Bump esbuild, @vitejs/plugin-legacy, @vitejs/plugin-react and vite #189

dependabot · 2025-04-24T18:12:22Z

Bumps esbuild to 0.25.3 and updates ancestor dependencies esbuild, @vitejs/plugin-legacy, @vitejs/plugin-react and vite. These dependencies need to be updated together.

Updates esbuild from 0.18.20 to 0.25.3

Release notes

Sourced from esbuild's releases.

v0.25.3
Fix lowered async arrow functions before super() (#4141, #4142)

This change makes it possible to call an async arrow function in a constructor before calling super() when targeting environments without async support, as long as the function body doesn't reference this. Here's an example (notice the change from this to null):
// Original code
class Foo extends Object {
  constructor() {
    (async () => await foo())()
    super()
  }
}
// Old output (with --target=es2016)
class Foo extends Object {
constructor() {
(() => __async(this, null, function* () {
return yield foo();
}))();
super();
}
}
// New output (with --target=es2016)
class Foo extends Object {
constructor() {
(() => __async(null, null, function* () {
return yield foo();
}))();
super();
}
}
Some background: Arrow functions with the async keyword are transformed into generator functions for older language targets such as --target=es2016. Since arrow functions capture this, the generated code forwards this into the body of the generator function. However, JavaScript class syntax forbids using this in a constructor before calling super(), and this forwarding was problematic since previously happened even when the function body doesn't use this. Starting with this release, esbuild will now only forward this if it's used within the function body.

This fix was contributed by @magic-akari.
Fix memory leak with --watch=true (#4131, #4132)

This release fixes a memory leak with esbuild when --watch=true is used instead of --watch. Previously using --watch=true caused esbuild to continue to use more and more memory for every rebuild, but --watch=true should now behave like --watch and not leak memory.

This bug happened because esbuild disables the garbage collector when it's not run as a long-lived process for extra speed, but esbuild's checks for which arguments cause esbuild to be a long-lived process weren't updated for the new --watch=true style of boolean command-line flags. This has been an issue since this boolean flag syntax was added in version 0.14.24 in 2022. These checks are unfortunately separate from the regular argument parser because of how esbuild's internals are organized (the command-line interface is exposed as a separate Go API so you can build your own custom esbuild CLI).

This fix was contributed by @mxschmitt.

More concise output for repeated legal comments (#4139)

Some libraries have many files and also use the same legal comment text in all files. Previously esbuild would copy each legal comment to the output file. Starting with this release, legal comments duplicated across separate files will now be grouped in the output file by unique comment content.

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

677910b publish 0.25.3 to npm
a41040e fix #4110: support custom non-IP host values
dfe0e1c fix #4114: add a limit to css nesting expansion
a54916b fix #4139: deduplicate repeated legal comments
dc60e60 run make update-compat-table
d917038 fix #4144: node path resolution edge case
7ed1684 fix #4141: Avoid redundant this access during async function lowering (#4142)
edc3a23 docs(dev): update alias command for make test-go (#4113)
1ee8b67 workaround process.exit() not exiting in node
5c56e07 changelog note with credit for the fix
Additional commits viewable in compare view

Updates @vitejs/plugin-legacy from 4.1.1 to 6.1.0

Release notes

Sourced from @vitejs/plugin-legacy's releases.

[email protected]

Please refer to CHANGELOG.md for details.

v6.1.0

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.1.0-beta.2

Please refer to CHANGELOG.md for details.

v6.1.0-beta.1

Please refer to CHANGELOG.md for details.

v6.1.0-beta.0

Please refer to CHANGELOG.md for details.

v6.0.15

Please refer to CHANGELOG.md for details.

v6.0.14

Please refer to CHANGELOG.md for details.

v6.0.13

Please refer to CHANGELOG.md for details.

v6.0.12

Please refer to CHANGELOG.md for details.

v6.0.11

Please refer to CHANGELOG.md for details.

v6.0.10

Please refer to CHANGELOG.md for details.

v6.0.9

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v6.0.8

Please refer to CHANGELOG.md for details.

v6.0.7

Please refer to CHANGELOG.md for details.

v6.0.6

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from @vitejs/plugin-legacy's changelog.

