build(deps-dev): bump the development-dependencies group with 3 updates

[dependabot]

Bumps the development-dependencies group with 3 updates: esbuild, undici and yaml.

Updates esbuild from 0.19.4 to 0.19.5

Release notes

Sourced from esbuild's releases.

v0.19.5

• Fix a regression in 0.19.0 regarding paths in tsconfig.json (#3354)

  The fix in esbuild version 0.19.0 to process tsconfig.json aliases before the --packages=external setting unintentionally broke an edge case in esbuild's handling of certain tsconfig.json aliases where there are multiple files with the same name in different directories. This release adjusts esbuild's behavior for this edge case so that it passes while still processing aliases before --packages=external. Please read the linked issue for more details.

• Fix a CSS font property minification bug (#3452)

  This release fixes a bug where esbuild's CSS minifier didn't insert a space between the font size and the font family in the font CSS shorthand property in the edge case where the original source code didn't already have a space and the leading string token was shortened to an identifier:

  /* Original code */
  .foo { font: 16px"Menlo"; }
  /* Old output (with --minify) */
  .foo{font:16pxMenlo}
  /* New output (with --minify) */
  .foo{font:16px Menlo}

• Fix bundling CSS with asset names containing spaces (#3410)

  Assets referenced via CSS url() tokens may cause esbuild to generate invalid output when bundling if the file name contains spaces (e.g. url(image 2.png)). With this release, esbuild will now quote all bundled asset references in url() tokens to avoid this problem. This only affects assets loaded using the file and copy loaders.

• Fix invalid CSS url() tokens in @import rules (#3426)

  In the future, CSS url() tokens may contain additional stuff after the URL. This is irrelevant today as no CSS specification does this. But esbuild previously had a bug where using these tokens in an @import rule resulted in malformed output. This bug has been fixed.

• Fix browser + false + type: module in package.json (#3367)

  The browser field in package.json allows you to map a file to false to have it be treated as an empty file when bundling for the browser. However, if package.json contains "type": "module" then all .js files will be considered ESM, not CommonJS. Importing a named import from an empty CommonJS file gives you undefined, but importing a named export from an empty ESM file is a build error. This release changes esbuild's interpretation of these files mapped to false in this situation from ESM to CommonJS to avoid generating build errors for named imports.

• Fix a bug in top-level await error reporting (#3400)

  Using require() on a file that contains top-level await is not allowed because require() must return synchronously and top-level await makes that impossible. You will get a build error if you try to bundle code that does this with esbuild. This release fixes a bug in esbuild's error reporting code for complex cases of this situation involving multiple levels of imports to get to the module containing the top-level await.

• Update to Unicode 15.1.0

  The character tables that determine which characters form valid JavaScript identifiers have been updated from Unicode version 15.0.0 to the newly-released Unicode version 15.1.0. I'm not putting an example in the release notes because all of the new characters will likely just show up as little squares since fonts haven't been updated yet. But you can read https://www.unicode.org/versions/Unicode15.1.0/#Summary for more information about the changes.

  This upgrade was contributed by @​JLHwung.

Changelog

Sourced from esbuild's changelog.

0.19.5

• Fix a regression in 0.19.0 regarding paths in tsconfig.json (#3354)

  The fix in esbuild version 0.19.0 to process tsconfig.json aliases before the --packages=external setting unintentionally broke an edge case in esbuild's handling of certain tsconfig.json aliases where there are multiple files with the same name in different directories. This release adjusts esbuild's behavior for this edge case so that it passes while still processing aliases before --packages=external. Please read the linked issue for more details.

• Fix a CSS font property minification bug (#3452)

  This release fixes a bug where esbuild's CSS minifier didn't insert a space between the font size and the font family in the font CSS shorthand property in the edge case where the original source code didn't already have a space and the leading string token was shortened to an identifier:

  /* Original code */
  .foo { font: 16px"Menlo"; }
  /* Old output (with --minify) */
  .foo{font:16pxMenlo}
  /* New output (with --minify) */
  .foo{font:16px Menlo}

• Fix bundling CSS with asset names containing spaces (#3410)

  Assets referenced via CSS url() tokens may cause esbuild to generate invalid output when bundling if the file name contains spaces (e.g. url(image 2.png)). With this release, esbuild will now quote all bundled asset references in url() tokens to avoid this problem. This only affects assets loaded using the file and copy loaders.

• Fix invalid CSS url() tokens in @import rules (#3426)

  In the future, CSS url() tokens may contain additional stuff after the URL. This is irrelevant today as no CSS specification does this. But esbuild previously had a bug where using these tokens in an @import rule resulted in malformed output. This bug has been fixed.

