Skip to content

build(deps-dev): bump the dev-tooling group across 1 directory with 6 updates - #7

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-tooling-5fb84c5225
Open

build(deps-dev): bump the dev-tooling group across 1 directory with 6 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-tooling-5fb84c5225

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-tooling group with 6 updates in the / directory:

Package From To
@vitest/coverage-v8 3.2.4 5.0.5
electron 39.2.7 45.0.0
electron-builder 26.4.0 26.18.0
esbuild 0.27.0 0.28.2
vite 7.2.4 8.3.5
vitest 3.2.4 5.0.5

Updates @vitest/coverage-v8 from 3.2.4 to 5.0.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitest/coverage-v8 since your current version.


Updates electron from 39.2.7 to 45.0.0

Release notes

Sourced from electron's releases.

electron v45.0.0

Release Notes for v45.0.0

Stack Upgrades

Breaking Changes

  • Reduced sandboxed renderer startup work for preload scripts that do not use Buffer. #54048
    • Removed the events, timers and url modules and the Buffer, setImmediate and clearImmediate globals from sandboxed preload scripts; use a polyfill.
    • Made sandboxed renderers without a preload script start faster.
    • Made sandboxed preload scripts start faster; Electron no longer evaluates a JavaScript bundle of its own in sandboxed renderers unless webviewTag is enabled.
  • With nodeIntegrationInWorker: true, a Worker created from an <iframe> in the same process as the main frame used to get Node.js integration even though the iframe itself had none. Workers now only get Node.js integration when the frame that creates them has it: the main frame, or any frame when nodeIntegrationInSubFrames is enabled.
  • A chrome-extension:// document used to receive the window's preload script (and session preload scripts) wherever it was embedded. It now only does so when it is a top-level frame or is hosted inside the DevTools front-end (a devtools_page or panel); an extension frame embedded in an ordinary page is treated like any other subframe and follows nodeIntegrationInSubFrames.
  • The legacy chromeMediaSource: 'desktop' constraint now only accepts screen and window source ids from desktopCapturer.getSources. Passing a WebContents source id there now fails with an "Invalid state" error. To capture a WebContents, use chromeMediaSource: 'tab' with an id from webContents.getMediaSourceId(), or use ses.setDisplayMediaRequestHandler.
  • The experimental contentTracing.enableHeapProfiling() API has been removed. Chromium removed the memlog implementation that backed this API and replaced it with a Perfetto heap-profiling data source. Pass a nativeHeapProfiling option to contentTracing.startRecording() to enable heap profiling for the duration of a trace. Like all recordings, heap-enabled recordings use the Perfetto protobuf format.
  • Changed heap profiling in contentTracing recordings to now use a perfetto heap-profiling data source. #54863
  • Screen, window and tab capture requests are now reported to setPermissionRequestHandler as display-capture instead of media; a handler that allows only media must also allow display-capture to keep screen sharing working. #52824
  • Chromium has disabled document.requestStorageAccessFor by default ahead of its removal. The API can temporarily be restored with the enableBlinkFeatures web preference set to RequestStorageAccessFor. See Chromium's intent to remove discussion for more information.
  • fs.open, fs.openSync and fs.promises.open on a file inside an ASAR archive used to extract the file to a temporary copy and return a descriptor for that copy. They now return a descriptor that only identifies the entry to Node's fs module, which reads directly out of the archive with no temporary file (fs.read, fs.readv, fs.fstat, fs.readFile(fd), fs.createReadStream and the FileHandle methods). The descriptor itself is not backed by the file's contents: code that reads the raw descriptor (a native addon, child_process stdio, net.Socket({ fd }), http2stream.respondWithFile() / respondWithFD(), a FileHandle transferred to a worker, ...) fails with EBADF and is not supported. Opening a file inside an archive with a flag that allows writing (w, a, r+, ...) now fails with EACCES instead of silently writing to the temporary copy, and fs.fchmod, fs.fchown and fs.futimes on these descriptors fail with EACCES.
  • A window.open() child whose sandbox state differs from its opener's renderer process is now created in its own process with no opener relationship instead of silently sharing the opener's process; set sandbox: false in setWindowOpenHandler to keep sharing an unsandboxed opener's process. #52472
  • The synchronous safeStorage methods are deprecated and will be removed in Electron 46, following Chromium's removal of the synchronous OSCrypt backend they are built on. Use the asynchronous methods instead, which use the same per-platform key stores. Data encrypted with safeStorage.encryptString() can be decrypted with safeStorage.decryptStringAsync().
  • Added select-client-certificate event support for net.request and net.fetch; requests to servers requesting a client certificate no longer fail with ERR_SSL_CLIENT_AUTH_CERT_NEEDED, and applications can now select a certificate to present. #52162 (Also in 44)
  • Clipboard module is now aligned with the W3C Clipboard API. #51707 (Also in 44)
  • Removed 32-bit builds (Windows ia32 and Linux armv7l). Electron is now published only for 64-bit (x64 and arm64) platforms. #51816 (Also in 44)
  • Removed openAsHidden option from app.setLoginItemSettings(). #52351 (Also in 44)
    • Removed openAsHidden, wasOpenedAsHidden and restoreState fields from return value of app.getLoginItemSettings().
    • Fixed potential deadlock inside app.getLoginItemSettings() on macOS.
  • Updated the Linux support policy. #52429 (Also in 44)

See the Breaking Changes doc for more details about these changes.

Features

  • Added a badge property to MenuItem on macOS 14+ for showing a count or custom text badge next to a menu item's label. #50805 (Also in 43, 44)
  • Added a Save/Restore Window State API for cross-platform use. #51510 (Also in 44)
  • Added a Windows Error Reporting helper (electron_wer.dll, renamed to <app>_wer.dll alongside the executable) so crashReporter captures __fastfail and other crashes that bypass the in-process handler on Windows. #53851
  • Added app shims on macOS to show windows under another app's Dock icon. #55072 (Also in 44)
  • Added app.configureWebAuthn() API to enable iCloud Keychain passkey support on macOS. When enabled, navigator.credentials.create() and .get() present Apple's native passkey UI via ASAuthorizationController. #51563
  • Added available to process.getSystemMemoryInfo() on Linux, exposing proc/meminfo MemAvailable. #52299 (Also in 42, 43, 44)
  • Added disableWakeLocks option to WebPreferences. #52342
  • Added getIsolatedWorlds method and isolated-world-created event for webFrame to enable discovery of isolated worlds. #50633

... (truncated)

Commits
  • 54f961b chore: bump chromium to 156.0.8078.48 (45-x-y) (#55144)
  • a7f3579 chore: cherry-pick 29 changes from chromium, pdfium, skia and v8 (#55145)
  • 8807961 fix: cherry-pick 431b8be6a111 from chromium (#54912)
  • a6ce292 test: fix unload-IPC and protocol.handle 'is fast' flakes (#55132)
  • 0f79472 test: wait for the parent's ack before utility children exit (#55123)
  • 1d2f13b fix: apply the certificate SPKI blocklist to Node and add entries (45-x-y) (#...
  • 21ea802 docs: add UIPI note for setIgnoreMouseEvents forward option (#55112)
  • aa25341 test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
  • f17325a docs: update breaking-changes.md ahead of 45.0.0 release (#55121)
  • 528eb6f docs: fix code block line highlighting after docs reformats (#55105)
  • Additional commits viewable in compare view

Updates electron-builder from 26.4.0 to 26.18.0

Release notes

Sourced from electron-builder's releases.

electron-builder@26.18.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.17.0...electron-builder@26.18.0

electron-builder@26.17.0

What's Changed

Full Changelog: https://github.com/electron-userland/electron-builder/compare/electron-builder@26.16.1...electron-builder@26.17.0

electron-builder@26.16.1

What's Changed

... (truncated)

Changelog

Sourced from electron-builder's changelog.

26.18.0

Patch Changes

206d35d 3dc7c90 e703212 84f7b46 6202a27 fcd6897 160c3b4 1928adf c60987c a92517a a1e9db8 4123c27

  • app-builder-lib@26.18.0
  • dmg-builder@26.18.0

26.17.0

Patch Changes

bae1c8b 2a2dd22 07c8344 07c8344 613cd58 d4a4f50 41a027c 59f6364

  • app-builder-lib@26.17.0
  • dmg-builder@26.17.0

26.16.1

Patch Changes

b9b2e8a d6d4125 a4ec75f 5ae5a02 7c04b35

  • app-builder-lib@26.16.1
  • dmg-builder@26.16.1

... (truncated)

Commits

Updates esbuild from 0.27.0 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

  • Allow import path specifiers starting with #/ (#4361)

    Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

    This change was contributed by @​hybrist.

  • Automatically add the -webkit-mask prefix (#4357, #4358)

    This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

    /* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}

    This change was contributed by @​BPJEnnova.

  • Additional minification of switch statements (#4176, #4359)

    This release contains additional minification patterns for reducing switch statements. Here is an example:

    // Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates vite from 7.2.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2026
@dependabot dependabot Bot changed the title build(deps-dev): bump the dev-tooling group with 6 updates build(deps-dev): bump the dev-tooling group across 1 directory with 6 updates Sep 18, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-tooling-5fb84c5225 branch from 5276a92 to 90cf7ec Compare September 18, 2026 03:26
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-tooling-5fb84c5225 branch 2 times, most recently from a08d63a to 0eb7080 Compare September 30, 2026 05:41
@a23bc

a23bc commented Sep 30, 2026

Copy link
Copy Markdown
Owner

CI fails on peer dependency resolution (from review):

  • @tailwindcss/vite@4.1.17\ peer-wants \�ite@^5 || ^6 || ^7, but this PR brings vite 8
  • Same group also jumps electron 39→44, vitest 3→5, esbuild, electron-builder — several majors at once

Keeping this open on purpose. To land it we need to also bump @tailwindcss/vite\ (and re-check vitest/electron config). Prefer splitting majors rather than merging the group as-is.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-tooling-5fb84c5225 branch 3 times, most recently from 8f07c75 to f84cccb Compare September 30, 2026 07:58
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-tooling-5fb84c5225 branch from f84cccb to d9b01c8 Compare October 14, 2026 17:49
@dependabot
build(deps-dev): bump the dev-tooling group across 1 directory with 6…
e74793b 
… updates

Bumps the dev-tooling group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `3.2.4` | `5.0.5` |
| [electron](https://github.com/electron/electron) | `39.2.7` | `45.0.0` |
| [electron-builder](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-builder) | `26.4.0` | `26.18.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.0` | `0.28.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.2.4` | `8.3.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `5.0.5` |



Updates `@vitest/coverage-v8` from 3.2.4 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8)

Updates `electron` from 39.2.7 to 45.0.0
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v39.2.7...v45.0.0)

Updates `electron-builder` from 26.4.0 to 26.18.0
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/electron-builder@26.18.0/packages/electron-builder/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-builder@26.18.0/packages/electron-builder)

Updates `esbuild` from 0.27.0 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2025.md)
- [Commits](evanw/esbuild@v0.27.0...v0.28.2)

Updates `vite` from 7.2.4 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

Updates `vitest` from 3.2.4 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: electron
  dependency-version: 44.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: electron-builder
  dependency-version: 26.15.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
- dependency-name: vitest
  dependency-version: 5.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-tooling-5fb84c5225 branch from d9b01c8 to e74793b Compare October 27, 2026 13:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@a23bc