chore(deps): bump esbuild, @vitejs/plugin-vue and vite in /app/vue#148
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): bump esbuild, @vitejs/plugin-vue and vite in /app/vue#148dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Removes [esbuild](https://github.com/evanw/esbuild). It's no longer used after updating ancestor dependencies [esbuild](https://github.com/evanw/esbuild), [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). These dependencies need to be updated together. Removes `esbuild` Updates `@vitejs/plugin-vue` from 5.2.4 to 6.0.7 - [Release notes](https://github.com/vitejs/vite-plugin-vue/releases) - [Changelog](https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.7/packages/plugin-vue) Updates `vite` from 6.4.2 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: esbuild dependency-version: dependency-type: indirect - dependency-name: "@vitejs/plugin-vue" dependency-version: 6.0.7 dependency-type: direct:development - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Contributor
|
Superseded by #160, which consolidates this update with the other pending dependency bumps into a single build- and test-validated PR. Closing in favor of that. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/app/vue/multi-74278cf740
branch
July 11, 2026 18:19
jung-thomas
added a commit
that referenced
this pull request
Jul 11, 2026
* chore(deps): consolidate dependency updates across subprojects Supersedes the 9 open Dependabot PRs (#146, #147, #148, #149, #151, #152, #153, #156, #157) with one validated update. Direct-dep bumps plus lockfile refreshes that absorb the transitive updates; each subproject's build and test suite was run to confirm the majors are safe. vscode-extension: - @vscode/vsce 2.32 -> 3.9.2 (major), esbuild 0.25 -> 0.28.1 (#147, #149) - transitives via lockfile: markdown-it 12->14, js-yaml 4.3, form-data 4.0.6, undici 7.28, tmp 0.2.7 (#146, #152, #153, #157) - Verified: compile + esbuild bundle + `vsce package` succeed; the .vsix stays self-contained (webview assets present, zero native binaries). app/vue: - vite 6.3 -> 8.1.4 (two majors), @vitejs/plugin-vue 5.2 -> 6.0.7 (major), echarts 6.0 -> 6.1 (#148, #156) - Verified: 46 vitest tests pass; `build` and `build:vscode` succeed and emit the webview assets consumed by the extension .vsix. docs: - dompurify 3.4.3 -> 3.4.11 via lockfile (transitive under mermaid) (#151) - Verified: `docs:build` succeeds. Root `test:ci` (550 passing) and `lint` remain green. Pre-existing app/vue advisories (xlsx, dompurify-via-monaco) are untouched — out of scope and only resolvable with breaking `audit fix --force`. * chore(deps): upgrade to CAP 10 (@sap/cds 10) + cds-10-native cap-js drivers Completes the CAP 10 migration on top of the consolidated dependency update. The project's prior pre-work (compat flags already set to CAP 10 targets: legacyLocking=false, ieee754compatible=true, compat_srv_getters=false, compat_texts_entities=false) meant no runtime code changes were required. - @sap/cds ^9.9.0 -> ^10.0.3 - @cap-js/hana 2.8 -> 3.0.1, @cap-js/sqlite 2.4 -> 3.0.2, @cap-js/postgres 2.3 -> 3.0.1, @cap-js/telemetry 1.6 -> 2.0.1 (the 3.x/2.x majors declare `peer @sap/cds ^10`) - Remove @sap/cds-hana: its cds-plugin throws "incompatible with @sap/cds version 9 and higher — use @cap-js/hana instead". Unused in source; @cap-js/hana already covers HANA connectivity. - esbuild: mark generic-pool external — it's an OPTIONAL peer of @cap-js/db-service@3 whose require() is guarded behind the legacy pool path (CAP 10 uses the built-in pool), and it's not installed. Audit: no CAP 10 breaking-change surface in source — no CAP req.params (the one req.params is an