build: bump the npm_and_yarn group across 1 directory with 3 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the / directory: @babel/plugin-transform-modules-systemjs, minimatch and esbuild.

Updates @babel/plugin-transform-modules-systemjs from 7.20.11 to 7.29.4

Release notes

Sourced from @​babel/plugin-transform-modules-systemjs's releases.

v7.29.4 (2026-05-05)

🐛 Bug Fix

• babel-plugin-transform-modules-systemjs
  • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

• Huáng Jùnliàng (@​JLHwung)

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser
  • #17782 Improve trailing comma comment handling (@​JLHwung)

📝 Documentation

• #17847 Replace npmjs.com links with npmx.dev (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-helper-import-to-platform-api, babel-plugin-proposal-import-wasm-source, babel-plugin-transform-json-modules
  • #17818 Load async Wasm and JSON imports in parallel (@​nicolo-ribaudo)

Committers: 4

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu

v7.29.2 (2026-03-16)

👓 Spec Compliance

• babel-parser
  • #17840 [7.x backport] async x => {} must be in leading pos (@​JLHwung)

🐛 Bug Fix

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3
  • #17805 [7.x backport] fix: Properly handle await in finally (@​liuxingbaoyu)
• babel-preset-env

... (truncated)

Commits

• a458f66 v7.29.4
• 32ebd5a [7.x backport]fix(systemjs): improve module string name support (#17974)
• aa8394e v7.29.0
• 0053db6 Update polyfill packages (#17727)
• 61647ae v7.28.5
• a177d55 [Babel 8] Use t.traverseFast to replace some path.traverse (#17518)
• eebd3a0 v7.27.1
• 317e332 Enforce node protocol import (#17207)
• fdc0fb5 [Babel 8] Bump nodejs requirements to ^20.19.0 || >= 22.12.0 (#17204)
• cd24cc0 chore: Update TS 5.7 (#17053)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​babel/plugin-transform-modules-systemjs since your current version.

Updates minimatch from 3.1.2 to 3.1.5

Commits

• 7bba978 3.1.5
• bd25942 docs: add warning about ReDoS
• 1a9c27c fix partial matching of globstar patterns
• 1a2e084 3.1.4
• ae24656 update lockfile
• b100374 limit recursion for **, improve perf considerably
• 26ffeaa lockfile update
• 9eca892 lock node version to 14
• 00c323b 3.1.3
• 30486b2 update CI matrix and actions
• Additional commits viewable in compare view

Updates esbuild from 0.18.10 to 0.18.20

Release notes

Sourced from esbuild's releases.

v0.18.20

• Support advanced CSS @import rules (#953, #3137)

  CSS @import statements have been extended to allow additional trailing tokens after the import path. These tokens sort of make the imported file behave as if it were wrapped in a @layer, @supports, and/or @media rule. Here are some examples:

  @import url(foo.css);
  @import url(foo.css) layer;
  @import url(foo.css) layer(bar);
  @import url(foo.css) layer(bar) supports(display: flex);
  @import url(foo.css) layer(bar) supports(display: flex) print;
  @import url(foo.css) layer(bar) print;
  @import url(foo.css) supports(display: flex);
  @import url(foo.css) supports(display: flex) print;
  @import url(foo.css) print;

  You can read more about this advanced syntax here. With this release, esbuild will now bundle @import rules with these trailing tokens and will wrap the imported files in the corresponding rules. Note that this now means a given imported file can potentially appear in multiple places in the bundle. However, esbuild will still only load it once (e.g. on-load plugins will only run once per file, not once per import).

v0.18.19

• Implement composes from CSS modules (#20)

  This release implements the composes annotation from the CSS modules specification. It provides a way for class selectors to reference other class selectors (assuming you are using the local-css loader). And with the from syntax, this can even work with local names across CSS files. For example:

  // app.js
  import { submit } from './style.css'
  const div = document.createElement('div')
  div.className = submit
  document.body.appendChild(div)

  /* style.css */
  .button {
    composes: pulse from "anim.css";
    display: inline-block;
  }
  .submit {
    composes: button;
    font-weight: bold;
  }

  /* anim.css */
  @keyframes pulse {
    from, to { opacity: 1 }
    50% { opacity: 0.5 }
  }

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.18.20

• Support advanced CSS @import rules (#953, #3137)

  CSS @import statements have been extended to allow additional trailing tokens after the import path. These tokens sort of make the imported file behave as if it were wrapped in a @layer, @supports, and/or @media rule. Here are some examples:

  @import url(foo.css);
  @import url(foo.css) layer;
  @import url(foo.css) layer(bar);
  @import url(foo.css) layer(bar) supports(display: flex);
  @import url(foo.css) layer(bar) supports(display: flex) print;
  @import url(foo.css) layer(bar) print;
  @import url(foo.css) supports(display: flex);
  @import url(foo.css) supports(display: flex) print;
  @import url(foo.css) print;

  You can read more about this advanced syntax here. With this release, esbuild will now bundle @import rules with these trailing tokens and will wrap the imported files in the corresponding rules. Note that this now means a given imported file can potentially appear in multiple places in the bundle. However, esbuild will still only load it once (e.g. on-load plugins will only run once per file, not once per import).

0.18.19

• Implement composes from CSS modules (#20)

  This release implements the composes annotation from the CSS modules specification. It provides a way for class selectors to reference other class selectors (assuming you are using the local-css loader). And with the from syntax, this can even work with local names across CSS files. For example:

  // app.js
  import { submit } from './style.css'
  const div = document.createElement('div')
  div.className = submit
  document.body.appendChild(div)

  /* style.css */
  .button {
    composes: pulse from "anim.css";
    display: inline-block;
  }
  .submit {
    composes: button;
    font-weight: bold;
  }

  /* anim.css */
  @keyframes pulse {
    from, to { opacity: 1 }

... (truncated)

Commits

• 22f0818 publish 0.18.20 to npm
• 89b98d9 css: test coverage for some external test cases
• 4bb897f fix #953, fix #3137: advanced css @import syntax
• 6892b1b css: change ast format for @import conditions
• d770d53 remove unnecessary file slice.go
• 0e5b5fb add test-e2e-yarn
• e08ee89 publish 0.18.19 to npm
• d2bc26c css: attempt to warn about undefined composes
• a0910fd fix #20: implement composes from css modules
• a470f0a css: a basic implementation of local composes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.