Skip to content

chore(deps): update all non-major dependencies - #160

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#160
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented May 19, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@types/node (source) 18.19.100 → 18.19.130 age confidence
debug 4.4.1 → 4.4.3 age confidence
rollup (source) 3.29.5 → 3.30.0 age confidence
semver 7.7.2 → 7.8.5 age confidence
typescript (source) 5.8.3 → 5.9.3 age confidence
webpack 5.99.8 → 5.109.2 age confidence

Release Notes

debug-js/debug (debug)

v4.4.3

Compare Source

Functionally identical release to 4.4.1.

Version 4.4.2 is compromised. Please see #​1005.

rollup/rollup (rollup)

v3.30.0

Compare Source

3.30.0

2026-02-22

Features
  • Throw when the generated bundle contains paths that would leave the output directory (#​6276)
Pull Requests
npm/node-semver (semver)

v7.8.5

Compare Source

Bug Fixes

v7.8.4

Compare Source

Bug Fixes

v7.8.3

Compare Source

Bug Fixes
Chores

v7.8.2

Compare Source

Bug Fixes

v7.8.1

Compare Source

Bug Fixes

v7.8.0

Compare Source

Features
Bug Fixes
Documentation
Chores

v7.7.4

Compare Source

Bug Fixes
Documentation
Dependencies
Chores

v7.7.3

Compare Source

Bug Fixes
Chores
microsoft/TypeScript (typescript)

v5.9.3: TypeScript 5.9.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

v5.9.2: TypeScript 5.9

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

webpack/webpack (webpack)

v5.109.2

Compare Source

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #​21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #​21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #​21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #​21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #​21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #​21473)

v5.109.1

Compare Source

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #​21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #​21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #​21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #​21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #​21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #​21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #​21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #​21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #​21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #​21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #​21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #​21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #​21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #​21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #​21523)

  • Encode the persistent cache with V8's value serializer. (by @​avivkeller in #​21514)

  • Speed up SplitChunksPlugin: reject non-subset chunk sets with 64-bit signatures, cache unnamed entry keys, and drop per-module closures. (by @​avivkeller in #​21529)

  • Initialize NormalModule._ast in the constructor so each instance keeps a single hidden-class shape. (by @​alexander-akait in #​21515)

  • Reduce allocations in the binary serialization hot paths. (by @​alexander-akait in #​21526)

  • Deduplicate and simplify several lib modules and speed up AggressiveMergingPlugin. (by @​alexander-akait in #​21525)

  • Rename nested const/let __webpack_require__ and __webpack_exports__ declarations in bundled webpack output. (by @​hai-x in #​21508)

v5.109.0

Compare Source

Minor Changes

  • Default experiments.typescript to "auto", enabling built-in TypeScript support on Node.js >= 22.6 when no TypeScript loader is registered. (by @​alexander-akait in #​21477)

  • Default experiments.css, experiments.html and experiments.asyncWebAssembly to "auto", enabling built-in support unless a loader is registered for those files; modules with inline or hook-injected loaders (e.g. html-webpack-plugin templates) keep being parsed as JavaScript. (by @​alexander-akait in #​21477)

  • Add output.resourceHints to emit resource hints (preload/prefetch/modulepreload/preconnect), on by default for ESM output, plus module.parser.<type>.urlHints, css.fontPreload and javascript.dynamicImportCssPreload. (by @​alexander-akait in #​21477)

  • Add built-in build progress via infrastructureLogging.progress, plus estimatedTime, phaseTimings, progress bar width and progressBar: "auto" on ProgressPlugin. (by @​alexander-akait in #​21477)

  • Concatenate CommonJS modules with statically analyzable exports; opt out via optimization.concatenateModules: { commonjs: false }. (by @​alexander-akait in #​21477)

  • Wrap "weird" CommonJS modules into module concatenation instead of bailing out. (by @​alexander-akait in #​21477)

  • Add output.html.inline (true | "script" | "style") and the webpackInline magic comment to inline chunk content into HTML. (by @​alexander-akait in #​21477)

  • Add output.html.inject to control where chunk tags are injected. (by @​alexander-akait in #​21477)

  • Add output.html.title, output.html.meta and output.html.base options for head generation. (by @​alexander-akait in #​21477)

  • Support per-icon link attributes (sizes, media, color, type, crossorigin) and arrays in output.html.favicon. (by @​alexander-akait in #​21487)

  • Add output.html.manifest to generate and link a web app manifest with hashed icons. (by @​alexander-akait in #​21487)

  • Add output.html.csp to inject a Content-Security-Policy meta with inline-content hashes and an optional nonce. (by @​alexander-akait in #​21487)

  • Add the output.html injectTags compilation hook to inject tags (script/link/meta/…) with injectTo placement. (by @​alexander-akait in #​21487)

