chore(lambda): bump the vite group across 1 directory with 2 updates #4846

dependabot · 2025-10-27T19:45:56Z

Bumps the vite group with 2 updates in the /lambdas directory: vite and vitest.

Updates vite from 7.1.9 to 7.1.12

Release notes

v7.1.12

Please refer to CHANGELOG.md for details.

v7.1.11

Please refer to CHANGELOG.md for details.

v7.1.10

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.1.12 (2025-10-23)

Bug Fixes

deps: downgrade commonjs plugin to 28.0.6 to avoid rollup/plugins#1909 (#20990) (56fd722)

7.1.11 (2025-10-20)

Bug Fixes

dev: trim trailing slash before server.fs.deny check (#20968) (f479cc5)

Miscellaneous Chores

deps: update all non-major dependencies (#20966) (6fb41a2)

Code Refactoring

use subpath imports for types module reference (#20921) (d0094af)

Build System

remove cjs reference in files field (#20945) (ef411ce)

remove hash from built filenames (#20946) (a817307)

7.1.10 (2025-10-14)

Bug Fixes

css: avoid duplicate style for server rendered stylesheet link and client inline style during dev (#20767) (3a92bc7)

css: respect emitAssets when cssCodeSplit=false (#20883) (d3e7eee)

deps: update all non-major dependencies (879de86)

deps: update all non-major dependencies (#20894) (3213f90)

dev: allow aliases starting with // (#20760) (b95fa2a)

dev: remove timestamp query consistently (#20887) (6537d15)

esbuild: inject esbuild helpers correctly for esbuild 0.25.9+ (#20906) (446eb38)

normalize path before calling fileToBuiltUrl (#20898) (73b6d24)

preserve original sourcemap file field when combining sourcemaps (#20926) (c714776)

Documentation

correct WebSocket spelling (#20890) (29e98dc)

Miscellaneous Chores

deps: update rolldown-related dependencies (#20923) (a5e3b06)

Commits

2436afe release: v7.1.12
56fd722 fix(deps): downgrade commonjs plugin to 28.0.6 to avoid rollup/plugins#1909 (...
8b69c9e release: v7.1.11
f479cc5 fix(dev): trim trailing slash before server.fs.deny check (#20968)
6fb41a2 chore(deps): update all non-major dependencies (#20966)
a817307 build: remove hash from built filenames (#20946)
ef411ce build: remove cjs reference in files field (#20945)
d0094af refactor: use subpath imports for types module reference (#20921)
ed4a0dc release: v7.1.10
c714776 fix: preserve original sourcemap file field when combining sourcemaps (#20926)
Additional commits viewable in compare view

Updates vitest from 3.2.4 to 4.0.4

Release notes

Sourced from vitest's releases.

v4.0.4

   🐞 Bug Fixes

browser:

Correct typo - by @benmccann in vitest-dev/vitest#8796 (ede1f)

Publish a missing context file for webdriverio - by @sheremet-va in vitest-dev/vitest#8824 (7c7b6)

mocker:

Support mocking builtins without node: prefix - by @sheremet-va in vitest-dev/vitest#8829 (06208)

pool:

Runner's error listener causing MaxListenersExceededWarning - by @AriPerkkio in vitest-dev/vitest#8820 (d1bff)

Capture workers stdio to logger - by @AriPerkkio in vitest-dev/vitest#8809 (fb95f)

spy:

Allow classes in vi.mocked utility - by @sheremet-va in vitest-dev/vitest#8839 (f8756)

worker:

Rpc listener leak when isolate: false - by @AriPerkkio in vitest-dev/vitest#8821 (573dc)

   🏎 Performance

utils: Optimized reducer to avoid creating new objects - by @Connormiha in vitest-dev/vitest#8818 (d19ce)

    View changes on GitHub

v4.0.3

   🐞 Bug Fixes

Preserve reporter options from config when CLI reporters override them - by @Copilot and sheremet-va in vitest-dev/vitest#8794 (15552)

browser: More stable in-source testing validation - by @sheremet-va in vitest-dev/vitest#8793 (62297)

happy-dom: Support fetch globals - by @sheremet-va in vitest-dev/vitest#8791 (0fb74)

init: Use correct jsx/tsx extension - by @sheremet-va in vitest-dev/vitest#8792 (abc04)

    View changes on GitHub

v4.0.2

   🐞 Bug Fixes

browser:

Don't print the deprecation notice in node_modules - by @sheremet-va in vitest-dev/vitest#8779 (588f7)

pool:

Assign envs before running tests to keep in sync with process.env - by @sheremet-va in vitest-dev/vitest#8769 (26ce8)

spy:

Properly inherit implementation's length - by @sheremet-va in vitest-dev/vitest#8778 (d4c2b)

Reset spies if both restoreMocks and mockReset are set in the config - by @sheremet-va in vitest-dev/vitest#8781 (2eedb)

    View changes on GitHub

v4.0.1

   🐞 Bug Fixes

Move the getBuiltins check - by @sheremet-va in vitest-dev/vitest#8765 (81000)

pool: Don't teardown the communication channel too soon if something is running after the test - by @sheremet-va in vitest-dev/vitest#8767 (3fae7)

... (truncated)

Commits

9b75ec5 chore: release v4.0.4
fb95fc7 fix(pool): capture workers stdio to logger (#8809)
06208d3 fix(mocker): support mocking builtins without node: prefix (#8829)
573dc06 fix(worker): rpc listener leak when isolate: false (#8821)
d1bff3b fix(pool): runner's error listener causing MaxListenersExceededWarning (#8820)
d19cece perf(utils): optimized reducer to avoid creating new objects (#8818)
ede1f39 fix(browser): correct typo (#8796)
ca1766f chore: release v4.0.3
155521a fix: preserve reporter options from config when CLI reporters override them (...
abc046f fix(init): use correct jsx/tsx extension (#8792)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vitest since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the vite group with 2 updates in the /lambdas directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `vite` from 7.1.9 to 7.1.12 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.1.12/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.1.12/packages/vite) Updates `vitest` from 3.2.4 to 4.0.4 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.4/packages/vitest) --- updated-dependencies: - dependency-name: vite dependency-version: 7.1.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: vite - dependency-name: vitest dependency-version: 4.0.4 dependency-type: direct:development update-type: version-update:semver-major dependency-group: vite ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2025-10-27T19:46:16Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/vite

^7.1.12

🟢 7.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 20/24 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 6	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 7	binaries present in source code
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
SAST	🟢 3	SAST tool is not run on all commits -- score normalized to 3
Vulnerabilities	🟢 10	0 existing vulnerabilities detected

npm/vitest

^4.0.4

Unknown

npm/@jridgewell/sourcemap-codec

1.5.5

Unknown

npm/@standard-schema/spec

1.0.0

Unknown

npm/@vitest/expect

4.0.4

Unknown

npm/@vitest/mocker

4.0.4

Unknown

npm/@vitest/pretty-format

4.0.4

Unknown

npm/@vitest/runner

4.0.4

Unknown

npm/@vitest/snapshot

4.0.4

Unknown

npm/@vitest/spy

4.0.4

Unknown

npm/@vitest/utils

4.0.4

Unknown

npm/chai

6.2.0

🟢 5.5

Details

Check	Score	Reason
Maintained	🟢 10	24 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	🟢 6	Found 11/16 approved changesets -- score normalized to 6
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
Vulnerabilities	🟢 5	5 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/debug

4.4.3

🟢 4.5

Details

Check	Score	Reason
Code-Review	🟢 3	Found 10/30 approved changesets -- score normalized to 3
Maintained	🟢 8	1 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 8
Token-Permissions	⚠️ -1	No tokens found
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	⚠️ -1	no workflows found
Pinned-Dependencies	⚠️ -1	no dependencies found
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/expect-type

1.2.2

🟢 4.1

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 3	Found 10/26 approved changesets -- score normalized to 3
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 10	security policy file detected
Maintained	⚠️ 0	0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 6	branch protection is not maximal on development and all release branches
Vulnerabilities	⚠️ 0	20 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/magic-string

0.30.21

🟢 4.5

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	🟢 3	Found 10/30 approved changesets -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	15 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	🟢 8	2 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/tinyrainbow

3.0.3

Unknown

npm/vite

7.1.12

🟢 7.3

Details

Check	Score	Reason
Code-Review	🟢 8	Found 20/24 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 6	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Binary-Artifacts	🟢 7	binaries present in source code
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
SAST	🟢 3	SAST tool is not run on all commits -- score normalized to 3
Vulnerabilities	🟢 10	0 existing vulnerabilities detected

npm/vitest

4.0.4

Unknown

Scanned Files

lambdas/package.json
lambdas/yarn.lock

npalm · 2025-10-30T11:41:32Z

@dependabot rebase

dependabot · 2025-10-30T11:41:36Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

npalm · 2025-10-30T11:43:10Z

@dependabot recreate

dependabot · 2025-10-30T11:44:35Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 27, 2025

dependabot bot requested a review from a team as a code owner October 27, 2025 19:45

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 27, 2025

npalm approved these changes Oct 30, 2025

View reviewed changes

Merge branch 'main' into dependabot/npm_and_yarn/lambdas/vite-495d167e0d

94e0abb

dependabot bot closed this Oct 30, 2025

dependabot bot deleted the dependabot/npm_and_yarn/lambdas/vite-495d167e0d branch October 30, 2025 11:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(lambda): bump the vite group across 1 directory with 2 updates #4846

chore(lambda): bump the vite group across 1 directory with 2 updates #4846

Uh oh!

dependabot bot commented on behalf of github Oct 27, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 27, 2025 •

edited

Loading

Uh oh!

npalm commented Oct 30, 2025

Uh oh!

dependabot bot commented on behalf of github Oct 30, 2025

Uh oh!

npalm commented Oct 30, 2025

Uh oh!

dependabot bot commented on behalf of github Oct 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(lambda): bump the vite group across 1 directory with 2 updates #4846

chore(lambda): bump the vite group across 1 directory with 2 updates #4846

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.1.12

v7.1.11

v7.1.10

7.1.12 (2025-10-23)

Bug Fixes

7.1.11 (2025-10-20)

Bug Fixes

Miscellaneous Chores

Code Refactoring

Build System

7.1.10 (2025-10-14)

Bug Fixes

Documentation

Miscellaneous Chores

v4.0.4

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v4.0.3

🐞 Bug Fixes

View changes on GitHub

v4.0.2

🐞 Bug Fixes

View changes on GitHub

v4.0.1

🐞 Bug Fixes

Uh oh!

github-actions bot commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

npalm commented Oct 30, 2025

Uh oh!

dependabot bot commented on behalf of github Oct 30, 2025

Uh oh!

npalm commented Oct 30, 2025

Uh oh!

dependabot bot commented on behalf of github Oct 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Oct 27, 2025 •

edited

Loading

github-actions bot commented Oct 27, 2025 •

edited

Loading