Bump esbuild, @vitejs/plugin-react and vitest in /dashboard

[dependabot]

Bumps esbuild to 0.25.0 and updates ancestor dependencies esbuild, @vitejs/plugin-react and vitest. These dependencies need to be updated together.

Updates esbuild from 0.14.54 to 0.25.0

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.

• Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

  This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

  Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

  In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

  Thanks to @​sapphi-red for reporting this issue.

• Delete output files when a build fails in watch mode (#3643)

  It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.

• Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

  This release fixes the following problems:

  • Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.

    /* Original code */
    .parent {
      > .a,
      > .b1 > .b2 {
        color: red;
      }
    }
    /* Old output (with --supported:nesting=false) */
    .parent > :is(.a, .b1 > .b2) {
    color: red;
    }
    /* New output (with --supported:nesting=false) */
    .parent > .a,
    .parent > .b1 > .b2 {
    color: red;
    }

    Thanks to @​tim-we for working on a fix.

  • The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:

    /* Original code (color should be red) */

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2022

This changelog documents all esbuild versions published in the year 2022 (versions 0.14.11 through 0.16.12).

0.16.12

• Loader defaults to js for extensionless files (#2776)

  Certain packages contain files without an extension. For example, the yargs package contains the file yargs/yargs which has no extension. Node, Webpack, and Parcel can all understand code that imports yargs/yargs because they assume that the file is JavaScript. However, esbuild was previously unable to understand this code because it relies on the file extension to tell it how to interpret the file. With this release, esbuild will now assume files without an extension are JavaScript files. This can be customized by setting the loader for "" (the empty string, representing files without an extension) to another loader. For example, if you want files without an extension to be treated as CSS instead, you can do that like this:

  • CLI:

    esbuild --bundle --loader:=css
    

  • JS:

    esbuild.build({
      bundle: true,
      loader: { '': 'css' },
    })

  • Go:

    api.Build(api.BuildOptions{
      Bundle: true,
      Loader: map[string]api.Loader{"": api.LoaderCSS},
    })

  In addition, the "type" field in package.json files now only applies to files with an explicit .js, .jsx, .ts, or .tsx extension. Previously it was incorrectly applied by esbuild to all files that had an extension other than .mjs, .mts, .cjs, or .cts including extensionless files. So for example an extensionless file in a "type": "module" package is now treated as CommonJS instead of ESM.

0.16.11

• Avoid a syntax error in the presence of direct eval (#2761)

  The behavior of nested function declarations in JavaScript depends on whether the code is run in strict mode or not. It would be problematic if esbuild preserved nested function declarations in its output because then the behavior would depend on whether the output was run in strict mode or not instead of respecting the strict mode behavior of the original source code. To avoid this, esbuild transforms nested function declarations to preserve the intended behavior of the original source code regardless of whether the output is run in strict mode or not:

  // Original code
  if (true) {
    function foo() {}
    console.log(!!foo)
    foo = null
    console.log(!!foo)
  }

... (truncated)

Commits

• e9174d6 publish 0.25.0 to npm
• c27dbeb fix hosts in plugin-tests.js
• 6794f60 fix hosts in node-unref-tests.js
• de85afd Merge commit from fork
• da1de1b fix #4065: bitwise operators can return bigints
• f4e9d19 switch case liveness: default is always last
• 7aa47c3 fix #4028: minify live/dead switch cases better
• 22ecd30 minify: more constant folding for strict equality
• 4cdf03c fix #4053: reordering of .tsx in node_modules
• dc71977 fix #3692: 0 now picks a random ephemeral port
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 2.0.1 to 4.3.4

Release notes

Sourced from @​vitejs/plugin-react's releases.

v4.3.4

Add Vite 6 to peerDependencies range

Vite 6 is highly backward compatible, not much to add!

Force Babel to output spec compliant import attributes #386

The default was an old spec (with type: "json"). We now enforce spec compliant (with { type: "json" })

v4.3.3

React Compiler runtimeModule option removed

React Compiler was updated to accept a target option and runtimeModule was removed. vite-plugin-react will still detect runtimeModule for backwards compatibility.

When using a custom runtimeModule or target !== '19', the plugin will not try to pre-optimize react/compiler-runtime dependency.

The react-compiler-runtime is now available on npm can be used instead of the local shim for people using the compiler with React < 19.

Here is the configuration to use the compiler with React 18 and correct source maps in development:

npm install babel-plugin-react-compiler react-compiler-runtime @babel/plugin-transform-react-jsx-development

export default defineConfig(({ command }) => {
  const babelPlugins = [['babel-plugin-react-compiler', { target: '18' }]]
  if (command === 'serve') {
    babelPlugins.push(['@babel/plugin-transform-react-jsx-development', {}])
  }
return {
plugins: [react({ babel: { plugins: babelPlugins } })],
}
})

v4.3.2

Ignore directive sourcemap error #369

v4.3.1

Fix support for React Compiler with React 18

The previous version made this assumption that the compiler was only usable with React 19, but it's possible to use it with React 18 and a custom runtimeModule: https://gist.github.com/poteto/37c076bf112a07ba39d0e5f0645fec43

When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.

Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.

v4.3.0

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

4.3.4 (2024-11-26)

Add Vite 6 to peerDependencies range

Vite 6 is highly backward compatible, not much to add!

Force Babel to output spec compliant import attributes #386

The default was an old spec (with type: "json"). We now enforce spec compliant (with { type: "json" })

4.3.3 (2024-10-19)

React Compiler runtimeModule option removed

React Compiler was updated to accept a target option and runtimeModule was removed. vite-plugin-react will still detect runtimeModule for backwards compatibility.

When using a custom runtimeModule or target !== '19', the plugin will not try to pre-optimize react/compiler-runtime dependency.

