chore(deps): bump the npm_and_yarn group across 6 directories with 9 updates by dependabot[bot] · Pull Request #2193 · johanbook/meet

dependabot · 2026-06-28T19:00:47Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the npm_and_yarn group with 5 updates in the /services/api directory:

Package	From	To
@nestjs/platform-fastify	`11.1.23`	`11.1.24`
nodemailer	`8.0.5`	`9.0.1`
typeorm	`0.3.27`	`0.3.30`
form-data	`4.0.5`	`4.0.6`
ws	`8.20.1`	`8.21.0`

Bumps the npm_and_yarn group with 4 updates in the /services/web-ui directory: js-yaml, vite, ws and esbuild.
Bumps the npm_and_yarn group with 1 update in the / directory: js-yaml.
Bumps the npm_and_yarn group with 2 updates in the /services/auth-ui directory: js-yaml and vite.
Bumps the npm_and_yarn group with 3 updates in the /services/auth-api directory: @nestjs/platform-fastify, form-data and undici.
Bumps the npm_and_yarn group with 2 updates in the /services/homepage directory: js-yaml and vite.

Updates @nestjs/platform-fastify from 11.1.23 to 11.1.24

Release notes

Sourced from @nestjs/platform-fastify's releases.

v11.1.24 (2026-05-25)

Bug fixes

core

#17009 fix(core): reset dependency-tree cache on metadata changes (@puneetdixit200)

Enhancements

core

#16997 feat(core): warn on late websocket adapter registration (@hbinhng)

Dependencies

platform-ws

#17011 chore(deps): bump ws from 8.20.1 to 8.21.0 (@dependabot[bot])

Committers: 2

Nguyễn Hải Bình (@hbinhng)

Puneet Dixit (@puneetdixit200)

Commits

d8a0ab8 chore(release): publish v11.1.24 release
2dccece chore: update readmes
See full diff in compare view

Updates nodemailer from 8.0.5 to 9.0.1

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)

validate TLS certificates by default when fetching remote content (6a947ac)

8.0.11 (2026-06-10)

Bug Fixes

apply the transport-level newline option in stream and sendmail transports (cb4f904)

include icalEvent path/href content in the application/ics attachment (b801c48)

parse Ethereal response props without polynomial regex backtracking (067aebe)

resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)

return the promise from every resolveContent branch (07ffe8c)

strip the url scheme from List-ID header values (77e5885)

tag AWS SES transport errors with the ESES code (efa647a)

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

... (truncated)

Commits

69cf625 chore(master): release 9.0.1 (#1828)
a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
4e58450 chore: update dev dependencies
541f5fd chore(master): release 9.0.0 (#1827)
0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
6a947ac fix!: validate TLS certificates by default when fetching remote content
e3b1bda chore(master): release 8.0.11 (#1826)
4358caf refactor: remove dead checks flagged by Code Quality analysis
cf5195c chore: harden workflow token permissions and update GitHub Actions
067aebe fix: parse Ethereal response props without polynomial regex backtracking
Additional commits viewable in compare view

Updates typeorm from 0.3.27 to 0.3.30

Release notes

Sourced from typeorm's releases.

0.3.30

What's Changed

fix: scope invalidWhereValuesBehavior to high-level abstractions only by @naorpeled in typeorm/typeorm#11878

fix: scope computed-columns join to correct table in MSSQL schema query by @PreAgile in typeorm/typeorm#12288

fix: preserve user-defined shared join columns in change set by @PreAgile in typeorm/typeorm#12354

revert: fix up limit with joins by @alumni

fix(find-options): allow array values in JsonContains by @kyungseopk1m in typeorm/typeorm#12420

fix(cockroachdb): adjust join in loadTables to load correct table columns by @Cprakhar in typeorm/typeorm#12413

ci: use the v0.3 branch as base for detect-changes by @alumni

chore(release): release 0.3.30 by @alumni in typeorm/typeorm#12511

Full Changelog: typeorm/typeorm@0.3.29...0.3.30

0.3.29

What's Changed

fix: fix up aggregate methods ambiguous column by @Cprakhar in typeorm/typeorm#11822

