chore(deps): bump the npm_and_yarn group across 3 directories with 7 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: adm-zip, electron, vite and vitest.
Bumps the npm_and_yarn group with 1 update in the /package/@stackframe/stack-shared directory: uuid.
Bumps the npm_and_yarn group with 2 updates in the /package/@stackframe/react directory: cookie and esbuild.

Updates adm-zip from 0.5.18 to 0.6.0

Release notes

Sourced from adm-zip's releases.

v0.6.0

Full Changelog: cthackers/adm-zip@v0.5.18...v0.6.0

This release fixes a security vulnerability (CVE-2026-39244), resolves several long-standing bugs, ships built-in TypeScript types, and includes two behavior changes worth reading before you upgrade.

• extractEntryTo(dirEntry, target, maintainEntryPath = false) now preserves subdirectories instead of flattening files into the target folder by basename (which also silently overwrote same-named files). (#306)
• Extraction no longer fails when the modification time can't be set — utimes is now best-effort. (#379)
• Minimum Node.js is now 14 (the code already required it; engines was incorrectly >=12).
• CVE-2026-39244 — a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc and OOM the process; allocation is now bounded by the data actually present. Reported by Daniel Púa (devploit), Anh Hong, and José Antonio Zamudio Amaya. (#568)
• Hardened entry-name lookup against object injection (proto names). Prototype-less table.
• Data-descriptor regression rejecting valid archives (#548, #533, #554)
• Directory permissions not restored on extract (#530)
• Infinite recursion on symlink loops in addLocalFolder (#541)
• Uncaught process crash in writeFileToAsync on write failure (#470, #459, #402)
• Empty name on directory entries (#466)
• test() always returned false for archives with files
• ~6× faster entry sorting for large archives
• Built-in TypeScript definitions (types.d.ts) — you can drop @​types/adm-zip

Changelog

Sourced from adm-zip's changelog.

0.6.0 / 2026-07-10

Security

• Fixed CVE-2026-39244: a crafted archive declaring a huge uncompressed size could force an unbounded Buffer.alloc (memory exhaustion / DoS) before any validation. Allocation is now bounded by the data actually present — STORED output is sized from the real bytes, DEFLATED output is grown by the inflater and capped at the declared size (#568)
• Hardened the internal entry-name lookup table against object injection: entry names come from untrusted archives, and a name such as __proto__ previously resolved to Object.prototype, crashing addFile and hiding the entry from getEntry/readFile. The table is now prototype-less

Bug fixes

• Fixed a regression (0.5.15) that rejected valid archives using a data descriptor (general-purpose bit 3). The payload is now validated against the authoritative central-directory CRC instead of requiring/parsing the trailing descriptor (#548, #533, #554)
• Fixed extractAllTo/extractAllToAsync not restoring directory permissions with keepOriginalPermission; directory modes are applied after their contents are written, deepest path first, and no longer lock the extractor out of a restrictive directory (#530)
• Fixed infinite recursion in addLocalFolder when a folder contains a symlink pointing back to an ancestor (e.g. workspace node_modules); the walk now tracks resolved real paths and skips already-visited directories (#541)
• Fixed an uncaught exception (ERR_INVALID_ARG_TYPE) that crashed the process when writeFileToAsync could not open the target file (bad permissions, invalid filename, exhausted file descriptors); write failures are now reported through the callback and write errors are no longer silently swallowed (#470, #459, #402)
• Fixed directory entries reporting an empty name (e.g. a/b/c/ now returns c) (#466)
• Fixed extractEntryTo flattening subdirectories when maintainEntryPath is false; the structure below the extracted directory is now preserved instead of collapsing (and overwriting) files by basename (#306)
• Fixed a failed utimes aborting extraction; setting the modification time is now best-effort and never fails extraction of already-written content (#379)
• Fixed test() always returning false for any archive containing a file (it indexed the entries array with an entry object instead of reading the entry); it now correctly verifies each entry's CRC

Performance

• Faster entry sorting when writing archives with many entries: names are decoded once instead of on every comparison (about 6× faster sort for large archives)

Added

• Bundled TypeScript type definitions (types.d.ts), so @types/adm-zip is no longer required

Notes

• Behavior change: extractEntryTo(dir, target, /* maintainEntryPath */ false) now preserves subdirectories beneath the extracted directory rather than flattening them
• Behavior change: extraction no longer fails when the modification time cannot be set

0.5.4 / 2021-03-08

• Fixed relative paths
• Added zipcrypto encryption
• Lower verMade for macOS when generating zip file

0.5.3 / 2021-02-07

• Fixed filemode when unzipping

0.5.2 / 2021-01-27

• Fixed path traversal issue (GHSL-2020-198)

0.5.1 / 2020-11-27

• Incremented version (cthackers)
• Fixed outFileName (cthackers)

0.5.0 / 2020-11-19

• Added extra parameter to extractEntryTo so target filename can be renamed (cthackers)

... (truncated)

Commits

• 2b4d840 updated minimum node engine version to >= 14
• dc57f0f Hardened entry-name lookup, fixed test(), and sped up entry sorting
• f81806a Made utimes best-effort so it can't abort extraction (#379)
• ab04324 Fixed extractEntryTo flattening subdirectories (#306)
• 8a5d9ba Fixed empty name for directory entries (#466)
• 3e72790 Fixed uncaught crash in writeFileToAsync on write failure (#470, #459, #402)
• 651ae4c Added typescript types
• e72021d Fixed infinite recursion on symlink loops in addLocalFolder (#541)
• 8f3176b Fixed directory permissions on linux
• 4d2c8f9 Fixed error introduced with zip descriptor checks
• Additional commits viewable in compare view

Updates electron from 33.4.11 to 43.1.1

Release notes

Sourced from electron's releases.

electron v43.1.1

Release Notes for v43.1.1

Fixes

• Fixed a browser-process crash (ValidateIntegrityOrDie) and spurious preload ENOENT errors when an app's app.asar is replaced on disk (e.g. by an updater or MDM software) while the app is running. #52293 (Also in 42, 44)

Other Changes

• Updated Chromium to 150.0.7871.114. #52297

electron v43.1.0

Release Notes for v43.1.0

Fixes

• Fixed crash triggered by replacing an open application menu. #52276 (Also in 41, 42, 44)

Other Changes

• Updated Chromium to 150.0.7871.47. #52235
• Updated Node.js to v24.18.0. #52106

electron v43.0.0

Release Notes for v43.0.0

Stack Upgrades

• Chromium 150.0.7871.46
  • New in 150
  • New in 149
• Node v24.147.0
  • Node 24.17.0 blog post
• V8 15.0

Breaking Changes

• File downloads will open by default in the user's Downloads folder (or Home directory if Downloads doesn't exist). #49868
• Fix: If a nativeImage was passed an image with a color profile, its pixel values will now be normalized to SRGB. This ensures that two visually identical images after color space application will receive similar pixel values when converted to a nativeImage. #51565
• On Linux, frameless windows now have rounded corners by default, just like on macOS and Windows. Rounded corners can be disabled on all platforms by setting roundedCorners: false on the window. #52111
• Removed showHiddenFiles support from the dialog API on Linux. #51880

Features

Additions

• Added Clone method to WebContents. #49959
• Added JS stack trace to crash reports on renderer OOM. #50043 (Also in 42)
• Added Linux support for app.getApplicationInfoForProtocol(). #51297 (Also in 42)
• Added Notification.remove(), removeAll(), and removeGroup() static methods for macOS. #51690 (Also in 42)
• Added Notification.getHistory() for macOS, allowing developers to restore all delivered notifications still present in Notification Center. #50325 (Also in 42)
• Added accessibilityLabel property to MenuItem constructor options and properties for defining screen-reader-friendly labels. #50240
• Added allowExtensions privilege to protocol.registerSchemesAsPrivileged() to enable Chrome extensions on custom protocols. #49951 (Also in 40, 41, 42)
• Added app.configureWebAuthn() to enable the Touch ID platform authenticator for WebAuthn on macOS, and a select-webauthn-account session event for choosing between multiple discoverable credentials. #51255 (Also in 41, 42)

... (truncated)

Commits

• 49dacb7 chore: bump chromium to 150.0.7871.114 (43-x-y) (#52297)
• 3ece4d2 ci: fail gha-done when checkout jobs fail (#52250)
• ec31a73 fix: read asar contents through the archive's retained file handle (#52293)
• 155287d docs(mas): update security scoped bookmarks link (#52281)
• a8bb2f1 chore: bump chromium to 150.0.7871.101 (43-x-y) (#52285)
• b5c102b fix: restore SelfKeepAlive in Menu (#52276)
• 295cdff build: replace chalk with node:util styleText (#52258)
• c4baa54 chore: bump chromium to 150.0.7871.47 (43-x-y) (#52235)
• e4a5c5a chore: bump node to v24.18.0 (43-x-y) (#52106)
• 74daf45 build: update PGO profiles (#52201)
• Additional commits viewable in compare view

Updates vite from 5.4.21 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

• bundled-dev: avoid duplicated buildEnd (#22931) (8100320)
• client: overlay error message format align rolldown (#22869) (5a72b87)
• deps: update all non-major dependencies (#22921) (fef682d)
• deps: update rolldown-related dependencies (#22922) (3c345e4)
• module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)
• optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)
• ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

• build: fix incorrect @default for build.cssMinify (#22948) (c88c236)
• build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

• avoid scanner scanning all files under __tests__ (#22912) (c961cae)

8.1.4 (2026-07-09)

Features

• legacy: prefer oxc as minifier (fix #21973) (#22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#22839) (f1f90ed)
• deps: update all non-major dependencies (#22865) (d4295a9)
• deps: update rolldown-related dependencies (#22866) (7cf07e4)
• html: avoid backtracking in import-only check (#22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#22876) (ea22fb3)

Tests

... (truncated)

Commits

• 5e7fe12 release: v8.1.5
• 6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
• 5a72b87 fix(client): overlay error message format align rolldown (#22869)
• f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
• 8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
• c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
• b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
• fef682d fix(deps): update all non-major dependencies (#22921)
• 3c345e4 fix(deps): update rolldown-related dependencies (#22922)
• 369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
• Additional commits viewable in compare view

Updates vitest from 2.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

• browser:
  • Disable client cdp API when allowWrite/allowExec: false [backport to v4]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)
  • Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4]  -  by @​toxik and @​Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in vitest-dev/vitest#10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in vitest-dev/vitest#10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in vitest-dev/vitest#10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in vitest-dev/vitest#10276 (9f7b1)

    View changes on GitHub

... (truncated)

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• a7a61e7 chore: release v4.1.9 (#10598)
• 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
• 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
• a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
• e61f2dd chore: release v4.1.8
• e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• a09d472 chore: release v4.1.7
• a8fd24c chore: release v4.1.6
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates uuid from 9.0.1 to 14.0.1

Release notes

Sourced from uuid's releases.

v14.0.1

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

• expect crypto to be global everywhere (requires node@20+) (#935)
• drop node@18 support (#934)

Features

• drop node@18 support (#934) (dc4ddb8)

Bug Fixes

• expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)
• Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

• rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

• backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

• make browser exports the default (#901)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.1 (2026-06-20)

Bug Fixes

• add types condition to node export for moduleResolution bundler (#961) (27ffae5)

14.0.0 (2026-04-19)

Security

• Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

• crypto is now expected to be globally defined (requires node@20+) (#935)
• drop node@18 support (#934)
• upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

• make browser exports the default (#901)

Bug Fixes

• make browser exports the default (#901) (bce9d72)

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

• update to typescript@5.2 (#887)
• remove CommonJS support (#886)
• drop node@16 support (#883)

