Skip to content

Bump the npm_and_yarn group across 2 directories with 7 updates - #2

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nodejs/npm_and_yarn-7a19046c0b
Open

Bump the npm_and_yarn group across 2 directories with 7 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nodejs/npm_and_yarn-7a19046c0b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 6, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 7 updates in the /nodejs directory:

Package From To
@github/copilot 0.0.394 0.0.423
minimatch 3.1.2 3.1.5
flatted 3.3.3 3.4.2
lodash 4.17.21 4.18.1
picomatch 4.0.3 4.0.4
rollup 4.53.5 4.60.1
vite 7.3.0 7.3.2

Bumps the npm_and_yarn group with 4 updates in the /test/harness directory: @github/copilot, picomatch, rollup and vite.

Updates @github/copilot from 0.0.394 to 0.0.423

Release notes

Sourced from @​github/copilot's releases.

0.0.423

2026-03-06

  • Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
  • Block /share gist for EMU and GHE Cloud users with clear error messaging
  • Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
  • MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
  • Improve explore agent precision and large repository support with better context sharing
  • Diff mode displays cleanly on Windows with CRLF line endings

0.0.422

2026-03-05

  • Display request ID in authentication and authorization error messages to aid troubleshooting
  • Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
  • Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
  • Add support for GPT-5.4 model
  • Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
  • Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
  • Text selection persists after copying to clipboard in alt screen
  • Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
  • Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
  • IME candidate windows appear at correct cursor position in CJK input
  • Add mouse scroll support to /diff in alt-screen mode
  • Reduce memory usage in alt-screen mode for long sessions
  • Diff mode now works correctly when git color.diff=always is configured
  • Opening links on Windows correctly handles URLs with & query parameters
  • @-mention file completion always reflects the current state of the working directory
  • ESC key to cancel works correctly in tmux and other non-kitty terminals
  • Click in the prompt input to reposition the text cursor
  • Add /copy command to copy the last response to clipboard
  • Links in alt-screen mode are rendered with underline styling for better visibility
  • /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
  • GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
  • Colons in inline code render correctly inside markdown tables
  • Pressing Ctrl+C on the help dialog now dismisses it cleanly
  • Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
  • Pressing Enter in required enum field now selects the highlighted option
  • Hide noisy todo bookkeeping queries and show dependency details in timeline
  • CLI no longer hangs for minutes when working in a directory with a large number of files
  • Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
  • Add exitPlanMode.request protocol method for SDK plan approval support
  • Automatic notifications when background shell commands and agents complete
  • GitHub MCP server connection status is accurately tracked and counted in the status indicator
  • Press Ctrl+R to search command history with reverse incremental search (like Bash)
  • Long diff lines no longer overflow and wrap in the diff view
  • Add startup prompt hooks to auto-submit prompts or slash commands when a session starts
  • Ctrl+K joins lines when cursor is at end of line, matching standard Emacs/terminal behavior
  • Escape sequences split across input chunks no longer leak into text input
  • Rename launch_messages config setting to companyAnnouncements

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

0.0.423 - 2026-03-06

  • Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
  • Block /share gist for EMU and GHE Cloud users with clear error messaging
  • Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
  • MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
  • Improve explore agent precision and large repository support with better context sharing
  • Diff mode displays cleanly on Windows with CRLF line endings