The react-compiler-runtime is now available on npm can be used instead of the local shim for people using the compiler with React < 19.

Here is the configuration to use the compiler with React 18 and correct source maps in development:

npm install babel-plugin-react-compiler react-compiler-runtime @babel/plugin-transform-react-jsx-development

export default defineConfig(({ command }) => {
  const babelPlugins = [['babel-plugin-react-compiler', { target: '18' }]]
  if (command === 'serve') {
    babelPlugins.push(['@babel/plugin-transform-react-jsx-development', {}])
  }
return {
plugins: [react({ babel: { plugins: babelPlugins } })],
}
})

4.3.2 (2024-09-29)

Ignore directive sourcemap error #369

4.3.1 (2024-06-10)

Fix support for React Compiler with React 18

The previous version made this assumption that the compiler was only usable with React 19, but it's possible to use it with React 18 and a custom runtimeModule: https://gist.github.com/poteto/37c076bf112a07ba39d0e5f0645fec43

When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.

... (truncated)

Commits

• See full diff in compare view

Updates vitest from 0.22.1 to 3.0.8

Release notes

Sourced from vitest's releases.

v3.0.8

   🐞 Bug Fixes

• Fix fetch cache multiple writes  -  by @​hi-ogawa in vitest-dev/vitest#7546 (1a8b4)
• Use browser.isolate instead of config.isolate  -  by @​sheremet-va in vitest-dev/vitest#7560 (4b5ed)
• Remove vestigial spy stub, import directly from @vitest/spy  -  by @​mrginglymus in vitest-dev/vitest#7575 (7f7ff)
• Correctly split the argv string  -  by @​btea in vitest-dev/vitest#7533 (4325a)
• browser:
  • Remove @​testing-library/dom from dependencies  -  by @​sheremet-va in vitest-dev/vitest#7555 (5387a)
  • Improve source map handling for bundled files  -  by @​sheremet-va in vitest-dev/vitest#7534 (e2c57)
  • Print related test file and potential test in unhandled errors  -  by @​sheremet-va in vitest-dev/vitest#7564 (fee90)
• runner:
  • Fix beforeEach/All cleanup callback timeout  -  by @​hi-ogawa in vitest-dev/vitest#7500 (0c292)
  • Fix and simplify Task.suite initialization  -  by @​hi-ogawa in vitest-dev/vitest#7414 (ca9ff)
• snapshot:
  • Allow inline snapshot calls on same location with same snapshot  -  by @​jycouet and @​hi-ogawa in vitest-dev/vitest#7464 (d5cb8)
• vite-node:
  • Fix buildStart on Vite 6  -  by @​hi-ogawa in vitest-dev/vitest#7480 (c0f47)

    View changes on GitHub

v3.0.7

   🐞 Bug Fixes

• browser: Support webdriverio 9  -  by @​sheremet-va in vitest-dev/vitest#7553 (b1949)
• deps: Update all non-major dependencies  -  in vitest-dev/vitest#7543 (365ff)
• expect: Correct generic MatchersObject this type in expect.extend  -  by @​Workingstiff-s in vitest-dev/vitest#7526 (d5765)
• mocker: Include more modules to prefix-only module list  -  by @​btea in vitest-dev/vitest#7524 (a12ec)
• spy: Clear/reset/restore mocks in stack order  -  by @​hi-ogawa in vitest-dev/vitest#7499 (f7100)

   🏎 Performance

• browser: Do wdio context switching only once per file  -  by @​sheremet-va in vitest-dev/vitest#7549 (aaa58)

    View changes on GitHub

v3.0.6

   🐞 Bug Fixes

• Fix getMockedSystemTime for useFakeTimer  -  by @​hi-ogawa in vitest-dev/vitest#7405 (03912)
• Compat for jest-image-snapshot  -  by @​hi-ogawa in vitest-dev/vitest#7390 (9542b)
• Ensure project names are readable in dark terminals  -  by @​rgrove in vitest-dev/vitest#7371 (bb94c)
• Exclude queueMicrotask from default fake timers to not break node fetch  -  by @​hi-ogawa in vitest-dev/vitest#7505 (167a9)
• Use tinyglobby instead of fast-glob  -  by @​benmccann in vitest-dev/vitest#7504 (b62ac)
• browser:
  • Fix mocking modules out of root  -  by @​hi-ogawa in vitest-dev/vitest#7415 (d3acb)
  • Fix toHaveClass typing  -  by @​hi-ogawa in vitest-dev/vitest#7383 (7ef23)
  • Relax locator selectors methods  -  by @​sheremet-va in vitest-dev/vitest#7422 (1b8c5)
  • Resolve thread count from maxWorkers  -  by @​AriPerkkio in vitest-dev/vitest#7483 (adbb2)
  • Cleanup timeout on resolve and give more information in the error  -  by @​sheremet-va in vitest-dev/vitest#7487 (5a45a)

... (truncated)

Commits

• 814d5df chore: release v3.0.8
• 57c3234 chore: remove hijackVitePluginInject (#7613)
• 1a88b1b chore(deps): update dependency strip-literal to v3 (#7601)
• 4325ac6 fix: correctly split the argv string (#7533)
• 7f7ff11 fix: remove vestigial spy stub, import directly from @vitest/spy (#7575)
• fee90d8 fix(browser): print related test file and potential test in unhandled errors ...
• 1a8b433 fix: fix fetch cache multiple writes (#7546)
• 358cccf chore: release v3.0.7
• 365ffe6 fix(deps): update all non-major dependencies (#7543)
• aaa5855 perf(browser): do wdio context switching only once per file (#7549)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by vitestbot, a new releaser for vitest since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
analytics-dashboard	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Mar 7, 2025 7:12pm