ci: Bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #357 · thejefflarson/protector

dependabot · 2026-11-09T17:16:48Z

Bumps the npm_and_yarn group with 5 updates in the /engine/web directory:

Package	From	To
@vitest/mocker	`3.2.6`	`5.1.0`
brace-expansion	`1.1.16`	`1.1.21`
js-yaml	`4.3.1`	`4.3.2`
source-map-js	`1.2.1`	`1.2.2`
vite	`6.4.3`	`8.3.7`

Updates @vitest/mocker from 3.2.6 to 5.1.0

Release notes

Sourced from @vitest/mocker's releases.

v5.1.0

🚀 Features

Add --last-failed to run only failed tests - by @sheremet-va in vitest-dev/vitest#11558 (82f63)

Support Temporal.Instant and Temporal.ZonedDateTime in vi.setSystemTime() - by @Prajwal2246, Prajwal2246, Claude Opus 5.5 (1M context), @hi-ogawa and Codex (GPT-6) in vitest-dev/vitest#11321 (f150f)

Introduce --since-last-run flag - by @sheremet-va in vitest-dev/vitest#11516 (08bd9)

Expose per-retry/repeat attempt result - by @hi-ogawa, Codex (GPT-6) and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11232 (21be4)

Support fake timers for node:timers and node:timers/promise - by @hi-ogawa, OpenCode and Codex (GPT-6) in vitest-dev/vitest#10899 (fbe97)

Allow coverage providers to store data in fs module cache - by @AriPerkkio in vitest-dev/vitest#11747 (54a2b)

Interactively review failed snapshots - by @macarie and @hi-ogawa in vitest-dev/vitest#11325 (54e5b)

browser:

Mock modules through an import map - by @sheremet-va in vitest-dev/vitest#11534 (707f8)

Drop experimental label from trace view - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11518 (44c3c)

Introduce experimental pointer API - by @macarie in vitest-dev/vitest#10780 (5dc09)

Capture aria snapshot in trace view - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11492 (0cc39)

Show trace steps timeline on terminal on test failure - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11594 (973dc)

Add failure-only trace view mode - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11612 (d5d7d)

Enable failure-only trace view by default - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11766 (f37b6)

coverage:

V8 to support ignoreNode option - by @erickserra and @AriPerkkio in vitest-dev/vitest#11688 (e02db)

experimental:

Add trace timeline for node - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11753 (4e985)

Add message option to vi.waitFor and vi.waitUntil - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11754 (fd145)

🐞 Bug Fixes

Rerun setup files after --changed filtering - by @sheremet-va in vitest-dev/vitest#11621 (3a39c)

Return the mock to concurrent imports - by @sheremet-va in vitest-dev/vitest#11623 (1453b)

Don't fail on console log pending at teardown - by @sheremet-va in vitest-dev/vitest#11619 (a60b8)

Reference chai types in every d.ts chunk - by @sheremet-va in vitest-dev/vitest#11618 (fb150)

Detect mock factory cycles that form later - by @sheremet-va in vitest-dev/vitest#11642 (e9554)

Skip fs module cache for typed import.meta.glob - by @sheremet-va in vitest-dev/vitest#11666 (79501)

Run tests that import a deleted file - by @sheremet-va in vitest-dev/vitest#11669 (80aa1)

Keep syntax highlighting in code frames - by @sheremet-va in vitest-dev/vitest#11705 (d39f5)

Respect CLI filters when prewarming browsers - by @sheremet-va and Benjamin Tang in vitest-dev/vitest#11706 (10947)

Read cached source as utf-8 - by @juan-fernandez in vitest-dev/vitest#11682 and vitest-dev/vitest#11709 (867a5)

Inherit watch from the root config in projects - by @nstepien and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11724 (77c12)

Prefix expect.poll message to all errors - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11756 (cab58)

Support api.port 0 - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11641 (3667c)

Show attempts in test error logs of retried tests - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11696 (77a94)

Preserve rootDir in project paths - by @btea in vitest-dev/vitest#11816 (bf96d)

browser:

Change default port to 23315 - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11640 (a2ec4)

Advance fake timers in actions and expect.element - by @julienw, @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11242 (68190)

Drop trace view warning without html reporter - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11665 (e6407)

Detect shared chunks via the optimizer - by @sheremet-va in vitest-dev/vitest#11661 (e2e9c)

Clear screenshot stability timeout - by @sheremet-va in vitest-dev/vitest#11659 (fbe37)

Measure prepare duration with one clock - by @sheremet-va in vitest-dev/vitest#11667 (a3ed4)

Keep failure screenshot per attempt - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11694 (a5022)

Print trace timeline of each attempt - by @hi-ogawa and Claude Opus 5.5 (1M context) in vitest-dev/vitest#11695 (27229)

... (truncated)

Commits

7a38449 chore: release v5.1.0 (#11838)
810ec66 fix(mocker): use root mocks for linked packages (fix #7708) (#11739)
cca423d fix(mocker): don't change the original prototype chain (#11737)
e1b0d33 chore: release v5.1.0-beta.1 (#11647)
707f8ad feat(browser): mock modules through an import map (#11534)
7a825db chore: release v5.0.5 (#11609)
6a11cf6 chore: release v5.0.4 (#11554)
58c86ed chore(deps): update all non-major dependencies (#11550)
5c95521 fix(browser): clean up unmocked and pending mocks (#11537)
cd423ba fix(mocker): fix native loader mocking edge cases (#11540)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.16 to 1.1.21

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
758fcd6 1.1.18
27fbeed Merge commit from fork
5c57cc2 1.1.17
d757f1d npm ignore .claude
Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

[backport] Hard-limit merge sequence size to 100.

Security

[backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

79ca68d 4.3.2 released
d90b661 Backport merge limits from v5.4.1
See full diff in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Updates vite from 6.4.3 to 8.3.7

Release notes

Sourced from vite's releases.

v8.3.7

Bug Fixes

deps: update Rolldown to v1.2.18 (#24038) (517affb)

Miscellaneous Chores

enable more lint rules (#24035) (72f86e5)

Tests

use onTestFinished for tear downs (#24003) (a579e35)

Build System

generate sourcemaps in shim-deps plugin (#24023) (c02138c)

v8.3.6

Bug Fixes

await overlapping plugin container close calls (#23935) (175bbeb)

build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)

build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)

bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)

bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)

deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)

deps: update all non-major dependencies (#23896) (46b91c5)

deps: update all non-major dependencies (#23966) (b3cb057)

deps: update rolldown-related dependencies (#23868) (a63eb87)

deps: update rolldown-related dependencies (#23967) (0105733)

dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)

html: remove adjacent module tags on the first line (#23823) (eab1dc2)

ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)

optimizer: detect cache dir precisely (#23912) (cc9bc21)

optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)

respect build.sourcemap from environment (#23879) (82e7aa0)

server: escape HTML attributes (#23995) (a270391)

server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)

ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)

use top-level input for SSR build when build.ssr: true (#23898) (90bc034)

wasm: reject .wasm outside server.fs (#23914) (64e2467)

watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)

worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)

css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.7 (2026-11-09)

Bug Fixes

deps: update Rolldown to v1.2.18 (#24038) (517affb)

Miscellaneous Chores

enable more lint rules (#24035) (72f86e5)

Tests

use onTestFinished for tear downs (#24003) (a579e35)

Build System

generate sourcemaps in shim-deps plugin (#24023) (c02138c)

8.3.6 (2026-11-05)

Bug Fixes

await overlapping plugin container close calls (#23935) (175bbeb)

build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)

build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)

bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)

bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)

deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)

deps: update all non-major dependencies (#23896) (46b91c5)

deps: update all non-major dependencies (#23966) (b3cb057)

deps: update rolldown-related dependencies (#23868) (a63eb87)

deps: update rolldown-related dependencies (#23967) (0105733)

dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)

html: remove adjacent module tags on the first line (#23823) (eab1dc2)

ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)

optimizer: detect cache dir precisely (#23912) (cc9bc21)

optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)

respect build.sourcemap from environment (#23879) (82e7aa0)

server: escape HTML attributes (#23995) (a270391)

server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)

ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)

use top-level input for SSR build when build.ssr: true (#23898) (90bc034)

wasm: reject .wasm outside server.fs (#23914) (64e2467)

watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)

worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)

css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

... (truncated)

Commits

5def936 release: v8.3.7 (#24040)
517affb fix(deps): update Rolldown to v1.2.18 (#24038)
72f86e5 chore: enable more lint rules (#24035)
c02138c build: generate sourcemaps in shim-deps plugin (#24023)
a579e35 test: use onTestFinished for tear downs (#24003)
0fd9a29 release: v8.3.6 (#23996)
eab1dc2 fix(html): remove adjacent module tags on the first line (#23823)
a270391 fix(server): escape HTML attributes (#23995)
7139ef3 fix(worker): keep chunks conflicted with unused workers that are still used b...
0fdd81e fix(optimizer): resolve subpath imports (#) with Vite's resolver (#23959)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 5 updates in the /engine/web directory: | Package | From | To | | --- | --- | --- | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `3.2.6` | `5.1.0` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.16` | `1.1.21` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.3.1` | `4.3.2` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.3` | `8.3.7` | Updates `@vitest/mocker` from 3.2.6 to 5.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/mocker) Updates `brace-expansion` from 1.1.16 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.16...v1.1.21) Updates `js-yaml` from 4.3.1 to 4.3.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.1...4.3.2) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) Updates `vite` from 6.4.3 to 8.3.7 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.7/packages/vite) --- updated-dependencies: - dependency-name: "@vitest/mocker" dependency-version: 5.1.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.3.7 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026

Navigation Menu

Repository navigation

ci: Bump the npm_and_yarn group across 1 directory with 5 updates - #357

ci: Bump the npm_and_yarn group across 1 directory with 5 updates#357
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/engine/web/npm_and_yarn-8b9c6e9d80

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

v5.1.0

🚀 Features

🐞 Bug Fixes

4.3.2 - 2026-08-26

Changed

Security

v1.2.2

1.2.2

v8.3.7

Bug Fixes

Miscellaneous Chores

Tests

Build System

v8.3.6

Bug Fixes

Performance Improvements

Miscellaneous Chores

8.3.7 (2026-11-09)

Bug Fixes

Miscellaneous Chores

Tests

Build System

8.3.6 (2026-11-05)

Bug Fixes

Performance Improvements

Miscellaneous Chores

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants