Skip to content

Bump esbuild and sst #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 6, 2025

Removes esbuild. It's no longer used after updating ancestor dependency sst. These dependencies need to be updated together.

Removes esbuild

Updates sst from 2.48.5 to 3.17.3

Release notes

Sourced from sst's releases.

v3.17.3

Changelog

  • 1d4891fe34d03ca800c8b6c99d10e83c98a9684d Cloudflare Astro
  • 5fd1a1ac514a636159f80b6893255a4dc9d5571f Examples: sync playground

v3.17.2

Changelog

  • 24d4ddc68462e38f437d845eedebfaea4647243b Bump OpenNext to v3.6.4 (#5839)
  • 7873122caf7bad58f815a7ecdd91f7404765e472 Router: optimize routing function
  • bc02c3c3bf8700e2b86fd84adf214931088d7188 fix: normalize path separators in TypeScript reference generation (#5842)

v3.17.0

Breaking Changes in sst.aws.Service and sst.aws.Task

Previously, when linking components to a Service or Task, SST passed the linking data into the container as Docker build arguments. This can be insecure when the linking data include sensitive values, ie. passwords for Postgres or Redis components, since build arguments can be exposed in build logs.

Starting from v3.17.0, SST now passes linking data using Docker secrets, which are not exposed in logs, providing a more secure mechanism for handling sensitive values.

How to Migrate

This only affects you if your Dockerfile needs access to linked resources during build time.

To migrate your Dockerfile to use Docker secrets:

  1. Remove all ARG SST_RESOURCE_<resource_name> declarations from your Dockerfile.
  2. Update your build command to mount secrets, like so:
    - RUN npm run build
    + RUN --mount=type=secret,id=SST_RESOURCE_<resource_name>,env=SST_RESOURCE_<resource_name>` npm run build
  3. Deploy the changes.

Changelog

  • 4ef5529369830beefc1302a24bd70060505e05ff Cluster: use docker secrets to pass link values
  • 08e4522dc273427a3c52920dcd58fed1b0fe5791 Example: sync playground
  • 394092949ed7cbb6de33f06a36b48e1ccee4a850 Router: update docs to clarify route path takes prefix
  • 69b6c0ccf2faa28adfc50d230523eb923f94d552 Router: update docs to clarify route path takes prefix

v3.16.7

Changelog

  • 2158cdd6df3e17280bd52dfcd2c9c212767eec08 Examples: sync playground
  • 0f174aeed1c2849ba5176d1caa3216bafbfbeffe StepFunctions: fix ecsRunTask payload format

v3.16.6

Changelog

  • 211f6faab5afc625d328832e4687207b13cdc89c Realtime: grant iot permissions when linked

v3.16.5

Changelog

  • 210c68a1bb2f602b5e3d4fd17a691b5844475f27 Function: fix addEnvironment not redeployed after refresh

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 6, 2025
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/multi-6191fd5922 branch 3 times, most recently from f8ddd94 to 7e44fcc Compare June 9, 2025 19:54
Removes [esbuild](https://github.com/evanw/esbuild). It's no longer used after updating ancestor dependency [sst](https://github.com/sst/sst). These dependencies need to be updated together.


Removes `esbuild`

Updates `sst` from 2.48.5 to 3.17.3
- [Release notes](https://github.com/sst/sst/releases)
- [Changelog](https://github.com/sst/sst/blob/dev/.goreleaser.yml)
- [Commits](https://github.com/sst/sst/commits/v3.17.3)

---
updated-dependencies:
- dependency-name: esbuild
  dependency-version: 
  dependency-type: indirect
- dependency-name: sst
  dependency-version: 3.17.3
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/multi-6191fd5922 branch from 7e44fcc to 771fb83 Compare June 12, 2025 13:53
@oschwartz10612
Copy link
Member

@dependabot ignore sst major version

Copy link
Contributor Author

dependabot bot commented on behalf of github Jun 15, 2025

This option is only available on single-dependency pull requests, as the versions in multi-dependency pull requests may differ.

If you'd like to ignore all updates for these dependencies just reply @dependabot ignore these dependencies.

@oschwartz10612
Copy link
Member

@dependabot close

@dependabot dependabot bot closed this Jun 15, 2025
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/multi-6191fd5922 branch June 15, 2025 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant