build(deps): bump esbuild, vite and @vitejs/plugin-vue #3

dependabot · 2025-07-10T21:04:24Z

Bumps esbuild to 0.25.6 and updates ancestor dependencies esbuild, vite and @vitejs/plugin-vue. These dependencies need to be updated together.

Updates esbuild from 0.18.20 to 0.25.6

Release notes

Sourced from esbuild's releases.

v0.25.6
Fix a memory leak when cancel() is used on a build context (#4231)

Calling rebuild() followed by cancel() in rapid succession could previously leak memory. The bundler uses a producer/consumer model internally, and the resource leak was caused by the consumer being termianted while there were still remaining unreceived results from a producer. To avoid the leak, the consumer now waits for all producers to finish before terminating.

Support empty :is() and :where() syntax in CSS (#4232)

Previously using these selectors with esbuild would generate a warning. That warning has been removed in this release for these cases.
Improve tree-shaking of try statements in dead code (#4224)

With this release, esbuild will now remove certain try statements if esbuild considers them to be within dead code (i.e. code that is known to not ever be evaluated). For example:
// Original code
return 'foo'
try { return 'bar' } catch {}
// Old output (with --minify)
return"foo";try{return"bar"}catch{}
// New output (with --minify)
return"foo";
Consider negated bigints to have no side effects

While esbuild currently considers 1, -1, and 1n to all have no side effects, it didn't previously consider -1n to have no side effects. This is because esbuild does constant folding with numbers but not bigints. However, it meant that unused negative bigint constants were not tree-shaken. With this release, esbuild will now consider these expressions to also be side-effect free:
// Original code
let a = 1, b = -1, c = 1n, d = -1n
// Old output (with --bundle --minify)
(()=>{var n=-1n;})();
// New output (with --bundle --minify)
(()=>{})();
Support a configurable delay in watch mode before rebuilding (#3476, #4178)

The watch() API now takes a delay option that lets you add a delay (in milliseconds) before rebuilding when a change is detected in watch mode. If you use a tool that regenerates multiple source files very slowly, this should make it more likely that esbuild's watch mode won't generate a broken intermediate build before the successful final build. This option is also available via the CLI using the --watch-delay= flag.

This should also help avoid confusion about the watch() API's options argument. It was previously empty to allow for future API expansion, which caused some people to think that the documentation was missing. It's no longer empty now that the watch() API has an option.

Allow mixed array for entryPoints API option (#4223)

The TypeScript type definitions now allow you to pass a mixed array of both string literals and object literals to the entryPoints API option, such as ['foo.js', { out: 'lib', in: 'bar.js' }]. This was always possible to do in JavaScript but the TypeScript type definitions were previously too restrictive.

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

d38c1f0 publish 0.25.6 to npm
11e547e missing ) in release notes
cc8ac0a fix trailing comment whitespace
1e3fb57 fix #4178: add the --watch-delay= option
c1f5f18 fix #4209: disable binary executable optimization on WASM platform (#4210)
3ed5ecc fix incorrect locations in CHANGELOG.md
248089c fix #4224: allow try statements to become dead
42f159c openharmony: keep makefile targets sorted
63256e1 chore: fix some comments (#4211)
d803f72 add support for openharmony-arm64 platform (#4212)
Additional commits viewable in compare view

Updates vite from 4.5.14 to 7.0.4

Release notes

Sourced from vite's releases.

v7.0.4

Please refer to CHANGELOG.md for details.

v7.0.3

Please refer to CHANGELOG.md for details.

v7.0.2

Please refer to CHANGELOG.md for details.

create-vite@7.0.2

Please refer to CHANGELOG.md for details.

v7.0.1

Please refer to CHANGELOG.md for details.

create-vite@7.0.1

Please refer to CHANGELOG.md for details.

create-vite@7.0.0

Please refer to CHANGELOG.md for details.

plugin-legacy@7.0.0

Please refer to CHANGELOG.md for details.

v7.0.0

Please refer to CHANGELOG.md for details.

v7.0.0-beta.2

Please refer to CHANGELOG.md for details.

v7.0.0-beta.1

Please refer to CHANGELOG.md for details.

plugin-legacy@7.0.0-beta.1

Please refer to CHANGELOG.md for details.

plugin-legacy@7.0.0-beta.0

Please refer to CHANGELOG.md for details.

v7.0.0-beta.0

Please refer to CHANGELOG.md for details.

create-vite@6.5.0

Please refer to CHANGELOG.md for details.

create-vite@6.4.1

Please refer to CHANGELOG.md for details.

create-vite@6.4.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.0.4 (2025-07-10)

Bug Fixes

allow resolving bare specifiers to relative paths for entries (#20379) (324669c)

Build System

remove @oxc-project/runtime devDep (#20389) (5e29602)

7.0.3 (2025-07-08)

Bug Fixes

client: protect against window being defined but addEv undefined (#20359) (31d1467)

define: replace optional values (#20338) (9465ae1)

deps: update all non-major dependencies (#20366) (43ac73d)

Miscellaneous Chores

deps: update dependency dotenv to v17 (#20325) (45040d4)

deps: update dependency rolldown to ^1.0.0-beta.24 (#20365) (5ab25e7)

use n/prefer-node-protocol rule (#20368) (38bb268)

Code Refactoring

minor changes to reduce diff between normal Vite and rolldown-vite (#20354) (2e8050e)

7.0.2 (2025-07-04)

Bug Fixes

css: resolve relative paths in sass, revert #20300 (#20349) (db8bd41)

7.0.1 (2025-07-03)

Bug Fixes

css: skip resolving resolved paths in sass (#20300) (ac528a4)

deps: update all non-major dependencies (#20324) (3e81af3)

types: add a global interface for Worker (#20243) (37bdfc1)

Miscellaneous Chores

deps: update rolldown-related dependencies (#20323) (30d2f1b)

fix typos and grammatical errors across documentation and comments (#20337) (c1c951d)

group commits by category in changelog (#20310) (41e83f6)

rearrange 7.0 changelog (#20280) (eafd28a)

7.0.0 (2025-06-24)

Today, we're excited to announce the release of the next Vite major:

... (truncated)

Commits

8a65433 release: v7.0.4
324669c fix: allow resolving bare specifiers to relative paths for entries (#20379)
5e29602 build: remove @oxc-project/runtime devDep (#20389)
f562df8 release: v7.0.3
38bb268 chore: use n/prefer-node-protocol rule (#20368)
45040d4 chore(deps): update dependency dotenv to v17 (#20325)
9465ae1 fix(define): replace optional values (#20338)
43ac73d fix(deps): update all non-major dependencies (#20366)
31d1467 fix(client): protect against window being defined but addEv undefined (#20359)
5ab25e7 chore(deps): update dependency rolldown to ^1.0.0-beta.24 (#20365)
Additional commits viewable in compare view

Updates @vitejs/plugin-vue from 4.6.2 to 6.0.0

Release notes

Sourced from @vitejs/plugin-vue's releases.

plugin-vue@6.0.0

Please refer to CHANGELOG.md for details.

plugin-vue@6.0.0-beta.2

Please refer to CHANGELOG.md for details.

plugin-vue@6.0.0-beta.1

Please refer to CHANGELOG.md for details.

plugin-vue@6.0.0-beta.0

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.4

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.3

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.2

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.1

Please refer to CHANGELOG.md for details.

plugin-vue@5.2.0

Please refer to CHANGELOG.md for details.

plugin-vue@5.1.5

Please refer to CHANGELOG.md for details.

plugin-vue@5.1.4

Please refer to CHANGELOG.md for details.

plugin-vue@5.1.3

Please refer to CHANGELOG.md for details.

plugin-vue@5.1.2

Please refer to CHANGELOG.md for details.

plugin-vue@5.1.1

Please refer to CHANGELOG.md for details.

plugin-vue@5.1.0

Please refer to CHANGELOG.md for details.

plugin-vue@5.0.5

Please refer to CHANGELOG.md for details.

plugin-vue@5.0.4

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from @vitejs/plugin-vue's changelog.

6.0.0 (2025-06-24)

Bug Fixes

deps: update all non-major dependencies (#590) (43426c8)

deps: update all non-major dependencies (#600) (a4c32a8)

deps: update all non-major dependencies (#605) (67534e5)

deps: update all non-major dependencies (#609) (98c52eb)

Miscellaneous Chores

add description and keywords field to package.json (#604) (67ab76b)

deps: update dependency rollup to ^4.41.1 (#591) (256ac31)

deps: update dependency rollup to ^4.43.0 (#601) (a495edf)

remove Vite 7 beta from supported range (#598) (c7ddd62)

Code Refactoring

always use crypto.hash (#606) (5de85f6)

6.0.0-beta.2 (2025-06-06)

⚠ BREAKING CHANGES

bump required node version to 20.19+, 22.12+ and drop CJS build (#596)

Features

add Vite 7 support (#597) (12f2881)

Bug Fixes

template src sourcemap source (#267) (de18693)

Code Refactoring

bump required node version to 20.19+, 22.12+ and drop CJS build (#596) (56df545)

6.0.0-beta.1 (2025-06-02)

Bug Fixes

vue: import with query (#592) (b0400f3)

6.0.0-beta.0 (2025-05-21)

⚠ BREAKING CHANGES

vue: separate include and exclude from api.options and add filter (#582)

Features

vue: separate include and exclude from api.options and add filter (#582) (e3beac8)

... (truncated)

Commits

9c07818 release: plugin-vue@6.0.0
c7ddd62 chore: remove Vite 7 beta from supported range (#598)
98c52eb fix(deps): update all non-major dependencies (#609)
5de85f6 refactor: always use crypto.hash (#606)
67534e5 fix(deps): update all non-major dependencies (#605)
67ab76b chore: add description and keywords field to package.json (#604)
a495edf chore(deps): update dependency rollup to ^4.43.0 (#601)
a4c32a8 fix(deps): update all non-major dependencies (#600)
256ac31 chore(deps): update dependency rollup to ^4.41.1 (#591)
43426c8 fix(deps): update all non-major dependencies (#590)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [esbuild](https://github.com/evanw/esbuild) to 0.25.6 and updates ancestor dependencies [esbuild](https://github.com/evanw/esbuild), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [@vitejs/plugin-vue](https://github.com/vitejs/vite-plugin-vue/tree/HEAD/packages/plugin-vue). These dependencies need to be updated together. Updates `esbuild` from 0.18.20 to 0.25.6 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.18.20...v0.25.6) Updates `vite` from 4.5.14 to 7.0.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.0.4/packages/vite) Updates `@vitejs/plugin-vue` from 4.6.2 to 6.0.0 - [Release notes](https://github.com/vitejs/vite-plugin-vue/releases) - [Changelog](https://github.com/vitejs/vite-plugin-vue/blob/main/packages/plugin-vue/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-vue/commits/plugin-vue@6.0.0/packages/plugin-vue) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.25.6 dependency-type: indirect - dependency-name: vite dependency-version: 7.0.4 dependency-type: direct:development - dependency-name: "@vitejs/plugin-vue" dependency-version: 6.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

nnegi88 · 2025-07-14T15:53:57Z

@claude review this MR

claude · 2025-07-14T15:54:17Z

Claude finished @nnegi88's task —— View job

Dependency Update Review

I've reviewed this dependency update PR that upgrades esbuild, vite, and @vitejs/plugin-vue to their latest versions.

Todo List:

Read repository guidelines (CLAUDE.md)
Review package.json and package-lock.json changes
Check for breaking changes in dependency updates
Review project configuration files
Analyze compatibility between updated dependencies
Provide comprehensive review feedback

Changes Overview:

This PR contains significant version updates for core build tools:

@vitejs/plugin-vue: 4.6.2 → 6.0.0 (major version jump)
vite: 4.5.3 → 7.0.4 (major version jump)
esbuild: 0.18.20 → 0.25.6 (transitive dependency, major version jump)

Project Context:

Vue 3 + Composition API frontend application
Uses Vuetify 3 for UI components
Vite as build tool with standard configuration
ESLint for code quality
GitHub Actions for CI/CD deployment
No test suite identified

Breaking Changes Analysis:

@vitejs/plugin-vue 6.0.0:

⚠️ Node.js requirement: Now requires Node.js 20.19+ or 22.12+ (current project requires 18+)
⚠️ CJS build dropped: No longer provides CommonJS build (project uses ESM, so should be fine)
⚠️ API changes: include and exclude options separated from api.options

Vite 7.0.4:

⚠️ Node.js requirement: Likely requires Node.js 20+ (current project specifies 18+)
✅ ESM support: Better ESM support aligns with project's "type": "module"
✅ Performance improvements: Better build times and bundle optimization

esbuild 0.25.6:

✅ Memory leak fixes: Fixes for cancel() memory leaks
✅ CSS improvements: Better CSS selector handling
✅ Tree-shaking: Improved dead code elimination

Configuration Compatibility:

vite.config.js:

✅ Current configuration: Standard setup with @vitejs/plugin-vue and vuetify plugins
✅ Build configuration: Uses standard Rollup options, should remain compatible
✅ Plugin usage: Simple vue() plugin call without custom options - should work with v6

CI/CD (GitHub Actions):

✅ Node.js version: Currently uses Node.js 20 in CI, which meets new requirements
✅ Build process: Uses standard npm run build command
⚠️ Legacy peer deps: Uses --legacy-peer-deps flag which may need review

Review Recommendations:

🔴 Action Required:

Update Node.js requirement in package.json from >=18.0.0 to >=20.19.0 to match new dependency requirements
Test the build process thoroughly after merging, especially with the --legacy-peer-deps flag

🟡 Monitor:

Bundle size impact: Check if the new versions affect bundle sizes (current limit: 500KB)
Build performance: Monitor build times for any regressions
Runtime compatibility: Verify Vue 3 application still functions correctly

✅ Positive Aspects:

Security updates: All dependencies include security fixes and improvements
Performance improvements: Better tree-shaking and build optimization
Memory leak fixes: esbuild 0.25.6 fixes memory leaks in build processes
Maintained compatibility: Current vite.config.js should work without changes

Recommended Next Steps:

Update package.json to require Node.js 20.19+ to match dependency requirements
Test locally with npm run build and npm run dev to verify functionality
Monitor CI/CD pipeline for any build failures
Consider removing --legacy-peer-deps flag if no longer needed

Overall Assessment:

✅ APPROVE with minor updates - This is a well-structured dependency update that brings security fixes and performance improvements. The main requirement is updating the Node.js version constraint to match the new dependency requirements.

nnegi88 · 2025-07-14T15:58:54Z

@claude do make the suggested changes

claude · 2025-07-14T15:59:10Z

Claude finished @nnegi88's task —— View job

Changes Implementation Complete ✅

I've successfully implemented the suggested changes from my previous review:

Todo List:

Read repository guidelines (CLAUDE.md) - No CLAUDE.md file found
Review current package.json structure - Found Node.js requirement at >=18.0.0
Update Node.js version requirement from >=18.0.0 to >=20.19.0
Test build process to ensure compatibility - Cannot run build test (no Bash permissions)
Commit and push changes to the PR branch - Pushed to dependabot/npm_and_yarn/multi-04f1560622
Update comment with completion status

Changes Made:

Updated package.json at line 8: Changed "node": ">=18.0.0" to "node": ">=20.19.0"
Committed changes with commit hash b7b90a6
Pushed to remote branch dependabot/npm_and_yarn/multi-04f1560622

Note on Build Testing:

I was unable to run the build test (npm install and npm run build) due to limited permissions. However, the Node.js version requirement has been updated to match the new dependency requirements from @vitejs/plugin-vue 6.0.0 and vite 7.0.4. The GitHub Actions CI/CD pipeline should test the build process automatically when this PR is updated.

Summary:

The main actionable change from my previous review has been implemented. The Node.js version requirement now matches the requirements of the updated dependencies, which should resolve the compatibility concerns I identified in the dependency update review.

Update minimum Node.js version to match new dependency requirements from @vitejs/plugin-vue 6.0.0 and vite 7.0.4 Co-authored-by: Naveen Singh Negi <nnegi88@users.noreply.github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 10, 2025

feat: update Node.js version requirement to >=20.19.0

b7b90a6

Update minimum Node.js version to match new dependency requirements from @vitejs/plugin-vue 6.0.0 and vite 7.0.4 Co-authored-by: Naveen Singh Negi <nnegi88@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump esbuild, vite and @vitejs/plugin-vue #3

build(deps): bump esbuild, vite and @vitejs/plugin-vue #3

Uh oh!

dependabot bot commented on behalf of github Jul 10, 2025

Uh oh!

nnegi88 commented Jul 14, 2025

Uh oh!

claude bot commented Jul 14, 2025 •

edited

Loading

Uh oh!

nnegi88 commented Jul 14, 2025

Uh oh!

claude bot commented Jul 14, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

build(deps): bump esbuild, vite and @vitejs/plugin-vue #3

Are you sure you want to change the base?

build(deps): bump esbuild, vite and @vitejs/plugin-vue #3

Uh oh!

Conversation

dependabot bot commented on behalf of github Jul 10, 2025

v0.25.6

Changelog: 2023

0.19.11

v7.0.4

v7.0.3

v7.0.2

create-vite@7.0.2

v7.0.1

create-vite@7.0.1

create-vite@7.0.0

plugin-legacy@7.0.0

v7.0.0

v7.0.0-beta.2

v7.0.0-beta.1

plugin-legacy@7.0.0-beta.1

plugin-legacy@7.0.0-beta.0

v7.0.0-beta.0

create-vite@6.5.0

create-vite@6.4.1

create-vite@6.4.0

7.0.4 (2025-07-10)

Bug Fixes

Build System

7.0.3 (2025-07-08)

Bug Fixes

Miscellaneous Chores

Code Refactoring

7.0.2 (2025-07-04)

Bug Fixes

7.0.1 (2025-07-03)

Bug Fixes

Miscellaneous Chores

7.0.0 (2025-06-24)

plugin-vue@6.0.0

plugin-vue@6.0.0-beta.2

plugin-vue@6.0.0-beta.1

plugin-vue@6.0.0-beta.0

plugin-vue@5.2.4

plugin-vue@5.2.3

plugin-vue@5.2.2

plugin-vue@5.2.1

plugin-vue@5.2.0

plugin-vue@5.1.5

plugin-vue@5.1.4

plugin-vue@5.1.3

plugin-vue@5.1.2

plugin-vue@5.1.1

plugin-vue@5.1.0

plugin-vue@5.0.5

plugin-vue@5.0.4

6.0.0 (2025-06-24)

Bug Fixes

Miscellaneous Chores

Code Refactoring

6.0.0-beta.2 (2025-06-06)

⚠ BREAKING CHANGES

Features

Bug Fixes

Code Refactoring

6.0.0-beta.1 (2025-06-02)

Bug Fixes

6.0.0-beta.0 (2025-05-21)

⚠ BREAKING CHANGES

Features

Uh oh!

nnegi88 commented Jul 14, 2025

Uh oh!

claude bot commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Update Review

Todo List:

Changes Overview:

Project Context:

Breaking Changes Analysis:

claude bot commented Jul 14, 2025 •

edited

Loading

claude bot commented Jul 14, 2025 •

edited

Loading