Bump the npm_and_yarn group across 1 directory with 2 updates by dependabot[bot] · Pull Request #111 · LCSOGthb/Tools

dependabot · 2026-09-01T11:28:38Z

Bumps the npm_and_yarn group with 2 updates in the / directory: esbuild and vite.

Updates esbuild from 0.27.3 to 0.28.1

Release notes

v0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

bb9db84 publish 0.28.1 to npm
9ff053e security: add integrity checks to the Deno API
0a9bf21 enforce non-negative size in gzip parser
e2a1a71 security: forbid \\ in local dev server requests
83a2cbf fix #4482: don't inline using declarations
308ad74 fix #4471: renaming of nested var declarations
f013f5f fix some typos
aafd6e4 chore: fix some minor issues in comments (#4462)
15300c3 follow up: cjs evaluation fixes
1bda0c3 fix #4461, fix #4467: esm evaluation fixes
Additional commits viewable in compare view

Updates vite from 7.3.2 to 7.3.5

Release notes

Sourced from vite's releases.

v7.3.5

Please refer to CHANGELOG.md for details.

v7.3.3

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.5 (2026-06-01)

Bug Fixes

backport #22572, reject windows alternate paths (#22574) (8c18556)

deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

Miscellaneous Chores

skip v7.3.4 release (8a6a0c9)

7.3.4 (2026-06-01)

Bug Fixes

backport #22572, reject windows alternate paths (#22574) (8c18556)

deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

7.3.3 (2026-05-07)

Bug Fixes

avoid destructure lowering for newer safari (#22346) (5ab51c0)

Commits

077945c release: v7.3.5
8a6a0c9 chore: skip v7.3.4 release
8c18556 fix: backport #22572, reject windows alternate paths (#22574)
f20d64b fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
ca31424 release: v7.3.3
5ab51c0 fix: avoid destructure lowering for newer safari (#22346)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Bumps esbuild from 0.27.3 to 0.28.1 and vite from 7.3.2 to 7.3.5 to pull in security and bug fixes.

Dependencies

esbuild 0.28.1 blocks \ path traversal in the dev server and adds integrity checks for the Deno installer.
vite 7.3.5 rejects Windows alternate and UNC paths in middleware and avoids destructure lowering for newer Safari.
Updates the vite catalog entry in pnpm-workspace.yaml and regenerates pnpm-lock.yaml.

^{Written for commit 0209e8c. Summary will update on new commits.}

Bumps the npm_and_yarn group with 2 updates in the / directory: [esbuild](https://github.com/evanw/esbuild) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `esbuild` from 0.27.3 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.28.1) Updates `vite` from 7.3.2 to 7.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 7.3.5 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-09-01T11:28:41Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
tools	Error		Sep 1, 2026 11:29am UTC

codesherlock-ai · 2026-09-01T11:28:42Z

We could not run your PR Review. We noticed that you are part of an Org. We require everyone who is part of an Org to SignUp via GitHub so we can track your individual usage and maximize on your usage capacity. Enroll into CodeSherlock system by signing up via GitHub using the SignUp link. Also, please note — every user pays for their own usage.

cr-gpt · 2026-09-01T11:28:43Z

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

semanticdiff-com · 2026-09-01T11:28:44Z

Review changes with

Changed Files

File	Status
pnpm-workspace.yaml	97% smaller
pnpm-lock.yaml	4% smaller

codeant-ai · 2026-09-01T11:28:46Z

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

codereviewbot-ai · 2026-09-01T11:28:46Z

🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews.

github-actions · 2026-09-01T11:28:51Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

npm/vite

7.3.6

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 7	Found 20/27 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	🟢 6	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Binary-Artifacts	⚠️ 1	binaries present in source code
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

Scanned Files

pnpm-lock.yaml

difflens · 2026-09-01T11:28:52Z

View changes in DiffLens

cloudflare-workers-and-pages · 2026-09-01T11:28:52Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	tools	`8b76024`	Sep 01 2026, 11:29 AM

what-the-diff · 2026-09-01T11:28:55Z

PR Summary

Updated Vite Version
The version of Vite, which is a tool we use in development, has been updated. This means we've just gotten the latest features and improvements from this tool, which could potentially provide better efficiency and solve previous issues we encountered.

socket-security · 2026-09-01T11:29:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@7.3.6

View full report

…, Rustfmt, Scalafmt, StandardJS, StandardRB and swift-format This commit fixes the style issues introduced in 0209e8c according to the output from ClangFormat, dotnet-format, Prettier, RuboCop, Rustfmt, Scalafmt, StandardJS, StandardRB and swift-format. Details: #111

cr-gpt · 2026-09-01T11:29:10Z

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

codereviewbot-ai · 2026-09-01T11:29:11Z

🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews.

difflens · 2026-09-01T11:29:13Z

View changes in DiffLens

difflens · 2026-09-01T11:29:24Z

View changes in DiffLens

guardrails · 2026-09-01T11:29:43Z

⚠️ We detected 4 security issues in this pull request:

Hard-Coded Secrets (1)

Severity

Details

Docs

Medium

Title: Secret Keyword

Tools/artifacts/personal-tool-console/src/pages/home.tsx

Line 12 in 8b76024

passwordMode: 'strong',

📚

More info on how to fix Hard-Coded Secrets in General.

Insecure Processing of Data (3)

Severity

Details

Docs

Medium

Title: Unescaped user input in React dangerouslySetInnerHTML

Tools/artifacts/mockup-sandbox/src/components/ui/chart.tsx

Line 94 in 8b76024

.join("\n"),

📚

Medium

Title: Unescaped user input in React dangerouslySetInnerHTML

Tools/artifacts/personal-tool-console/src/components/ui/chart.tsx

Line 95 in 8b76024

.join("\n"),

📚

Medium

Title: Unescaped user input in React dangerouslySetInnerHTML

Tools/artifacts/personal-tool-console/src/components/tools/misc/misc-tools.tsx

Line 269 in 8b76024

📚

More info on how to fix Insecure Processing of Data in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

codescene-delta-analysis

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Customizable Safeguards
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

sonarqubecloud · 2026-09-01T11:29:57Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

deepsource-io · 2026-09-01T11:30:23Z

DeepSource Code Review

We reviewed changes in 110a8a2...8b76024 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
Scala	Sep 1, 2026 11:29a.m.	Review ↗
Swift	Sep 1, 2026 11:29a.m.	Review ↗
JavaScript	Sep 1, 2026 11:29a.m.	Review ↗
Ruby	Sep 1, 2026 11:29a.m.	Review ↗
C & C++	Sep 1, 2026 11:29a.m.	Review ↗
C#	Sep 1, 2026 11:29a.m.	Review ↗
Rust	Sep 1, 2026 11:29a.m.	Review ↗
Shell	Sep 1, 2026 11:29a.m.	Review ↗
Terraform	Sep 1, 2026 11:29a.m.	Review ↗
Code coverage	Sep 1, 2026 12:00p.m.	Review ↗
SQL	Sep 1, 2026 11:29a.m.	Review ↗
Secrets	Sep 1, 2026 11:29a.m.	Review ↗
Ansible	Sep 1, 2026 11:29a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

codacy-production · 2026-09-01T11:30:35Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric Results

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026

pull-request-size Bot added the size/XS label Sep 1, 2026

vercel Bot had a problem deploying to Preview September 1, 2026 11:28 Failure

pull-request-size Bot added size/M and removed size/XS labels Sep 1, 2026

vercel Bot had a problem deploying to Preview September 1, 2026 11:29 Failure

This comment was marked as outdated.

Sign in to view

codescene-delta-analysis Bot approved these changes Sep 1, 2026

View reviewed changes

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.28.1

0.28.1

v7.3.5

v7.3.3

7.3.5 (2026-06-01)

Bug Fixes

Miscellaneous Chores

7.3.4 (2026-06-01)

Bug Fixes

7.3.3 (2026-05-07)

Bug Fixes

Summary by cubic

Uh oh!

vercel Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codesherlock-ai Bot commented Sep 1, 2026

Uh oh!

cr-gpt Bot commented Sep 1, 2026

Uh oh!

semanticdiff-com Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codeant-ai Bot commented Sep 1, 2026

Uh oh!

codereviewbot-ai Bot commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

difflens Bot commented Sep 1, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

what-the-diff Bot commented Sep 1, 2026

PR Summary

Uh oh!

socket-security Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cr-gpt Bot commented Sep 1, 2026

Uh oh!

codereviewbot-ai Bot commented Sep 1, 2026

Uh oh!

difflens Bot commented Sep 1, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

difflens Bot commented Sep 1, 2026

Uh oh!

guardrails Bot commented Sep 1, 2026

Uh oh!

codescene-delta-analysis Bot left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Sep 1, 2026

Quality Gate passed

Uh oh!

deepsource-io Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

codacy-production Bot commented Sep 1, 2026

Up to standards ✅

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited by cubic-dev-ai Bot

Loading

vercel Bot commented Sep 1, 2026 •

edited

Loading

semanticdiff-com Bot commented Sep 1, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Sep 1, 2026 •

edited

Loading

socket-security Bot commented Sep 1, 2026 •

edited

Loading

deepsource-io Bot commented Sep 1, 2026 •

edited

Loading