Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 15 updates#193

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-90069712ee
Open

chore(deps): bump the npm_and_yarn group across 3 directories with 15 updates#193
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-90069712ee

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 17, 2026

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package From To
next 14.0.4 15.5.10
tmp 0.2.1 0.2.4
express 4.19.2 4.22.0
esbuild 0.20.2 0.25.0
braces 3.0.2 3.0.3
diff 4.0.2 4.0.4
js-yaml 3.14.1 3.14.2
lodash 4.17.21 4.17.23
vite 5.0.0-beta.13 5.4.21

Bumps the npm_and_yarn group with 1 update in the /test/next directory: next.
Bumps the npm_and_yarn group with 1 update in the /test/sourceMapPath directory: esbuild.

Updates next from 14.0.4 to 15.5.10

Release notes

Sourced from next's releases.

v15.5.10

Please refer the following changelogs for more information about this security release:

v15.4.11

Please see this changelog for more information about this security patch.

v15.3.9

Please see this changelog for more information about this security patch.

Commits

Updates tmp from 0.2.1 to 0.2.4

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

🐛 Bug Fix

📝 Documentation

Committers: 5

Commits

Updates express from 4.19.2 to 4.22.0

Release notes

Sourced from express's releases.

4.22.0

Important: Security

What's Changed

Full Changelog: expressjs/express@4.21.2...4.22.0

4.21.2

What's Changed

Full Changelog: expressjs/express@4.21.1...4.21.2

4.21.1

What's Changed

Full Changelog: expressjs/express@4.21.0...4.21.1

4.21.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from express's changelog.

4.22.0 / 2025-12-01

4.21.2 / 2024-11-06

  • deps: path-to-regexp@0.1.12
    • Fix backtracking protection
  • deps: path-to-regexp@0.1.11
    • Throws an error on invalid path values

4.21.1 / 2024-10-08

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie
Commits

Updates esbuild from 0.20.2 to 0.25.0

Release notes

Sourced from esbuild's releases.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.

  • Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

    This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

    Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

    In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

    Thanks to @​sapphi-red for reporting this issue.

  • Delete output files when a build fails in watch mode (#3643)

    It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.

  • Fix correctness issues with the CSS nesting transform (#3620, #3877, #3933, #3997, #4005, #4037, #4038)

    This release fixes the following problems:

    • Naive expansion of CSS nesting can result in an exponential blow-up of generated CSS if each nesting level has multiple selectors. Previously esbuild sometimes collapsed individual nesting levels using :is() to limit expansion. However, this collapsing wasn't correct in some cases, so it has been removed to fix correctness issues.

      /* Original code */
.parent {
  > .a,
  > .b1 > .b2 {
    color: red;
  }
}
/* Old output (with --supported:nesting=false) */
.parent > :is(.a, .b1 > .b2) {
color: red;
}
/* New output (with --supported:nesting=false) */
.parent > .a,
.parent > .b1 > .b2 {
color: red;
}

      Thanks to @​tim-we for working on a fix.

    • The & CSS nesting selector can be repeated multiple times to increase CSS specificity. Previously esbuild ignored this possibility and incorrectly considered && to have the same specificity as &. With this release, this should now work correctly:

      /* Original code (color should be red) */

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

  • Fix regression with --define and import.meta (#4010, #4012, #4013)

    The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

    This fix was contributed by @​sapphi-red.

0.24.1

  • Allow es2024 as a target in tsconfig.json (#4004)

    TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

    {
  "compilerOptions": {
    "target": "ES2024"
  }
}

    As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

    This fix was contributed by @​billyjanitsch.

  • Allow automatic semicolon insertion after get/set

    This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

    class Foo {
  get
  *x() {}
  set
  *y() {}
}

    The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

  • Allow quoted property names in --define and --pure (#4008)

    The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

    

    • 






... (truncated)





Commits

    

  • e9174d6 publish 0.25.0 to npm
    • 

  • c27dbeb fix hosts in plugin-tests.js
    • 

  • 6794f60 fix hosts in node-unref-tests.js
    • 

  • de85afd Merge commit from fork
    • 

  • da1de1b fix #4065: bitwise operators can return bigints
    • 

  • f4e9d19 switch case liveness: default is always last
    • 

  • 7aa47c3 fix #4028: minify live/dead switch cases better
    • 

  • 22ecd30 minify: more constant folding for strict equality
    • 

  • 4cdf03c fix #4053: reordering of .tsx in node_modules
    • 

  • dc71977 fix #3692: 0 now picks a random ephemeral port
    • 

  • Additional commits viewable in compare view
    • 







Updates body-parser from 1.20.2 to 1.20.4



Release notes

Sourced from body-parser's releases.




1.20.4


What's Changed



Full Changelog: expressjs/body-parser@1.20.3...1.20.4


1.20.3


What's Changed


Important


    

  • deps: qs@6.13.0
    • 

  • add depth option to customize the depth level in the parser
    • 

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation
    • 



Other changes



New Contributors



Full Changelog: expressjs/body-parser@1.20.2...1.20.3







Changelog

Sourced from body-parser's changelog.




1.20.4 / 2025-12-01


    

  • deps: qs@~6.14.0
    • 

  • deps: use tilde notation for dependencies
    • 

  • deps: http-errors@~2.0.1
    • 

  • deps: raw-body@~2.5.3
    • 



1.20.3 / 2024-09-10


    

  • deps: qs@6.13.0
    • 

  • add depth option to customize the depth level in the parser
    • 

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
    • 








Commits





Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.






Updates braces from 3.0.2 to 3.0.3



Commits






Updates cookie from 0.6.0 to 0.7.2



Release notes

Sourced from cookie's releases.




v0.7.2


Fixed


    

  • Fix object assignment of hasOwnProperty (#177)  bc38ffd
    • 



jshttp/cookie@v0.7.1...v0.7.2


0.7.1


Fixed


    

  • Allow leading dot for domain (#174)

      

    • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
      • 

    

    • 

  • Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)
    • 



jshttp/cookie@v0.7.0...v0.7.1


0.7.0



jshttp/cookie@v0.6.0...v0.7.0







Commits





Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.






Updates diff from 4.0.2 to 4.0.4



Changelog

Sourced from diff's changelog.




v4.0.4 - January 2026


Only change from 4.0.2 is a backport of the fix to GHSA-73rr-hh4g-fpgx.


v4.0.3 (deprecated)


Accidental release - do not use.







Commits





Maintainer changes

This version was pushed to npm by explodingcabbage, a new releaser for diff since your current version.






Updates js-yaml from 3.14.1 to 3.14.2



Changelog

Sourced from js-yaml's changelog.




[3.14.2] - 2025-11-15


Security


    

  • Backported v4.1.1 fix to v3
    • 



[4.1.1] - 2025-11-12


Security


    

  • Fix prototype pollution issue in yaml merge (<<) operator.
    • 



[4.1.0] - 2021-04-15


Added


    

  • Types are now exported as yaml.types.XXX.
    • 

  • Every type now has options property with original arguments kept as they were
(see yaml.types.int.options as an example).
    • 



Changed


    

  • Schema.extend() now keeps old type order in case of conflicts
(e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).
    • 



[4.0.0] - 2021-01-03


Changed


    

  • Check migration guide to see details for all breaking changes.
    • 

  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are
moved to js-yaml-js-types package.
    • 

  • Breaking: removed safe* functions. Use load, loadAll, dump
instead which are all now safe by default.
    • 

  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use
yaml.DEFAULT_SCHEMA instead.
    • 

  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
    • 

  • !!binary now always mapped to Uint8Array on load.
    • 

  • Reduced nesting of /lib folder.
    • 

  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal,
0o1234 is octal, 1:23 is parsed as string instead of base60).
    • 

  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
    • 

  • Line and column in exceptions are now formatted as (X:Y) instead of
at line X, column Y (also present in compact format), #332.
    • 

  • Code snippet created in exceptions now contains multiple lines with line numbers.
    • 

  • dump() now serializes undefined as null in collections and removes keys with
undefined in mappings, #571.
    • 

  • dump() with skipInvalid=true now serializes invalid items in collections as null.
    • 

  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
    • 

  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.
    • 



Added


    

  • Added .mjs (es modules) support.
    • 

  • Added quotingType and forceQuotes options for dumper to configure
string literal style, #290, #529.
    • 

  • Added styles: { '!!null': 'empty' } option for dumper
(serializes { foo: null } as "foo: "), #570.
    • 






... (truncated)





Commits






Updates lodash from 4.17.21 to 4.17.23



Commits






Updates path-to-regexp from 0.1.7 to 0.1.12



Release notes

Sourced from path-to-regexp's releases.




Fix backtracking (again)


Fixed


    

  • Improved backtracking protection for 0.1.x, will break some previously valid paths (see previous advisory: GHSA-9wv6-86v2-598j)
    • 



pillarjs/path-to-regexp@v0.1.11...v0.1.12


Error on bad input


Changed


    

  • Add error on bad input values  8f09549
    • 



pillarjs/path-to-regexp@v0.1.10...v0.1.11


Backtrack protection


Fixed


    

  • Add backtrack protection to parameters  29b96b4

      

    • This will break some edge cases but should improve performance
      • 

    

    • 



pillarjs/path-to-regexp@v0.1.9...v0.1.10


Support non-lookahead regex output


Added


    

  • Allow a non-lookahead regex (#312)  c4272e4
    • 



component/path-to-regexp@v0.1.8...v0.1.9


Support named matching groups in RegExp


Added


    

  • Add support for named matching groups (#301)  114f62d
    • 



pillarjs/path-to-regexp@v0.1.7...v0.1.8







Commits






Updates qs from 6.11.0 to 6.14.2



Changelog

Sourced from qs's changelog.




6.14.2


    

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
    • 

  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
    • 

  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
    • 

  • [Fix] parse: enforce arrayLimit on comma-parsed values
    • 

  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
    • 

  • [Robustness] avoid .push, use void
    • 

  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
    • 

  • [readme] clarify parseArrays and arrayLimit documentation (#543)
    • 

  • [readme] replace runkit CI badge with shields.io check-runs badge
    • 

  • [meta] fix changelog typo (arrayLength → arrayLimit)
    • 

  • [actions] fix rebase workflow permissions
    • 



6.14.1


    

  • [Fix] ensure arrayLimit applies to [] notation as well
    • 

  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
    • 

  • [Refactor] parse: extract key segment splitting helper
    • 

  • [meta] add threat model
    • 

  • [actions] add workflow permissions
    • 

  • [Tests] stringify: increase coverage
    • 

  • [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect
    • 



6.14.0


    

  • [New] parse: add throwOnParameterLimitExceeded option (#517)
    • 

  • [Refactor] parse: use utils.combine more
    • 

  • [patch] parse: add explicit throwOnLimitExceeded default
    • 

  • [actions] use shared action; re-add finishers
    • 

  • [meta] Fix changelog formatting bug
    • 

  • [Deps] update side-channel
    • 

  • [Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols
    • 

  • [Tests] increase coverage
    • 



6.13.3


[Fix] fix regressions from robustness refactor
[actions] update reusable workflows


6.13.2


    

  • [Robustness] avoid .push, use void
    • 

  • [readme] clarify parseArrays and arrayLimit documentation (#543)
    • 

  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
    • 

  • [readme] replace runkit CI badge with shields.io check-runs badge
    • 

  • [actions] fix rebase workflow permissions
    • 



6.13.1


    

  • [Fix] stringify: avoid a crash when a filter key is null
    • 

  • [Fix] utils.merge: functions should not be stringified into keys
    • 

  • [Fix] parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset
    • 

  • [Fix] stringify: ensure a non-string filter does not crash
    • 

  • [Refactor] use __proto__ syntax instead of Object.create for null objects
    • 

  • [Refactor] misc cleanup
    • 






... (truncated)





Commits

    

  • bdcf0c7 v6.14.2
    • 

  • 294db90 [readme] document that addQueryPrefix does not add ? to empty output
    • 

  • 5c308e5 [readme] clarify parseArrays and arrayLimit documentation
    • 

  • 6addf8c [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit
    • 

  • cfc108f [Fix] arrayLimit means max count, not max index, in combine/merge/`pars...
    • 

  • febb644 [Fix] parse: throw on arrayLimit exceeded with indexed notation when `thr...
    • 

  • f6a7abf [Fix] parse: enforce arrayLimit on comma-parsed values
    • 

  • fbc5206 [Fix] parse: fix error message to reflect arrayLimit as max index; remove e...
    • 

  • 1b9a8b4 [actions] fix rebase workflow permissions
    • 

  • 2a35775 [meta] fix changelog typo (arrayLength → arrayLimit)
    • 

  • Additional commits viewable in compare view
    • 







Updates send from 0.18.0 to 0.19.2



Release notes

Sourced from send's releases.




0.19.2


What's Changed



Full Changelog: pillarjs/send@0.19.1...0.19.2


0.19.1


What's Changed


    

  • fix(deps): encodeurl@~2.0....

    Description has been truncated

    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          chore(deps): bump the npm_and_yarn group across 3 directories with 15…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          bc54c6a
        
      

    

  

    

      
… updates

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `14.0.4` | `15.5.10` |
| [tmp](https://github.com/raszi/node-tmp) | `0.2.1` | `0.2.4` |
| [express](https://github.com/expressjs/express) | `4.19.2` | `4.22.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.20.2` | `0.25.0` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `3.14.1` | `3.14.2` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.0.0-beta.13` | `5.4.21` |

Bumps the npm_and_yarn group with 1 update in the /test/next directory: [next](https://github.com/vercel/next.js).
Bumps the npm_and_yarn group with 1 update in the /test/sourceMapPath directory: [esbuild](https://github.com/evanw/esbuild).


Updates `next` from 14.0.4 to 15.5.10
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.0.4...v15.5.10)

Updates `tmp` from 0.2.1 to 0.2.4
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.1...v0.2.4)

Updates `express` from 4.19.2 to 4.22.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](expressjs/express@4.19.2...4.22.0)

Updates `esbuild` from 0.20.2 to 0.25.0
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.20.2...v0.25.0)

Updates `body-parser` from 1.20.2 to 1.20.4
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.2...1.20.4)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `cookie` from 0.6.0 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.6.0...v0.7.2)

Updates `diff` from 4.0.2 to 4.0.4
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4)

Updates `js-yaml` from 3.14.1 to 3.14.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...3.14.2)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `path-to-regexp` from 0.1.7 to 0.1.12
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.12)

Updates `qs` from 6.11.0 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.11.0...v6.14.2)

Updates `send` from 0.18.0 to 0.19.2
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.18.0...0.19.2)

Updates `serve-static` from 1.15.0 to 1.16.3
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.15.0...v1.16.3)

Updates `vite` from 5.0.0-beta.13 to 5.4.21
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.21/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.21/packages/vite)

Updates `next` from 14.2.35 to 16.1.7
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.0.4...v15.5.10)

Updates `esbuild` from 0.20.2 to 0.27.4
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md)
- [Commits](evanw/esbuild@v0.20.2...v0.25.0)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 15.5.10
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: tmp
  dependency-version: 0.2.4
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-version: 4.22.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.25.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-version: 0.7.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 3.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-version: 0.19.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-version: 1.16.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 5.4.21
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.1.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.27.4
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Mar 17, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews






    
    
    

    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
      

  

    

      0 participants