0.0.422 - 2026-03-05

  • Display request ID in authentication and authorization error messages to aid troubleshooting
  • Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
  • Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
  • Add support for GPT-5.4 model
  • Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
  • Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
  • Text selection persists after copying to clipboard in alt screen
  • Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
  • Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
  • IME candidate windows appear at correct cursor position in CJK input
  • Add mouse scroll support to /diff in alt-screen mode
  • Reduce memory usage in alt-screen mode for long sessions
  • Diff mode now works correctly when git color.diff=always is configured
  • Opening links on Windows correctly handles URLs with & query parameters
  • @-mention file completion always reflects the current state of the working directory
  • ESC key to cancel works correctly in tmux and other non-kitty terminals
  • Click in the prompt input to reposition the text cursor
  • Add /copy command to copy the last response to clipboard
  • Links in alt-screen mode are rendered with underline styling for better visibility
  • /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
  • GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
  • Colons in inline code render correctly inside markdown tables
  • Pressing Ctrl+C on the help dialog now dismisses it cleanly
  • Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
  • Pressing Enter in required enum field now selects the highlighted option
  • Hide noisy todo bookkeeping queries and show dependency details in timeline
  • CLI no longer hangs for minutes when working in a directory with a large number of files
  • Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
  • Add exitPlanMode.request protocol method for SDK plan approval support
  • Automatic notifications when background shell commands and agents complete
  • GitHub MCP server connection status is accurately tracked and counted in the status indicator
  • Press Ctrl+R to search command history with reverse incremental search (like Bash)
  • Long diff lines no longer overflow and wrap in the diff view
  • Add startup prompt hooks to auto-submit prompts or slash commands when a session starts
  • Ctrl+K joins lines when cursor is at end of line, matching standard Emacs/terminal behavior
  • Escape sequences split across input chunks no longer leak into text input
  • Rename launch_messages config setting to companyAnnouncements
  • Show a waiting message when the terminal is handed to an external editor
  • Support enabledPlugins in config for automatic plugin installation at startup

... (truncated)

Commits
  • 7aa08b3 Update changelog.md for version 0.0.422
  • 689d148 Update changelog.md for version 0.0.421
  • 119c6f8 Merge pull request #1699 from github/devm33/install-ready
  • 3b73154 Update changelog.md for version 0.0.420
  • 9596516 Update changelog.md for version 0.0.419
  • 30034c7 install: guide user to update PATH for current shell session
  • 9277ab5 Update changelog.md for version 0.0.418
  • f8396ae Merge pull request #1670 from github/RyanHecht-patch-1
  • b54e97c Update README.md
  • aea9faa Revise README for GitHub Copilot CLI installation
  • Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

Updates flatted from 3.3.3 to 3.4.2

Commits
  • 3bf0909 3.4.2
  • 885ddcc fix CWE-1321
  • 0bdba70 added flatted-view to the benchmark
  • 2a02dce 3.4.1
  • fba4e8f Merge pull request #89 from WebReflection/python-fix
  • 5fe8648 added "when in Rome" also a test for PHP
  • 53517ad some minor improvement
  • b3e2a0c Fixing recursion issue in Python too
  • c4b46db Add SECURITY.md for security policy and reporting
  • f86d071 Create dependabot.yml for version updates
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates rollup from 4.53.5 to 4.60.1

Release notes

Sourced from rollup's releases.

v4.60.1

4.60.1

2026-03-30

Bug Fixes

  • Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

v4.60.0

4.60.0

2026-03-22

Features

  • Support source phase imports as long as they are external (#6279)

Pull Requests

v4.59.1

4.59.1

2026-03-21

Bug Fixes

  • Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.60.1

2026-03-30

Bug Fixes

  • Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

4.60.0

2026-03-22

Features

  • Support source phase imports as long as they are external (#6279)

Pull Requests

4.59.1

2026-03-21

Bug Fixes

  • Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)

Pull Requests

... (truncated)

Commits

Updates vite from 7.3.0 to 7.3.2

Release notes

Sourced from vite's releases.

v7.3.2

Please refer to CHANGELOG.md for details.

v7.3.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.2 (2026-04-06)

Bug Fixes

7.3.1 (2026-01-07)

Features

  • add ignoreOutdatedRequests option to optimizeDeps (#21364) (9d39d37)
Commits

Updates @github/copilot from 0.0.394 to 0.0.423

Release notes

Sourced from @​github/copilot's releases.

0.0.423

2026-03-06

  • Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
  • Block /share gist for EMU and GHE Cloud users with clear error messaging
  • Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
  • MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
  • Improve explore agent precision and large repository support with better context sharing
  • Diff mode displays cleanly on Windows with CRLF line endings

0.0.422

2026-03-05

  • Display request ID in authentication and authorization error messages to aid troubleshooting
  • Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
  • Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
  • Add support for GPT-5.4 model
  • Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
  • Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
  • Text selection persists after copying to clipboard in alt screen
  • Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
  • Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
  • IME candidate windows appear at correct cursor position in CJK input
  • Add mouse scroll support to /diff in alt-screen mode
  • Reduce memory usage in alt-screen mode for long sessions
  • Diff mode now works correctly when git color.diff=always is configured
  • Opening links on Windows correctly handles URLs with & query parameters
  • @-mention file completion always reflects the current state of the working directory
  • ESC key to cancel works correctly in tmux and other non-kitty terminals
  • Click in the prompt input to reposition the text cursor
  • Add /copy command to copy the last response to clipboard
  • Links in alt-screen mode are rendered with underline styling for better visibility
  • /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
  • GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
  • Colons in inline code render correctly inside markdown tables
  • Pressing Ctrl+C on the help dialog now dismisses it cleanly
  • Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
  • Pressing Enter in required enum field now selects the highlighted option
  • Hide noisy todo bookkeeping queries and show dependency details in timeline
  • CLI no longer hangs for minutes when working in a directory with a large number of files
  • Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
  • Add exitPlanMode.request protocol method for SDK plan approval support
  • Automatic notifications when background shell commands and agents complete
  • GitHub MCP server connection status is accurately tracked and counted in the status indicator
  • Press Ctrl+R to search command history with reverse incremental search (like Bash)
  • Long diff lines no longer overflow and wrap in the diff view
  • Add startup prompt hooks to auto-submit prompts or slash commands when a session starts
  • Ctrl+K joins lines when cursor is at end of line, matching standard Emacs/terminal behavior
  • Escape sequences split across input chunks no longer leak into text input
  • Rename launch_messages config setting to companyAnnouncements

... (truncated)

Changelog

Sourced from @​github/copilot's changelog.

0.0.423 - 2026-03-06

  • Users are prompted for shell commands with potentially dangerous expansion or substitution use cases, additional guardrails for malicious exploits
  • Block /share gist for EMU and GHE Cloud users with clear error messaging
  • Elicitation enum and boolean fields now require Enter to confirm a selection, with a ✓ indicator for confirmed values vs ❯ for the browsing cursor
  • MCP servers can now request users to visit a URL for out-of-band interactions such as OAuth flows or API key entry
  • Improve explore agent precision and large repository support with better context sharing
  • Diff mode displays cleanly on Windows with CRLF line endings

0.0.422 - 2026-03-05

  • Display request ID in authentication and authorization error messages to aid troubleshooting
  • Load personal hooks from ~/.copilot/hooks in addition to repo-level .github/hooks
  • Timeline now shows the question in a box and displays 'Making best guess on autopilot' when ask_user is auto-responded
  • Add support for GPT-5.4 model
  • Plugin cache automatically recovers from a corrupted or incomplete clone without manual intervention
  • Show a clear, actionable error message when git is not installed and a remote plugin or marketplace is used
  • Text selection persists after copying to clipboard in alt screen
  • Scroll view no longer jumps to earlier messages when scrolling during response streaming or with popups open
  • Add copy_on_select config option to auto-copy selected text to clipboard in alt screen mode
  • IME candidate windows appear at correct cursor position in CJK input
  • Add mouse scroll support to /diff in alt-screen mode
  • Reduce memory usage in alt-screen mode for long sessions
  • Diff mode now works correctly when git color.diff=always is configured
  • Opening links on Windows correctly handles URLs with & query parameters
  • @-mention file completion always reflects the current state of the working directory
  • ESC key to cancel works correctly in tmux and other non-kitty terminals
  • Click in the prompt input to reposition the text cursor
  • Add /copy command to copy the last response to clipboard
  • Links in alt-screen mode are rendered with underline styling for better visibility
  • /delegate prompts for a target remote in multi-remote repositories and clarifies confirmation text
  • GitHub MCP server stays enabled in repositories that have both Azure DevOps and GitHub remotes
  • Colons in inline code render correctly inside markdown tables
  • Pressing Ctrl+C on the help dialog now dismisses it cleanly
  • Plugin-contributed LSP servers are now loaded, started, and shown in /lsp show
  • Pressing Enter in required enum field now selects the highlighted option
  • Hide noisy todo bookkeeping queries and show dependency details in timeline
  • CLI no longer hangs for minutes when working in a directory with a large number of files
  • Add --output-format json flag to emit JSONL in prompt mode for programmatic integrations
  • Add exitPlanMode.request protocol method for SDK plan approval support
  • Automatic notifications when background shell commands and agents complete
  • GitHub MCP server connection status is accurately tracked and counted in the status indicator
  • Press Ctrl+R to search command history with reverse incremental search (like Bash)
  • Long diff lines no longer overflow and wrap in the diff view
  • Add startup prompt hooks to auto-submit prompts or slash commands when a session starts
  • Ctrl+K joins lines when cursor is at end of line, matching standard Emacs/terminal behavior
  • Escape sequences split across input chunks no longer leak into text input
  • Rename launch_messages config setting to companyAnnouncements
  • Show a waiting message when the terminal is handed to an external editor
  • Support enabledPlugins in config for automatic plugin installation at startup

... (truncated)

Commits
  • 7aa08b3 Update changelog.md for version 0.0.422
  • 689d148 Update changelog.md for version 0.0.421
  • 119c6f8 Merge pull request #1699 from github/devm33/install-ready
  • 3b73154 Update changelog.md for version 0.0.420
  • 9596516 Update changelog.md for version 0.0.419
  • 30034c7 install: guide user to update PATH for current shell session
  • 9277ab5 Update changelog.md for version 0.0.418
  • f8396ae Merge pull request #1670 from github/RyanHecht-patch-1
  • b54e97c Update README.md
  • aea9faa Revise README for GitHub Copilot CLI installation
  • Additional commits viewable in compare view

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

Updates rollup from 4.54.0 to 4.60.1

Release notes

Sourced from rollup's releases.

v4.60.1

4.60.1

2026-03-30

Bug Fixes

  • Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

v4.60.0

4.60.0

2026-03-22

Features

  • Support source phase imports as long as they are external (#6279)

Pull Requests

v4.59.1

4.59.1

2026-03-21

Bug Fixes

  • Fix a crash when using lazy dynamic imports with moduleSideEffects:false (#6306)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.60.1

2026-03-30

Bug Fixes

  • Resolve a situation where side effect imports could be dropped due to a caching issue (#6286)

Pull Requests

@dependabot
Bump the npm_and_yarn group across 2 directories with 7 updates
6bce4a8 
Bumps the npm_and_yarn group with 7 updates in the /nodejs directory:

| Package | From | To |
| --- | --- | --- |
| [@github/copilot](https://github.com/github/copilot-cli) | `0.0.394` | `0.0.423` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` |
| [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` |
| [rollup](https://github.com/rollup/rollup) | `4.53.5` | `4.60.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.0` | `7.3.2` |

Bumps the npm_and_yarn group with 4 updates in the /test/harness directory: [@github/copilot](https://github.com/github/copilot-cli), [picomatch](https://github.com/micromatch/picomatch), [rollup](https://github.com/rollup/rollup) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@github/copilot` from 0.0.394 to 0.0.423
- [Release notes](https://github.com/github/copilot-cli/releases)
- [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md)
- [Commits](github/copilot-cli@v0.0.394...v0.0.423)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `flatted` from 3.3.3 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.3...v3.4.2)

Updates `lodash` from 4.17.21 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.18.1)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `rollup` from 4.53.5 to 4.60.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.5...v4.60.1)

Updates `vite` from 7.3.0 to 7.3.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite)

Updates `@github/copilot` from 0.0.394 to 0.0.423
- [Release notes](https://github.com/github/copilot-cli/releases)
- [Changelog](https://github.com/github/copilot-cli/blob/main/changelog.md)
- [Commits](github/copilot-cli@v0.0.394...v0.0.423)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `rollup` from 4.54.0 to 4.60.1
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.53.5...v4.60.1)

Updates `vite` from 7.3.0 to 7.3.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite)

---
updated-dependencies:
- dependency-name: "@github/copilot"
  dependency-version: 0.0.423
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.60.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@github/copilot"
  dependency-version: 0.0.423
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.60.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 6, 2026
@dependabot dependabot Bot mentioned this pull request Apr 6, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants