Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 1, 2025

Bumps the deps group with 11 updates in the /bundle-size directory:

Package From To
@bufbuild/protobuf 2.6.3 2.9.0
@connectrpc/connect 2.0.3 2.1.0
@bufbuild/buf 1.56.0 1.57.2
@bufbuild/protoc-gen-es 2.6.3 2.9.0
esbuild 0.25.8 0.25.10
parcel 2.15.4 2.16.0
typescript 5.9.2 5.9.3
rollup 4.46.2 4.52.3
vite 7.0.6 7.1.7
ts-loader 9.5.2 9.5.4
webpack 5.101.0 5.102.0

Updates @bufbuild/protobuf from 2.6.3 to 2.9.0

Release notes

Sourced from @​bufbuild/protobuf's releases.

v2.9.0

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.8.0...v2.9.0

v2.8.0

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.7.0...v2.8.0

v2.7.0

What's Changed

[!IMPORTANT]

TypeScript 5.9 includes breaking changes to lib.d.ts, forcing us to change return types for some functions from Uint8Array to Uint8Array<ArrayBuffer>. See #1200 for details.

Full Changelog: bufbuild/protobuf-es@v2.6.3...v2.7.0

Commits

Updates @connectrpc/connect from 2.0.3 to 2.1.0

Release notes

Sourced from @​connectrpc/connect's releases.

v2.1.0

What's Changed

[!IMPORTANT]

TypeScript 5.9 includes breaking changes to lib.d.ts, forcing us to change return types for some functions from Uint8Array to Uint8Array<ArrayBuffer>. This is unlikely to affect you, but if it does, see #1560 for details.

Full Changelog: connectrpc/connect-es@v2.0.4...v2.1.0

v2.0.4

What's Changed

Full Changelog: connectrpc/connect-es@v2.0.3...v2.0.4

Commits

Updates @bufbuild/buf from 1.56.0 to 1.57.2

Release notes

Sourced from @​bufbuild/buf's releases.

v1.57.2

  • Fix buf curl for HTTP/2 services.

v1.57.1

  • Minor bug fixes and dependency upgrades.

v1.57.0

  • Update exclude types to remove unused options reducing the size of generated code.
  • Add gitlab-code-quality error format to print errors in the GitLab Code Quality format for buf lint and buf breaking.
  • Add source_control_url to json outputs for buf registry {module, plugin} commit commands.
Changelog

Sourced from @​bufbuild/buf's changelog.

[v1.57.2] - 2025-09-16

  • Fix buf curl for HTTP/2 services

[v1.57.1] - 2025-09-16

  • Minor bug fixes and dependency upgrades.

[v1.57.0] - 2025-08-27

  • Update exclude types to remove unused options reducing the size of generated code.
  • Add gitlab-code-quality error format to print errors in the GitLab Code Quality format for buf lint and buf breaking.
  • Add source_control_url to json outputs for buf registry {module, plugin} commit commands.
Commits

Updates @bufbuild/protoc-gen-es from 2.6.3 to 2.9.0

Release notes

Sourced from @​bufbuild/protoc-gen-es's releases.

v2.9.0

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.8.0...v2.9.0

v2.8.0

What's Changed

Full Changelog: bufbuild/protobuf-es@v2.7.0...v2.8.0

v2.7.0

What's Changed

[!IMPORTANT]

TypeScript 5.9 includes breaking changes to lib.d.ts, forcing us to change return types for some functions from Uint8Array to Uint8Array<ArrayBuffer>. See #1200 for details.

Full Changelog: bufbuild/protobuf-es@v2.6.3...v2.7.0

Commits

Updates esbuild from 0.25.8 to 0.25.10

Release notes

Sourced from esbuild's releases.

v0.25.10

  • Fix a panic in a minification edge case (#4287)

    This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):

    function identity(x) { return x }
    identity({ y: identity(123) })
  • Fix @supports nested inside pseudo-element (#4265)

    When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

    The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

    However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:

    /* Original code */
    ::placeholder {
      color: red;
      body & { color: green }
      @supports (color: blue) { color: blue }
    }
    /* Old output (with --supported:nesting=false) */
    ::placeholder {
    color: red;
    }
    body :is() {
    color: green;
    }
    @​supports (color: blue) {
    {
    color: blue;
    }
    }
    /* New output (with --supported:nesting=false) */
    ::placeholder {
    color: red;
    }
    body :is() {
    color: green;
    }
    @​supports (color: blue) {
    ::placeholder {
    color: blue;
    }

