Bump the npm_and_yarn group across 4 directories with 11 updates

[dependabot]

Bumps the npm_and_yarn group with 3 updates in the /angular-workspace/ng17 directory: esbuild, @angular-devkit/build-angular and ng-packagr.
Bumps the npm_and_yarn group with 4 updates in the /angular-workspace/test-ng15 directory: @babel/helpers, esbuild, @angular-devkit/build-angular and ng-packagr.
Bumps the npm_and_yarn group with 1 update in the /react-workspace/test-react-v18 directory: webpack.
Bumps the npm_and_yarn group with 4 updates in the /react-workspace/test-web-components directory: @babel/helpers, @babel/runtime, serialize-javascript and webpack.

Updates esbuild from 0.19.12 to 0.25.1

Release notes

Sourced from esbuild's releases.

v0.25.1

• Fix incorrect paths in inline source maps (#4070, #4075, #4105)

  This fixes a regression from version 0.25.0 where esbuild didn't correctly resolve relative paths contained within source maps in inline sourceMappingURL data URLs. The paths were incorrectly being passed through as-is instead of being resolved relative to the source file containing the sourceMappingURL comment, which was due to the data URL not being a file URL. This regression has been fixed, and this case now has test coverage.

• Fix invalid generated source maps (#4080, #4082, #4104, #4107)

  This release fixes a regression from version 0.24.1 that could cause esbuild to generate invalid source maps. Specifically under certain conditions, esbuild could generate a mapping with an out-of-bounds source index. It was introduced by code that attempted to improve esbuild's handling of "null" entries in source maps (i.e. mappings with a generated position but no original position). This regression has been fixed.

  This fix was contributed by @​jridgewell.

• Fix a regression with non-file source map paths (#4078)

  The format of paths in source maps that aren't in the file namespace was unintentionally changed in version 0.25.0. Path namespaces is an esbuild-specific concept that is optionally available for plugins to use to distinguish paths from file paths and from paths meant for other plugins. Previously the namespace was prepended to the path joined with a : character, but version 0.25.0 unintentionally failed to prepend the namespace. The previous behavior has been restored.

• Fix a crash with switch optimization (#4088)

  The new code in the previous release to optimize dead code in switch statements accidentally introduced a crash in the edge case where one or more switch case values include a function expression. This is because esbuild now visits the case values first to determine whether any cases are dead code, and then visits the case bodies once the dead code status is known. That triggered some internal asserts that guard against traversing the AST in an unexpected order. This crash has been fixed by changing esbuild to expect the new traversal ordering. Here's an example of affected code:

  switch (x) {
    case '':
      return y.map(z => z.value)
    case y.map(z => z.key).join(','):
      return []
  }

• Update Go from 1.23.5 to 1.23.7 (#4076, #4077)

  This should have no effect on existing code as this version change does not change Go's operating system support. It may remove certain reports from vulnerability scanners that detect which version of the Go compiler esbuild uses.

  This PR was contributed by @​MikeWillCook.

v0.25.0

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.24.0 or ~0.24.0. See npm's documentation about semver for more information.

• Restrict access to esbuild's development server (GHSA-67mh-4wv8-2f99)

  This change addresses esbuild's first security vulnerability report. Previously esbuild set the Access-Control-Allow-Origin header to * to allow esbuild's development server to be flexible in how it's used for development. However, this allows the websites you visit to make HTTP requests to esbuild's local development server, which gives read-only access to your source code if the website were to fetch your source code's specific URL. You can read more information in the report.

  Starting with this release, CORS will now be disabled, and requests will now be denied if the host does not match the one provided to --serve=. The default host is 0.0.0.0, which refers to all of the IP addresses that represent the local machine (e.g. both 127.0.0.1 and 192.168.0.1). If you want to customize anything about esbuild's development server, you can put a proxy in front of esbuild and modify the incoming and/or outgoing requests.

  In addition, the serve() API call has been changed to return an array of hosts instead of a single host string. This makes it possible to determine all of the hosts that esbuild's development server will accept.

  Thanks to @​sapphi-red for reporting this issue.

• Delete output files when a build fails in watch mode (#3643)

  It has been requested for esbuild to delete files when a build fails in watch mode. Previously esbuild left the old files in place, which could cause people to not immediately realize that the most recent build failed. With this release, esbuild will now delete all output files if a rebuild fails. Fixing the build error and triggering another rebuild will restore all output files again.

