Bump the bench group with 2 updates by dependabot[bot] · Pull Request #1360 · bufbuild/protobuf-es

dependabot · 2026-03-01T07:03:25Z

Bumps the bench group with 2 updates: esbuild and google-protobuf.

Updates esbuild from 0.27.2 to 0.27.3

Release notes

v0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.27.3
Preserve URL fragments in data URLs (#4370)

Consider the following HTML, CSS, and SVG:
index.html:
<!DOCTYPE html>
<html>
  <head><link rel="stylesheet" href="icons.css"></head>
  <body><div class="triangle"></div></body>
</html>
icons.css:
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url(./triangle.svg#x);
}
triangle.svg:
<svg xmlns="http://www.w3.org/2000/svg">
  <defs>
    <clipPath id="x">
      <path d="M0 0H10V10Z"/>
    </clipPath>
  </defs>
</svg>
The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using the dataurl loader, which broke the bundled CSS. With this release, esbuild will now preserve the URL fragment in the bundled CSS:
/* icons.css */
.triangle {
  width: 10px;
  height: 10px;
  background: currentColor;
  clip-path: url('data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="x"><path d="M0 0H10V10Z"/></clipPath></defs></svg>#x');
}

... (truncated)

Commits

9129e00 publish 0.27.3 to npm
e20e411 small fix to release notes
0dc0f2d fix #4322: parse and print CSS @scope rules
55fe391 update firefox css gradient support
2c35297 update gradient lowering transform
9209e44 Update Go to 1.25.7 (#4388)
e8d861b close #4374: compat table for the using feature
19b8887 no longer need williamkapke/node-compat-table
7e44218 the kangax/compat-table repo moved to a new url
23b9338 run make update-compat-table
Additional commits viewable in compare view

Updates google-protobuf from 4.0.1 to 4.0.2

Release notes

Sourced from google-protobuf's releases.

v4.0.2

stop hardcoding protoc-gen-js plugin version in download script. This fixes an issue where @protocolbuffers/protoc-gen-js only downloads v4.0.0, which lacks support for editions 2024

Full Changelog: protocolbuffers/protobuf-javascript@v4.0.1...v4.0.2

EDIT: Feb. 27, 2026: macos and windows releases were mistakenly double-zipped, causing further problems for the @protocolbuffers/protoc-gen-js's download script. Re-uploading the inner zip files to fix.

v4.0.2-rc7

Using bzlmod with Bazel 7 or later:

Add to your MODULE.bazel file:
bazel_dep(name = "protobuf_javascript", version = "v4.0.2-rc7")
What's Changed

adjust path for archive and bump pre-release version by @dibenede in protocolbuffers/protobuf-javascript#273

Full Changelog: protocolbuffers/protobuf-javascript@v4.0.2-rc6...v4.0.2-rc7

v4.0.2-rc6

Using bzlmod with Bazel 7 or later:

Add to your MODULE.bazel file:
bazel_dep(name = "protobuf_javascript", version = "v4.0.2-rc6")
What's Changed

add MODULE.bazel and licenses to BCR package, bump pre-release version by @dibenede in protocolbuffers/protobuf-javascript#272

Full Changelog: protocolbuffers/protobuf-javascript@v4.0.2-rc5...v4.0.2-rc6

v4.0.2-rc5

Using bzlmod with Bazel 7 or later:

Add to your MODULE.bazel file:
bazel_dep(name = "protobuf_javascript", version = "v4.0.2-rc5")
What's Changed

... (truncated)

Commits

88c63a0 bump version v4.0.2
1cb4478 Use protoc_plugin's package.json version instead of hardcoding
261daec Update for bazel 9 and protobuf 33.4 (#274)
d0a7fc0 adjust path for archive and bump pre-release version (#273)
9eb5f39 add MODULE.bazel and licenses to BCR package, bump pre-release version
edcf435 Switch BCR release workflow javascript source tarball, bump version (#271)
34756fc Bump version to 4.0.2-rc4 for testing BCR workflow
016866a Use bazel build for BCR release test command
7d64c8d Add placeholder google-protobuf.js file to fix missing input
b784079 Bump version to v4.0.2-rc2 or testing BCR workflow
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

timostamm · 2026-03-02T16:52:52Z

@dependabot rebase

Bumps the bench group with 2 updates: [esbuild](https://github.com/evanw/esbuild) and [google-protobuf](https://github.com/protocolbuffers/protobuf-javascript). Updates `esbuild` from 0.27.2 to 0.27.3 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.2...v0.27.3) Updates `google-protobuf` from 4.0.1 to 4.0.2 - [Release notes](https://github.com/protocolbuffers/protobuf-javascript/releases) - [Commits](protocolbuffers/protobuf-javascript@v4.0.1...v4.0.2) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.27.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bench - dependency-name: google-protobuf dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bench ... Signed-off-by: dependabot[bot] <support@github.com>

…rn/bench-108d770a70

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 1, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/bench-108d770a70 branch from 4ff405f to 4ba20fb Compare March 2, 2026 16:53

timostamm added 3 commits March 2, 2026 17:57

Merge remote-tracking branch 'origin/main' into dependabot/npm_and_ya…

3ba6c9f

…rn/bench-108d770a70

bump remote plugin version

440c285

npx turbo run bundle-size

eebb6f3

timostamm approved these changes Mar 2, 2026

View reviewed changes

timostamm merged commit 25686a7 into main Mar 2, 2026
25 checks passed

timostamm deleted the dependabot/npm_and_yarn/bench-108d770a70 branch March 2, 2026 17:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the bench group with 2 updates#1360

Bump the bench group with 2 updates#1360
timostamm merged 4 commits into
mainfrom
dependabot/npm_and_yarn/bench-108d770a70

dependabot Bot commented on behalf of github Mar 1, 2026 •

edited

Loading

Uh oh!

timostamm commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Mar 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.27.3

0.27.3

v4.0.2

v4.0.2-rc7

Using bzlmod with Bazel 7 or later:

What's Changed

v4.0.2-rc6

Using bzlmod with Bazel 7 or later:

What's Changed

v4.0.2-rc5

Using bzlmod with Bazel 7 or later:

What's Changed

Uh oh!

timostamm commented Mar 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Mar 1, 2026 •

edited

Loading