Express route param), no ASSERT_MANDATORY matching, no draft SAVE handlers, no @requires/req.user relying on skipped local checks. Bonus: @cap-js/sqlite@3 makes better-sqlite3 an optional peer, so the native binary is no longer installed at all — reinforcing the OS-portable .vsix. Verified on CAP 10.0.3: - root test:ci 550 passing; database+connection utils 50 passing; lint clean - `cds compile` produces SQL; runtime SELECT via node:sqlite works, better-sqlite3 never loads - extension bundles + packages: 352 webview assets, 0 native binaries * chore(deps): refresh lockfiles for in-range patch/minor updates `npm update` sweep across all projects to pull patch/minor bumps that sit within existing semver ranges (no package.json changes needed): - root: @cap-js-community/odata-v2-adapter 1.16, @wdio/* 9.29.1, chromedriver 150.0.3, eslint 10.6, terminal-kit 3.1.3, webdriverio, @types/node, hdb 2.29, sap-hdb-promisfied (lockfile only) - docs: vue 3.5.39, @agentmarkup/vite 0.5.2 (56 transitive packages) - app/vue, vscode-extension: already at wanted versions Verified: root test:ci 550 passing, lint clean, docs:build and app/vue vitest (46) green. * chore(deps): upgrade TypeScript to 7 in vscode-extension and mcp-server TypeScript 7.0 (the native compiler) builds both plain-tsc projects cleanly: - vscode-extension: ^5.7 -> ^7.0.2 (compile, pretest, esbuild bundle all pass) - mcp-server: ^6.0.2 -> ^7.0.2 (tsc build passes) Regenerated mcp-server/build/ (committed output): only .d.ts and .js.map files change — TS 7 emits single quotes in declarations. Zero runtime .js changes; no behavior difference. app/vue is intentionally NOT upgraded: vue-tsc@2 does `require('typescript/lib/tsc')`, a subpath TS 7 removed from its exports map (ERR_PACKAGE_PATH_NOT_EXPORTED). It needs vue-tsc@3 first — tracked in the Group B follow-up issue. app/vue stays on TS 5.9 (within its ^5.7 range). --------- Co-authored-by: Thomas Jung <12159356+jung-thomas@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes esbuild. It's no longer used after updating ancestor dependencies esbuild, @vitejs/plugin-vue and vite. These dependencies need to be updated together.
Removes
esbuildUpdates
@vitejs/plugin-vuefrom 5.2.4 to 6.0.7Release notes
Sourced from @vitejs/plugin-vue's releases.
Changelog
Sourced from @vitejs/plugin-vue's changelog.
... (truncated)
Commits
f93acebrelease: plugin-vue@6.0.7941b651feat: use carets for@rolldown/pluginutilsversion (#776)77dc8bcfix(deps): update all non-major dependencies (#774)9e825b8fix(deps): update all non-major dependencies (#762)51dbf4brelease: plugin-vue@6.0.69e07ae9feat(plugin-vue): propagate multiRoot for template-only vapor components (#745)050c996fix(deps): update all non-major dependencies (#738)6d834d8chore: remove unused deps (#760)a0e1ef8chore(deps): update dependency rollup to ^4.59.0 (#749)6ad6cc1release: plugin-vue@6.0.5Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@vitejs/plugin-vuesince your current version.Updates
vitefrom 6.4.2 to 8.0.16Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
f94df87release: v8.0.16dc245c7fix: reject windows alternate paths (#22572)50b9512fix(deps): reject UNC paths for launch-editor-middleware (#22571)8d1b019release: v8.0.152686d7dfix(deps): update all non-major dependencies (#22511)3052a67chore(deps): update rolldown-related dependencies (#22566)e3cfb9dfix(optimizer): close the rolldown bundle when write() rejects (#22528)6978a9crefactor: correct logic incollectAllModulesfunction (#22562)646dbedfeat: update rolldown to 1.0.3 (#22538)85a0efffix: capitalize error messages and remove spurious space in parse error (#22488)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.