Bump the npm_and_yarn group across 1 directory with 6 updates

[dependabot]

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
aws-cdk-lib	2.163.1	2.204.0
esbuild	0.20.2	0.25.5
tsx	4.19.1	4.20.3
@vitejs/plugin-react	4.3.3	4.6.0
vite	5.4.10	7.0.2
@babel/runtime	7.25.9	7.27.6

Updates aws-cdk-lib from 2.163.1 to 2.204.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.204.0

Features

• apigatewayv2: add stage variables support for HTTP and WebSocket API (#34548) (965e055)
• cloudwatch: add id and visible properties for CloudWatch Metric (#34870) (879afd6), closes #19876
• report feature flags into Cloud Assembly (#34884) (f70e46c), closes #34798
• region-info: add support for region eusc-de (#34860)

Bug Fixes

• ecr-assets: incorrect handling of nested excludes in .dockerignore (#34810) (8328c79), closes #13636 #13636
• "Invalid Assembly Manifest" when used with CLI 2.1017.0 and 2.1018.0 (#34880) (741b0a7), closes aws/aws-cdk#34798

---

Alpha modules (2.204.0-alpha.0)

Features

• lambda-python-alpha: support uv (#33880) (ac6f136), closes #31238 #32413

v2.203.1

Bug Fixes

• "Invalid Assembly Manifest" when used with CLI 2.1017.0 and 2.1018.0 (#34880) (32ee050), closes aws/aws-cdk#34798

---

Alpha modules (2.203.1-alpha.0)

v2.203.0

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• cloudformation: Some L1 resources experienced breaking changes due to updated CloudFormation resources. Please check the notes for each specific module for more information.

• aws-cdk-lib.aws_kendra.CfnDataSource.TemplateConfigurationProperty: template property here has changed from string to json

Features

• rds: instance engine lifecycle support (#34719) (bab7413), closes #34492
• report feature flag configuration into Cloud Assembly (#34798) (76af7dc)
• backup: add support for ScheduleExpressionTimezone (#34603) (8ceea43), closes #34532
• cloudformation: update L1 CloudFormation resource definitions (#34839) (4c75889)
• cloudwatch: add account id field for log query and metric widgets to support cross account visibility (#34793) (ac4d09d), closes #26105
• lambda: function log removal policy (#34723) (0388483), closes #34669
• pipelines: cdk-assets version is configurable (#34802) (a361c9c)
• update L1 CloudFormation resource definitions (#34792) (074cb8c)

Bug Fixes

• codecov: update codecov-upload.yml (#34845) (8055016), closes /github.com/aws/aws-cdk/blob/main/codecov.yml#L35
• codecov: update codecov-upload.yml action to upload report with correct path (#34814) (705e76b)
• stepfunctions-tasks: properly serialize CallAwsServiceCrossRegion Lambda responses (#34843) (a4b15df), closes #34768

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.204.0-alpha.0 (2025-07-04)

Features

• lambda-python-alpha: support uv (#33880) (ac6f136), closes #31238 #32413

2.203.1-alpha.0 (2025-07-02)

2.203.0-alpha.0 (2025-07-01)

Features

• ec2: support for client route enforcement for client VPN endpoint (#34405) (063f4e7)

Bug Fixes

• ec2: don't use inferenceAccellerators in the constructors if not needed (#34618) (054c6c5), closes #33505 aws/aws-cdk#33505 #34610

2.202.0-alpha.0 (2025-06-20)

Features

• amplify: add compute role support for Amplify branches (#34708) (817a21a)
• amplify-alpha: support custom response headers in monorepo structures (#31771) (aea1372), closes #31758

2.201.0-alpha.0 (2025-06-12)

Features

• amplify: add skew protection feature for Amplify branches (#34656) (8808998)
• bedrock: adding bedrock l2 construct features (#34065) (a028927)
• ec2: add interface VPC endpoint for DSQL (#34487) (3e53c2c)
• ec2: support Firehose IDeliveryStream as flow log destination (#34596) (cdfe6e7), closes #33883 #33757
• ec2: volume initialization rate for EBS volume (#34570) (527d483)

Reverts

• ec2: support Firehose IDeliveryStream as flow log destination (#34665) (b77bd0e), closes aws/aws-cdk#34596