Features

• add node@24 to ci matrix (#879) (42b6178)
• drop node@16 support (#883) (0f38cf1)
• remove CommonJS support (#886) (ae786e2)
• update to typescript@5.2 (#887) (c7ee405)

Bug Fixes

... (truncated)

Commits

• 7017780 chore(main): release 14.0.1 (#964)
• f2c3e4b chore: fix release-please workflow (#963)
• 27ffae5 fix: add types condition to node export for moduleResolution bundler (#961)
• 664cb31 Remove outdated security contact information (#959)
• d729016 fix(ci): checkout PR head commit in browser workflow (#957)
• 89a5ebc Workflows (#948)
• 196e208 chore: fix workflow (#947)
• 95af448 chore: update workflows (#946)
• 3b57f95 chore: add workflow_dispatch (#944)
• a433096 chore: add 12.x and 13.x maintenance release branches (#941)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates cookie from 0.6.0 to 2.0.1

Release notes

Sourced from cookie's releases.

v2.0.1

Improved:

• Small performance improvement by incrementing = index while parsing set-cookie (jshttp/cookie#280)

v2.0.0

Important: This release moves the package to ESM only. In node 22+ you can require(esm), and older node versions are not supported.

Changed

• Switch to ESM (jshttp/cookie#273)
• Remove deprecated code paths (jshttp/cookie#272)
  • The old parse and stringify methods have been renamed: parseCookie and stringifySetCookie
  • stringifySetCookie only supports object mode (e.g. { name: "", value: "" })

Improvements

• Faster stringify cookie (#262)
• Optimize encode performance (jshttp/cookie#269)
• Apply encode to empty cookie values (jshttp/cookie#277)

Fixed

• Omit leading semicolon when stringifying cookies with skipped values (#267)

v1.1.1

Fixed

• Overwrite value in passed in options (#253) c66147c
  • When value was provided in serialize(key, value, { value }) the value in options was used instead of the value passed as an argument

---

jshttp/cookie@v1.1.0...v1.1.1

v1.1.0

Added:

• Add stringifyCookie and parseSetCookie methods (#244, #214)
• Rename existing methods for clarity (old method names remain for backward compatibility)
  • parse → parseCookie
  • serialize → stringifySetCookie
• Add side effects field (#245) 00b0327

---

jshttp/cookie@v1.0.2...v1.1.0

v1.0.2

Fixed

... (truncated)

Commits

• 51c4854 2.0.1
• 84068f8 Increment = index when parsing set-cookie (#280)
• e5164de 2.0.0
• ddd3ad4 Remove deprecations from README (#279)
• 581e9df Apply encode to empty cookie values (#277)
• 6a4ec43 Upgrade deps (#278)
• f6d0482 Switch to ESM (#273)
• b05ae23 Add release workflow (#264)
• 15d7996 Remove deprecated code paths (#272)
• 4f7c94a Optimize encode performance (#269)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for cookie since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates esbuild from 0.20.2 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

• Fix regression with --define and import.meta (#4010, #4012, #4013)

  The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

  This fix was contributed by @​sapphi-red.

0.24.1

• Allow es2024 as a target in tsconfig.json (#4004)

  TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

  {
    "compilerOptions": {
      "target": "ES2024"
    }
  }

  As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

  This fix was contributed by @​billyjanitsch.

• Allow automatic semicolon insertion after get/set

  This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

  class Foo {
    get
    *x() {}
    set
    *y() {}
  }

  The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

• Allow quoted property names in --define and --pure (#4008)

  The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 

[greptile-apps]

PR author is in the excluded authors list.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	twilight-math-75ea	412e521	Jul 18 2026, 03:46 AM

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vitest@​4.1.10
	npm/​vite@​8.1.5
	npm/​adm-zip@​0.6.0
	npm/​uuid@​14.0.1
	npm/​cookie@​2.0.1
	npm/​electron@​43.1.1

View full report