chore(deps): bump the npm_and_yarn group across 16 directories with 17 updates

[dependabot]

Bumps the npm_and_yarn group with 7 updates in the /docs directory:

Package	From	To
astro	6.1.10	7.1.6
sharp	0.34.5	0.35.3
sharp	0.33.5	0.35.3
@astrojs/rss	4.0.18	4.0.19
esbuild	0.27.7	0.28.1
vite	7.3.3	7.3.6
fast-uri	3.1.2	3.1.5
svgo	4.0.1	4.0.2
esbuild	0.27.7	0.28.1

Bumps the npm_and_yarn group with 1 update in the /v2/examples/dragdrop-test/frontend directory: postcss.
Bumps the npm_and_yarn group with 2 updates in the /v2/internal/frontend/runtime directory: postcss and shell-quote.
Bumps the npm_and_yarn group with 1 update in the /v2/internal/frontend/runtime/dev directory: shell-quote.
Bumps the npm_and_yarn group with 1 update in the /v3/examples/android/frontend directory: postcss.
Bumps the npm_and_yarn group with 1 update in the /v3/examples/custom-protocol-example/frontend directory: postcss.
Bumps the npm_and_yarn group with 1 update in the /v3/examples/dev/frontend directory: postcss.
Bumps the npm_and_yarn group with 1 update in the /v3/examples/dock/frontend directory: postcss.
Bumps the npm_and_yarn group with 1 update in the /v3/examples/file-association/frontend directory: postcss.
Bumps the npm_and_yarn group with 1 update in the /v3/examples/ios/frontend directory: postcss.
Bumps the npm_and_yarn group with 1 update in the /v3/examples/mac-window-tabs/frontend directory: vite.
Bumps the npm_and_yarn group with 1 update in the /v3/examples/mobile/frontend directory: postcss.
Bumps the npm_and_yarn group with 2 updates in the /v3/examples/notifications/frontend directory: esbuild and vite.
Bumps the npm_and_yarn group with 4 updates in the /v3/internal/runtime/desktop/@wailsio/runtime directory: js-yaml, postcss, brace-expansion and linkify-it.
Bumps the npm_and_yarn group with 1 update in the /v3/internal/setupwizard/frontend directory: postcss.
Bumps the npm_and_yarn group with 9 updates in the /website directory:

Package	From	To
fast-uri	3.1.2	3.1.3
postcss	8.5.15	8.5.16
svgo	3.3.3	3.3.4
shell-quote	1.8.4	1.9.0
axios	1.16.1	1.17.0
body-parser	1.20.5	1.20.6
tar	7.5.16	7.5.19
webpack-dev-server	5.2.5	5.2.6
websocket-driver	0.7.4	0.7.5

Updates astro from 6.1.10 to 7.1.6

Release notes

Sourced from astro's releases.

astro@7.1.6

Patch Changes

• #17536 ff97b86 Thanks @​dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

• #17383 296e1b0 Thanks @​thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

• #17543 bbc1ec9 Thanks @​ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

  For example, you can reduce the size of chunks to 1MB:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: {
  type: 'chunked',
  chunkSize: 1024 * 1024,
  },
  },
  });

• #17545 5214663 Thanks @​ematipico! - Bumps the Astro compiler to the latest version. Changelog.

astro@7.1.5

Patch Changes

• #17524 7613030 Thanks @​matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

• #17480 f61ba9c Thanks @​florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

• #17525 e614b7b Thanks @​matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

• #17284 c775c1f Thanks @​matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

• #17474 c895b12 Thanks @​nicksnyder! - Updates dependency js-yaml to v4.3.0

• Updated dependencies [c895b12]:

  • @​astrojs/internal-helpers@​0.10.2
  • @​astrojs/markdown-remark@​7.2.2
  • @​astrojs/markdown-satteri@​0.3.5

astro@7.1.4

Patch Changes

• #17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.6

Patch Changes

• #17536 ff97b86 Thanks @​dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

• #17383 296e1b0 Thanks @​thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

• #17543 bbc1ec9 Thanks @​ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

  For example, you can reduce the size of chunks to 1MB:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: {
  type: 'chunked',
  chunkSize: 1024 * 1024,
  },
  },
  });

• #17545 5214663 Thanks @​ematipico! - Bumps the Astro compiler to the latest version. Changelog.

