chore(deps-dev): bump the dependencies group across 1 directory with 9 updates by dependabot[bot] · Pull Request #4826 · webpack/webpack-cli

dependabot · 2026-08-05T18:06:35Z

Bumps the dependencies group with 9 updates in the / directory:

Package	From	To
@swc/core	`1.15.43`	`1.15.47`
eslint	`10.7.0`	`10.8.1`
js-yaml	`5.2.2`	`5.2.3`
lint-staged	`17.0.8`	`17.3.0`
pkg-pr-new	`0.0.79`	`0.0.87`
prettier	`3.9.5`	`3.9.6`
sass	`1.101.0`	`1.102.0`
tsx	`4.23.1`	`4.23.12`
webpack	`5.108.4`	`5.109.2`

Updates @swc/core from 1.15.43 to 1.15.47

Changelog

Sourced from @swc/core's changelog.

[1.15.47] - 2026-07-29

Bug Fixes

(es) Preserve numeric property key identity (#12050) (46900a3)

(es/ast) Support hashing non-finite numbers (#12043) (f4b85a6)

(es/codegen) Emit non-finite numeric literals (#12047) (883abc4)

(es/decorators) Avoid class state leakage for nested undecorated classes (#12076) (4c9d277)

(es/minifier) Apply ToInt32 when folding bitwise NOT (#12058) (550e2f7)

(es/minifier) Avoid inexact number radix folding (#12057) (506a0ea)

(es/minifier) Preserve invalid Array lengths (#12056) (3ce9e16)

(es/minifier) Preserve non-canonical arguments access (#12052) (850230b)

(es/minifier) Apply ToUint16 in fromCharCode (#12055) (9ae7b92)

(es/minifier) Index strings by UTF-16 code unit (#12054) (bc263d2)

(es/minifier) Use numeric literals for non-finite values (#12048) (b830786)

(es/minifier) Preserve top-level declarations referenced only by direct eval (#12029) (ad0e3b4)

(es/optimization) Preserve JSON numeric values (#12051) (667af8c)

(es/transforms) Use numeric literals for non-finite enum values (#12049) (1e3ed5c)

(es/typescript) Evaluate cooked enum templates (#12059) (49d0b0f)

... (truncated)

Commits

0febbba chore: Publish 1.15.47 with swc_core v75.0.0
68abe42 chore: Publish 1.15.47-nightly-20260729.1 with swc_core v75.0.0
9383162 chore: Publish 1.15.46 with swc_core v74.0.1
035084a chore: Publish 1.15.46-nightly-20260719.1 with swc_core v74.0.1
42d599f chore: Publish 1.15.45-nightly-20260719.1 with swc_core v74.0.1
715eab8 chore: Publish 1.15.44-nightly-20260718.1 with swc_core v74.0.0
d6833cc refactor(es/lexer): remove smartstring dependency (#12013)
5761a2b refactor: remove direct rkyv dependencies (#12010)
f36e4b6 refactor(es/helpers): Generate inline helpers from canonical ESM sources (#12...
2f47530 fix(es/module): Rewrite SystemJS transform (#11996)
Additional commits viewable in compare view

Updates eslint from 10.7.0 to 10.8.1

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)

151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)

6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)

4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)

677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

7d0cbf8 docs: Update README (GitHub Actions Bot)

0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)

678c90b docs: Update README (GitHub Actions Bot)

8a10424 docs: Update README (GitHub Actions Bot)

69bb948 docs: Update README (GitHub Actions Bot)

Chores

0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])

05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)

5611035 test: add error locations info to no-void (#21185) (Lee Daeun)

ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])

f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)

1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)

d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)

65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)

22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)

55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])

7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])

eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)

60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)

f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)

d086293 test: add error locations to no-undef (#21147) (JIYEON)

cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)

688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)

7c1e175 test: add error locations to require-await (#21145) (Grit)

588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)

059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)

5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)

v10.8.0

Features

2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)

9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)

e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)

20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)

8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)

b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

... (truncated)

Commits

c049dc3 10.8.1
a3f7826 Build: changelog update for 10.8.1
18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173)
0a14800 chore: update github/codeql-action action to v4.37.4 (#21196)
7d0cbf8 docs: Update README
05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191)
5611035 test: add error locations info to no-void (#21185)
ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176)
f131c03 chore: improve ecosystem test failure reporting (#20937)
0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183)
Additional commits viewable in compare view

Updates js-yaml from 5.2.2 to 5.2.3

Changelog

Sourced from js-yaml's changelog.

[5.2.3] - 2026-08-01

Fixed

Prevent prototype fallback when resolving tags and mapping entries, #782.

Resolve !!timestamp years 0000-0099 correctly, #775.

Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.

Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

Commits

6740445 5.2.3 released
94e766d Update changelog
c3bd7ca Polish previous commit, #780
00209b6 presenter: treat a tab-indented line in a folded scalar as more-indented (#780)
40fcb4f Fix missing mapping values before document markers and reject unpaired mappin...
49280f3 Fix !!timestamp resolution for years 0000-0099, #775
355dc96 fix: prevent prototype fallback in tag and harden object lookups, #782 (than...
d524f83 docs: add contributing guidelines
See full diff in compare view

Updates lint-staged from 17.0.8 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes
#1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:
{
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}
As a concrete example, lint-staged's own configuration is:
/** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};
which means:

for all staged files, run the two commands in parallel with staged filenames appended, for example:

oxfmt --check --no-error-on-unmatched-pattern lib/index.js

oxlint --no-error-on-unmatched-pattern lib/index.js

additionally, if any *.ts files are staged, run tsc without appending any arguments

The two sets of commands also run in parallel
Patch Changes

#1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes
#1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:
{
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}
As a concrete example, lint-staged's own configuration is:
/** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};
which means:

for all staged files, run the two commands in parallel with staged filenames appended, for example:

oxfmt --check --no-error-on-unmatched-pattern lib/index.js

oxlint --no-error-on-unmatched-pattern lib/index.js

additionally, if any *.ts files are staged, run tsc without appending any arguments

The two sets of commands also run in parallel
Patch Changes

#1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

... (truncated)

Commits

d153443 Merge pull request #1828 from lint-staged/changeset-release/main
5162c14 chore(changeset): release
a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
ea96cab style: enable oxlint "suspicious" category
2fae007 style: add @e18e/eslint-plugin
2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
1453ae6 test: relax assertion so that it passes in worktree
15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
286e25c feat: allow running parallel tasks by nesting arrays
Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.79 to 0.0.87

Commits

d293ab2 release: v0.0.87
cc27684 release: v0.0.86
7ec965c release: v0.0.85
41bf979 release: v0.0.84
80d1b1b release: v0.0.83
2c98680 release: v0.0.82
889fedb release: v0.0.81
1091262 release: v0.0.80
568f597 feat(cli): support --bin for monorepos (#524)
ecd9bce fix: resolve workspace deps in publishConfig.directory package.json (#389) (#...
See full diff in compare view

Updates prettier from 3.9.5 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

Preserve quotes for methods named new (prettier/prettier#19621 by @kovsu)

Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @fisker)

Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @kovsu)
// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}
TypeScript: Support import defer (#19624, #19675 by @fisker)
// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";
JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:
Install the plugin:
yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

8f0c950 Release 3.9.6
e910764 Update changelog
ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
73d2efc Update Yuku parser to v0.7.0 (#19664)
dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
b74dd53 Update Yuku parser to v0.6.5 (#19654)
f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
3bbb815 Remove typescript-only directory (#19636)
Additional commits viewable in compare view

Updates sass from 1.101.0 to 1.102.0

Release notes

Sourced from sass's releases.

Dart Sass 1.102.0

To install Sass 1.102.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.7

To install Sass 1.101.7, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.6

To install Sass 1.101.6, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.5

To install Sass 1.101.5, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.4

To install Sass 1.101.4, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

... (truncated)

Changelog

Sourced from sass's changelog.

1.102.0

Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

1.101.7

No user-visible changes.

1.101.6

No user-visible changes.

1.101.5

No user-visible changes.

1.101.4

Avoid emitting rgb() or rgba() functions with non-percent decimal channels. Older browsers only support integer values or (potentially decimal) percentages for these functions, so in order to preserve backwards-compatibility while retaining full precision for modern browsers, legacy colors that contain at least one non-integer channel will now use percentages for their channels (for example, rgb(0%, 100%, 50%) rather than rgb(0, 255, 127.5)).

Fix a bug where the values of plain-CSS if() expressions were emitted using their meta.inspect() format rather than their CSS serialization format.

1.101.3

No user-visible changes.

1.101.2

Fix a bug where the deprecation warning for vendor-prefixed expression() functions would incorrectly indicate whether or not the function would be invalid Sass in Dart Sass 2.0.0.

1.101.1

Sass stack trace entries are now always either absolute URLs, absolute paths, or paths relative to the current working directory. Previously, if a stylesheet was loaded using a relative URL (as from a load path), that relative URL was listed even if it couldn't be resolved relative to the current working directory. However, this created potential ambiguities, so this behavior has been removed.

Command Line Interface

... (truncated)

Commits

45d1efe Use gamma 2.40 for display-referred rec2020 (#2729)
96aa291 Persist credentials on all repos we push to (#2812)
5af0b89 Set the Git committer for release tasks (#2811)
2cecbbb Fix more issues downstream from Zizmor (#2809)
a16f014 Emit floating-point rgb() values as percentages (#2800)
4ed2c88 Serialize if() values as CSS, not as inspected values (#2808)
9dfde3d Fix more post-Zizmor failures (#2806)
e8c1233 Fix some GitHub actions issues introduced by the Zizmor refactor (#2798)
d676118 Merge pull request #2797 from sass/lints
548e660 Prefer interpolation to compose strings
Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

npm package (@latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

preserve async ESM require fallback (55cbece)

This release is also available on:

npm package (@latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

support nyc coverage discovery (#710) (ec1bcd5)

This release is also available on:

npm package (@latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

map Node test locations (2f55884)

support data URLs in tsImport (b94f46f)

This release is also available on:

npm package (@latest dist-tag)

v4.23.8

... (truncated)

Commits

ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
651f5be test: cover CommonJS TypeScript import.meta paths
bd3bc64 test: cover CommonJS loader source fallback
55cbece fix: preserve async ESM require fallback
6c5ba85 docs: document CommonJS default interop
ec1bcd5 fix: support nyc coverage discovery (#710)
b6e5b48 docs: clarify CommonJS default imports
2f55884 fix: map Node test locations
de935d5 docs: document Node source-map stack formatting
b94f46f fix: support data URLs in tsImport
Additional commits viewable in compare view

Updates webpack from 5.108.4 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

Resolve aliases pointing at a package directory whose name ends with .js again. (by @alexander-akait in #21542)

Name CSS sources in source maps by their resource path, without the css prefix. (by @bjohansebas in #21536)

Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @bjohansebas in #21528)

Report "universal" as the loader context target for the universal target. (by @alexander-akait in #21540)

Skip require().prop in dead branches gated by inlined imported constants. (by @hai-x in #21517)

Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @bjohansebas in #21473)

v5.109.1

Patch Changes

Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @alexander-akait in #21533)

Make require(esm) module.exports re-export analysis independent of module processing order. (by @alexander-akait in #21521)

Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @alexander-akait in #21521)

Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @alexander-akait in #21503)

Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @alexander-akait in #21524)

Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @alexander-akait in #21492)

Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @alexander-akait in #21531)

Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @alexander-akait in #21500)

Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @alexander-akait in #21498)

Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @alexander-akait in #21504)

Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @alexander-akait in #21511)

Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @alexander-akait in #21506)

Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @bjohansebas in #21520)

Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @alexander-akait in #21516)

Enable the Node.js compile cache in the webpack CLI entry point. (by @bjohansebas in #21523)

Encode the persistent cache with V8's value serializer. (by @avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

Resolve aliases pointing at a package directory whose name ends with .js again. (by @alexander-akait in #21542)

Name CSS sources in source maps by their resource path, without the css prefix. (by @bjohansebas in #21536)

Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @bjohansebas in #21528)

Report "universal" as the loader context target for the universal target. (by @alexander-akait in #21540)

Skip require().prop in dead branches gated by inlined imported constants. (by @hai-x in #21517)

Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @bjohansebas in #21473)

5.109.1

Patch Changes

Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @alexander-akait in #21533)

Make require(esm) module.exports re-export analysis independent of module processing order. (by @alexander-akait in #21521)

Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @alexander-akait in #21521)

Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @alexander-akait in #21503)

Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @alexander-akait in #21524)

Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @alexander-akait in #21492)

Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @alexander-akait in #21531)

Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @alexander-akait in #21500)

Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @alexander-akait in #21498)

Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @alexander-akait in #21504)

Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @alexander-akait in #21511)

Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @alexander-akait<...
Description has been truncated

changeset-bot · 2026-08-05T18:06:46Z

⚠️ No Changeset found

Latest commit: f5c7e37

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-14T14:45:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
pkg-pr-new@0.0.79 ⏵ 0.0.87		⁺¹	⁺³
tsx@4.23.1 ⏵ 4.23.12		⁺¹
webpack@5.108.4 ⏵ 5.109.2		⁺¹
@swc/core@1.15.43 ⏵ 1.15.47			⁺²
js-yaml@5.2.2 ⏵ 5.2.3	⁺¹	⁺¹	⁺¹
eslint@10.7.0 ⏵ 10.8.1	⁺¹
lint-staged@17.0.8 ⏵ 17.3.0	⁺¹		⁺²
sass@1.101.0 ⏵ 1.102.0			⁺²
prettier@3.9.5 ⏵ 3.9.6		⁺¹