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

• Fix regression with --define and import.meta (#4010, #4012, #4013)

  The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

  This fix was contributed by @​sapphi-red.

0.24.1

• Allow es2024 as a target in tsconfig.json (#4004)

  TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

  {
    "compilerOptions": {
      "target": "ES2024"
    }
  }

  As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

  This fix was contributed by @​billyjanitsch.

• Allow automatic semicolon insertion after get/set

  This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

  class Foo {
    get
    *x() {}
    set
    *y() {}
  }

  The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

• Allow quoted property names in --define and --pure (#4008)

  The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

• 6bfc1c1 publish 0.25.1 to npm
• f9b3952 fix #4078: prepend namespaces to source map paths
• ccf3dd7 add "contributed by" in changelog
• 48cd7a9 Update Go from 1.23.5 to 1.23.7 (#4077)
• 1f04fa4 fix absolute windows paths in source maps
• 9ca03f6 also add test case from #4075
• 2f244c0 add test case from #4104
• 1dde994 fix incorrect test names
• 9f008c5 fix #4070: file namespace for sourceMappingURL
• cbd5eb8 release notes and tests for #4082
• Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 17.3.8 to 19.2.5

Release notes

Sourced from @​angular-devkit/build-angular's releases.

19.2.5

@​angular/build

Commit	Description
	correct handling of response/request errors
	handle undefined getOrCreateAngularServerApp during error compilation
	normalize karma asset paths before lookup
	update vite to 6.2.3

v19.2.4

19.2.4 (2025-03-19)

@​schematics/angular

Commit	Description
	replace @angular/platform-browser-dynamic with @angular/platform-browser

@​angular/build

Commit	Description
	ensure errors for missing component resources
	ensure relative karma stack traces for test failures

v19.2.3

19.2.3 (2025-03-13)

@​angular/build

Commit	Description
	update babel packages

v19.2.2

19.2.2 (2025-03-12)

@​angular/cli

Commit	Description
	record analytics for nested schematics

@​angular/build

Commit	Description
	exclude all entrypoints of a library from prebundling
	handle postcss compilation errors gracefully
	provide extract-i18n does not respect
	remove duplicate prebundling warning

@​angular/ssr

Commit	Description
	prevent stream draining if write does not return a boolean

v19.2.1

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

19.2.5 (2025-03-26)

@​angular/build

Commit	Type	Description
20455e2a6	fix	correct handling of response/request errors
32b1dcd91	fix	handle undefined getOrCreateAngularServerApp during error compilation
7552a9fec	fix	normalize karma asset paths before lookup
1eb5b4357	fix	update vite to 6.2.3

18.2.16 (2025-03-26)

@​angular-devkit/build-angular

Commit	Type	Description
4267a80c5	fix	remove @vitejs/plugin-basic-ssl from dependencies

@​angular/build

Commit	Type	Description
9c2904d0d	fix	update vite to 5.4.15

17.3.14 (2025-03-26)

@​angular-devkit/build-angular

Commit	Type	Description
cb8f859f1	fix	update vite to 5.4.15

20.0.0-next.2 (2025-03-19)

Breaking Changes

@​schematics/angular

... (truncated)

Commits

• ab0bdce release: cut the v19.2.5 release
• 1eb5b43 fix(@​angular/build): update vite to 6.2.3
• 7552a9f fix(@​angular/build): normalize karma asset paths before lookup
• 32b1dcd fix(@​angular/build): handle undefined getOrCreateAngularServerApp during er...
• 20455e2 fix(@​angular/build): correct handling of response/request errors
• e2413f5 test: correct test description typos
• 148023a release: cut the v19.2.4 release
• b0b643e fix(@​angular/build): ensure errors for missing component resources
• 0a4e96b fix(@​schematics/angular): replace @angular/platform-browser-dynamic with `@...
• 2cd763e fix(@​angular/build): ensure relative karma stack traces for test failures
• Additional commits viewable in compare view

Updates ng-packagr from 17.3.0 to 19.2.1

Release notes

Sourced from ng-packagr's releases.

19.2.1

Bug Fixes

• correctly resolve SCSS resources from nested paths (2fcbe68), closes #3006

19.2.0

No release notes provided.

19.2.0-next.2

Features

• support TypeScript 5.8 (4dc79fa)

19.2.0-next.1

• add tailwindcss version 4 as a valid peer dependency (16561cd)

19.2.0-next.0

No changes.

19.1.2

• add tailwindcss version 4 as a valid peer dependency (719577c)

19.1.1

Bug Fixes

• disable TypeScript removeComments option (f0415dd)

19.1.0

Features

• support TypeScript 5.7 (af70d03)

Bug Fixes

• Re-use module resolution cache.

Performance

• mitigate TypeScript 5.6+ performance regression (ac9766e), closes #2969

19.1.0-next.4

Performance

• mitigate TypeScript 5.6+ performance regression (ac9766e), closes #2969

19.1.0-next.3

... (truncated)

Changelog

Sourced from ng-packagr's changelog.

19.2.1 (2025-04-02)

Bug Fixes

• correctly resolve SCSS resources from nested paths (2fcbe68), closes #3006

19.2.0 (2025-02-25)

19.2.0-next.2 (2025-02-10)

Features

• support TypeScript 5.8 (4dc79fa)

19.2.0-next.1 (2025-01-29)

Bug Fixes

• add tailwindcss version 4 as a valid peer dependency (16561cd)

19.2.0-next.0 (2025-01-24)

19.1.1 (2025-01-24)

Bug Fixes

• disable TypeScript removeComments option (f0415dd)

19.1.0 (2025-01-15)

Features

• support TypeScript 5.7 (af70d03)

Bug Fixes

• Re-use module resolution cache.
• adjust peerDependencies to allow Angular 19.1.0-next (d27ef5b)

Performance

• mitigate TypeScript 5.6+ performance regression (ac9766e), closes #2969

19.1.0-next.4 (2025-01-15)

... (truncated)

Commits

• 74ef3e0 release: cut 19.2.1
• 2fcbe68 fix: correctly resolve SCSS resources from nested paths
• ce8bffb release: cut 19.2.0
• 6e1b1a7 build: lock file maintenance
• e15f7c2 release: cut 19.2.0-next.2
• 990f723 build: update dependency typescript to v5.8.0-dev.20250210
• ca3ec77 build: update dependency prettier to ~3.5.0
• 446b33f build: update dependency esbuild to ^0.25.0
• 42cdd85 build: lock file maintenance
• 4dc79fa feat: support TypeScript 5.8
• Additional commits viewable in compare view

Updates postcss from 8.4.35 to 8.5.2

Release notes

Sourced from postcss's releases.

8.5.2

• Fixed end position of rules with semicolon (by @​romainmenke).

8.5.1

• Fixed backwards compatibility for complex cases (by @​romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@​romainmenke during his work on Stylelint added Input#document in additional to Input#css.

root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"

Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:

• Tidelift with a Spotify-like subscription model supporting all projects from your lock file.
• Direct donations at GitHub Sponsors or Open Collective.

8.4.49

• Fixed custom syntax without source.offset (by @​romainmenke).

8.4.48

• Fixed position calculation in error/warnings methods (by @​romainmenke).

8.4.47

• Removed debug code.

8.4.46

• Fixed Cannot read properties of undefined (reading 'before').

8.4.45

• Removed unnecessary fix which could lead to infinite loop.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.2

• Fixed end position of rules with semicolon (by @​romainmenke).

8.5.1

• Fixed backwards compatibility for complex cases (by @​romainmenke).

8.5 “Duke Alloces”

• Added Input#document for sources like CSS-in-JS or HTML (by @​romainmenke).

8.4.49

• Fixed custom syntax without source.offset (by @​romainmenke).

8.4.48

• Fixed position calculation in error/warnings methods (by @​romainmenke).

8.4.47

• Removed debug code.

8.4.46

• Fixed Cannot read properties of undefined (reading 'before').

8.4.45

• Removed unnecessary fix which could lead to infinite loop.

8.4.44

• Another way to fix markClean is not a function error.

8.4.43

• Fixed markClean is not a function error.

8.4.42

• Fixed CSS syntax error on long minified files (by @​varpstar).

8.4.41

• Fixed types (by @​nex3 and @​querkmachine).
• Cleaned up RegExps (by @​bluwy).

8.4.40

• Moved to getter/setter in nodes types to help Sass team (by @​nex3).

8.4.39

• Fixed CssSyntaxError types (by @​romainmenke).

8.4.38

• Fixed endIndex: 0 in errors and warnings (by @​romainmenke).

8.4.37

• Fixed original.column are not numbers error in another case.

8.4.36

... (truncated)

Commits

• 692fcde Release 8.5.2 version
• b70e98f Update dependencies
• ba587e3 Fix end position of rules with ownSemicon (#2012)
• 7b02c75 Release 8.5.1 version
• 4c15339 Update dependencies
• 7efe91e Improve backwards compat for Input#document (#2000)
• 6873270 Release 8.5 version
• 4223bb9 Fix 80 columns limit
• 80e2401 Add Input#document (#1996)
• 6f86879 Update dependencies
• Additional commits viewable in compare view

Updates rollup from 4.22.4 to 4.34.8

Release notes

Sourced from rollup's releases.

v4.34.8

4.34.8

2025-02-17

Bug Fixes

• Do not make assumptions about the value of nested paths in logical expressions if the expression cannot be simplified (#5846)

Pull Requests

• #5846: return UnknownValue if the usedbranch is unkown and the path is not empty (@​TrickyPi)

v4.34.7

4.34.7

2025-02-14

Bug Fixes

• Ensure that calls to parameters are included correctly when using try-catch deoptimization (#5842)

Pull Requests

• #5840: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5842: Fix prop inclusion with try-catch-deoptimization (@​lukastaegert)

v4.34.6

4.34.6

2025-02-07

Bug Fixes

• Retain "void 0" in the output for smaller output and fewer surprises (#5838)

Pull Requests

• #5835: fix(deps): update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #5838: replace undefined with void 0 for operator void (@​TrickyPi)

v4.34.5

4.34.5

2025-02-07

Bug Fixes

• Ensure namespace reexports always include all properties of all exports (#5837)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.34.8

2025-02-17

Bug Fixes

• Do not make assumptions about the value of nested paths in logical expressions if the expression cannot be simplified (#5846)

Pull Requests

• #5846: return UnknownValue if the usedbranch is unkown and the path is not empty (@​TrickyPi)

4.34.7

2025-02-14

Bug Fixes

• Ensure that calls to parameters are included correctly when using try-catch deoptimization (#5842)

Pull Requests

• #5840: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5842: Fix prop inclusion with try-catch-deoptimization (@​lukastaegert)

4.34.6

2025-02-07

Bug Fixes

• Retain "void 0" in the output for smaller output and fewer surprises (#5838)

Pull Requests

• #5835: fix(deps): update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #5838: replace undefined with void 0 for operator void (@​TrickyPi)

4.34.5

2025-02-07

Bug Fixes

• Ensure namespace reexports always include all properties of all exports (#5837)

Pull Requests

• #5836: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot])
• #5837: Include all paths of reexports if namespace is used (@​lukastaegert)

... (truncated)

Commits

• 8f667b7 4.34.8
• ba692fe return UnknownValue if the usedbranch is unkown and the path is not empty (#5...
• f9c52f8 4.34.7
• 15a6f73 Fix prop inclusion with try-catch-deoptimization (#5842)
• a724b60 fix(deps): lock file maintenance minor/patch updates (#5840)
• 4b87459 4.34.6
• fe89821 replace undefined with void 0 for operator void (#5838)
• 18cc314 fix(deps): update swc monorepo (major) (#5835)
• 3426b02 4.34.5
• f3aa1f0 Include all paths of reexports if namespace is used (#5837)
• Additional commits viewable in compare view

Updates vite from 5.1.7 to 6.2.3

Release notes

Sourced from vite's releases.

v6.2.3

Please refer to CHANGELOG.md for details.

v6.2.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.2.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.2.0

Please refer to CHANGELOG.md for details.

v6.2.0-beta.1

Please refer to CHANGELOG.md for details.

v6.2.0-beta.0

Please refer to CHANGELOG.md for details.

v6.1.3

Please refer to CHANGELOG.md for details.

v6.1.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.1.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.1.0

Please refer to CHANGELOG.md for details.

v6.1.0-beta.2

Please refer to CHANGELOG.md for details.

v6.1.0-beta.1

Please refer to CHANGELOG.md for details.

v6.1.0-beta.0

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

6.2.3 (2025-03-24)

• fix: fs raw query with query separators (#19702) (f234b57), closes #19702

6.2.2 (2025-03-14)

• fix: await client buildStart on top level buildStart (#19624) (b31faab), closes #19624
• fix(css): inline css correctly for double quote use strict (#19590) (d0aa833), closes #19590
• fix(deps): update all non-major dependencies (#19613) (363d691), closes #19613
• fix(indexHtml): ensure correct URL when querying module graph (#19601) (dc5395a), closes #19601
• fix(preview): use preview https config, not server (#19633) (98b3160), closes #19633
• fix(ssr): use optional chaining to prevent "undefined is not an object" happening in `ssrRewriteStac (4309755), closes #19612
• feat: show friendly error for malformed base (#19616) (2476391), closes #19616
• feat(worker): show asset filename conflict warning (#19591) (367d968), closes #19591
• chore: extend commit hash correctly when ambigious with a non-commit object (#19600) (89a6287), closes #19600

6.2.1 (2025-03-07)

• refactor: remove isBuild check from preAliasPlugin (#19587) (c9e086d), closes #19587
• refactor: restore endsWith usage (#19554) (6113a96), closes #19554
• refactor: use applyToEnvironment in internal plugins (#19588) (f678442), closes #19588
• fix(css): stabilize css module hashes with lightningcss in dev mode (#19481) (92125b4), closes #19481
• fix(deps): update all non-major dependencies (#19555) (f612e0f), closes #19555
• fix(reporter): fix incorrect bundle size calculation with non-ASCII characters (#19561) (437c0ed), closes #19561
• fix(sourcemap): combine sourcemaps with multiple sources without matched source (#18971) (e3f6ae1), closes #18971
• fix(ssr): named export should overwrite export all (#19534) (2fd2fc1), closes #19534
• feat: add *?url&no-inline type and warning for .json?inline / .json?no-inline (#19566) (c0d3667), closes #19566
• test: add glob import test case (#19516) (aa1d807), closes #19516
• test: convert config playground to unit tests (#19568) (c0e68da), closes #19568
• test: convert resolve-config playground to unit tests (#19567) (db5fb48), closes #19567
• perf: flush compile cache after 10s (#19537) (6c8a5a2), closes #19537
• chore(css): move environment destructuring after condition check (#19492) (c9eda23), closes #19492
• chore(html): remove unnecessary value check (#19491) (797959f), closes #19491

6.2.0 (2025-02-25)

• fix(deps): update all non-major dependencies (#19501) (c94c9e0), closes #19501
• fix(worker): string interpolation in dynamic worker options (#19476) (07091a1), closes #19476
• chore: use unicode cross icon instead of x (#19497) (5c70296), closes #19497

6.2.0-beta.1 (2025-02-21)

... (truncated)

Commits

• 16869d7 release: v6.2.3
• f234b57 fix: fs raw query with query separators (#19702)
• b12911e release: v6.2.2
• 98b3160 fix(preview): use preview https config, not server (#19633)
• b31faab fix: await client buildStart on top level buildStart (#19624)
• dc5395a fix(indexHtml): ensure correct URL when querying module graph (#19601)
• 2476391 feat: show friendly error for malformed base (#19616)
• 4309755 fix(ssr): use optional chaining to prevent "undefined is not an object" happe...
• 363d691 fix(deps): update all non-major dependencies (#19613)
• d0aa833 fix(css): inline css correctly for double quote use strict (#19590)
• Additional commits viewable in compare view

Updates webpack from 5.90.3 to 5.98.0

Release notes

Sourced from webpack's releases.

v5.98.0

Fixes

• Avoid the deprecation message #19062 by @​alexander-akait
• Should not escape CSS local ident in JS #19060 by @​JSerFeng
• MF parse range not compatible with Safari #19083 by @​alexander-akait
• Preserve filenameTemplate in new split chunk #19104 by @​henryqdineen
• Use module IDs for final render order #19184 by @​dmichon-msft
• Strip blob: protocol when public path is auto #19199 by @​alexander-akait
• Respect output.charset everywhere #19202 by @​alexander-akait
• Node async WASM loader generation #19210 by @​ashi009
• Correct BuildInfo and BuildMeta type definitions #19200 by @​inottn

Performance Improvements

• Improve FlagDependencyExportsPlugin for large JSON by depth #19058 by @​hai-x
• Optimize assign-depths #19193 by @​dmichon-msft
• Use startsWith for matching instead of converting the string to a regex #19207 by @​inottn

Chores

• Bump nanoid from 3.3.7 to 3.3.8 #19063 by @​dependabot
• Fixed incorrect typecast in DefaultStatsFactoryPlugin #19156 by @​Andarist
• Improved readme.md by adding video links for understanding webpack #19101 by @​Vansh5632
• Typo fix

[netlify]

✅ Deploy Preview for moduswebcomponents canceled.

Name	Link
🔨 Latest commit	3a2f877
🔍 Latest deploy log	https://app.netlify.com/sites/moduswebcomponents/deploys/67ed102200de1e0008d18a0b