Bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: vite and js-yaml.

Updates vite from 6.2.0 to 6.4.1

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.1

Please refer to CHANGELOG.md for details.

v6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0-beta.2

Please refer to CHANGELOG.md for details.

v6.3.0-beta.1

Please refer to CHANGELOG.md for details.

v6.3.0-beta.0

Please refer to CHANGELOG.md for details.

v6.2.7

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.2.2 (2025-11-07)

Bug Fixes

• revert "refactor: use fs.cpSync (#21019)" (#21081) (728c8ee)

7.2.1 (2025-11-06)

Bug Fixes

• worker: some worker asset was missing (#21074) (82d2d6c)

Code Refactoring

• build: rename indexOfMatchInSlice to findPreloadMarker (#21054) (f83264f)

7.2.0 (2025-11-05)

Bug Fixes

• css: fallback to sass when sass-embedded platform binary is missing (#21002) (b1fd616)
• module-runner: make getBuiltins response JSON serializable (#21029) (ad5b3bf)
• types: add undefined to optional properties for exactOptionalProperties type compatibility (#21040) (2833c55)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#21047) (e3a6a83)

7.2.0-beta.1 (2025-10-29)

Bug Fixes

• increase stream reset rate limit for HTTP2 (#21024) (4f44f22)
• optimizer: externalize virtual modules for html like files (#21001) (e5af352)

Documentation

• clarify the values are escaped automatically (#21017) (246df13)

Code Refactoring

• use fs.cpSync (#21019) (a2df778)

7.2.0-beta.0 (2025-10-28)

Features

• add import.meta.resolve support for ESM config (bundle config loader) (#20962) (f86789a)
• add perEnvironmentWatchChangeDuringDev (#20996) (a5e98e6)
• add vite client connect events (#20978) (543d87c)
• build: emit license (#18546) (b42c3fb)
• dev: support HTTP2 even if proxy feature is used (#20869) (fc21af7)
• lib: enable minification but keep pure annotations for es output with terser (#20522) (df997d0)
• optimizer: add rush lockfile support (#20833) (718ca2d)
• utils: support multiple certificates in resolveServerUrls (#20707) (24513e5)

... (truncated)

Commits

• a7349ef release: v6.3.1
• a152b7c fix: backward compat for internal plugin transform calls (#19878)
• 35c7f35 fix: avoid using Promise.allSettled in preload function (#19805)
• 5fdcfe7 release: v6.3.0
• d4ee5e8 fix(hmr): avoid infinite loop happening with hot.invalidate in circular dep...
• 5003434 fix(preview): use host url to open browser (#19836)
• bf9728e release: v6.3.0-beta.2
• 380c10e fix(hmr): run HMR handler sequentially (#19793)
• 8bed1de fix: addWatchFile doesn't work if base is specified (fixes #19792) (#19794)
• 0a0c50a refactor: simplify pluginFilter implementation (#19828)
• Additional commits viewable in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

• Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

• Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

• Types are now exported as yaml.types.XXX.
• Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

• Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

• Check migration guide to see details for all breaking changes.
• Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
• Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
• yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
• yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
• !!binary now always mapped to Uint8Array on load.
• Reduced nesting of /lib folder.
• Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
• dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
• Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
• Code snippet created in exceptions now contains multiple lines with line numbers.
• dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
• dump() with skipInvalid=true now serializes invalid items in collections as null.
• Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
• Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

• Added .mjs (es modules) support.
• Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
• Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

• 9963d36 3.14.2 released
• 10d3c8e dist rebuild
• 5278870 fix prototype pollution in merge (<<) (#731)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Updates dev tooling by bumping Vite to 6.4.1 and applying a js-yaml patch, refreshing lockfile with related Rollup and globbing deps.

• Dependencies:
  • Build tooling: Update vite from 6.2.0 to 6.4.1 in package.json.
    • Lockfile refresh adds/updates related deps: [email protected] (+ platform binaries), [email protected], [email protected], [email protected].
  • Security/Parsing: Bump js-yaml from 3.14.1 to 3.14.2.
  • Misc: Update glob to 7.2.3 and @types/estree to 1.0.8.

^{Written by Cursor Bugbot for commit fcfb6e6. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​6.4.1

View full report

[socket-security]

Warning

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Potential code anomaly (AI signal): npm glob is 100.0% likely to have a medium risk anomaly Notes: The code is a conventional, non-malicious implementation of a globbing helper with ignore pattern support. It reads inputs from configuration and filesystem state, and writes results to an internal cache/result set. There are no indicators of malware or exfiltration within this fragment. Confidence: 1.00 Severity: 0.60 From: ? → npm/[email protected] → npm/[email protected] → npm/[email protected] → npm/[email protected] ℹ Read more on: This package | This alert | What is an AI-detected potential code anomaly? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report