fix: prevent eager-loaded entities from overwriting manual relations by @LeviHeber in typeorm/typeorm#11267

fix: release query runner when there is no migration to revert by @mjr128 in typeorm/typeorm#11232

fix: add async to the method using setFindOptions() by @bindon in typeorm/typeorm#10787

chore: disable eslint errors for chai assertions by @alumni in typeorm/typeorm#11833

ci(tests): Remove limitation of branches to run on by @OSA413 in typeorm/typeorm#11794

ci: upgrade actions to v6 by @pkuczynski in typeorm/typeorm#11844

docs(v0.3): add version dropdown (stable/dev) by @naorpeled in typeorm/typeorm#11863

fix(sap): QueryBuilder parameter of type JS Date not escaped correctly by @alumni in typeorm/typeorm#11867

feat(sap): add pool timeout by @alumni in typeorm/typeorm#11868

feat(qodo): enable new review experience in v0.3 by @naorpeled in typeorm/typeorm#11910

feat: add returning option to update/upsert operations by @naorpeled in typeorm/typeorm#11782

test: enable repository-returning test by @gioboa in typeorm/typeorm#11913

chore(qodo): disable in progress notification in v0.3 by @naorpeled in typeorm/typeorm#11928

ci(docs): add deploy Github Action to v0.3 branch by @naorpeled in typeorm/typeorm#11929

chore(qodo): disable persistent comments and inline code suggestions in v0.3 by @naorpeled in typeorm/typeorm#11989

chore(deps): update all dependencies to the latest minor version by @alumni in typeorm/typeorm#12015

fix(redis): redis cache version detection by @mguida22 in typeorm/typeorm#11936

ci: remove summary comments location policy by @naorpeled in typeorm/typeorm#12117

ci(qodo): remove /improve from pr and push commands by @naorpeled in typeorm/typeorm#12129

ci: migrate from npm to pnpm by @pkuczynski in typeorm/typeorm#12193

ci(qodo): sync qodo pr agent config from master by @naorpeled in typeorm/typeorm#12265

ci: remove docs indexing by @alumni in typeorm/typeorm#12435

fix(security): validate limit() in Update/SoftDelete query builders by @smith-xyz in typeorm/typeorm#12437

chore(deps): update all minor by @alumni in typeorm/typeorm#12443

chore(release): release 0.3.29 by @michaelbromley in typeorm/typeorm#12442

New Contributors

@LeviHeber made their first contribution in typeorm/typeorm#11267

@mjr128 made their first contribution in typeorm/typeorm#11232

@bindon made their first contribution in typeorm/typeorm#10787

Full Changelog: typeorm/typeorm@0.3.28...0.3.29

... (truncated)

Changelog

Sourced from typeorm's changelog.

0.3.30 (2026-05-18)

Bug Fixes

cockroachdb: adjust join in loadTables to load correct table columns (#12413) (d93402e)

find-options: allow array values in JsonContains (#12420) (90f169d)

preserve user-defined shared join columns in change set (#12354) (0aba011)

scope computed-columns join to correct table in MSSQL schema query (#12288) (6170be6)

scope invalidWhereValuesBehavior to high-level abstractions only (#11878) (1e10fb8)

Reverts

fix up limit with joins (#11987) (66f1ff8)

0.3.29 (2026-05-08)

Bug Fixes

add async to the method using setFindOptions() (#10787) (cc07c90)

change import for process dependency (#11248) (1c67c3b)

cli: init command loading non-existing package.json (#11947) (4d9d1a6)

fix up aggregate methods ambiguous column (#11822) (6e34756)

fix up limit with joins (#11987) (3657db8)

getPendingMigrations unnecessarily creating migrations table (#11672) (1dbc224)

postgres: execute queries sequentially to avoid pg 8.19.0 deprecation warning (#12105) (79829a0)

prevent columns with select false from being returned (#11944) (6b20831)

prevent eager-loaded entities from overwriting manual relations (#11267) (2d8c515)

propagate schema and database to closure junction table (#12110) (58b403f)

redis: redis cache version detection (#11936) (f22c7a2)

release query runner when there is no migration to revert (#11232) (a46eb0a)

sap: QueryBuilder parameter of type JS Date not escaped correctly (#11867) (5153436)

security: validate limit() in Update/SoftDelete query builders (#12437) (0d7991a)

virtual property handling in schema builder (#11000) (5bd3255)