2.200.2-alpha.0 (2025-06-11)

... (truncated)

Commits

• 8b396a3 chore: update analytics metadata blueprints
• 965e055 feat(apigatewayv2): add stage variables support for HTTP and WebSocket API (#...
• c3559b5 chore(region-info): eusc-de-east-1 (#34860)
• 879afd6 feat(cloudwatch): add id and visible properties for CloudWatch Metric (#34870)
• 8328c79 fix(ecr-assets): incorrect handling of nested excludes in .dockerignore (#34810)
• fb4730f Merge branch 'main' into merge-back/2.203.1
• f70e46c feat: report feature flags into Cloud Assembly (#34884)
• 07a8698 chore: update feature flag documentation (#34838)
• 32ee050 fix: "Invalid Assembly Manifest" when used with CLI 2.1017.0 and 2.1018.0 (#3...
• 741b0a7 fix: "Invalid Assembly Manifest" when used with CLI 2.1017.0 and 2.1018.0 (#3...
• Additional commits viewable in compare view

Updates esbuild from 0.20.2 to 0.25.5

Release notes

Sourced from esbuild's releases.

v0.25.5

• Fix a regression with browser in package.json (#4187)

  The fix to #4144 in version 0.25.3 introduced a regression that caused browser overrides specified in package.json to fail to override relative path names that end in a trailing slash. That behavior change affected the [email protected] package. This regression has been fixed, and now has test coverage.

• Add support for certain keywords as TypeScript tuple labels (#4192)

  Previously esbuild could incorrectly fail to parse certain keywords as TypeScript tuple labels that are parsed by the official TypeScript compiler if they were followed by a ? modifier. These labels included function, import, infer, new, readonly, and typeof. With this release, these keywords will now be parsed correctly. Here's an example of some affected code:

  type Foo = [
    value: any,
    readonly?: boolean, // This is now parsed correctly
  ]

• Add CSS prefixes for the stretch sizing value (#4184)

  This release adds support for prefixing CSS declarations such as div { width: stretch }. That CSS is now transformed into this depending on what the --target= setting includes:

  div {
    width: -webkit-fill-available;
    width: -moz-available;
    width: stretch;
  }

v0.25.4

• Add simple support for CORS to esbuild's development server (#4125)

  Starting with version 0.25.0, esbuild's development server is no longer configured to serve cross-origin requests. This was a deliberate change to prevent any website you visit from accessing your running esbuild development server. However, this change prevented (by design) certain use cases such as "debugging in production" by having your production website load code from localhost where the esbuild development server is running.

  To enable this use case, esbuild is adding a feature to allow Cross-Origin Resource Sharing (a.k.a. CORS) for simple requests. Specifically, passing your origin to the new cors option will now set the Access-Control-Allow-Origin response header when the request has a matching Origin header. Note that this currently only works for requests that don't send a preflight OPTIONS request, as esbuild's development server doesn't currently support OPTIONS requests.

  Some examples:

  • CLI:

    esbuild --servedir=. --cors-origin=https://example.com
    

  • JS:

    const ctx = await esbuild.context({})
    await ctx.serve({
      servedir: '.',
      cors: {

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

• Fix regression with --define and import.meta (#4010, #4012, #4013)

  The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

  This fix was contributed by @​sapphi-red.

0.24.1

• Allow es2024 as a target in tsconfig.json (#4004)

  TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:

  {
    "compilerOptions": {
      "target": "ES2024"
    }
  }

  As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

  This fix was contributed by @​billyjanitsch.

• Allow automatic semicolon insertion after get/set

  This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:

  class Foo {
    get
    *x() {}
    set
    *y() {}
  }

  The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.

• Allow quoted property names in --define and --pure (#4008)

  The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

• ea453bf publish 0.25.5 to npm
• 223ddc6 fix #4187: browser package.json regression
• b2c8251 fix #4192: typescript tuple label parser edge case
• 28cf2f3 fix #4184: css prefixes for stretch
• bee1b09 fix comment indents
• 9ddfe5f run make update-compat-table
• c339f34 fix a misplaced comment
• 218d29e publish 0.25.4 to npm
• e66cd0b dev server: simple support for CORS requests (#4171)
• 8bf3368 js api: validate some options as arrays of strings
• Additional commits viewable in compare view

Updates tsx from 4.19.1 to 4.20.3

Release notes

Sourced from tsx's releases.

v4.20.3

4.20.3 (2025-06-13)

Bug Fixes

• revert v4.20 changes (dadcf27)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.20.2

4.20.2 (2025-06-12)

Bug Fixes

• support ambiguous package (#79) (c188268)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.20.1

4.20.1 (2025-06-11)

Bug Fixes

• json: handle keys with special characters (9bd2546)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.20.0

4.20.0 (2025-06-11)

Bug Fixes

... (truncated)

Commits

• dadcf27 fix: revert v4.20 changes
• 2d1aaee chore: upgrade manten
• c188268 fix: support ambiguous package (#79)
• 602f1b1 chore: debug to accept levels (#77)
• 5172c47 test: log node-pty failure stdout
• 1e8f17b refactor: node-pty test code
• 9bd2546 fix(json): handle keys with special characters
• e97fe67 test: failed pty tests logs
• 532c50a tests: fix Windows tests
• ec316d3 feat: support latest Node versions
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 4.3.3 to 4.6.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

[email protected]

Add raw Rolldown support

This plugin only worked with Vite. But now it can also be used with raw Rolldown. The main purpose for using this plugin with Rolldown is to use react compiler.

[email protected]

Suggest @vitejs/plugin-react-oxc if rolldown-vite is detected #491

Emit a log which recommends @vitejs/plugin-react-oxc when rolldown-vite is detected to improve performance and use Oxc under the hood. The warning can be disabled by setting disableOxcRecommendation: false in the plugin options.

Use optimizeDeps.rollupOptions instead of optimizeDeps.esbuildOptions for rolldown-vite #489

This suppresses the warning about optimizeDeps.esbuildOptions being deprecated in rolldown-vite.

Add Vite 7-beta to peerDependencies range #497

React plugins are compatible with Vite 7, this removes the warning when testing the beta.

[email protected]

Add explicit semicolon in preambleCode #485

This fixes an edge case when using HTML minifiers that strips line breaks aggressively.

[email protected]

Add filter for rolldown-vite #470

Added filter so that it is more performant when running this plugin with rolldown-powered version of Vite.

Skip HMR for JSX files with hooks #480

This removes the HMR warning for hooks with JSX.

[email protected]

Fix type issue when using moduleResolution: "node" in tsconfig #462

[email protected]

Make compatible with rolldown-vite

This plugin is now compatible with rolldown-powered version of Vite. Note that currently the __source property value position might be incorrect. This will be fixed in the near future.

[email protected]

Add reactRefreshHost option

Add reactRefreshHost option to set a React Fast Refresh runtime URL prefix. This is useful in a module federation context to enable HMR by specifying the host application URL in the Vite config of a remote application. See full discussion here: module-federation/vite#183

export default defineConfig({
</tr></table> 

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

4.6.0 (2025-06-23)

Add raw Rolldown support

This plugin only worked with Vite. But now it can also be used with raw Rolldown. The main purpose for using this plugin with Rolldown is to use react compiler.

4.5.2 (2025-06-10)

Suggest @vitejs/plugin-react-oxc if rolldown-vite is detected #491

Emit a log which recommends @vitejs/plugin-react-oxc when rolldown-vite is detected to improve performance and use Oxc under the hood. The warning can be disabled by setting disableOxcRecommendation: true in the plugin options.

Use optimizeDeps.rollupOptions instead of optimizeDeps.esbuildOptions for rolldown-vite #489

This suppresses the warning about optimizeDeps.esbuildOptions being deprecated in rolldown-vite.

Add Vite 7-beta to peerDependencies range #497

React plugins are compatible with Vite 7, this removes the warning when testing the beta.

4.5.1 (2025-06-03)

Add explicit semicolon in preambleCode #485

This fixes an edge case when using HTML minifiers that strips line breaks aggressively.

4.5.0 (2025-05-23)

Add filter for rolldown-vite #470

Added filter so that it is more performant when running this plugin with rolldown-powered version of Vite.

Skip HMR for JSX files with hooks #480

This removes the HMR warning for hooks with JSX.