6.1.0 (2025-04-16)

feat(legacy): add 'assumptions' option (#19719) (d1d99c9), closes #19719

feat(legacy): add sourcemapBaseUrl support (#19281) (a92c74b), closes #19281

fix(deps): update all non-major dependencies (#19555) (f612e0f), closes #19555

fix(deps): update all non-major dependencies (#19613) (363d691), closes #19613

fix(deps): update all non-major dependencies (#19649) (f4e712f), closes #19649

refactor: restore endsWith usage (#19554) (6113a96), closes #19554

6.0.2 (2025-02-25)

fix(deps): update all non-major dependencies (#19392) (60456a5), closes #19392

fix(deps): update all non-major dependencies (#19440) (ccac73d), closes #19440

fix(legacy): warn if plugin-legacy is passed to worker.plugins (#19079) (171f2fb), closes #19079

chore: fix typos (#19398) (b44e3d4), closes #19398

6.0.1 (2025-02-05)

fix(deps): update all non-major dependencies (#18853) (5c02236), closes #18853

fix(deps): update all non-major dependencies (#18967) (d88d000), closes #18967

fix(deps): update all non-major dependencies (#19098) (8639538), closes #19098

fix(deps): update all non-major dependencies (#19190) (f2c07db), closes #19190

fix(deps): update all non-major dependencies (#19296) (2bea7ce), closes #19296

fix(legacy): build respect hashCharacters config (#19262) (3aa10b7), closes #19262

fix(legacy): import babel once (#19152) (282496d), closes #19152

revert: update moduleResolution value casing (#18409) (#18774) (b0fc6e3), closes #18409 #18774

6.0.0 (2024-11-26)

chore: upgrade to unbuild v3 rc (#18502) (ddd5c5d), closes #18502

chore(deps): update all non-major dependencies (#18562) (fb227ec), closes #18562

chore(legacy): bump terser peer dep to ^5.16 (#18772) (3f6d5fe), closes #18772

chore(legacy): update peer dep Vite to 6 (#18771) (63c62b3), closes #18771

chore(plugin-legacy): add type module in package.json (#18535) (28cefca), closes #18535

feat!: drop node 21 support in version ranges (#18729) (a384d8f), closes #18729

fix(deps): update all non-major dependencies (#18484) (2ec12df), closes #18484

fix(deps): update all non-major dependencies (#18691) (f005461), closes #18691

5.4.3 (2024-10-25)

chore: enable some eslint rules (#18084) (e9a2746), closes #18084

chore: remove stale TODOs (#17866) (e012f29), closes #17866

... (truncated)

Commits

2bea7ce fix(deps): update all non-major dependencies (#19296)
f2c07db fix(deps): update all non-major dependencies (#19190)
3aa10b7 fix(legacy): build respect hashCharacters config (#19262)
282496d fix(legacy): import babel once (#19152)
8639538 fix(deps): update all non-major dependencies (#19098)
d88d000 fix(deps): update all non-major dependencies (#18967)
5c02236 fix(deps): update all non-major dependencies (#18853)
b0fc6e3 revert: update moduleResolution value casing (#18409) (#18774)
4b69756 release: [email protected]
3f6d5fe chore(legacy): bump terser peer dep to ^5.16 (#18772)
Additional commits viewable in compare view

Updates @vitejs/plugin-react from 3.1.0 to 4.4.1

Release notes

Sourced from @vitejs/plugin-react's releases.

[email protected]

Fix type issue when using moduleResolution: "node" in tsconfig #462

[email protected]

Make compatible with rolldown-vite

This plugin is now compatible with rolldown-powered version of Vite. Note that currently the __source property value position might be incorrect. This will be fixed in the near future.

[email protected]

Add reactRefreshHost option

Add reactRefreshHost option to set a React Fast Refresh runtime URL prefix. This is useful in a module federation context to enable HMR by specifying the host application URL in the Vite config of a remote application. See full discussion here: module-federation/vite#183
export default defineConfig({
  plugins: [react({ reactRefreshHost: 'http://localhost:3000' })],
})
[email protected]

No release notes provided.

[email protected]

Add Vite 6 to peerDependencies range

Vite 6 is highly backward compatible, not much to add!

Force Babel to output spec compliant import attributes #386

The default was an old spec (with type: "json"). We now enforce spec compliant (with { type: "json" })

[email protected]

React Compiler runtimeModule option removed

React Compiler was updated to accept a target option and runtimeModule was removed. vite-plugin-react will still detect runtimeModule for backwards compatibility.

When using a custom runtimeModule or target !== '19', the plugin will not try to pre-optimize react/compiler-runtime dependency.

The react-compiler-runtime is now available on npm can be used instead of the local shim for people using the compiler with React < 19.

Here is the configuration to use the compiler with React 18 and correct source maps in development:
npm install babel-plugin-react-compiler react-compiler-runtime @babel/plugin-transform-react-jsx-development
</tr></table> 

... (truncated)

Changelog

Sourced from @vitejs/plugin-react's changelog.

4.4.1 (2025-04-19)

Fix type issue when using moduleResolution: "node" in tsconfig #462

4.4.0 (2025-04-15)

Make compatible with rolldown-vite

This plugin is now compatible with rolldown-powered version of Vite. Note that currently the __source property value position might be incorrect. This will be fixed in the near future.

4.4.0-beta.2 (2025-04-15)

Add reactRefreshHost option

Add reactRefreshHost option to set a React Fast Refresh runtime URL prefix. This is useful in a module federation context to enable HMR by specifying the host application URL in the Vite config of a remote application. See full discussion here: module-federation/vite#183
export default defineConfig({
  plugins: [react({ reactRefreshHost: 'http://localhost:3000' })],
})
4.4.0-beta.1 (2025-04-09)

4.4.0-beta.0 (2025-04-09)

4.3.4 (2024-11-26)

Add Vite 6 to peerDependencies range

Vite 6 is highly backward compatible, not much to add!

Force Babel to output spec compliant import attributes #386

The default was an old spec (with type: "json"). We now enforce spec compliant (with { type: "json" })

4.3.3 (2024-10-19)

React Compiler runtimeModule option removed

React Compiler was updated to accept a target option and runtimeModule was removed. vite-plugin-react will still detect runtimeModule for backwards compatibility.

When using a custom runtimeModule or target !== '19', the plugin will not try to pre-optimize react/compiler-runtime dependency.

The react-compiler-runtime is now available on npm can be used instead of the local shim for people using the compiler with React < 19.

Here is the configuration to use the compiler with React 18 and correct source maps in development:

... (truncated)

Commits

57cc398 release: [email protected]
a62bdd6 fix(react): fix package.json types (#462)
8beda4f release: [email protected]
fffe4ad feat: add support for rolldown-vite (#451)
c197fd9 release: [email protected]
bd1a1ad fix(deps): update all non-major dependencies (#392)
87f7fdd feat: add reactRefreshHost option to support module federation HMR (#420)
da01d56 release: [email protected]
9b1b510 chore: fix refresh runtime path in dev (#444)
8258442 release: [email protected]
Additional commits viewable in compare view

Updates vite from 4.5.3 to 6.3.3

Release notes

Sourced from vite's releases.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0-beta.2

Please refer to CHANGELOG.md for details.

v6.3.0-beta.1

Please refer to CHANGELOG.md for details.

v6.3.0-beta.0

Please refer to CHANGELOG.md for details.

v6.2.6

Please refer to CHANGELOG.md for details.

v6.2.5

Please refer to CHANGELOG.md for details.

v6.2.4

Please refer to CHANGELOG.md for details.

v6.2.3

Please refer to CHANGELOG.md for details.

v6.2.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.2.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

6.3.3 (2025-04-24)

fix: ignore malformed uris in tranform middleware (#19853) (e4d5201), closes #19853

fix(assets): ensure ?no-inline is not included in the asset url in the production environment (#1949 (16a73c0), closes #19496

fix(css): resolve relative imports in sass properly on Windows (#19920) (ffab442), closes #19920

fix(deps): update all non-major dependencies (#19899) (a4b500e), closes #19899

fix(ssr): fix execution order of re-export (#19841) (ed29dee), closes #19841

fix(ssr): fix live binding of default export declaration and hoist exports getter (#19842) (80a91ff), closes #19842

perf: skip sourcemap generation for renderChunk hook of import-analysis-build plugin (#19921) (55cfd04), closes #19921

test(ssr): test ssrTransform re-export deps and test stacktrace with first line (#19629) (9399cda), closes #19629

6.3.2 (2025-04-18)

fix: match default asserts case insensitive (#19852) (cbdab1d), closes #19852

fix: open first url if host does not match any urls (#19886) (6abbdce), closes #19886

fix(css): respect css.lightningcss option in css minification process (#19879) (b5055e0), closes #19879

fix(deps): update all non-major dependencies (#19698) (bab4cb9), closes #19698

feat(css): improve lightningcss messages (#19880) (c713f79), closes #19880

6.3.1 (2025-04-17)

fix: avoid using Promise.allSettled in preload function (#19805) (35c7f35), closes #19805

fix: backward compat for internal plugin transform calls (#19878) (a152b7c), closes #19878

6.3.0 (2025-04-16)

fix(hmr): avoid infinite loop happening with hot.invalidate in circular deps (#19870) (d4ee5e8), closes #19870

fix(preview): use host url to open browser (#19836) (5003434), closes #19836

6.3.0-beta.2 (2025-04-11)

fix: addWatchFile doesn't work if base is specified (fixes #19792) (#19794) (8bed1de), closes #19792 #19794

fix: correct the behavior when multiple transform filter options are specified (#19818) (7200dee), closes #19818

fix: fs check with svg and relative paths (#19782) (62d7e81), closes #19782

fix: keep entry asset files imported by other files (#19779) (2fa1495), closes #19779

fix: reject requests with # in request-target (#19830) (175a839), closes #19830

fix: unbundle fdir to fix commonjsOptions.dynamicRequireTargets (#19791) (71227be), closes #19791

fix(css): remove empty chunk imports correctly when chunk file name contained special characters (#1 (b125172), closes #19814

fix(dev): make query selector regexes more inclusive (fix #19213) (#19767) (f530a72), closes #19213 #19767

fix(hmr): run HMR handler sequentially (#19793) (380c10e), closes #19793

fix(module-runner): allow already resolved id as entry (#19768) (e2e11b1), closes #19768

fix(types): remove the keepProcessEnv from the DefaultEnvironmentOptions type (#19796) (36935b5), closes #19796

... (truncated)

Commits

db9eb97 release: v6.3.3
e4d5201 fix: ignore malformed uris in tranform middleware (#19853)
55cfd04 perf: skip sourcemap generation for renderChunk hook of import-analysis-build...
ffab442 fix(css): resolve relative imports in sass properly on Windows (#19920)
16a73c0 fix(assets): ensure ?no-inline is not included in the asset url in the produc...
9399cda test(ssr): test ssrTransform re-export deps and test stacktrace with first ...
ed29dee fix(ssr): fix execution order of re-export (#19841)
80a91ff fix(ssr): fix live binding of default export declaration and hoist exports ge...
a4b500e fix(deps): update all non-major dependencies (#19899)
4bc17b4 release: v6.3.2
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 24, 2025

dependabot bot mentioned this pull request Apr 24, 2025

Bump vite from 4.5.3 to 4.5.13 #187

Closed

dependabot bot had a problem deploying to test April 24, 2025 18:12 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump esbuild, @vitejs/plugin-legacy, @vitejs/plugin-react and vite #189

Bump esbuild, @vitejs/plugin-legacy, @vitejs/plugin-react and vite #189

Uh oh!

dependabot bot commented on behalf of github Apr 24, 2025

Uh oh!

Uh oh!

Bump esbuild, @vitejs/plugin-legacy, @vitejs/plugin-react and vite #189

Are you sure you want to change the base?

Bump esbuild, @vitejs/plugin-legacy, @vitejs/plugin-react and vite #189

Uh oh!

Conversation

dependabot bot commented on behalf of github Apr 24, 2025

v0.25.3

Changelog: 2023

0.19.11

v6.1.0

v6.1.0-beta.2

v6.1.0-beta.1

v6.1.0-beta.0

v6.0.15

v6.0.14

v6.0.13

v6.0.12

v6.0.11

v6.0.10

v6.0.9

v6.0.8

v6.0.7

v6.0.6

6.1.0 (2025-04-16)

6.0.2 (2025-02-25)

6.0.1 (2025-02-05)

6.0.0 (2024-11-26)

5.4.3 (2024-10-25)

Make compatible with rolldown-vite

Add reactRefreshHost option

Add Vite 6 to peerDependencies range

Force Babel to output spec compliant import attributes #386

React Compiler runtimeModule option removed

4.4.1 (2025-04-19)

4.4.0 (2025-04-15)

Make compatible with rolldown-vite

4.4.0-beta.2 (2025-04-15)

Add reactRefreshHost option

4.4.0-beta.1 (2025-04-09)

4.4.0-beta.0 (2025-04-09)

4.3.4 (2024-11-26)

Add Vite 6 to peerDependencies range

Force Babel to output spec compliant import attributes #386

4.3.3 (2024-10-19)

React Compiler runtimeModule option removed

v6.3.3

v6.3.2

v6.3.1

v6.3.0

v6.3.0-beta.2

v6.3.0-beta.1

v6.3.0-beta.0

v6.2.6

v6.2.5

v6.2.4

v6.2.3

v6.2.2

v6.2.1

6.3.3 (2025-04-24)

6.3.2 (2025-04-18)

6.3.1 (2025-04-17)

6.3.0 (2025-04-16)

6.3.0-beta.2 (2025-04-11)

Uh oh!

Uh oh!

Add `reactRefreshHost` option

Add `reactRefreshHost` option