chore(deps): bump esbuild, @tailwindcss/vite, @vitejs/plugin-react and vite in /web by dependabot[bot] · Pull Request #108 · evalops/diffscope

dependabot · 2026-06-12T20:31:23Z

Removes esbuild. It's no longer used after updating ancestor dependencies esbuild, @tailwindcss/vite, @vitejs/plugin-react and vite. These dependencies need to be updated together.

Removes esbuild

Updates @tailwindcss/vite from 4.2.1 to 4.3.1

Release notes

Sourced from @tailwindcss/vite's releases.

v4.3.1

Added

Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)

Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)

Allow @apply to be used with CSS mixins (#19427)

Ensure not-* correctly negates @container queries, including style(…) queries (#20059)

Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)

Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)

Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)

Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)

Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)

Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)

Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)

Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)

Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)

Allow @variant to be used inside addBase (#19480)

Ensure @source globs with symlinks are preserved (#20203)

Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)

Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)

Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)

Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)

Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)

Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)

Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)

Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#20196)

v4.3.0

Added

Add @container-size utility (#18901)

Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)

Add scrollbar-gutter-* utilities (#20018)

Add zoom-* utilities (#20020)

Add tab-* utilities (#20022)

Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)

Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)

Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#19949)

... (truncated)

Changelog

Sourced from @tailwindcss/vite's changelog.

[4.3.1] - 2026-06-12

Added

Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)

Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)

Allow @apply to be used with CSS mixins (#19427)

Ensure not-* correctly negates @container queries, including style(…) queries (#20059)

Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#20080)

Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#20103)

Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#20027)

Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#20127)

Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#20130)

Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#20137)

Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#20139)

Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#20198)

Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#19588)

Allow @variant to be used inside addBase (#19480)

Ensure @source globs with symlinks are preserved (#20203)

Ensure later @source rules can re-include files excluded by earlier @source not rules (#20203)

Upgrade: don't migrate empty class rules to invalid @utility rules (#20205)

Ensure transitions between inset-shadow-none and other inset shadows work correctly (#20208)

Ensure explicitly referenced @source directories are scanned even when ignored by git (#20214)

Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#20217)

Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#20221)

Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#20228)

Changed

Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#20196)

Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#20196)

[4.3.0] - 2026-05-08

Added

Add @container-size utility (#18901)

Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#19981, #20019)

Add scrollbar-gutter-* utilities (#20018)

Add zoom-* utilities (#20020)

Add tab-* utilities (#20022)

Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#19996)

Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#19996)

Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#19989)

Fixed

... (truncated)

Commits

8a14a71 4.3.1 (#20226)
73983e1 Fix 'Sourcemap is likely to be incorrect' warnings when using `@tailwindcss/v...
588bd73 4.3.0 (#20023)
d194d4c docs: fix various typos in comments and documentation (#19878)
db27049 fix(@tailwindcss/vite): include @variant in feature detection (#19966)
5a79990 Always resolve relative files, relative to the current .css file (#19965)
f3fdda2 fix(vite): avoid resolving JS plugins to browser CSS entries (#19949)
69ad7cc 4.2.4 (#19948)
685c19e Fix issue around resolving paths in @tailwindcss/vite (#19947)
2e3fa49 4.2.3 (#19944)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @tailwindcss/vite since your current version.

Updates @vitejs/plugin-react from 5.1.4 to 5.2.0

Release notes

Sourced from @vitejs/plugin-react's releases.

plugin-react@5.2.0

Add Vite 8 to peerDependencies range #1143

This plugin is compatible with Vite 8.

Changelog

Sourced from @vitejs/plugin-react's changelog.

5.2.0 (2026-03-12)

Add Vite 8 to peerDependencies range #1143

This plugin is compatible with Vite 8.

Commits

fda3a86 release: plugin-react@5.2.0
99ab1b6 feat(react): add Vite 8 to peer dependency (#1143)
See full diff in compare view

Updates vite from 7.3.2 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

v8.0.6

Please refer to CHANGELOG.md for details.

v8.0.5

Please refer to CHANGELOG.md for details.

v8.0.4

Please refer to CHANGELOG.md for details.

create-vite@8.0.3

Please refer to CHANGELOG.md for details.

v8.0.3

Please refer to CHANGELOG.md for details.

create-vite@8.0.2

Please refer to CHANGELOG.md for details.

v8.0.2

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

deps: reject UNC paths for launch-editor-middleware (#22571) (50b9512)

reject windows alternate paths (#22572) (dc245c7)

8.0.15 (2026-06-01)

Features

send 408 on request timeout (#22476) (c85c9ee)

update rolldown to 1.0.3 (#22538) (646dbed)

Bug Fixes

capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)

deps: update all non-major dependencies (#22511) (2686d7d)

dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)

glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)

optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)

resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22566) (3052a67)

Code Refactoring

correct logic in collectAllModules function (#22562) (6978a9c)

