Bump picomatch, @vitejs/plugin-react and sass

[dependabot]

Bumps picomatch to 4.0.5 and updates ancestor dependencies picomatch, @vitejs/plugin-react and sass. These dependencies need to be updated together.

Updates picomatch from 2.3.1 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

• fix: preserve all branches when rewriting risky repeated extglobs by @​MerlijnW70 in micromatch/picomatch#182
• fix: honor the windows option when matching basenames by @​MerlijnW70 in micromatch/picomatch#183

New Contributors

• @​MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144

New Contributors

• @​Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

3.0.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@3.0.1...3.0.2

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

• Changelogs are for humans, not machines.
• There should be an entry for every single version.
• The same types of changes should be grouped.
• Versions and sections should be linkable.
• The latest version comes first.
• The release date of each versions is displayed.
• Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

• Added for new features.
• Changed for changes in existing functionality.
• Deprecated for soon-to-be removed features.
• Removed for now removed features.
• Fixed for any bug fixes.
• Security in case of vulnerabilities.

4.0.0 (2024-02-07)

Fixes

• Fix bad text values in parse #126, thanks to @​connor4312

Changed

• Remove process global to work outside of node #129, thanks to @​styfle
• Add sideEffects to package.json #128, thanks to @​frandiox
• Removed os, make compatible browser environment. See #124, thanks to @​gwsbhqt

3.0.1

Fixes

... (truncated)

Commits

• 4f41a8e 4.0.5
• 02cfc1b Update .verb.md and run verb to generate README documentation
• cc52ff6 Only run the upload code coverage step for 1 matrix permutation
• 6d426d7 Allow workflow to continue if the code coverage step to fails
• a00b954 Merge branch 'codeql-coverage'
• 9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
• 648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
• 70e6485 Configure code coverage upload for CodeQL
• ab8bc4d fix: honor the windows option when matching basenames
• 6289307 fix: preserve all branches when rewriting risky repeated extglobs
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 1.3.2 to 6.0.4

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

plugin-react@6.0.3

No release notes provided.

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
</tr></table> 

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

6.0.3 (2026-06-23)

6.0.2 (2026-05-14)

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitejs/plugin-react since your current version.

Updates sass from 1.63.3 to 1.102.0

Release notes

Sourced from sass's releases.

Dart Sass 1.102.0

To install Sass 1.102.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.7

To install Sass 1.101.7, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.6

To install Sass 1.101.6, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.5

To install Sass 1.101.5, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.4

To install Sass 1.101.4, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

... (truncated)

Changelog

Sourced from sass's changelog.

1.102.0

• Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

1.101.7

• No user-visible changes.

1.101.6

• No user-visible changes.

1.101.5

• No user-visible changes.

1.101.4

• Avoid emitting rgb() or rgba() functions with non-percent decimal channels. Older browsers only support integer values or (potentially decimal) percentages for these functions, so in order to preserve backwards-compatibility while retaining full precision for modern browsers, legacy colors that contain at least one non-integer channel will now use percentages for their channels (for example, rgb(0%, 100%, 50%) rather than rgb(0, 255, 127.5)).

• Fix a bug where the values of plain-CSS if() expressions were emitted using their meta.inspect() format rather than their CSS serialization format.

1.101.3

• No user-visible changes.

1.101.2

• Fix a bug where the deprecation warning for vendor-prefixed expression() functions would incorrectly indicate whether or not the function would be invalid Sass in Dart Sass 2.0.0.

1.101.1

• Sass stack trace entries are now always either absolute URLs, absolute paths, or paths relative to the current working directory. Previously, if a stylesheet was loaded using a relative URL (as from a load path), that relative URL was listed even if it couldn't be resolved relative to the current working directory. However, this created potential ambiguities, so this behavior has been removed.

Command Line Interface

... (truncated)

Commits

• 45d1efe Use gamma 2.40 for display-referred rec2020 (#2729)
• 96aa291 Persist credentials on all repos we push to (#2812)
• 5af0b89 Set the Git committer for release tasks (#2811)
• 2cecbbb Fix more issues downstream from Zizmor (#2809)
• a16f014 Emit floating-point rgb() values as percentages (#2800)
• 4ed2c88 Serialize if() values as CSS, not as inspected values (#2808)
• 9dfde3d Fix more post-Zizmor failures (#2806)
• e8c1233 Fix some GitHub actions issues introduced by the Zizmor refactor (#2798)
• d676118 Merge pull request #2797 from sass/lints
• 548e660 Prefer interpolation to compose strings
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sass since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.