Bump esbuild from 0.21.5 to 0.27.3 in the npm_and_yarn group across 1 directory by dependabot[bot] · Pull Request #10 · mattglory/Flashstack

dependabot · 2026-02-22T10:30:15Z

Bumps the npm_and_yarn group with 1 update in the / directory: esbuild.

Updates esbuild from 0.21.5 to 0.27.3

Release notes

v0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

9129e00 publish 0.27.3 to npm
e20e411 small fix to release notes
0dc0f2d fix #4322: parse and print CSS @scope rules
55fe391 update firefox css gradient support
2c35297 update gradient lowering transform
9209e44 Update Go to 1.25.7 (#4388)
e8d861b close #4374: compat table for the using feature
19b8887 no longer need williamkapke/node-compat-table
7e44218 the kangax/compat-table repo moved to a new url
23b9338 run make update-compat-table
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Updated README.md to reflect new version and testnet status.

- Implement Clarigen v4.0.1 for type-safe contract testing - Add 60 comprehensive tests covering core, admin, and security features - Configure Vitest with coverage reporting - Create TESTING.md and TESTING_SUMMARY.md documentation - Update README with testing section, prerequisites, and installation - Add custom Clarity matchers for type-safe assertions All tests passing. Ready for audit phase.

Scaffold Next.js 14 app in web/ with @stacks/connect v8 wallet integration, @stacks/transactions v7 read-only contract calls against the live testnet deployment, and a dark-themed dashboard showing protocol stats with 30s auto-refresh. Polish README with integration guide, Stacks JS code snippets, and streamlined project documentation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add nul and tmpclaude-* patterns to root .gitignore to prevent temporary files from appearing in git status. Track web/.gitignore for Vercel build artifacts. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Fetch fee rate dynamically from flashstack-core instead of hardcoding - Add total-operations and total-volume tracking data vars - Add remove-vault admin function for vault management - Add is-vault-authorized and get-owner read-only functions - Add apy-boost calculation to calculate-leverage-benefit - Rename mock functions for clarity (mock-deposit-to-vault, etc.) - Improve variable naming throughout (user-capital, flash-fees, etc.) - Add comprehensive inline documentation and TODO markers Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Bug fix: sbtc-token mint/burn now checks contract-caller (not tx-sender) for flash-minter authorization. This fixes cross-contract flash mint calls where tx-sender is the user, not the calling contract. Tests added (86 total, up from 60): - Successful end-to-end flash mint execution - Flash mint result data validation - Stats accumulation after successful mints - Zero sBTC supply after mint-burn cycle - Multiple sequential loans with incremental IDs - Admin transfer revokes old admin privileges - Boundary value collateral tests (exact boundary, one-below) - Single loan limit boundary tests - sbtc-token mint/burn/transfer authorization - SNP receiver v3 leverage benefit calculator - SNP receiver v3 stats and owner queries Also: Register snp-flashstack-receiver-v3 in Clarinet.toml, fix CRLF line endings in contract files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

New page at /flash-loan with: - Loan amount input with real-time fee calculation preview - Receiver contract dropdown (8 deployed receivers) - Collateral check warning when exceeding max flash amount - Transaction submission via @stacks/connect request API - Success/error status with Explorer link - Protocol stats display (fee rate, max flash, total mints) Also: - Sidebar now uses usePathname for active route highlighting - Header title updates dynamically per page - Receiver contracts list added to config Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CI: Replace stub pipeline with real test execution and frontend build - Contract tests run via npm test (86 tests) - Frontend build verification via npm run build README: - Update test count: 60 -> 86 - Update contract count: 12 -> 15 - Add flash loan execution UI to frontend features - Add live deployment link (flashstack.vercel.app) - Add SNP receiver v3 to receiver examples table - Expand test coverage description Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove `as const` from RECEIVER_CONTRACTS array to prevent literal type narrowing that caused type mismatch in FlashLoanForm. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Both CI jobs failed because package-lock.json was in .gitignore. npm ci requires lock files to exist. Now tracking both root and web/ lock files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Track settings/Devnet.toml (standard Clarinet test accounts, required for simnet initialization in CI) - Add .gitattributes to enforce LF line endings for .clar files (Clarinet rejects CRLF) - Fix flashstack-test.ts simnet reference (must be inside test block, not at module level) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Prevents Next.js 14→15/16, React 18→19, and esbuild major/minor upgrade PRs that require migration work. Allows patch and security updates through automatically. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Bumps [next](https://github.com/vercel/next.js) from 14.2.28 to 14.2.35. - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.2.28...v14.2.35) --- updated-dependencies: - dependency-name: next dependency-version: 14.2.35 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Use wildcard ignore to prevent any major version PRs across all dependencies. Only patch and minor updates will be proposed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…-14.2.35 Bump next from 14.2.28 to 14.2.35 in /web

Bumps the npm_and_yarn group with 1 update in the / directory: [esbuild](https://github.com/evanw/esbuild). Updates `esbuild` from 0.21.5 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.27.3) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

mattglory and others added 18 commits January 8, 2026 03:29

Update README.md

f4a98bb

Updated README.md to reflect new version and testnet status.

v1.3: Flash loans working with conservative limits

0a53e28

Clean up temp files and update gitignore

6d9edcb

Add nul and tmpclaude-* patterns to root .gitignore to prevent temporary files from appearing in git status. Track web/.gitignore for Vercel build artifacts. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Merge branch 'feature/receiver-v3-improvements'

cfaefd1

Fix TypeScript build error in receiver config

cf92ac3

Remove `as const` from RECEIVER_CONTRACTS array to prevent literal type narrowing that caused type mismatch in FlashLoanForm. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fix CI: track package-lock.json files for npm ci

a37c9bc

Both CI jobs failed because package-lock.json was in .gitignore. npm ci requires lock files to exist. Now tracking both root and web/ lock files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add Dependabot config to block major version upgrades

259d4e7

Prevents Next.js 14→15/16, React 18→19, and esbuild major/minor upgrade PRs that require migration work. Allows patch and security updates through automatically. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Block all major version upgrades in Dependabot

ff9a8f0

Use wildcard ignore to prevent any major version PRs across all dependencies. Only patch and minor updates will be proposed. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Merge pull request #8 from mattglory/dependabot/npm_and_yarn/web/next…

5928466

…-14.2.35 Bump next from 14.2.28 to 14.2.35 in /web

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 22, 2026

mattglory force-pushed the main branch from a394521 to 0831f9e Compare April 12, 2026 18:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump esbuild from 0.21.5 to 0.27.3 in the npm_and_yarn group across 1 directory#10

Bump esbuild from 0.21.5 to 0.27.3 in the npm_and_yarn group across 1 directory#10
dependabot[bot] wants to merge 18 commits intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-d4a1a5d767

dependabot bot commented on behalf of github Feb 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.27.3

Changelog: 2024

0.24.2

0.24.1

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot bot commented on behalf of github Feb 22, 2026 •

edited

Loading