• Fix browser + false + type: module in package.json (#3367)

  The browser field in package.json allows you to map a file to false to have it be treated as an empty file when bundling for the browser. However, if package.json contains "type": "module" then all .js files will be considered ESM, not CommonJS. Importing a named import from an empty CommonJS file gives you undefined, but importing a named export from an empty ESM file is a build error. This release changes esbuild's interpretation of these files mapped to false in this situation from ESM to CommonJS to avoid generating build errors for named imports.

• Fix a bug in top-level await error reporting (#3400)

  Using require() on a file that contains top-level await is not allowed because require() must return synchronously and top-level await makes that impossible. You will get a build error if you try to bundle code that does this with esbuild. This release fixes a bug in esbuild's error reporting code for complex cases of this situation involving multiple levels of imports to get to the module containing the top-level await.

• Update to Unicode 15.1.0

  The character tables that determine which characters form valid JavaScript identifiers have been updated from Unicode version 15.0.0 to the newly-released Unicode version 15.1.0. I'm not putting an example in the release notes because all of the new characters will likely just show up as little squares since fonts haven't been updated yet. But you can read https://www.unicode.org/versions/Unicode15.1.0/#Summary for more information about the changes.

  This upgrade was contributed by @​JLHwung.

Commits

• a7fcc43 publish 0.19.5 to npm
• 5870809 fix #3367: ignore ESM flag for disabled modules
• d5f397f fix #3354: tsconfig.json regression with paths
• 72b1e8b resolver: move IsExternal into PathPair
• b0eddea fix #3400: bug in top-level await error reporting
• 47fc80b fix #3426: improve invalid url() token parsing
• d6973b9 css: fix url token backtracking with leading space
• 30a43ec fix #3410: quote asset references in url tokens
• a579bd8 fix #3452: insert space in font when minifying
• cd91337 update go 1.20.7 => 1.20.10
• Additional commits viewable in compare view

Updates undici from 5.26.2 to 5.27.0

Release notes

Sourced from undici's releases.

v5.27.0

What's Changed

• Use sets and reusable TextEncoder/TextDecoder instances by @​kibertoad in nodejs/undici#2368
• feat: forward onRequestSent to handler by @​ronag in nodejs/undici#2375
• skip bundle test on node 16 by @​KhafraDev in nodejs/undici#2377
• fix windows CI by @​KhafraDev in nodejs/undici#2379

Full Changelog: nodejs/undici@v5.26.5...v5.27.0

v5.26.5

What's Changed

• Drop race condition in connect-timeout test by @​mcollina in nodejs/undici#2360
• Remove a couple of unnecessary async functions by @​kibertoad in nodejs/undici#2367
• Update namespace type with Fetch exports by @​Ethan-Arrowood in nodejs/undici#2361

Full Changelog: nodejs/undici@v5.26.4...v5.26.5

v5.26.4

What's Changed

• use esbuild define/hooks by @​KhafraDev in nodejs/undici#2342
• fix request's arrayBuffer returning uint8 instead of arraybuffer by @​KhafraDev in nodejs/undici#2344
• fix: skip readMore call if parser is null or undefined by @​iiAku in nodejs/undici#2346
• test: first attempt for flaky fix by @​metcoder95 in nodejs/undici#2337
• test: only include WebSocket in WPT Report where it's landed by @​panva in nodejs/undici#2351
• Update DispatchInterceptor.md by @​Uzlopak in nodejs/undici#2354
• fix: Avoid error for stream() being aborted by @​BobNobrain in nodejs/undici#2355
• fix names with esbuild by @​KhafraDev in nodejs/undici#2359

New Contributors

• @​iiAku made their first contribution in nodejs/undici#2346
• @​Uzlopak made their first contribution in nodejs/undici#2354
• @​BobNobrain made their first contribution in nodejs/undici#2355

Full Changelog: nodejs/undici@v5.26.3...v5.26.4

v5.26.3

No release notes provided.

Commits

• 41c253d 5.27.0
• 6df0fe0 fix windows CI (#2379)
• 3ec35ee skip bundle test on node 16 (#2377)
• 67e714d feat: forward onRequestSent to handler (#2375)
• 8050ec0 Use sets and reusable TextEncoder/TextDecoder instances (#2368)
• 9197790 Bumped v5.26.5
• c31bd88 Update namespace type with Fetch exports (#2361)
• 24db5d4 Remove a couple of unnecessary async functions (#2367)
• 63afd9b Drop race condition in connect-timeout test (#2360)
• dea70e2 Bumped v5.26.4
• Additional commits viewable in compare view

Updates yaml from 2.3.2 to 2.3.3

Release notes

Sourced from yaml's releases.

v2.3.3

• Do not throw error on malformed URI escape in tag (#498)

Commits

• e8576e8 2.3.3
• 3fb6c1f chore: Refresh lockfile
• 69d881c fix: Do not throw error on malformed URI escape in tag (#498)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[create-app-token-action-releaser]

🎉 This PR is included in version 1.5.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