Update Npm non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@vitest/coverage-v8 (source)	4.0.7 -> 4.0.8
@vitest/ui (source)	4.0.7 -> 4.0.8
@vitest/web-worker (source)	4.0.7 -> 4.0.8
cypress (source)	15.5.0 -> 15.6.0
esbuild	0.25.12 -> 0.27.0
pnpm (source)	10.20.0 -> 10.21.0
rollup (source)	4.52.5 -> 4.53.2
vite (source)	7.1.12 -> 7.2.2
vitest (source)	4.0.7 -> 4.0.8

---

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v4.0.8

Compare Source

   🐞 Bug Fixes

• Workaround noExternal merging bug on Vite 6  -  by @​hi-ogawa in #​8950 (bcb13)
• Missed context.d.ts file  -  by @​termorey in #​8965 (9044d)
• Incorrect error message for non-awaited expect.element()  -  by @​StyleShit in #​8954 (9638d)
• browser: Cleanup frame-ancestors from CSP header at coverage middleware  -  by @​userquin in #​8941 (1f730)
• deps: Update all non-major dependencies  -  by @​sheremet-va in #​8636 (da8b9)
• forks: Do not fail with Windows Defender enabled  -  by @​sheremet-va in #​8967 (c79f4)
• runner: Properly encode Uint8Array body in annotations  -  by @​Livan-pro in #​8951 (997ca)
• spy: Copy static properties if spy is initialised with vi.fn(), fix types for vi.spyOn(obj, class)  -  by @​sheremet-va in #​8956 (75e7f)
• webdriverio: When no argument is passed to the .click interaction command, the webdriver command should also have no argument  -  by @​julienw in #​8937 (069e6)

    View changes on GitHub

cypress-io/cypress (cypress)

v15.6.0

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-6-0

evanw/esbuild (esbuild)

v0.27.0

Compare Source

This release deliberately contains backwards-incompatible changes. To avoid automatically picking up releases like this, you should either be pinning the exact version of esbuild in your package.json file (recommended) or be using a version range syntax that only accepts patch upgrades such as ^0.26.0 or ~0.26.0. See npm's documentation about semver for more information.

• Use Uint8Array.fromBase64 if available (#​4286)

  With this release, esbuild's binary loader will now use the new Uint8Array.fromBase64 function unless it's unavailable in the configured target environment. If it's unavailable, esbuild's previous code for this will be used as a fallback. Note that this means you may now need to specify target when using this feature with Node (for example --target=node22) unless you're using Node v25+.

• Update the Go compiler from v1.23.12 to v1.25.4 (#​4208, #​4311)

  This raises the operating system requirements for running esbuild:

  • Linux: now requires a kernel version of 3.2 or later
  • macOS: now requires macOS 12 (Monterey) or later

v0.26.0

Compare Source

• Enable trusted publishing (#​4281)

  GitHub and npm are recommending that maintainers for packages such as esbuild switch to trusted publishing. With this release, a VM on GitHub will now build and publish all of esbuild's packages to npm instead of me. In theory.

  Unfortunately there isn't really a way to test that this works other than to do it live. So this release is that live test. Hopefully this release is uneventful and is exactly the same as the previous one (well, except for the green provenance attestation checkmark on npm that happens with trusted publishing).

pnpm/pnpm (pnpm)

v10.21.0

Compare Source

rollup/rollup (rollup)

v4.53.2

Compare Source

2025-11-10

Bug Fixes

• Do not throw when using invalid escape sequences in template literals (#​6177)

Pull Requests

• #​6177: handle TemplateElement with null cooked value (@​TrickyPi)

v4.53.1

Compare Source

2025-11-07

Bug Fixes

• Fix install script (#​6172)

Pull Requests

• #​6172: fix: move patch-package from postinstall to prepare script (@​mshima)

v4.53.0

Compare Source

2025-11-07

Features

• Improve rendering performance by caching generated variable names (#​5947)

Pull Requests

• #​5947: refactor: store safe variable names in cache for subsequent usage (@​Aslemammad, @​lukastaegert, @​Service account user)
• #​6149: chore(deps): update dependency vite to v7.1.11 [security] (@​renovate[bot], @​Service account user)
• #​6151: fix(deps): update swc monorepo (major) (@​renovate[bot], @​Service account user)
• #​6152: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​Service account user)
• #​6153: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​Service account user)
• #​6155: Fix tests: Do not swallow warnings for multi-format tests (@​lukastaegert, @​Service account user)
• #​6159: chore(deps): update dependency eslint-plugin-unicorn to v62 (@​renovate[bot])
• #​6160: chore(deps): update github artifact actions (major) (@​renovate[bot])
• #​6161: fix(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)
• #​6164: chore(deps): update dependency @​rollup/plugin-alias to v6 (@​renovate[bot])
• #​6165: chore(deps): update dependency @​rollup/plugin-commonjs to v29 (@​renovate[bot])
• #​6166: fix(deps): update swc monorepo (major) (@​renovate[bot], @​lukastaegert)
• #​6167: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)

vitejs/vite (vite)

v7.2.2

Compare Source

Bug Fixes

• revert "refactor: use fs.cpSync (#​21019)" (#​21081) (728c8ee)

v7.2.1

Compare Source

Bug Fixes

• worker: some worker asset was missing (#​21074) (82d2d6c)

Code Refactoring

• build: rename indexOfMatchInSlice to findPreloadMarker (#​21054) (f83264f)

v7.2.0

Compare Source

Bug Fixes

• css: fallback to sass when sass-embedded platform binary is missing (#​21002) (b1fd616)
• module-runner: make getBuiltins response JSON serializable (#​21029) (ad5b3bf)
• types: add undefined to optional properties for exactOptionalProperties type compatibility (#​21040) (2833c55)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#​21047) (e3a6a83)

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.