7.1.5

Patch Changes

• #17524 7613030 Thanks @​matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

• #17480 f61ba9c Thanks @​florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

• #17525 e614b7b Thanks @​matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

• #17284 c775c1f Thanks @​matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

• #17474 c895b12 Thanks @​nicksnyder! - Updates dependency js-yaml to v4.3.0

• Updated dependencies [c895b12]:

  • @​astrojs/internal-helpers@​0.10.2
  • @​astrojs/markdown-remark@​7.2.2
  • @​astrojs/markdown-satteri@​0.3.5

7.1.4

Patch Changes

... (truncated)

Commits

• 9865d1c [ci] release (#17539)
• 5214663 fix: bump compiler (#17545)
• bbc1ec9 fix: chuncked content collections (#17543)
• 296e1b0 fix(dev): refresh stale CSS for component \<style> block HMR (#17383)
• ff97b86 fix(build): introduce two-staged build to prevent race condition with concurr...
• b0535ca [ci] release (#17528)
• c895b12 Update js-yaml to 4.3.0 (#17474)
• f61ba9c fix(logger): loading at runtime when entrypoint is a URL (#17480)
• e614b7b fix(astro): do not resolve action function properties as path segments (#17525)
• 7613030 Return a response when request finalization fails (#17524)
• Additional commits viewable in compare view

Updates sharp from 0.34.5 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info. #4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

• Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

• Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

• Reject infinite values when validating numbers. #4553 @​metsw24-max

• Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

• Verify background colour values are numbers. #4556 @​metsw24-max

• Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

• Tighten recomb and affine matrix verification. #4560 @​chatman-media

• Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

• 1018449 Release v0.35.3
• ba303a7 Prerelease v0.35.3-rc.2
• 4f94fc5 Upgrade to sharp-libvips v1.3.2
• c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
• 9a8d002 Docs: Add changelog entry and note about transferable #4520
• 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
• e000d0b Prerelease v0.35.3-rc.1
• 9554ca9 Prerelease v0.35.3-rc.0
• 6a29fd5 Emit warning about native binaries on Linux Electron
• 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
• Additional commits viewable in compare view

Updates sharp from 0.33.5 to 0.35.3

Release notes

Sourced from sharp's releases.

v0.35.3

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

• Improve code bundler support by resolving path to libvips binary.

• Increase default concurrency when use of MALLOC_ARENA_MAX is detected.

• Emit warning about binaries provided by Electron for use on Linux.

• Add hasAlpha property to output info. #4500

• TypeScript: Return more precise Buffer<ArrayBuffer> from toBuffer. #4520 @​Andarist

• Bound clahe width and height to avoid signed overflow. #4551 @​metsw24-max

• Bound trim margin to avoid signed overflow. #4552 @​metsw24-max

• Reject infinite values when validating numbers. #4553 @​metsw24-max

• Bound extract region to libvips coordinate limit. #4555 @​metsw24-max

• Verify background colour values are numbers. #4556 @​metsw24-max

• Bound create and raw input dimensions to coordinate limit. #4558 @​metsw24-max

• Tighten recomb and affine matrix verification. #4560 @​chatman-media

• Verify cache memory limit to avoid overflow. #4561 @​metsw24-max

v0.35.3-rc.2

• Tighten verification of text dimensions, TIFF tile dimensions and extend values.

... (truncated)

Commits

• 1018449 Release v0.35.3
• ba303a7 Prerelease v0.35.3-rc.2
• 4f94fc5 Upgrade to sharp-libvips v1.3.2
• c5e7a3f Bump devDeps, fix Deno/Windows smoke tests
• 9a8d002 Docs: Add changelog entry and note about transferable #4520
• 8694db0 TypeScript: Return more precise Buffer\<ArrayBuffer> from toBuffer (#4520)
• e000d0b Prerelease v0.35.3-rc.1
• 9554ca9 Prerelease v0.35.3-rc.0
• 6a29fd5 Emit warning about native binaries on Linux Electron
• 540d2ea Increase default concurrency when use of MALLOC_ARENA_MAX detected
• Additional commits viewable in compare view

Updates @astrojs/rss from 4.0.18 to 4.0.19

Release notes

Sourced from @​astrojs/rss's releases.

@​astrojs/rss@​4.0.19

Patch Changes

• #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

Changelog

Sourced from @​astrojs/rss's changelog.

4.0.19

Patch Changes

• #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

Commits

• 5978993 [ci] release (#17213)
• 2bfb179 chore: simpler package.json types (#17229)
• fbcfa03 Escape source and enclosure fields in RSS feed generation (#17209)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• 46633f5 refactor(create-astro): migrate tests to typescript (#16400)
• 747a5b3 refactor: migrate astro-rss tests to typescript (#16357)
• 88fcc98 fix integrations links across docs (#16098)
• See full diff in compare view

Updates esbuild from 0.27.7 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates vite from 7.3.3 to 7.3.6

Release notes

Sourced from vite's releases.

v7.3.6

Please refer to CHANGELOG.md for details.

v7.3.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.6 (2026-06-25)

Features

• allow esbuild 0.28 (#22743) (a24931e)

7.3.5 (2026-06-01)

Bug Fixes

• backport #22572, reject windows alternate paths (#22574) (8c18556)
• deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

Miscellaneous Chores

• skip v7.3.4 release (8a6a0c9)

7.3.4 (2026-06-01)

Bug Fixes

• backport #22572, reject windows alternate paths (#22574) (8c18556)
• deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

Commits

• 0a7b53b release: v7.3.6
• a24931e feat: allow esbuild 0.28 (#22743)
• 077945c release: v7.3.5
• 8a6a0c9 chore: skip v7.3.4 release
• 8c18556 fix: backport #22572, reject windows alternate paths (#22574)
• f20d64b fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
• See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

• Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

• 5e179cb Bumped v3.1.5
• 2cad02d Merge commit from fork
• 6aeece6 Bumped v3.1.4
• 2d50fba fix: reject literal backslash in URI authority
• 0549fe3 Bumped v3.1.3
• 2a6d357 Merge commit from fork
• See full diff in compare view

Updates js-yaml from 4.1.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• See full diff in compare view

Updates postcss from 8.5.14 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Commits

• 08c989c Release 8.5.25 version
• 24f6814 Fix 8.5.17 visitor regression
• f2fa53f Add supply chain security requirement to PostCSS plugin guide
• 10edf0b fix: return empty array for empty string in list.split (#2121)
• 0ebe8ad Release 8.5.24 version
• 73218c6 Update dependencies
• 9a114f6 Preserve the BOM when stringifying (#2119)
• 9069261 Fix types check
• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates svgo from 4.0.1 to 4.0.2

Commits

• See full diff in compare view

Updates vite from 7.3.3 to 7.3.6

Release notes

Sourced from vite's releases.

v7.3.6

Please refer to CHANGELOG.md for details.

v7.3.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.6 (2026-06-25)

Features

• allow esbuild 0.28 (#22743) (a24931e)

7.3.5 (2026-06-01)

Bug Fixes

• backport #22572, reject windows alternate paths (#22574) (8c18556)
• deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

Miscellaneous Chores

• skip v7.3.4 release (8a6a0c9)

7.3.4 (2026-06-01)

Bug Fixes

• backport #22572, reject windows alternate paths (#22574) (8c18556)
• deps: backport #22571, reject UNC paths for launch-editor-middleware (#22573) (f20d64b)

Commits

• 0a7b53b release: v7.3.6
• a24931e feat: allow esbuild 0.28 (#22743)
• 077945c release: v7.3.5
• 8a6a0c9 chore: skip v7.3.4 release
• 8c18556 fix: backport #22572, reject windows alternate paths (#22574)
• f20d64b fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
• See full diff in compare view

Updates vite from 7.3.3 to 7.3.6

Release notes

Sourced from vite's releases.

v7.3.6

Please refer to CHANGELOG.md for details.

v7.3.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.6 (2026-06-25)

Features

• allow esbuild 0.28 (#22743) (a24931e)

7.3.5 (2026-06-01)

Bug F...

Description has been truncated