View full report

socket-security · 2026-08-14T14:45:27Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `webpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/webpack@5.109.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/webpack@5.109.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

evenstensberg · 2026-08-15T13:16:58Z

@dependabot recreate

…9 updates Bumps the dependencies group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core) | `1.15.43` | `1.15.47` | | [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.8.1` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.2` | `5.2.3` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.3.0` | | [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.79` | `0.0.87` | | [prettier](https://github.com/prettier/prettier) | `3.9.5` | `3.9.6` | | [sass](https://github.com/sass/dart-sass) | `1.101.0` | `1.102.0` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` | | [webpack](https://github.com/webpack/webpack) | `5.108.4` | `5.109.2` | Updates `@swc/core` from 1.15.43 to 1.15.47 - [Release notes](https://github.com/swc-project/swc/releases) - [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md) - [Commits](https://github.com/swc-project/swc/commits/v1.15.47/packages/core) Updates `eslint` from 10.7.0 to 10.8.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.7.0...v10.8.1) Updates `js-yaml` from 5.2.2 to 5.2.3 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.2.2...5.2.3) Updates `lint-staged` from 17.0.8 to 17.3.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.8...v17.3.0) Updates `pkg-pr-new` from 0.0.79 to 0.0.87 - [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.87/packages/cli) Updates `prettier` from 3.9.5 to 3.9.6 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.5...3.9.6) Updates `sass` from 1.101.0 to 1.102.0 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.101.0...1.102.0) Updates `tsx` from 4.23.1 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.1...v4.23.12) Updates `webpack` from 5.108.4 to 5.109.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.108.4...v5.109.2) --- updated-dependencies: - dependency-name: "@swc/core" dependency-version: 1.15.47 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: eslint dependency-version: 10.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: js-yaml dependency-version: 5.2.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: lint-staged dependency-version: 17.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: pkg-pr-new dependency-version: 0.0.86 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: sass dependency-version: 1.102.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: tsx dependency-version: 4.23.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: webpack dependency-version: 5.109.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 5, 2026

webpack Bot previously approved these changes Aug 5, 2026

View reviewed changes

webpack Bot enabled auto-merge (squash) August 5, 2026 18:06

dependabot Bot dismissed webpack[bot]’s stale review via fd850b3 August 7, 2026 14:44

dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-bed65c70a8 branch from 5da8830 to fd850b3 Compare August 7, 2026 14:44

webpack Bot previously approved these changes Aug 7, 2026

View reviewed changes

dependabot Bot dismissed webpack[bot]’s stale review via 59ee05f August 14, 2026 14:45

dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-bed65c70a8 branch from fd850b3 to 59ee05f Compare August 14, 2026 14:45

webpack Bot approved these changes Aug 14, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-bed65c70a8 branch from 59ee05f to f5c7e37 Compare August 15, 2026 13:20

webpack Bot approved these changes Aug 15, 2026

View reviewed changes

Navigation Menu

Uh oh!

Uh oh!

chore(deps-dev): bump the dependencies group across 1 directory with 9 updates - #4826

chore(deps-dev): bump the dependencies group across 1 directory with 9 updates#4826
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-bed65c70a8

dependabot Bot commented on behalf of github Aug 5, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

evenstensberg commented Aug 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[1.15.47] - 2026-07-29

Bug Fixes

v10.8.1

Bug Fixes

Documentation

Chores

v10.8.0

Features

Bug Fixes

[5.2.3] - 2026-08-01

Fixed

v17.3.0

Minor Changes

Patch Changes

v17.2.0

Minor Changes

17.3.0

Minor Changes

Patch Changes

17.2.0

Minor Changes

3.9.6

What's Changed

3.9.6

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

TypeScript: Support import defer (#19624, #19675 by @​fisker)

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

Dart Sass 1.102.0

Changes

Dart Sass 1.101.7

Changes

Dart Sass 1.101.6

Changes

Dart Sass 1.101.5

Changes

Dart Sass 1.101.4

1.102.0

1.101.7

1.101.6

1.101.5

1.101.4

1.101.3

1.101.2

1.101.1

Command Line Interface

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

v4.23.8

v5.109.2

Patch Changes

v5.109.1

Patch Changes

5.109.2

Patch Changes

5.109.1

Patch Changes

Uh oh!

changeset-bot Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

socket-security Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

dependabot Bot commented on behalf of github Aug 5, 2026 •

edited

Loading

TypeScript: Preserve quotes for methods named `new` (#19621 by `@kovsu`)

TypeScript: Support `import defer` (#19624, #19675 by `@fisker`)

JavaScript: Added a new official plugin `@prettier/plugin-yuku` (#19628, #19629 by `@fisker`)

changeset-bot Bot commented Aug 5, 2026 •

edited

Loading

socket-security Bot commented Aug 14, 2026 •

edited

Loading

socket-security Bot commented Aug 14, 2026 •

edited

Loading