4.4.1 (2025-04-19)

Fix type issue when using moduleResolution: "node" in tsconfig #462

4.4.0 (2025-04-15)

Make compatible with rolldown-vite

This plugin is now compatible with rolldown-powered version of Vite. Note that currently the __source property value position might be incorrect. This will be fixed in the near future.

4.4.0-beta.2 (2025-04-15)

Add reactRefreshHost option

... (truncated)

Commits

• 12bd153 release: [email protected]
• 572bb94 fix(deps): update all non-major dependencies (#515)
• 552af8f feat(react): add raw rolldown support (#513)
• dd5bd78 fix(deps): update all non-major dependencies (#498)
• 4951c90 docs: typo in CHANGELOG.md (#504)
• bfb45ad release: [email protected]
• 6ea9398 feat: add Vite 7-beta to peerDependencies range (#497)
• 6db7e7c fix(deps): update all non-major dependencies (#469)
• c450133 feat: suggest vite-plugin-react-oxc when using rolldown-vite (#491)
• 4bec551 fix: use optimizeDeps.rollupOptions for rolldown-vite (#489)
• Additional commits viewable in compare view

Updates vite from 5.4.10 to 7.0.2

Release notes

Sourced from vite's releases.

v7.0.2

Please refer to CHANGELOG.md for details.

v7.0.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.0.0

Please refer to CHANGELOG.md for details.

v7.0.0-beta.2

Please refer to CHANGELOG.md for details.

v7.0.0-beta.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.0.0-beta.0

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.0.2 (2025-07-04)

Bug Fixes

• css: resolve relative paths in sass, revert #20300 (#20349) (db8bd41)

7.0.1 (2025-07-03)

Bug Fixes

• css: skip resolving resolved paths in sass (#20300) (ac528a4)
• deps: update all non-major dependencies (#20324) (3e81af3)
• types: add a global interface for Worker (#20243) (37bdfc1)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#20323) (30d2f1b)
• fix typos and grammatical errors across documentation and comments (#20337) (c1c951d)
• group commits by category in changelog (#20310) (41e83f6)
• rearrange 7.0 changelog (#20280) (eafd28a)

7.0.0 (2025-06-24)

Today, we're excited to announce the release of the next Vite major:

• Vite 7.0 announcement blog post
• Docs (translations: 简体中文, 日本語, Español, Português, 한국어, Deutsch, فارسی)
• Migration Guide

⚠ BREAKING CHANGES

• ssr: don't access Object variable in ssr transformed code (#19996)
• remove experimental.skipSsrTransform option (#20038)
• remove HotBroadcaster (#19988)
• css: always use sass compiler API (#19978)
• bump build.target and name it baseline-widely-available (#20007)
• bump required node version to 20.19+, 22.12+ and remove cjs build (#20032)
• css: remove sass legacy API support (#19977)
• remove deprecated HotBroadcaster related types (#19987)
• remove deprecated no-op type only properties (#19985)
• remove node 18 support (#19972)
• remove deprecated hook-level enforce/transform from transformIndexHtml hook (#19349)
• remove deprecated splitVendorChunkPlugin (#19255)

Features

• types: use terser types from terser package (#20274) (a5799fa)
• apply some middlewares before configurePreviewServer hook (#20224) (b989c42)
• apply some middlewares before configureServer hook (#20222) (f5cc4c0)
• add base option to import.meta.glob (#20163) (253d6c6)

... (truncated)

Commits

• d6464bc release: v7.0.2
• db8bd41 fix(css): resolve relative paths in sass, revert #20300 (#20349)
• 0badf64 release: v7.0.1
• 41e83f6 chore: group commits by category in changelog (#20310)
• c1c951d chore: fix typos and grammatical errors across documentation and comments (#2...
• 3e81af3 fix(deps): update all non-major dependencies (#20324)
• 30d2f1b chore(deps): update rolldown-related dependencies (#20323)
• ac528a4 fix(css): skip resolving resolved paths in sass (#20300)
• 37bdfc1 fix(types): add a global interface for Worker (#20243)
• eafd28a chore: rearrange 7.0 changelog (#20280)
• Additional commits viewable in compare view

Updates vite from 5.4.10 to 7.0.2

Release notes

Sourced from vite's releases.

v7.0.2

Please refer to CHANGELOG.md for details.

v7.0.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.0.0

Please refer to CHANGELOG.md for details.

v7.0.0-beta.2

Please refer to CHANGELOG.md for details.

v7.0.0-beta.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.0.0-beta.0

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.0.2 (2025-07-04)

Bug Fixes

• css: resolve relative paths in sass, revert #20300 (#20349) (db8bd41)

7.0.1 (2025-07-03)

Bug Fixes

• css: skip resolving resolved paths in sass (#20300) (ac528a4)
• deps: update all non-major dependencies (#20324) (3e81af3)
• types: add a global interface for Worker (#20243) (37bdfc1)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#20323) (30d2f1b)
• fix typos and grammatical errors across documentation and comments (#20337) (c1c951d)
• group commits by category in changelog (#20310) (41e83f6)
• rearrange 7.0 changelog (#20280) (eafd28a)

7.0.0 (2025-06-24)

Today, we're excited to announce the release of the next Vite major:

• Vite 7.0 announcement blog post
• Docs (translations: 简体中文, 日本語, Español, Português, 한국어, Deutsch, فارسی)
• Migration Guide

⚠ BREAKING CHANGES

• ssr: don't access Object variable in ssr transformed code (#19996)
• remove experimental.skipSsrTransform option (#20038)
• remove HotBroadcaster (#19988)
• css: always use sass compiler API (#19978)
• bump build.target and name it baseline-widely-available (#20007)
• bump required node version to 20.19+, 22.12+ and remove cjs build (#20032)
• css: remove sass legacy API support (#19977)
• remove deprecated HotBroadcaster related types (#19987)
• remove deprecated no-op type only properties (#19985)
• remove node 18 support (#19972)
• remove deprecated hook-level enforce/transform from transformIndexHtml hook (#19349)
• remove deprecated splitVendorChunkPlugin (#19255)

Features

• types: use terser types from terser package (#20274) (a5799fa)
• apply some middlewares before configurePreviewServer hook (#20224) (b989c42)
• apply some middlewares before configureServer hook (#20222) (f5cc4c0)
• add base option to import.meta.glob (#20163) (253d6c6)

... (truncated)

Commits

• d6464bc release: v7.0.2
• db8bd41 fix(css): resolve relative paths in sass, revert #20300 (#20349)
• 0badf64 release: v7.0.1
• 41e83f6 chore: group commits by category in changelog (#20310)
• c1c951d chore: fix typos and grammatical errors across documentation and comments (#2...
• 3e81af3 fix(deps): update all non-major dependencies (#20324)
• 30d2f1b chore(deps): update rolldown-related dependencies (#20323)
• ac528a4 fix(css): skip resolving resolved paths in sass (#20300)
• 37bdfc1 fix(types): add a global interface for Worker (#20243)
• eafd28a chore: rearrange 7.0 changelog (#20280)
• Additional commits viewable in compare view

Updates @babel/runtime from 7.25.9 to 7.27.6

Release notes

Sourced from @​babel/runtime's releases.

v7.27.6 (2025-06-05)

🐛 Bug Fix

• babel-helpers, babel-plugin-transform-async-generator-functions, babel-plugin-transform-regenerator, babel-preset-env, babel-runtime-corejs3
  • #17366 fix: finally causes unexpected return value (@​liuxingbaoyu)
• babel-generator, babel-parser, babel-types
  • #17357 Ensure syntactic ordering when visiting array-type AST nodes (@​JLHwung)

Committers: 3

• Huáng Jùnliàng (@​JLHwung)
• Ingvar Stepanyan (@​RReverser)
• @​liuxingbaoyu

v7.27.5 (2025-06-03)

Thanks @​NullVoxPopuli for your first PR!

🐛 Bug Fix

• babel-plugin-transform-regenerator
  • #17359 fix: Unexpected infinite loop with regenerator for try (@​liuxingbaoyu)
• Other
  • #17349 Map ESLint's sourceType: commonjs to script (@​JLHwung)

💅 Polish

• babel-parser
  • #17333 Improve using declaration errors (@​JLHwung)

Committers: 4

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• @​NullVoxPopuli
• @​liuxingbaoyu

v7.27.4 (2025-05-30)

👓 Spec Compliance

• babel-parser, babel-plugin-proposal-explicit-resource-management
  • #17323 Disallow using in bare case statement (@​JLHwung)

💅 Polish

• babel-par...

  Description has been truncated