Features

add returning option to update/upsert operations (#11782) (11d9767)

sap: add pool timeout (#11868) (b4e2ad2)

sap: support locking in select (#11996) (86a9e3e)

0.3.28 (2025-12-02)

Bug Fixes

add multiSubnetFailover option for mssql (#10804) (83e3a8a)

circular import in SapDriver.ts (#11750) (bed7913)

cli: init command reading package.json from two folders up (#11789) (dd55218)

deps: upgrade glob to fix CVE-2025-64756 (#11784) (dc74f53)

mongodb: add missing findBy method to MongoEntityManager (#11814) (38715bb)

redis: version detection logic (#11815) (6f486e5)

... (truncated)

Commits

4c91616 chore(release): release 0.3.30 (#12511)
7792d00 ci: use the v0.3 branch as base for detect-changes
d93402e fix(cockroachdb): adjust join in loadTables to load correct table columns (#1...
90f169d fix(find-options): allow array values in JsonContains (#12420)
66f1ff8 revert: fix up limit with joins (#11987)
0aba011 fix: preserve user-defined shared join columns in change set (#12354)
6170be6 fix: scope computed-columns join to correct table in MSSQL schema query (#12288)
1e10fb8 fix: scope invalidWhereValuesBehavior to high-level abstractions only (#11878)
0ed009a ci: add npm environment to publish job for trusted publishing
6ede38b chore: enable trusted publishing in publish workflow
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for typeorm since your current version.

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

[Fix] escape CR, LF, and " in field names and filenames 8dff42c

[Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e

[Deps] update hasown, mime-types 92ae0eb

[Dev Deps] update js-randomness-predictor 67b0f65

Commits

64190db v4.0.6
92ae0eb [Deps] update hasown, mime-types
f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
8dff42c [Fix] escape CR, LF, and " in field names and filenames
67b0f65 [Dev Deps] update js-randomness-predictor
See full diff in compare view

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});
The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Commits

bca91ad [dist] 8.21.0
2b2abd4 [security] Limit retained message parts
78eabe2 [security] Add latest vulnerability to SECURITY.md
See full diff in compare view

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0 - 2026-06-27

Added

[backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

Restore umd builds back to es5.

Removed

[backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

Added docs/safety.md with notes about processing untrusted YAML.

Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.

Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.

Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.

Switched dev toolchains to Vite / neostandard.

Updated demo.

Reorganized tests.

dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.

Fix trailing whitespace handling when folding flow scalar lines, #307.

Reject top-level block scalars without content indentation, #280.

Ensure numbers survive round-trip, #737.

Fix test coverage for issue #221.

Fix flow scalar trailing whitespace folding, #307.

Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

Commits

33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
f944dc5 Add package.json funding field
f692719 Changelog update
Additional commits viewable in compare view

Updates vite from 7.3.2 to 8.1.0

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.1.0 (2026-06-23)

Features

extend server.fs.deny list with common files (#22707) (61ba8fd)

update rolldown to 1.1.2 (#22695) (4f008a6)

use ~ for Rolldown (#22693) (9928722)

Bug Fixes

bundled-dev: errors should be kept when incremental build fails (#22617) (9a0dd48)

cache falsy values in perEnvironmentState (#22715) (0e91e79)

glob: respect caseSensitive option in hmr matcher (#22711) (65f525e)

html: omit nonce on import map when cspNonce is unset (#22713) (8340bb5)

optimizer: skip null-valued exports in expandGlobIds glob resolution (#22611) (8b9f5cd)

resolved build options should be kept as a getter (#22691) (3527191)

server: handle malformed URI in memory files middleware (#22714) (df9e0a5)

use literal envPrefix queries for Vite Task (#22706) (da72733)

warn on deprecated envFile (#22555) (ed7b283)

Code Refactoring

client: inline dev-id value in CSS selector (#22736) (57f59bc)

remove unused removeRawQuery util (#22724) (403cc60)

use rolldownOptions property for chunkImportMap (#22692) (8e8816c)

8.1.0-beta.0 (2026-06-15)

Features

import.meta.glob support caseSensitive option (#21707) (2ad6737)

add warning to discourage Vite with yarn pnp (#21906) (3fbb55a)

build: chunk importmap (#21580) (e180312)

css: support lightningcss plugin dependency (#21748) (0b7aaed)

deps: bump @vitejs/devtools peer dependency version (#22542) (d2c2bc0)

html: add html.additionalAssetSources option (#21412) (a41404b)

integrate with Vite Task for zero-config build caching (#22453) (f8d75f7)

rename server.hmr options to server.ws options (#21357) (9ce3036)

server: support multiple hosts in __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS (#21501) (735f9a1)

track dependencies when loading config with native (#22602) (a7e2da8)

types: add more precise typing for known query types to match known as types (#21863) (cc39e55)

update rolldown to 1.1.1 (#22593) (8a13d63)

wasm: direct .wasm imports (WASM ESM Integration) (#21779) (c23d85b)

Bug Fixes

apply correct fs restrictions for pnpm gvs (#22415) (092320b)

css: support external CSS with lightningcss (#18389) (d64a1a5)

deps: update all non-major dependencies (#22637) (44bb9d9)

deps: update all non-major dependencies (#22681) (f4f0633)

html: insert import map before modulepreload that is not self-close tag (#21409) (e399c89)

optimizer: preserve sourcemaps for transformed optimized deps with follow-up transforms (#22428) (1298951)

... (truncated)

Commits

572aaca release: v7.2.2
728c8ee fix: revert "refactor: use fs.cpSync (#21019)" (#21081)
a532e68 release: v7.2.1
82d2d6c fix(worker): some worker asset was missing (#21074)
f83264f refactor(build): rename indexOfMatchInSlice to findPreloadMarker (#21054)
8293de0 release: v7.2.0
2833c55 fix(types): add undefined to optional properties for exactOptionalProperties ...
e3a6a83 chore(deps): update rolldown-related dependencies (#21047)
b1fd616 fix(css): fallback to sass when sass-embedded platform binary is missing (#21...
ad5b3bf fix(module-runner): make getBuiltins response JSON serializable (#21029)
Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.
import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});
The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Commits

bca91ad [dist] 8.21.0
2b2abd4 [security] Limit retained message parts
78eabe2 [security] Add latest vulnerability to SECURITY.md
See full diff in compare view

Updates esbuild from 0.25.3 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1
Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

Thanks to @dellalibera for reporting this issue.

Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

Thanks to @sondt99 for reporting this issue.
Avoid inlining using and await using declarations (#4482)

Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:
// Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}
Fix module evaluation when an error is thrown (#4461, #4467)

If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.
Fix some edge cases around the new operator (#4477)

Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:
// Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

Allow import path specifiers starting with #/ (#4361)

Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

This change was contributed by @hybrist.

Automatically add the -webkit-mask prefix (#4357, #4358)