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.25.10

  • Fix a panic in a minification edge case (#4287)

    This release fixes a panic due to a null pointer that could happen when esbuild inlines a doubly-nested identity function and the final result is empty. It was fixed by emitting the value undefined in this case, which avoids the panic. This case must be rare since it hasn't come up until now. Here is an example of code that previously triggered the panic (which only happened when minifying):

    function identity(x) { return x }
    identity({ y: identity(123) })
  • Fix @supports nested inside pseudo-element (#4265)

    When transforming nested CSS to non-nested CSS, esbuild is supposed to filter out pseudo-elements such as ::placeholder for correctness. The CSS nesting specification says the following:

    The nesting selector cannot represent pseudo-elements (identical to the behavior of the ':is()' pseudo-class). We’d like to relax this restriction, but need to do so simultaneously for both ':is()' and '&', since they’re intentionally built on the same underlying mechanisms.

    However, it seems like this behavior is different for nested at-rules such as @supports, which do work with pseudo-elements. So this release modifies esbuild's behavior to now take that into account:

    /* Original code */
    ::placeholder {
      color: red;
      body & { color: green }
      @supports (color: blue) { color: blue }
    }
    /* Old output (with --supported:nesting=false) */
    ::placeholder {
    color: red;
    }
    body :is() {
    color: green;
    }
    @​supports (color: blue) {
    {
    color: blue;
    }
    }
    /* New output (with --supported:nesting=false) */
    ::placeholder {
    color: red;
    }
    body :is() {
    color: green;
    }
    @​supports (color: blue) {
    ::placeholder {
    color: blue;

... (truncated)

Commits

Updates parcel from 2.15.4 to 2.16.0

Release notes

Sourced from parcel's releases.

v2.16.0

This release significantly improves code splitting and tree shaking when scope hoisting is disabled, e.g. when using React Server Components with static rendering. It enables re-exports to be followed when resolving a dependency, so that only used exports from large libraries get bundled together for each page rather than across all pages. This was already the case when using scope hoisting, but now it works without scope hoisting as well.

Added

  • JavaScript
    • Code split re-exports when scope hoisting is disabled – Details

Fixed

  • JavaScript
    • Scope macro asset unique keys to the parent asset – Details
Changelog

Sourced from parcel's changelog.

[2.16.0] – 2025-09-18

Added

  • JavaScript
    • Code split re-exports when scope hoisting is disabled – Details

Fixed

  • JavaScript
    • Scope macro asset unique keys to the parent asset – Details

[2.15.3] – 2025-06-20

Fixed

  • JavaScript

    • Expose line and column number to macros – Details
  • React Server Components

    • Invalidate cache in ReactStaticPackager when pages are added or client components change – Details
    • Fix lazy mode with React Server Components – Details
    • Fix @parcel/rsc duplicate types – Details
    • Ensure publicUrl ends with a slash in react-static packager – Details
    • Fix hash reference replacement in react-static packager – Details

[2.15.2] - 2025-05-24

Fixed

  • Core

    • Change minimum required glibc version to 2.26 – Details
    • Cache inline bundle packaging – Details
    • Use stable id for package requests – Details
  • HTML

    • Do not remove <meta charset="utf-8">Details
  • MDX

    • Make URL dependencies in MDX files optional – Details
  • React Server Components

    • Fix memory leak in react-static packager – Details
  • Resolver

    • Fix resolving source package exports condition from self reference – Details
  • SVG

  • Compressors

    • Use max level compression for brotli compressor – Details

[2.15.1] - 2025-05-15

... (truncated)

Commits

Updates typescript from 5.9.2 to 5.9.3

Release notes

Sourced from typescript's releases.

TypeScript 5.9.3

Commits

Updates rollup from 4.46.2 to 4.52.3

Release notes

Sourced from rollup's releases.

v4.52.3

4.52.3

2025-09-27

Bug Fixes

  • Fix check in native loader for environments that do not support reports (#6123)

Pull Requests

v4.52.2

4.52.2

2025-09-23

Bug Fixes

  • Fix Android build crashing due to failed dlopen (#6109)

Pull Requests

v4.52.1

4.52.1

2025-09-23

Bug Fixes

  • Opt-out of dynamic import optimization when using top-level await to effectively prevent deadlocks (#6121)

Pull Requests

v4.52.0

4.52.0

2025-09-19

Features

  • Add option output.onlyExplicitManualChunks to turn off merging additional dependencies into manual chunks (#6087)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.52.3

2025-09-27

Bug Fixes

  • Fix check in native loader for environments that do not support reports (#6123)

Pull Requests

4.52.2

2025-09-23

Bug Fixes

  • Fix Android build crashing due to failed dlopen (#6109)

Pull Requests

4.52.1

2025-09-23

Bug Fixes

  • Opt-out of dynamic import optimization when using top-level await to effectively prevent deadlocks (#6121)

Pull Requests

4.52.0

2025-09-19

Features

  • Add option output.onlyExplicitManualChunks to turn off merging additional dependencies into manual chunks (#6087)
  • Add support for x86_64-pc-windows-gnu platform (#6110)

Pull Requests

... (truncated)

Commits

Updates vite from 7.0.6 to 7.1.7

Release notes

Sourced from vite's releases.

v7.1.7

Please refer to CHANGELOG.md for details.

v7.1.6

Please refer to CHANGELOG.md for details.

v7.1.5

Please refer to CHANGELOG.md for details.

v7.1.4

Please refer to CHANGELOG.md for details.

v7.1.3

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.1.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.1.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.1.0

Please refer to CHANGELOG.md for details.

v7.1.0-beta.1

Please refer to CHANGELOG.md for details.

v7.1.0-beta.0

Please refer to CHANGELOG.md for details.

v7.0.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.1.7 (2025-09-22)

Bug Fixes

  • build: fix ssr environment emitAssets: true when sharedConfigBuild: true (#20787) (4c4583c)
  • client: use CSP nonce when rendering error overlay (#20791) (9bc9d12)
  • deps: update all non-major dependencies (#20811) (9f2247c)
  • glob: handle glob imports from folders starting with dot (#20800) (105abe8)
  • hmr: trigger prune event when import is removed from non hmr module (#20768) (9f32b1d)
  • hmr: wait for import.meta.hot.prune callbacks to complete before running other HMRs (#20698) (98a3484)

7.1.6 (2025-09-18)

Bug Fixes

  • deps: update all non-major dependencies (#20773) (88af2ae)
  • esbuild: inject esbuild helper functions with minified $ variables correctly (#20761) (7e8e004)
  • fallback terser to main thread when nameCache is provided (#20750) (a679a64)
  • types: strict env typings fail when skipLibCheck is false (#20755) (cc54e29)

Miscellaneous Chores

7.1.5 (2025-09-08)

Bug Fixes

7.1.4 (2025-09-01)

Bug Fixes

Miscellaneous Chores

  • remove unused constants entry from rolldown.config.ts (#20710) (537fcf9)

Code Refactoring

  • remove unnecessary minify parameter from finalizeCss (#20701) (8099582)

7.1.3 (2025-08-19)

Features

  • cli: add Node.js version warning for unsupported versions (#20638) (a1be1bf)

... (truncated)

Commits
  • 693d255 release: v7.1.7
  • 98a3484 fix(hmr): wait for import.meta.hot.prune callbacks to complete before runni...
  • 9f32b1d fix(hmr): trigger prune event when import is removed from non hmr module (#20...
  • 9f2247c fix(deps): update all non-major dependencies (#20811)
  • 105abe8 fix(glob): handle glob imports from folders starting with dot (#20800)
  • 4c4583c fix(build): fix ssr environment emitAssets: true when `sharedConfigBuild: t...
  • 9bc9d12 fix(client): use CSP nonce when rendering error overlay (#20791)
  • 54377f7 release: v7.1.6
  • 88af2ae fix(deps): update all non-major dependencies (#20773)
  • d785e72 chore(deps): update rolldown-related dependencies (#20772)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vite since your current version.


Updates ts-loader from 9.5.2 to 9.5.4

Release notes

Sourced from ts-loader's releases.

v9.5.4

Skipping 9.5.3 due to a publishing issue

v9.5.3

Changelog

Sourced from ts-loader's changelog.

