An open index of dependabot pull requests across open source projects.

Bump the npm_and_yarn group across 2 directories with 5 updates

Open
Number: #1
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: None
Comments: 0
Created: September 02, 2025 at 11:59 PM UTC
(10 months ago)
Updated: September 02, 2025 at 11:59 PM UTC
(10 months ago)
Labels:
dependencies javascript
Description:

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package From To
esbuild 0.20.2 0.25.0
@nuxtjs/mdc 0.17.0 0.17.2
@octokit/plugin-paginate-rest 11.3.6 11.4.1
nuxt 3.15.3 3.16.0
fast-jwt 4.0.6 5.0.6

Bumps the npm_and_yarn group with 5 updates in the /packages/app directory:

Package From To
esbuild 0.20.2 0.25.0
@nuxtjs/mdc 0.17.0 0.17.2
@octokit/plugin-paginate-rest 11.3.6 11.4.1
nuxt 3.15.3 3.16.0
fast-jwt 4.0.6 5.0.6

Updates esbuild from 0.20.2 to 0.25.0

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.

  • Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

    This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

    Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

    In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

    Thanks to @​sapphi-red for reporting this issue.

  • Delete output files when a build fails in watch mode (#3643)

    It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.

  • Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

    This release fixes the following problems:

    • Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.

      /* Original code */
      .parent {
        > .a,
        > .b1 > .b2 {
          color: red;
        }
      }
      

      /* Old output (with --supported:nesting=false) */
      .parent > :is(.a, .b1 > .b2) {
      color: red;
      }

      /* New output (with --supported:nesting=false) */
      .parent > .a,
      .parent > .b1 > .b2 {
      color: red;
      }

      Thanks to @​tim-we for working on a fix.

    • The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:

      /* Original code (color should be red) */
      

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
      "compilerOptions": {
        "target": "ES2024"
      }
    }
    

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
      get
      *x() {}
      set
      *y() {}
    }
    

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits
  • e9174d6 publish 0.25.0 to npm
  • c27dbeb fix hosts in plugin-tests.js
  • 6794f60 fix hosts in node-unref-tests.js
  • de85afd Merge commit from fork
  • da1de1b fix #4065: bitwise operators can return bigints
  • f4e9d19 switch case liveness: default is always last
  • 7aa47c3 fix #4028: minify live/dead switch cases better
  • 22ecd30 minify: more constant folding for strict equality
  • 4cdf03c fix #4053: reordering of .tsx in node_modules
  • dc71977 fix #3692: 0 now picks a random ephemeral port
  • Additional commits viewable in compare view

Updates @nuxtjs/mdc from 0.17.0 to 0.17.2

Release notes

Sourced from @​nuxtjs/mdc's releases.

v0.17.2

[!IMPORTANT] This patch release contains a fix for Security Advisory https://github.com/nuxt-modules/mdc/security/advisories/GHSA-cj6r-rrr9-fg82, Special thanks to @​Vozec for the report.

Changelog:

  • Merge commit from fork (3657a5b)
  • chore: update "debug" version (f555abf)
  • chore(deps): lock file maintenance (#386) (287a1d5)
  • test: binding component spacing (ec49505)
  • chore: upgrade parse5 (e22f0c0)

v0.17.1

  • chore: upgrade deps (22bbe93)
  • fix: also check for nuxt-nightly path (#401) (2a48b7b)
  • fix: detect mdcUnwrap on slots too (#388) (44fef67)
Changelog

Sourced from @​nuxtjs/mdc's changelog.

v0.17.2

compare changes

🏡 Chore

✅ Tests

  • Binding component spacing (ec49505)

❤️ Contributors

v0.17.1

compare changes

🩹 Fixes

  • Detect mdcUnwrap on slots too (#388)
  • Also check for nuxt-nightly path (#401)

🏡 Chore

❤️ Contributors

Commits

Updates @octokit/plugin-paginate-rest from 11.3.6 to 11.4.1

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v11.4.1

11.4.1 (2025-02-13)

Bug Fixes

v11.4.0

11.4.0 (2025-01-08)

Features

  • new action runner groups endpoints, new code scanning alerts autofix endpoints, new sub-issues endpoints, new private registries enpoints, new code security endpoints, various description updates (#646) (a73883f)
Commits
  • 7d1fade fix: mitigate ReDos issues & linting issues (#659)
  • bb6c4f9 Merge commit from fork
  • d9c1e8f chore(deps): update dependency esbuild to ^0.25.0 (#656)
  • 7ed5627 build(deps-dev): bump vitest and @​vitest/coverage-v8 (#655)
  • 4a41307 build: remove @​types/fetch-mock (#654)
  • 31f8fe9 build(deps): bump vite from 5.4.6 to 6.0.11 (#651)
  • bc38852 chore(deps): update vitest monorepo to v3 (major) (#650)
  • a73883f feat: new action runner groups endpoints, new code scanning alerts autofix en...
  • bea6327 chore(deps): update dependency fetch-mock to v12 (#640)
  • 7262749 chore(deps): update dependency prettier to v3.4.2 (#645)
  • Additional commits viewable in compare view

Updates nuxt from 3.15.3 to 3.16.0

Release notes

Sourced from nuxt's releases.

v3.16.0

👀 Highlights

There's a lot in this one!

⚡️ A New New Nuxt

Say hello to create-nuxt, a new tool for starting Nuxt projects (big thanks to @​devgar for donating the package name)!

It's a streamlined version of nuxi init - just a sixth of the size and bundled as a single file with all dependencies inlined, to get you going as fast as possible.

Starting a new project is as simple as:

npm create nuxt

screenshot of create nuxt app

Special thanks to @​cmang for the beautiful ASCII-art. ❤️

Want to learn more about where we're headed with the Nuxt CLI? Check out our roadmap here, including our plans for an interactive modules selector.

🚀 Unhead v2

We've upgraded to unhead v2, the engine behind Nuxt's <head> management. This major version removes deprecations and improves how context works:

  • For Nuxt 3 users, we're shipping a legacy compatibility build so nothing breaks
  • The context implementation is now more direct via Nuxt itself
// Nuxt now re-exports composables while properly resolving the context
export function useHead(input, options = {}) {
  const unhead = injectHead(options.nuxt)
  return head(input, { head: unhead, ...options })
}

If you're using Unhead directly in your app, keep in mind:

  1. Import from Nuxt's auto-imports or #app/composables/head instead of @unhead/vue
  2. Importing directly from @unhead/vue might lose async context

Don't worry though - we've maintained backward compatibility in Nuxt 3, so most users won't need to change anything!

If you've opted into compatibilityVersion: 4, check out our upgrade guide for additional changes.

🔧 Devtools v2 Upgrade

Nuxt Devtools has leveled up to v2 (#30889)!

... (truncated)

Commits
  • 7a37a98 v3.16.0
  • 0d13fe9 chore(deps): update all non-major dependencies (3.x) (#31264)
  • 2476cab fix(nuxt): strip query in x-nitro-prerender header
  • 2c68c92 chore(deps): update all non-major dependencies (3.x) (#31240)
  • bf454cb fix(nuxt): pass useFetch function name on server for warning (#31213)
  • b29c0e8 chore: ignore nitro/renderer templates
  • 7c427df fix(nuxt): fall back to wasm if oxc native bindings are missing (#31190)
  • 0ebaa51 fix(nuxt): apply ignore rules to nitro devStorage (#31233)
  • 2f833f4 fix(nuxt): preserve query/hash when calling navigateTo with replace (#31244)
  • 3cd4384 fix(nuxt): ensure head components are reactive (#31248)
  • Additional commits viewable in compare view

Updates fast-jwt from 4.0.6 to 5.0.6

Release notes

Sourced from fast-jwt's releases.

v5.0.6

SECURITY RELEASE

This release contains a fix for https://github.com/nearform/fast-jwt/security/advisories/GHSA-gm45-q3v2-6cf8.

Upgrading is strongly recommended.

Thanks to @​tibrn for reporting, and @​agubler for fixing it.

What's Changed

New Contributors

Full Changelog: https://github.com/nearform/fast-jwt/compare/v5.0.5...v5.0.6

v5.0.5

What's Changed

Full Changelog: https://github.com/nearform/fast-jwt/compare/v5.0.2...v5.0.5

v5.0.2

What's Changed

New Contributors

Full Changelog: https://github.com/nearform/fast-jwt/compare/v5.0.1...v5.0.2

v5.0.1

... (truncated)

Commits

Updates esbuild from 0.20.2 to 0.25.0

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.

  • Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

    This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

    Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

    In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

    Thanks to @​sapphi-red for reporting this issue.

  • Delete output files when a build fails in watch mode (#3643)

    It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.

  • Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

    This release fixes the following problems:

    • Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.

      /* Original code */
      .parent {
        > .a,
        > .b1 > .b2 {
          color: red;
        }
      }
      

      /* Old output (with --supported:nesting=false) */
      .parent > :is(.a, .b1 > .b2) {
      color: red;
      }

      /* New output (with --supported:nesting=false) */
      .parent > .a,
      .parent > .b1 > .b2 {
      color: red;
      }

      Thanks to @​tim-we for working on a fix.

    • The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:

      /* Original code (color should be red) */
      

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
      "compilerOptions": {
        "target": "ES2024"
      }
    }
    

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
      get
      *x() {}
      set
      *y() {}
    }
    

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits
  • e9174d6 publish 0.25.0 to npm
  • c27dbeb fix hosts in plugin-tests.js
  • 6794f60 fix hosts in node-unref-tests.js
  • de85afd Merge commit from fork
  • da1de1b fix #4065: bitwise operators can return bigints
  • f4e9d19 switch case liveness: default is always last
  • 7aa47c3 fix #4028: minify live/dead switch cases better
  • 22ecd30 minify: more constant folding for strict equality
  • 4cdf03c fix #4053: reordering of .tsx in node_modules
  • dc71977 fix #3692: 0 now picks a random ephemeral port
  • Additional commits viewable in compare view

Updates @nuxtjs/mdc from 0.17.0 to 0.17.2

Release notes

Sourced from @​nuxtjs/mdc's releases.

v0.17.2

[!IMPORTANT] This patch release contains a fix for Security Advisory https://github.com/nuxt-modules/mdc/security/advisories/GHSA-cj6r-rrr9-fg82, Special thanks to @​Vozec for the report.

Changelog:

  • Merge commit from fork (3657a5b)
  • chore: update "debug" version (f555abf)
  • chore(deps): lock file maintenance (#386) (287a1d5)
  • test: binding component spacing (ec49505)
  • chore: upgrade parse5 (e22f0c0)

v0.17.1

  • chore: upgrade deps (22bbe93)
  • fix: also check for nuxt-nightly path (#401) (2a48b7b)
  • fix: detect mdcUnwrap on slots too (#388) (44fef67)
Changelog

Sourced from @​nuxtjs/mdc's changelog.

v0.17.2

compare changes

🏡 Chore

✅ Tests

  • Binding component spacing (ec49505)

❤️ Contributors

v0.17.1

compare changes

🩹 Fixes

  • Detect mdcUnwrap on slots too (#388)
  • Also check for nuxt-nightly path (#401)

🏡 Chore

❤️ Contributors

Commits

Updates @octokit/plugin-paginate-rest from 11.3.6 to 11.4.1

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v11.4.1

11.4.1 (2025-02-13)

Bug Fixes

v11.4.0

11.4.0 (2025-01-08)

Features

  • new action runner groups endpoints, new code scanning alerts autofix endpoints, new sub-issues endpoints, new private registries enpoints, new code security endpoints, various description updates (#646) (a73883f)
Commits
  • 7d1fade fix: mitigate ReDos issues & linting issues (#659)
  • bb6c4f9 Merge commit from fork
  • d9c1e8f chore(deps): update dependency esbuild to ^0.25.0 (#656)
  • 7ed5627 build(deps-dev): bump vitest and @​vitest/coverage-v8 (#655)
  • 4a41307 build: remove @​types/fetch-mock (#654)
  • 31f8fe9 build(deps): bump vite from 5.4.6 to 6.0.11 (#651)
  • bc38852 chore(deps): update vitest monorepo to v3 (major) (#650)
  • a73883f feat: new action runner groups endpoints, new code scanning alerts autofix en...
  • bea6327 chore(deps): update dependency fetch-mock to v12 (#640)
  • 7262749 chore(deps): update dependency prettier to v3.4.2 (#645)
  • Additional commits viewable in compare view

Updates nuxt from 3.15.3 to 3.16.0

Release notes

Sourced from nuxt's releases.

v3.16.0

👀 Highlights

There's a lot in this one!

⚡️ A New New Nuxt

Say hello to create-nuxt, a new tool for starting Nuxt projects (big thanks to @​devgar for donating the package name)!

It's a streamlined version of nuxi init - just a sixth of the size and bundled as a single file with all dependencies inlined, to get you going as fast as possible.

Starting a new project is as simple as:

npm create nuxt

screenshot of create nuxt app

Special thanks to @​cmang for the beautiful ASCII-art. ❤️

Want to learn more about where we're headed with the Nuxt CLI? Check out our roadmap here, including our plans for an interactive modules selector.

🚀 Unhead v2

We've upgraded to unhead v2, the engine behind Nuxt's <head> management. This major version removes deprecations and improves how context works:

  • For Nuxt 3 users, we're shipping a legacy compatibility build so nothing breaks
  • The context implementation is now more direct via Nuxt itself
// Nuxt now re-exports composables while properly resolving the context
export function useHead(input, options = {}) {
  const unhead = injectHead(options.nuxt)
  return head(input, { head: unhead, ...options })
}

If you're using Unhead directly in your app, keep in mind:

  1. Import from Nuxt's auto-imports or #app/composables/head instead of @unhead/vue
  2. Importing directly from @unhead/vue might lose async context

Don't worry though - we've maintained backward compatibility in Nuxt 3, so most users won't need to change anything!

If you've opted into compatibilityVersion: 4, check out our upgrade guide for additional changes.

🔧 Devtools v2 Upgrade

Nuxt Devtools has leveled up to v2 (#30889)!

... (truncated)

Commits
  • 7a37a98 v3.16.0
  • 0d13fe9 chore(deps): update all non-major dependencies (3.x) (#31264)
  • 2476cab fix(nuxt): strip query in x-nitro-prerender header
  • 2c68c92 chore(deps): update all non-major dependencies (3.x) (#31240)
  • bf454cb fix(nuxt): pass useFetch function name on server for warning (#31213)
  • b29c0e8 chore: ignore nitro/renderer templates
  • 7c427df fix(nuxt): fall back to wasm if oxc native bindings are missing (#31190)
  • 0ebaa51 fix(nuxt): apply ignore rules to nitro devStorage (#31233)
  • 2f833f4 fix(nuxt): preserve query/hash when calling navigateTo with replace (#31244)
  • 3cd4384 fix(nuxt): ensure head components are reactive (#31248)
  • Additional commits viewable in compare view

Updates fast-jwt from 4.0.6 to 5.0.6

Release notes

Sourced from fast-jwt's releases.

v5.0.6

SECURITY RELEASE

This release contains a fix for https://github.com/nearform/fast-jwt/security/advisories/GHSA-gm45-q3v2-6cf8.

Upgrading is strongly recommended.

Thanks to @​tibrn for reporting, and @​agubler for fixing it.

What's Changed

New Contributors

Full Changelog: https://github.com/nearform/fast-jwt/compare/v5.0.5...v5.0.6

v5.0.5

What's Changed

Full Changelog: https://github.com/nearform/fast-jwt/compare/v5.0.2...v5.0.5

v5.0.2

What's Changed

Pull Request Statistics
Commits:
1
Files Changed:
3
Additions:
+4566
Deletions:
-2230
Package Dependencies
Ecosystem:
npm
Version Change:
0.20.2 → 0.25.0
Update Type:
Minor
Package:
nuxt
Ecosystem:
npm
Version Change:
3.15.3 → 3.16.0
Update Type:
Minor
Ecosystem:
npm
Version Change:
11.3.6 → 11.4.1
Update Type:
Minor
Package:
fast-jwt
Ecosystem:
npm
Version Change:
4.0.6 → 5.0.6
Update Type:
Major
Package:
@nuxtjs/mdc
Ecosystem:
npm
Version Change:
0.17.0 → 0.17.2
Update Type:
Patch
Technical Details
ID: 6692082
UUID: 2794239361
Node ID: PR_kwDOPoNOkc6mjLWB
Host: GitHub
Repository: gitworkflows/pkg.gitworkflows.github.io
Merge State: Unknown