Skip to content

chore(web): bump the dev-tooling group across 1 directory with 4 updates - #1423

Merged
mforce merged 2 commits into
mainfrom
dependabot/npm_and_yarn/web/dev-tooling-fe3f1901db
Nov 14, 2026
Merged

chore(web): bump the dev-tooling group across 1 directory with 4 updates#1423
mforce merged 2 commits into
mainfrom
dependabot/npm_and_yarn/web/dev-tooling-fe3f1901db

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-tooling group with 4 updates in the /web directory: @testing-library/user-event, @vitejs/plugin-react, postcss-selector-parser and vite.

Updates @testing-library/user-event from 14.6.8 to 14.6.9

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.9

14.6.9 (2026-11-10)

Bug Fixes

  • keep the string value of valid numbers in number inputs (#1339) (edef34d), closes #1053
Commits

Updates @vitejs/plugin-react from 6.2.1 to 6.3.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.3.0

Make reactCompilerPreset work with @rolldown/plugin-babel's parallel option (#1549)

reactCompilerPreset now refers to its Babel preset by module path instead of by function, so it can be sent to worker threads.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.3.0 (2026-11-09)

Make reactCompilerPreset work with @rolldown/plugin-babel's parallel option (#1549)

reactCompilerPreset now refers to its Babel preset by module path instead of by function, so it can be sent to worker threads.

Commits
  • 0e95069 release: plugin-react@6.3.0 (#1557)
  • 8a7d0d4 feat(plugin-react): make reactCompilerPreset work with @​rolldown/plugin-babel...
  • See full diff in compare view

Updates postcss-selector-parser from 7.1.7 to 7.1.8

Release notes

Sourced from postcss-selector-parser's releases.

7.1.8

  • fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (reported by @​zachariah-mithani)
  • chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear
Changelog

Sourced from postcss-selector-parser's changelog.

7.1.8 - 2026-11-08

  • fix: parse selectors in linear time on four more kinds of crafted input, closing a CPU exhaustion vulnerability (GHSA-67xj-gfww-g738, reported by @​zachariah-mithani)
  • chore: replace the cssesc dependency with an internal copy, whose redundant space removal is linear
Commits

Updates vite from 8.3.5 to 8.3.7

Release notes

Sourced from vite's releases.

v8.3.7

Bug Fixes

Miscellaneous Chores

Tests

Build System

v8.3.6

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.7 (2026-11-09)

Bug Fixes

Miscellaneous Chores

Tests

Build System

8.3.6 (2026-11-05)

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 13, 2026
@dependabot
chore(web): bump the dev-tooling group across 1 directory with 4 updates
508cc60 
Bumps the dev-tooling group with 4 updates in the /web directory: [@testing-library/user-event](https://github.com/testing-library/user-event), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react), [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@testing-library/user-event` from 14.6.8 to 14.6.9
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.8...v14.6.9)

Updates `@vitejs/plugin-react` from 6.2.1 to 6.3.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.3.0/packages/plugin-react)

Updates `postcss-selector-parser` from 7.1.7 to 7.1.8
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@7.1.7...7.1.8)

Updates `vite` from 8.3.5 to 8.3.7
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.7/packages/vite)

---
updated-dependencies:
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: vite
  dependency-version: 8.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(web): bump the dev-tooling group in /web with 4 updates chore(web): bump the dev-tooling group across 1 directory with 4 updates Nov 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/web/dev-tooling-fe3f1901db branch from a4cdbdd to 508cc60 Compare November 14, 2026 01:39
@mforce
mforce merged commit 8282ccc into main Nov 14, 2026
21 checks passed
@mforce
mforce deleted the dependabot/npm_and_yarn/web/dev-tooling-fe3f1901db branch November 14, 2026 02:14
@mforce mforce mentioned this pull request Nov 14, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mforce