9.5.4

Skipping 9.5.3 due to a publishing issue

Commits

Updates webpack from 5.101.0 to 5.102.0

Release notes

Sourced from webpack's releases.

v5.102.0

Features

  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options

Fixes

  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types

Performance Improvements

  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies

v5.101.3

Fixes

  • Fixed resolve execution order issue from extra await in async modules
  • Avoid empty block for unused statement
  • Collect only specific expressions for destructuring assignment

v5.101.2

Fixes

  • Fixed syntax error when comment is on the last line
  • Handle var declaration for createRequire
  • Distinguish free variable and tagged variable

v5.101.1

Fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the deps group with 11 updates in the /bundle-size directory:

| Package | From | To |
| --- | --- | --- |
| [@bufbuild/protobuf](https://github.com/bufbuild/protobuf-es/tree/HEAD/packages/protobuf) | `2.6.3` | `2.9.0` |
| [@connectrpc/connect](https://github.com/connectrpc/connect-es/tree/HEAD/packages/connect) | `2.0.3` | `2.1.0` |
| [@bufbuild/buf](https://github.com/bufbuild/buf) | `1.56.0` | `1.57.2` |
| [@bufbuild/protoc-gen-es](https://github.com/bufbuild/protobuf-es/tree/HEAD/packages/protoc-gen-es) | `2.6.3` | `2.9.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.25.8` | `0.25.10` |
| [parcel](https://github.com/parcel-bundler/parcel) | `2.15.4` | `2.16.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.9.2` | `5.9.3` |
| [rollup](https://github.com/rollup/rollup) | `4.46.2` | `4.52.3` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.0.6` | `7.1.7` |
| [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.5.2` | `9.5.4` |
| [webpack](https://github.com/webpack/webpack) | `5.101.0` | `5.102.0` |



Updates `@bufbuild/protobuf` from 2.6.3 to 2.9.0
- [Release notes](https://github.com/bufbuild/protobuf-es/releases)
- [Commits](https://github.com/bufbuild/protobuf-es/commits/v2.9.0/packages/protobuf)

Updates `@connectrpc/connect` from 2.0.3 to 2.1.0
- [Release notes](https://github.com/connectrpc/connect-es/releases)
- [Commits](https://github.com/connectrpc/connect-es/commits/v2.1.0/packages/connect)

Updates `@bufbuild/buf` from 1.56.0 to 1.57.2
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](bufbuild/buf@v1.56.0...v1.57.2)

Updates `@bufbuild/protoc-gen-es` from 2.6.3 to 2.9.0
- [Release notes](https://github.com/bufbuild/protobuf-es/releases)
- [Commits](https://github.com/bufbuild/protobuf-es/commits/v2.9.0/packages/protoc-gen-es)

Updates `esbuild` from 0.25.8 to 0.25.10
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.25.8...v0.25.10)

Updates `parcel` from 2.15.4 to 2.16.0
- [Release notes](https://github.com/parcel-bundler/parcel/releases)
- [Changelog](https://github.com/parcel-bundler/parcel/blob/v2/CHANGELOG.md)
- [Commits](https://github.com/parcel-bundler/parcel/commits/v2.16.0)

Updates `typescript` from 5.9.2 to 5.9.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release-publish.yml)
- [Commits](microsoft/TypeScript@v5.9.2...v5.9.3)

Updates `rollup` from 4.46.2 to 4.52.3
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.46.2...v4.52.3)

Updates `vite` from 7.0.6 to 7.1.7
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.1.7/packages/vite)

Updates `ts-loader` from 9.5.2 to 9.5.4
- [Release notes](https://github.com/TypeStrong/ts-loader/releases)
- [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md)
- [Commits](TypeStrong/ts-loader@v9.5.2...v9.5.4)

Updates `webpack` from 5.101.0 to 5.102.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](webpack/webpack@v5.101.0...v5.102.0)

---
updated-dependencies:
- dependency-name: "@bufbuild/protobuf"
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@connectrpc/connect"
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@bufbuild/buf"
  dependency-version: 1.57.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: "@bufbuild/protoc-gen-es"
  dependency-version: 2.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: esbuild
  dependency-version: 0.25.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: parcel
  dependency-version: 2.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: typescript
  dependency-version: 5.9.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: rollup
  dependency-version: 4.52.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: vite
  dependency-version: 7.1.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: ts-loader
  dependency-version: 9.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: deps
- dependency-name: webpack
  dependency-version: 5.102.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants