chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates by dependabot[bot] · Pull Request #68 · harsha09/spec-driven-development

dependabot · 2026-10-22T08:48:22Z

Bumps the npm_and_yarn group with 3 updates in the / directory: vite, postcss and source-map-js.

Updates vite from 6.4.3 to 6.4.4

Release notes

v6.4.4

Please refer to CHANGELOG.md for details.

Changelog

6.4.4 (2026-10-06)

fix(deps): update launch-editor to v2.14.2 (#23654) (8afec69), closes #23654

fix(html): filename passed to transformIndexHtml should not include queries (#23653) (19902cf), closes #23653

fix(server): check resolved ids for transform access (#20410) (eec6464), closes #20410

fix(server): store ids to safeModulePaths rather than URLs (#23656) (e570d8d), closes #23656

Commits

5f0d9a4 release: v6.4.4
eec6464 fix(server): check resolved ids for transform access (#20410)
e570d8d fix(server): store ids to safeModulePaths rather than URLs (#23656)
8afec69 fix(deps): update launch-editor to v2.14.2 (#23654)
19902cf fix(html): filename passed to transformIndexHtml should not include queries (...
See full diff in compare view

Updates postcss from 8.5.19 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

Changelog

Sourced from postcss's changelog.

8.5.31

Fix better source map on </style> escaping (by @firefoxic).

8.5.30

Fix broken map on </style> escaping (by @Rufflet).

8.5.29

Improved </style> escaping (by @choudhryfrompak).

Fixed comments support in list.comma() and list.space() (by @00200200).

Fixed semicolon and custom property (by @wahidrizka).

8.5.28

Fixes types regression.

8.5.27

Fixed removing any comments starting with /*# (by @dylanpulver).

Fixed * hack before a comment in Custom Properties (by @Jaybhade).

Fixed empty values in the middle of list.comma() (by @MahinAnowar).

Fixed whitespace-only values in list.space() (by @MahinAnowar).

Fixed rule’s end position on space before semicolon (by @maximilliangrand).

Fixed types (by @romainmenke).

Fixed Chinese text in deprecation warning (by @Jesse205).

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

... (truncated)

Commits

d190857 Release 8.5.31 version
4ef6d8c Update dependencies
6abd674 Call the builder with every node when the output is escaped (#2175)
f1aca7e Release 8.5.30 version
9d83445 Update dependencies
6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
1fd8f88 Add missed changes in changelog
a7a1f34 Release 8.5.29 version
b55a36d Update dependencies
7647a81 Escape </style> in output of non-Root nodes (#2163)
Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 3 updates in the / directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [postcss](https://github.com/postcss/postcss) and [source-map-js](https://github.com/7rulnik/source-map-js). Updates `vite` from 6.4.3 to 6.4.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.4/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.4/packages/vite) Updates `postcss` from 8.5.19 to 8.5.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.19...8.5.31) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: vite dependency-version: 6.4.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.31 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-10-22T08:48:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@6.4.3 ⏵ 6.4.4		⁺²¹	⁺¹

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 22, 2026

harsha09 merged commit a4e36e7 into main Oct 23, 2026
6 checks passed

harsha09 deleted the dependabot/npm_and_yarn/npm_and_yarn-5426cb249e branch October 23, 2026 08:29

Navigation Menu

Repository navigation

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates - #68

chore(deps): bump the npm_and_yarn group across 1 directory with 3 updates#68
harsha09 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-5426cb249e

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

socket-security Bot commented Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026

v6.4.4

6.4.4 (2026-10-06)

8.5.31

8.5.30

8.5.29

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.31

8.5.30

8.5.29

8.5.28

8.5.27

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

v1.2.2

1.2.2

Uh oh!

socket-security Bot commented Oct 22, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant