chore(deps): bump the prod-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the prod-dependencies group with 4 updates in the / directory: @types/react-dom, @types/react, esbuild and vite-plus.

Updates @types/react-dom from 19.2.3 to 19.2.4

Commits

• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates vite-plus from 0.2.6 to 0.2.8

Release notes

Sourced from vite-plus's releases.

vite-plus v0.2.8: monorepo target resolution, breaking VP_* environment variable renames, and install fixes

Bare vp dev/build/preview/pack at a monorepo root now resolve a target package instead of silently running against the root, and three Vite+-specific environment variables move to the VP_* prefix without compatibility aliases. Two failures that broke Vite+ before it could run are also fixed: the crash on container images that ship no CA certificates, and the missing Rolldown binding under pnpm's global virtual store.

Breaking Changes

• Rename three Vite+-specific environment variables to the VP_* prefix, with no compatibility aliases, so the old names stop working (#2312), by @​jong-kyung:

  Old	New
  VITE_LOG	VP_LOG
  VITE_GLOBAL_CLI_JS_SCRIPTS_DIR	VP_GLOBAL_CLI_JS_SCRIPTS_DIR
  VITE_UPDATE_TASK_TYPES	VP_UPDATE_TASK_TYPES

  Update any shell profile, CI job, or Dockerfile that sets the old names.

Highlights

• Resolve a target package for vp dev, build, preview, and pack at a monorepo root: interactive shells get a fuzzy package picker, non-interactive runs list the candidates and exit 1 instead of building the root, and a new global -C <dir> flag or a defaultPackage setting (a single directory, or an object mapping each of the four commands to its own directory) skips the prompt (#2031, #2305), by @​fengmk2
• Stop aborting with exit 134 on container images that ship no CA certificates (Debian slim, distroless): the shared HTTP client now retries once with the bundled Mozilla root list, like Node's own bundled roots, and reports a real error instead of panicking when it still cannot be built (#2273, #2295), by @​jbmusso and @​fengmk2
• Resolve the bundled Rolldown binding through platform packages instead of an undeclared require back into vite-plus, fixing Cannot find module 'vite-plus/binding' under pnpm enable-global-virtual-store and in standalone @voidzero-dev/vite-plus-core installs (#2313), by @​fengmk2
• Add vp pm ci for reproducible frozen-lockfile installs, and vp pm patch / vp pm patch-commit for editing dependencies in place on pnpm, bun, and Yarn Berry (npm and Yarn Classic warn and exit successfully) (#2082, #2308), by @​forehalo and @​jong-kyung

Features

• Upgrade the bundled toolchain: vite 8.1.5 -> 8.2.0, rolldown 1.2.0 -> 1.2.2, oxlint 1.75.0 -> 1.76.0, oxfmt 0.60.0 -> 0.61.0, and Vite DevTools 0.4.5 -> 0.4.10 (#2302, #2311), by @​voidzero-guard[bot]. The new oxfmt and oxlint can flag code that passed before, so run vp fmt after upgrading if your CI runs vp check.
• Read the Node.js version from .nvmrc when no other version source is present (#2244), by @​BlankParticle
• Support pnpm v12, which ships as a native binary: Vite+ now downloads the platform-specific @pnpm/exe.* package and generates native shims, so pnpm and pnpx work instead of failing to exec (#2289), by @​jong-kyung
• Verify the downloaded bun platform tarball against the registry dist.integrity hash (#2310), by @​jong-kyung

Fixes & Enhancements

• Let vp config install the Git hook dispatcher without creating or modifying project hook scripts or staged-file configuration, so a custom .vite-hooks/pre-commit survives (#2280), by @​TheAlexLichter
• Nest immutable global package installs under packages/<package>/<uuid> instead of using # in the path, which Node treated as a URL fragment and which broke dynamic imports inside installed packages (#2222), by @​liangmiQwQ
• Keep the recorded version spec on global installs, so vp update -g follows a dist tag or range instead of silently resolving back to latest, vp outdated -g reports Wanted versus Latest, and vp update -g --latest explicitly moves packages back to latest (#2249), by @​TheAlexLichter
• Stop deleting a managed Node.js runtime that another process is concurrently installing (#2248), by @​shulaoda
• Preserve the real exit code when a spawned process is terminated by a signal on Unix (#2154), by @​liangmiQwQ
• Honor an explicit vp create --package-manager outside monorepos instead of inheriting the manager from a non-monorepo ancestor directory (#2226), by @​jong-kyung
• Scaffold the vite:library template into a directory that contains only .git, while still refusing to overwrite existing user files (#2287), by @​RSS1102
• Render help for delegated commands from the local CLI, so vp <command> --help matches the installed toolchain instead of drifting (#2184), by @​liangmiQwQ
• Resolve typeAware and typeCheck options inherited through Oxlint extends, so vp check --no-lint runs and classifies type checking correctly (#2228), by @​jong-kyung
• Report (no version) instead of unknown when globally installing a local package that has no version field (#2232), by @​liangmiQwQ

Refactor

• Rename the Git hooks environment variable to VP_GIT_HOOKS, keeping VITE_GIT_HOOKS working as a deprecated alias (#2195), by @​dennybiasiolli
• Consolidate the package manager infrastructure so typed command arguments are the source of truth for per-manager compatibility (#2140), by @​forehalo
• Generate the Zed language settings from a language list instead of 17 near-identical blocks (#2294), by @​jong-kyung
• Share the agent-file detect and write traversal helpers so both passes apply identical rules (#2296), by @​jong-kyung
• Drop redundant clippy allow attributes in the global CLI (#2235), by @​shulaoda

... (truncated)

Commits

• fc3f0e2 release: v0.2.8: monorepo target resolution, breaking VP_* environment variab...
• cfb59b2 fix(cli): preserve project-owned git hooks (#2280)
• 28b85a2 chore(deps): declare @​emnapi peers where @​napi-rs/cli is used (#2319)
• 2574cd3 feat(cli): per-command defaultPackage (#2305)
• 43047d1 feat(cli): global -C flag for working-directory switching (#2031)
• c962cbd chore(deps): remove duplicate direct dependencies (#2318)
• 0a5e76e fix(core): resolve bundled Rolldown bindings via platform packages (#2313)
• fc71714 refactor(env): rename remaining Vite+ environment variables (#2312)
• a518b1d fix(check): resolve typecheck options inherited through lint extends (#2228)
• 4e64087 feat(deps): upgrade upstream dependencies (#2311)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: cffa688

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.