing of Data in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

deepsource-io · 2026-08-30T16:38:50Z

DeepSource Code Review

We reviewed changes in 28cad60...f8c1a0c on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
Scala	Aug 30, 2026 4:38p.m.	Review ↗
Swift	Aug 30, 2026 4:38p.m.	Review ↗
JavaScript	Aug 30, 2026 4:38p.m.	Review ↗
Ruby	Aug 30, 2026 4:38p.m.	Review ↗
C & C++	Aug 30, 2026 4:38p.m.	Review ↗
C#	Aug 30, 2026 4:38p.m.	Review ↗
Rust	Aug 30, 2026 4:38p.m.	Review ↗
Shell	Aug 30, 2026 4:38p.m.	Review ↗
Terraform	Aug 30, 2026 4:38p.m.	Review ↗
Code coverage	Aug 30, 2026 5:08p.m.	Review ↗
SQL	Aug 30, 2026 4:38p.m.	Review ↗
Secrets	Aug 30, 2026 4:38p.m.	Review ↗
Ansible	Aug 30, 2026 4:38p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

codescene-delta-analysis

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Customizable Safeguards
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

sonarqubecloud · 2026-08-30T16:39:06Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

codacy-production · 2026-08-30T16:40:22Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric Results

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

dependabot · 2026-08-30T19:18:10Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 30, 2026

pull-request-size Bot added the size/XS label Aug 30, 2026

vercel Bot had a problem deploying to Preview August 30, 2026 16:37 Failure

pull-request-size Bot added size/M and removed size/XS labels Aug 30, 2026

vercel Bot had a problem deploying to Preview August 30, 2026 16:38 Failure

This comment was marked as outdated.

Sign in to view

codescene-delta-analysis Bot approved these changes Aug 30, 2026

View reviewed changes

LCSOGthb closed this Aug 30, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-1f7ee6e6cb branch August 30, 2026 19:18

Conversation

dependabot Bot commented on behalf of github Aug 30, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.28.1

0.28.1

v7.3.5

v7.3.3

7.3.5 (2026-06-01)

Bug Fixes

Miscellaneous Chores

7.3.4 (2026-06-01)

Bug Fixes

7.3.3 (2026-05-07)

Bug Fixes

Summary by cubic

Uh oh!

vercel Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cr-gpt Bot commented Aug 30, 2026

Uh oh!

codesherlock-ai Bot commented Aug 30, 2026

Uh oh!

semanticdiff-com Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codereviewbot-ai Bot commented Aug 30, 2026

Uh oh!

codeant-ai Bot commented Aug 30, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

github-actions Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

difflens Bot commented Aug 30, 2026

Uh oh!

what-the-diff Bot commented Aug 30, 2026

PR Summary

Uh oh!

socket-security Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cr-gpt Bot commented Aug 30, 2026

Uh oh!

difflens Bot commented Aug 30, 2026

Uh oh!

codereviewbot-ai Bot commented Aug 30, 2026

Uh oh!

difflens Bot commented Aug 30, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

guardrails Bot commented Aug 30, 2026

Uh oh!

deepsource-io Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

codescene-delta-analysis Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Aug 30, 2026

Quality Gate passed

Uh oh!

codacy-production Bot commented Aug 30, 2026

Up to standards ✅

Uh oh!

dependabot Bot commented on behalf of github Aug 30, 2026

Uh oh!

Reviewers

Assignees

Labels

dependabot Bot commented on behalf of github Aug 30, 2026 •

edited by cubic-dev-ai Bot

Loading

vercel Bot commented Aug 30, 2026 •

edited

Loading

semanticdiff-com Bot commented Aug 30, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Aug 30, 2026 •

edited

Loading

github-actions Bot commented Aug 30, 2026 •

edited

Loading

socket-security Bot commented Aug 30, 2026 •

edited

Loading

deepsource-io Bot commented Aug 30, 2026 •

edited

Loading