  • Add the output.html transformTags compilation hook to mutate, remove, or move (between <head> and <body>) a page's existing <script>/<link>/<style>/<meta> tags. (by @​alexander-akait in #​21487)

  • Extend the HTML pipeline with html link sources (bundled as their own emitted page) and rel="preload"/"prefetch" links bundled as chunks. (by @​alexander-akait in #​21477)

  • Recognize more asset-bearing HTML sources: the twitter:player:stream meta, legacy SVG references, and Web App Manifest icons/screenshots/shortcuts URLs. (by @​alexander-akait in #​21477)

  • Add module.parser.html.as to parse HTML as a document or an element fragment. (by @​alexander-akait in #​21477)

  • Allow disabling a built-in HTML parser source via type: false in sources. (by @​alexander-akait in #​21477)

  • Export webpack.html.HtmlModulesPlugin with transformHtml/htmlEmitted compilation hooks. (by @​alexander-akait in #​21477)

  • Resolve @custom-media (including media-type values) and @custom-selector in native CSS. (by @​alexander-akait in #​21477)

  • Scope view-transition-name/-group/-class names and ::view-transition-*() pseudo references in CSS modules under customIdents. (by @​alexander-akait in #​21486)

  • Add import.meta.glob support, with a caseSensitive option and consistent hidden/node_modules matching. (by @​alexander-akait in #​21477)

  • Resolve import.meta.resolve("./asset") to the emitted asset URL via the importMeta.resolve parser option. (by @​alexander-akait in #​21477)

  • Add import.meta.env defaults: MODE, DEV, PROD, SSR and BASE_URL. (by @​alexander-akait in #​21477)

  • Add fine-grained import.meta parser options. (by @​alexander-akait in #​21477)

  • Deprecate the importMetaContext parser option in favor of importMeta.webpackContext. (by @​alexander-akait in #​21477)

  • Emit analyzable new URL(…, import.meta.url), worker/worklet URL and import() references with literal specifiers for ESM module output. (by @​alexander-akait in #​21477)

  • Compile async modules to generators for targets without async/await. (by @​alexander-akait in #​21477)

  • Evaluate and validate the second argument of dynamic import(specifier, options). (by @​alexander-akait in #​21477)

  • Add module.parser.javascript.worklet to bundle Worklet addModule() entries. (by @​alexander-akait in #​21477)

  • Add ?raw, ?url, ?inline and ?no-inline asset query suffixes under experiments.futureDefaults. (by @​alexander-akait in #​21477)

  • Add an interop ("default" | "esModule") hint for object externals to control default-export interop. (by @​alexander-akait in #​21477)

  • Add an amd-async externals type that loads AMD externals without an AMD library wrapper. (by @​alexander-akait in #​21477)

  • Support cache.compression: "zstd" for the filesystem cache. (by @​alexander-akait in #​21477)

  • Warn on strict-mode-only syntax and semantic hazards in ES module output, configurable via the strictModeViolations parser option. (by @​alexander-akait in #​21477)

  • Support parsers without location APIs: locations derive from node offsets and AST nodes no longer carry loc. (by @​alexander-akait in #​21477)

  • Attach the original DOM event to ChunkLoadError and ScriptExternalLoadError as error.event. (by @​alexander-akait in #​21477)

  • Add output.wasmStreamingFallback for wasm fallback on a wrong MIME type. (by @​alexander-akait in #​21477)

  • Show why a module was marked as not cacheable in stats output. (by @​alexander-akait in #​21477)

  • Expose the active MultiWatching on MultiCompiler.watching. (by @​alexander-akait in #​21477)

  • Resolve git merge conflicts when parsing the build-http lockfile. (by @​alexander-akait in #​21477)

Patch Changes

v5.108.4

Compare Source

Patch Changes

v5.108.3

Compare Source

Patch Changes

v5.108.2

Compare Source

Patch Changes

v5.108.1

Compare Source

Patch Changes

  • Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #​21280)

  • Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #​21269)

v5.108.0

Compare Source

Minor Changes

  • Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @​alexander-akait in #​21218)

  • Add a bun target that emits ESM and externalizes bun:* and node.js built-in modules. (by @​alexander-akait in #​21248)

  • Support CommonJS reexports via Object.defineProperty value and getter descriptors. (by @​alexander-akait in #​21129)

  • Support JSON Schema const when generating CLI flags from a schema. (by @​alexander-akait in #​21087)

  • Support JSON Schema if/then/else when generating CLI flags from a schema. (by @​alexander-akait in #​21087)

  • Skip import specifiers, require() and import() calls in dead conditional branches gated by inlined imported constants (isDEV ? A : B), evaluated via getCondition. (by @​hai-x in #​21136)

  • CSS localIdentName [hash] now resolves to the local ident hash (matching css-loader); use [modulehash] for the module hash. (by @​alexander-akait in #​21259)

  • Add CSS parser as option and resolve url() inside HTML style attributes. (by @​alexander-akait in #​21157)

  • Add dedicated module classes for all built-in module types. (by @​alexander-akait in #​21164)

  • Support .html/.css for the default ./src entry under the html/css experiments. (by @​alexander-akait in #​21039)

  • Add defineConfig helper for typed configuration files. (by @​alexander-akait in #​21169)

  • Add a deno target (with versions, e.g. deno, deno2, deno1.40) that emits ESM, resolves node.js built-ins via the required node: specifier, and keeps Deno's own import protocols (npm:, jsr:, node:, http(s)://) external. (by @​alexander-akait in #​21247)

  • Use module-import for electron externals when the target supports ESM. (by @​alexander-akait in #​21184)

  • Add output.environment.logicalAssignment to emit ||= in runtime code when the target supports logical assignment operators. (by @​bjohansebas in #​21219)

  • Resolve and rewrite asset URLs inside <iframe srcdoc> in HTML modules. (by @​bjohansebas in #​21226)

  • Add HMR support for HTML modules with body/title DOM patching on update. (by @​alexander-akait in #​21011)

  • Add css-url html source type extracting url() references from CSS-valued attributes. (by @​alexander-akait in #​21250)

  • Add module.parser.html.sources option to disable or customize URL-attribute extraction for HTML modules, with script / script-module / stylesheet / stylesheet-inline types for custom attributes (by @​alexander-akait in #​21022)

  • Add module.parser.html.template option to transform HTML module source before parsing. (by @​alexander-akait in #​21055)

  • Extract more source URLs in HTML modules (SVG, legacy and obsolete attributes). (by @​alexander-akait in #​21241)

  • Inline export default <const> when the default-exported value is a primitive constant. (by @​hai-x in #​21189)

  • Support optimization.inlineExports for better tree-shaking. (by @​hai-x in #​20973)

  • Re-encode inline hash digests ([contenthash]/[chunkhash]/[fullhash]/[modulehash]) from the full content hash, so they carry full entropy and work under optimization.realContentHash and in dynamically-loaded chunk filenames; also preserve leading zero bytes in base-N digests. (by [@​alexander-akait](https://redirect.

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the renovate label May 19, 2025
@bolt-new-by-stackblitz

bolt-new-by-stackblitz Bot commented May 19, 2025

Copy link
Copy Markdown

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from f0332be to 6807969 Compare May 20, 2025 12:58
@renovate renovate Bot changed the title chore(deps): update dependency @types/node to v18.19.101 chore(deps): update all non-major dependencies May 20, 2025
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 0ce7a7d to 99eff70 Compare May 27, 2025 20:34
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from 0c91e72 to 87674c8 Compare June 4, 2025 06:31
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 87674c8 to 5342022 Compare June 6, 2025 21:40
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from c2bed05 to 031005b Compare June 22, 2025 15:24
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from f125b7f to d4f3375 Compare July 1, 2025 23:14
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 76264cf to ce537ab Compare July 15, 2025 16:26
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from ce537ab to 325507d Compare July 19, 2025 02:02
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from ca2006c to 7690ec0 Compare July 31, 2025 23:56
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 7690ec0 to 1ae0d93 Compare August 8, 2025 17:44
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 70d1efc to 0ca749b Compare October 1, 2025 02:35
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 4a2b442 to 51f0a8d Compare October 9, 2025 18:30
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 51f0a8d to 2838c46 Compare October 21, 2025 20:46
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 2838c46 to 55148a1 Compare November 10, 2025 18:14
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 55148a1 to bf4c01e Compare November 18, 2025 22:47
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from bf4c01e to 4121d17 Compare December 3, 2025 17:12
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from f15e3bc to dd67bf3 Compare December 18, 2025 13:54
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from dd67bf3 to 89091c4 Compare December 31, 2025 15:41
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 89091c4 to 0419262 Compare January 8, 2026 16:27
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 44f8866 to 45b8e1d Compare January 23, 2026 16:47
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from b0c1a62 to 65e4673 Compare February 5, 2026 19:09
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 8ad6d62 to 6978f11 Compare February 12, 2026 17:42
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 900dc7a to 613989f Compare February 22, 2026 16:38
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 0077fc1 to d6b1dcc Compare March 3, 2026 18:43
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from d6b1dcc to 4872c8b Compare March 5, 2026 20:02
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 4872c8b to 643d764 Compare March 13, 2026 18:14
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 643d764 to 8cd4b7d Compare March 27, 2026 13:29
@socket-security

socket-security Bot commented Mar 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm es-abstract is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yaml → npm/@so1ve/eslint-config@0.120.4 → npm/es-abstract@1.24.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-abstract@1.24.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm webpack is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/webpack@5.109.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 8cd4b7d to 4468ee0 Compare March 27, 2026 18:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants