Bump rollup, rollup-plugin-visualizer, @vitejs/plugin-react and vite in /example #628

dependabot · 2024-09-25T07:11:26Z

Bumps rollup to 4.22.4 and updates ancestor dependencies rollup, rollup-plugin-visualizer, @vitejs/plugin-react and vite. These dependencies need to be updated together.

Updates rollup from 2.79.1 to 4.22.4

Release notes

Sourced from rollup's releases.

v4.22.4

4.22.4

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5670: refactor: Use object.prototype to check for reserved properties (@YuHyeonWook)

#5671: Fix DOM Clobbering CVE (@lukastaegert)

v4.22.3

4.22.3

2024-09-21

Bug Fixes

Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

#5669: Ensure impure dependencies of pure modules are added (@lukastaegert)

v4.22.2

4.22.2

2024-09-20

Bug Fixes

Revert fix for side effect free modules until other issues are investigated (#5667)

Pull Requests

#5667: Partially revert #5658 and re-apply #5644 (@lukastaegert)

v4.22.1

4.22.1

2024-09-20

Bug Fixes

Revert #5644 "stable chunk hashes" while issues are being investigated

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.22.4

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5670: refactor: Use object.prototype to check for reserved properties (@YuHyeonWook)

#5671: Fix DOM Clobbering CVE (@lukastaegert)

4.22.3

2024-09-21

Bug Fixes

Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

#5669: Ensure impure dependencies of pure modules are added (@lukastaegert)

4.22.2

2024-09-20

Bug Fixes

Revert fix for side effect free modules until other issues are investigated (#5667)

Pull Requests

#5667: Partially revert #5658 and re-apply #5644 (@lukastaegert)

4.22.1

2024-09-20

Bug Fixes

Revert #5644 "stable chunk hashes" while issues are being investigated

Pull Requests

#5663: chore(deps): update dependency inquirer to v11 (@renovate[bot], @lukastaegert)

#5664: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5665: fix: type in CI file (@YuHyeonWook)

... (truncated)

Commits

79c0aba 4.22.4
e2552c9 Fix DOM Clobbering CVE (#5671)
10ab90e refactor: Use object.prototype to check for reserved properties (#5670)
e1cba8e 4.22.3
59cec3e Ensure impure dependencies of pure modules are added (#5669)
b86ffd7 4.22.2
d5ff63d Partially revert #5658 and re-apply #5644 (#5667)
0a821d9 Create SECURITY.md
76e962d 4.22.1
68c23da Partially revert #5644
Additional commits viewable in compare view

Updates rollup-plugin-visualizer from 5.7.1 to 5.12.0

Changelog

Sourced from rollup-plugin-visualizer's changelog.

5.12.0

Make unique id in generated data to be hash of data

Remove strict from CLI

5.11.0

Correct lenghts in case of sourcemap it will strictly use sourcemap data always

Add css cursor pointer

Add --open to CLI

5.10.0

Update dependencies

Add experimental flamegraph template

Make super simple placeholder to test if people stop complaining about input/output inputs

5.9.3

Update dependencies

Add Rollup 4.x to the list of supported

5.9.1

Update dependencies

Change a way code traversed for sourcemap in attempt to account for surrogate pairs

5.9.0

Add include and exclude options allowing to filter bundles, and files in separate or together

Fix possible bug with not correctly cutting prefix when projectRoot is a string

Use glob patterns via picomatch in include and exclude allowing to filter both bundles and files

treemap received new zoom. On click on node it will increase it size to 100%

5.8.3

Remove not used dependencies and updated rollup to v3

5.8.2

Update dependencies. Most notable source-map updated to 0.7.4

5.8.1

Make rollup to be optional peer dependency

5.8.0

New template type raw-data - it replaces .json option

Soft deprecate .json option in favor of new template type

... (truncated)

Commits

dec8398 5.12.0
b33791c Update changelog
8fe6656 Rebuild snapshots
7e256bb Instead of unique id use hash based on data
9ed44b4 Remove strict
dfc9477 Update deps
db62f94 5.11.0
14539d5 Set version in changelog
931b4a7 Refresh snapshots
72e0ede Update changelog
Additional commits viewable in compare view

Updates @vitejs/plugin-react from 2.0.0 to 4.3.1

Release notes

Sourced from @vitejs/plugin-react's releases.

v4.3.1

Fix support for React Compiler with React 18

The previous version made this assumption that the compiler was only usable with React 19, but it's possible to use it with React 18 and a custom runtimeModule: https://gist.github.com/poteto/37c076bf112a07ba39d0e5f0645fec43

When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.

Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.

v4.3.0

Fix support for React compiler

Don't set retainLines: true when the React compiler is used. This creates whitespace issues and the compiler is modifying the JSX too much to get correct line numbers after that. If you want to use the React compiler and get back correct line numbers for tools like vite-plugin-react-click-to-component to work, you should update your config to something like:
export default defineConfig(({ command }) => {
  const babelPlugins = [['babel-plugin-react-compiler', {}]]
  if (command === 'serve') {
    babelPlugins.push(['@babel/plugin-transform-react-jsx-development', {}])
  }
return {
plugins: [react({ babel: { plugins: babelPlugins } })],
}
})
Support HMR for class components

This is a long overdue and should fix some issues people had with HMR when migrating from CRA.

v4.2.1

Remove generic parameter on Plugin to avoid type error with Rollup 4/Vite 5 and skipLibCheck: false.

I expect very few people to currently use this feature, but if you are extending the React plugin via api object, you can get back the typing of the hook by importing ViteReactPluginApi:
import type { Plugin } from 'vite'
import type { ViteReactPluginApi } from '@vitejs/plugin-react'
export const somePlugin: Plugin = {
name: 'some-plugin',
api: {
reactBabel: (babelConfig) => {
babelConfig.plugins.push('some-babel-plugin')
},
} satisfies ViteReactPluginApi,
}

... (truncated)

Changelog

Sourced from @vitejs/plugin-react's changelog.

4.3.1 (2024-06-10)

Fix support for React Compiler with React 18

The previous version made this assumption that the compiler was only usable with React 19, but it's possible to use it with React 18 and a custom runtimeModule: https://gist.github.com/poteto/37c076bf112a07ba39d0e5f0645fec43

When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.

Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.

4.3.0 (2024-05-22)

Fix support for React compiler

Don't set retainLines: true when the React compiler is used. This creates whitespace issues and the compiler is modifying the JSX too much to get correct line numbers after that. If you want to use the React compiler and get back correct line numbers for tools like vite-plugin-react-click-to-component to work, you should update your config to something like:
export default defineConfig(({ command }) => {
  const babelPlugins = [['babel-plugin-react-compiler', {}]]
  if (command === 'serve') {
    babelPlugins.push(['@babel/plugin-transform-react-jsx-development', {}])
  }
return {
plugins: [react({ babel: { plugins: babelPlugins } })],
}
})
Support HMR for class components

This is a long overdue and should fix some issues people had with HMR when migrating from CRA.

4.2.1 (2023-12-04)

Remove generic parameter on Plugin to avoid type error with Rollup 4/Vite 5 and skipLibCheck: false.

I expect very few people to currently use this feature, but if you are extending the React plugin via api object, you can get back the typing of the hook by importing ViteReactPluginApi:
import type { Plugin } from 'vite'
import type { ViteReactPluginApi } from '@vitejs/plugin-react'
export const somePlugin: Plugin = {
name: 'some-plugin',
api: {
reactBabel: (babelConfig) => {
babelConfig.plugins.push('some-babel-plugin')
},
} satisfies ViteReactPluginApi,
</tr></table>

... (truncated)

Commits

See full diff in compare view

Updates vite from 3.2.7 to 5.4.8

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.8 (2024-09-25)

fix(css): backport #18113, fix missing source file warning with sass modern api custom importer (#18 (7d47fc1), closes #18183

fix(css): backport #18128, ensure sass compiler initialized only once (#18184) (8464d97), closes #18128 #18184

5.4.7 (2024-09-20)

fix: treat config file as ESM in Deno (#18158) (b5908a2), closes #18158

5.4.6 (2024-09-16)

fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115) (179b177), closes #18115

fix: fs raw query (#18112) (6820bb3), closes #18112

5.4.5 (2024-09-13)

fix(preload): backport #18098, throw error preloading module as well (#18099) (faa2405), closes #18098 #18099

5.4.4 (2024-09-11)

fix: backport #17997, ensure req.url matches moduleByEtag URL to avoid incorrect 304 (#18078) (74a79c5), closes #17997 #18078

fix: backport #18063, allow scanning exports from script module in svelte (#18077) (d90ba40), closes #18063 #18077

fix(preload): backport #18046, allow ignoring dep errors (#18076) (8760293), closes #18046 #18076

5.4.3 (2024-09-03)

fix: allow getting URL of JS files in publicDir (#17915) (943ece1), closes #17915

fix: cjs warning respect the logLevel flag (#17993) (dc3c14f), closes #17993

fix: improve CJS warning trace information (#17926) (5c5f82c), closes #17926

fix: only remove entry assets handled by Vite core (#17916) (ebfaa7e), closes #17916

fix: waitForRequestIdle locked (#17982) (ad13760), closes #17982

fix(css): fix directory index import in sass modern api (#17960) (9b001ba), closes #17960

fix(css): fix sass file:// reference (#17909) (561b940), closes #17909

fix(css): fix sass modern source map (#17938) (d428e7e), closes #17938

fix(deps): bump tsconfck (#17990) (8c661b2), closes #17990

fix(html): rewrite assets url in <template> (#17988) (413c86a), closes #17988

fix(preload): add crossorigin attribute in CSS link tags (#17930) (15871c7), closes #17930

chore: reduce diffs with v6 branch (#17942) (bf9065a), closes #17942

chore(deps): update all non-major dependencies (#17945) (cfb621e), closes #17945

chore(deps): update all non-major dependencies (#17991) (0ca53cf), closes #17991

... (truncated)

Commits

0474550 release: v5.4.8
8464d97 fix(css): backport #18128, ensure sass compiler initialized only once (#18184)
7d47fc1 fix(css): backport #18113, fix missing source file warning with sass modern a...
a403e73 release: v5.4.7
b5908a2 fix: treat config file as ESM in Deno (#18158)
f969176 release: v5.4.6
179b177 fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115)
6820bb3 fix: fs raw query (#18112)
37881e7 release: v5.4.5
faa2405 fix(preload): backport #18098, throw error preloading module as well (#18099)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [rollup](https://github.com/rollup/rollup) to 4.22.4 and updates ancestor dependencies [rollup](https://github.com/rollup/rollup), [rollup-plugin-visualizer](https://github.com/btd/rollup-plugin-visualizer), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). These dependencies need to be updated together. Updates `rollup` from 2.79.1 to 4.22.4 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v2.79.1...v4.22.4) Updates `rollup-plugin-visualizer` from 5.7.1 to 5.12.0 - [Changelog](https://github.com/btd/rollup-plugin-visualizer/blob/master/CHANGELOG.md) - [Commits](btd/rollup-plugin-visualizer@v5.7.1...v5.12.0) Updates `@vitejs/plugin-react` from 2.0.0 to 4.3.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/v4.3.1/packages/plugin-react) Updates `vite` from 3.2.7 to 5.4.8 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.4.8/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.4.8/packages/vite) --- updated-dependencies: - dependency-name: rollup dependency-type: indirect - dependency-name: rollup-plugin-visualizer dependency-type: direct:production - dependency-name: "@vitejs/plugin-react" dependency-type: direct:development - dependency-name: vite dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 25, 2024

dependabot bot mentioned this pull request Sep 25, 2024

Bump vite from 3.2.7 to 3.2.11 in /example #623

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump rollup, rollup-plugin-visualizer, @vitejs/plugin-react and vite in /example #628

Bump rollup, rollup-plugin-visualizer, @vitejs/plugin-react and vite in /example #628

dependabot bot commented on behalf of github Sep 25, 2024

Bump rollup, rollup-plugin-visualizer, @vitejs/plugin-react and vite in /example #628

Are you sure you want to change the base?

Bump rollup, rollup-plugin-visualizer, @vitejs/plugin-react and vite in /example #628

Conversation

dependabot bot commented on behalf of github Sep 25, 2024

v4.22.4

4.22.4

Bug Fixes

Pull Requests

v4.22.3

4.22.3

Bug Fixes

Pull Requests

v4.22.2

4.22.2

Bug Fixes

Pull Requests

v4.22.1

4.22.1

Bug Fixes

Pull Requests

4.22.4

Bug Fixes

Pull Requests

4.22.3

Bug Fixes

Pull Requests

4.22.2

Bug Fixes

Pull Requests

4.22.1

Bug Fixes

Pull Requests

5.12.0

5.11.0

5.10.0

5.9.3

5.9.1

5.9.0

5.8.3

5.8.2

5.8.1

5.8.0

v4.3.1

Fix support for React Compiler with React 18

v4.3.0

Fix support for React compiler

Support HMR for class components

v4.2.1

4.3.1 (2024-06-10)

Fix support for React Compiler with React 18

4.3.0 (2024-05-22)

Fix support for React compiler

Support HMR for class components

4.2.1 (2023-12-04)

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

[email protected]

5.4.8 (2024-09-25)

5.4.7 (2024-09-20)

5.4.6 (2024-09-16)

5.4.5 (2024-09-13)

5.4.4 (2024-09-11)

5.4.3 (2024-09-03)