8.0.14 (2026-05-21)

Features

update rolldown to 1.0.2 (#22484) (96efc88)

Bug Fixes

deps: update all non-major dependencies (#22471) (98b8163)

dev: handle errors when sending messages to vite server (#22450) (e8e9a34)

html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)

optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22470) (7cb728e)

remove irrelevant commits from changelog (2c69495)

Code Refactoring

glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

f94df87 release: v8.0.16
dc245c7 fix: reject windows alternate paths (#22572)
50b9512 fix(deps): reject UNC paths for launch-editor-middleware (#22571)
8d1b019 release: v8.0.15
2686d7d fix(deps): update all non-major dependencies (#22511)
3052a67 chore(deps): update rolldown-related dependencies (#22566)
e3cfb9d fix(optimizer): close the rolldown bundle when write() rejects (#22528)
6978a9c refactor: correct logic in collectAllModules function (#22562)
646dbed feat: update rolldown to 1.0.3 (#22538)
85a0eff fix: capitalize error messages and remove spurious space in parse error (#22488)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

…d vite Removes [esbuild](https://github.com/evanw/esbuild). It's no longer used after updating ancestor dependencies [esbuild](https://github.com/evanw/esbuild), [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). These dependencies need to be updated together. Removes `esbuild` Updates `@tailwindcss/vite` from 4.2.1 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `@vitejs/plugin-react` from 5.1.4 to 5.2.0 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/plugin-react@5.2.0/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@5.2.0/packages/plugin-react) Updates `vite` from 7.3.2 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) --- updated-dependencies: - dependency-name: esbuild dependency-version: dependency-type: indirect - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:production - dependency-name: "@vitejs/plugin-react" dependency-version: 5.2.0 dependency-type: direct:development - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

cursor · 2026-06-12T20:31:30Z

PR Summary

Medium Risk
Major Vite upgrade changes dev/build bundling (Rolldown vs Rollup/esbuild), which can surface plugin or CSS pipeline regressions even though application code is untouched.

Overview
Updates web toolchain dependencies only (package.json / lockfile)—no app source changes.

Vite moves from 7.3.2 → 8.0.16, which swaps the default production bundler from Rollup/esbuild to Rolldown; the lockfile drops the old esbuild tree that came with Vite 7. @vitejs/plugin-react is bumped to 5.2.0 so it declares Vite 8 in peer dependencies. @tailwindcss/vite goes 4.2.1 → 4.3.1 (Vite 8–compatible peer range); resolved Tailwind stack in the lockfile follows that plugin (e.g. oxide/node 4.3.1, lightningcss 1.32.0).

Reviewers should treat this as validating npm run build, npm run dev, and vitest still pass under the new bundler and Tailwind integration in vite.config.ts.

^{Reviewed by Cursor Bugbot for commit 6046877. Bugbot is set up for automated code reviews on this repo. Configure here.}

socket-security · 2026-06-12T20:34:40Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/vite@7.3.2 ⏵ 8.0.16	⁺¹	⁺¹
npm/tailwindcss@4.2.1 ⏵ 4.3.1
npm/@tailwindcss/vite@4.2.1 ⏵ 4.3.1		⁺¹	⁺¹
npm/@vitejs/plugin-react@5.1.4 ⏵ 5.2.0

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update JavaScript code labels Jun 12, 2026

haasonsaas merged commit 468a288 into main Jun 13, 2026
13 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/web/multi-130087f7e5 branch June 13, 2026 01:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump esbuild, @tailwindcss/vite, @vitejs/plugin-react and vite in /web#108

chore(deps): bump esbuild, @tailwindcss/vite, @vitejs/plugin-react and vite in /web#108
haasonsaas merged 1 commit into
mainfrom
dependabot/npm_and_yarn/web/multi-130087f7e5

dependabot Bot commented on behalf of github Jun 12, 2026

Uh oh!

cursor Bot commented Jun 12, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 12, 2026

v4.3.1

Added

Fixed

Changed

v4.3.0

Added

Fixed

[4.3.1] - 2026-06-12

Added

Fixed

Changed

[4.3.0] - 2026-05-08

Added

Fixed

plugin-react@5.2.0

Add Vite 8 to peerDependencies range #1143

5.2.0 (2026-03-12)

Add Vite 8 to peerDependencies range #1143

v8.0.16

v8.0.15

v8.0.14

v8.0.13

v8.0.12

v8.0.11

v8.0.10

v8.0.9

v8.0.8

v8.0.7

v8.0.6

v8.0.5

v8.0.4

create-vite@8.0.3

v8.0.3

create-vite@8.0.2

v8.0.2

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

Uh oh!

cursor Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

socket-security Bot commented Jun 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cursor Bot commented Jun 12, 2026 •

edited

Loading