This release automatically adds...
Description has been truncated

…updates Bumps the npm_and_yarn group with 5 updates in the /services/api directory: | Package | From | To | | --- | --- | --- | | [@nestjs/platform-fastify](https://github.com/nestjs/nest/tree/HEAD/packages/platform-fastify) | `11.1.23` | `11.1.24` | | [nodemailer](https://github.com/nodemailer/nodemailer) | `8.0.5` | `9.0.1` | | [typeorm](https://github.com/typeorm/typeorm) | `0.3.27` | `0.3.30` | | [form-data](https://github.com/form-data/form-data) | `4.0.5` | `4.0.6` | | [ws](https://github.com/websockets/ws) | `8.20.1` | `8.21.0` | Bumps the npm_and_yarn group with 4 updates in the /services/web-ui directory: [js-yaml](https://github.com/nodeca/js-yaml), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [ws](https://github.com/websockets/ws) and [esbuild](https://github.com/evanw/esbuild). Bumps the npm_and_yarn group with 1 update in the / directory: [js-yaml](https://github.com/nodeca/js-yaml). Bumps the npm_and_yarn group with 2 updates in the /services/auth-ui directory: [js-yaml](https://github.com/nodeca/js-yaml) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 3 updates in the /services/auth-api directory: [@nestjs/platform-fastify](https://github.com/nestjs/nest/tree/HEAD/packages/platform-fastify), [form-data](https://github.com/form-data/form-data) and [undici](https://github.com/nodejs/undici). Bumps the npm_and_yarn group with 2 updates in the /services/homepage directory: [js-yaml](https://github.com/nodeca/js-yaml) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@nestjs/platform-fastify` from 11.1.23 to 11.1.24 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.24/packages/platform-fastify) Updates `nodemailer` from 8.0.5 to 9.0.1 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.5...v9.0.1) Updates `typeorm` from 0.3.27 to 0.3.30 - [Release notes](https://github.com/typeorm/typeorm/releases) - [Changelog](https://github.com/typeorm/typeorm/blob/master/CHANGELOG.md) - [Commits](typeorm/typeorm@0.3.27...0.3.30) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.0) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.0/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `vite` from 7.3.2 to 8.1.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite) Updates `ws` from 8.20.1 to 8.21.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.20.1...8.21.0) Updates `esbuild` from 0.25.3 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md) - [Commits](evanw/esbuild@v0.25.3...v0.28.1) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.0/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.0/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `vite` from 6.4.2 to 8.1.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite) Updates `@nestjs/platform-fastify` from 11.1.23 to 11.1.24 - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.24/packages/platform-fastify) Updates `form-data` from 4.0.5 to 4.0.6 - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v4.0.5...v4.0.6) Updates `undici` from 7.24.6 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.6...v7.28.0) Updates `js-yaml` from 4.1.1 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.0/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) Updates `vite` from 6.4.2 to 8.1.0 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite) --- updated-dependencies: - dependency-name: "@nestjs/platform-fastify" dependency-version: 11.1.24 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nodemailer dependency-version: 9.0.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: typeorm dependency-version: 0.3.30 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.1.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.1.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@nestjs/platform-fastify" dependency-version: 11.1.24 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: form-data dependency-version: 4.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.1.0 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 6 directories with 9 updates#2193

chore(deps): bump the npm_and_yarn group across 6 directories with 9 updates#2193
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/services/api/npm_and_yarn-3f1ff16da5

dependabot Bot commented on behalf of github Jun 28, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v11.1.24 (2026-05-25)

Bug fixes

Enhancements

Dependencies

Committers: 2

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

9.0.1 (2026-06-17)

Bug Fixes

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

Bug Fixes

8.0.11 (2026-06-10)

Bug Fixes

8.0.10 (2026-05-29)

Bug Fixes

8.0.9 (2026-05-26)

Bug Fixes

8.0.8 (2026-05-23)

Bug Fixes

0.3.30

What's Changed

0.3.29

What's Changed

New Contributors

0.3.30 (2026-05-18)

Bug Fixes

Reverts

0.3.29 (2026-05-08)

Bug Fixes

Features

0.3.28 (2025-12-02)

Bug Fixes

v4.0.6 - 2026-06-12

Commits

8.21.0

Features

Bug fixes

4.3.0 - 2026-06-27

Added

Fixed

Removed

[4.2.0] - 2026-06-01

Added

Changed

Fixed

Security

[3.14.2] - 2025-11-15

Security

[email protected]

[email protected]

v8.1.0

[email protected]

v8.1.0-beta.0

v8.0.16

v8.0.15

v8.0.14

v8.0.13

v8.0.12

v8.0.11

v8.0.10

v8.0.9

v8.0.8

dependabot Bot commented on behalf of github Jun 28, 2026 •

edited

Loading