chore(deps): bump the dependencies group across 1 directory with 13 updates by dependabot[bot] · Pull Request #4835 · webpack/webpack-cli

dependabot · 2026-08-27T12:09:04Z

Bumps the dependencies group with 13 updates in the / directory:

Package	From	To
@swc/core	`1.15.43`	`1.16.1`
cspell	`10.0.1`	`10.1.0`
eslint	`10.7.0`	`10.9.0`
js-yaml	`5.2.2`	`5.3.0`
lint-staged	`17.0.8`	`17.3.0`
pkg-pr-new	`0.0.79`	`0.0.88`
prettier	`3.9.5`	`3.9.6`
sass	`1.101.0`	`1.103.1`
tsx	`4.23.1`	`4.23.12`
webpack	`5.108.4`	`5.109.2`
webpack-bundle-analyzer	`5.3.1`	`5.3.2`
@inquirer/expand	`5.1.1`	`5.1.2`
@inquirer/select	`5.2.1`	`5.2.2`

Updates @swc/core from 1.15.43 to 1.16.1

Changelog

Sourced from @swc/core's changelog.

[1.16.1] - 2026-08-19

Bug Fixes

(es/minifier) Preserve for init (#12121) (0a1d4de)

(es/modules) Preserve destructuring assignment targets in SystemJS (#12122) (557060b)

(es/react) Handle apos JSX entities (#12125) (d09547f)

[1.16.0] - 2026-08-14

Bug Fixes

(encoding) Fix incorrect fields count (#11905) (6fb4ca1)

BREAKING: Fix incorrect fields count (#11905)

(es/ast) Prevent mutable reference escape (#12088) (592f559)

(es/ast) Fix panic on JSX surrogate entities (#11803) (d21de47)

BREAKING: fix panic on JSX surrogate entities (#11803)

(es/es2015) Preserve this in static field parameters (#12085) (5b758ed)

(es/minifier) Remove unused variable initializer cycles (#12106) (0421534)

(es/minifier) Bound arguments parameter injection (#12053) (46d6f41)

(es/preset-env) Lower unsupported async generators (#12086) (3a144b1)

(hstr) Avoid references to uninitialized bytes (#12087) (68f0983)

(plugin) Make raw byte reconstruction unsafe (#12089) (83ab4ed)

(plugin/runner) Write Wasmer cache atomically (#12100) (3c4f404)

... (truncated)

Commits

490c7d8 chore: Publish 1.16.1 with swc_core v77.0.2
7e4d782 chore: Publish 1.16.1-nightly-20260819.1 with swc_core v77.0.2
ae2117a chore: Publish 1.16.0 with swc_core v77.0.0
99671f1 chore: Publish 1.16.0-nightly-20260814.1 with swc_core v77.0.0
394c7c9 refactor(es/ast)!: introduce FunctionBody (#12096)
9ae902e refactor(es/ast)!: use Function for object accessors (#12077)
1687c0f refactor(es/ast)!: split TypeScript this parameters (#12075)
0febbba chore: Publish 1.15.47 with swc_core v75.0.0
68abe42 chore: Publish 1.15.47-nightly-20260729.1 with swc_core v75.0.0
9383162 chore: Publish 1.15.46 with swc_core v74.0.1
Additional commits viewable in compare view

Updates cspell from 10.0.1 to 10.1.0

Release notes

Sourced from cspell's releases.

v10.1.0

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:
<testsuite tests="3">
  <testcase classname="File1" name"/>
  <testcase classname="File2" name="AnotherSuccessfulTest"/>
  <testcase classname="foo3" name="AFailingTest">
    <failure type="prohibited word"> zzz </failure>
  </testcase>
</testsuite>
This PR follows that shape but wraps it in a <testsuites> root and groups by file (one <testsuite> per file, suite name = file path), since that is the convention used by other widely-consumed JUnit reporters (for example ESLint's JUnit formatter) and is what most CI JUnit parsers expect. The package README documents the full mapping.

package.json, tsconfig.json, test framework, and files/exports/publishConfig shape are copied from cspell-json-reporter. Version pinned to 10.0.1 to match the monorepo's locked versioning.

No third-party XML library was added. The repo has no existing XML dependency, so a small escaping helper (src/utils/escapeXml.ts) and a pure XML-string builder (src/utils/buildJUnitXml.ts) were written in-repo, consistent with the monorepo's small-utility-file convention.

Unit tests (32) cover: no files, a clean file (single passing testcase), a file with issues, escaping of special characters in paths/words/messages, a skipped file, and non-issue processing errors (error emitter routed to a dedicated cspell-errors testsuite using <error>).

Assumptions the issue thread left ambiguous, called out for review:

One <testsuite> per file rather than one flat suite for the whole run. Matches common JUnit reporter convention and keeps per-file counts meaningful in CI UIs.

A clean file gets one synthetic passing <testcase name="no issues found"> so a suite is never reported with tests="0", which some JUnit consumers treat as suspicious.

Settings are intentionally slimmer than cspell-json-reporter's (outFile, suiteName only). JUnit XML has no natural place for arbitrary debug/progress log dumps.

cspell processing errors are reported as <error> elements, distinct from spelling <failure> elements, per the JUnit failure-vs-error distinction.

Verified locally: tsc -b clean, vitest 32/32, eslint and prettier clean, and the full monorepo build:prod succeeds with the package in the workspace. One environment note: the package's CLI smoke-test script wasn't runnable locally (repo requires Node >=22.18.0, local was 22.17.0 — the sibling json-reporter fails identically there), so CI is the first place it will run.

Fixes

fix: allow substitutions across ignored ranges (#9017)

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.1.0 (2026-08-22)

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:
<testsuite tests="3">
  <testcase classname="File1" name"/>
  <testcase classname="File2" name="AnotherSuccessfulTest"/>
  <testcase classname="foo3" name="AFailingTest">
    <failure type="prohibited word"> zzz </failure>
  </testcase>
</testsuite>
This PR follows that shape but wraps it in a <testsuites> root and groups by file (one <testsuite> per file, suite name = file path), since that is the convention used by other widely-consumed JUnit reporters (for example ESLint's JUnit formatter) and is what most CI JUnit parsers expect. The package README documents the full mapping.

package.json, tsconfig.json, test framework, and files/exports/publishConfig shape are copied from cspell-json-reporter. Version pinned to 10.0.1 to match the monorepo's locked versioning.

No third-party XML library was added. The repo has no existing XML dependency, so a small escaping helper (src/utils/escapeXml.ts) and a pure XML-string builder (src/utils/buildJUnitXml.ts) were written in-repo, consistent with the monorepo's small-utility-file convention.

Unit tests (32) cover: no files, a clean file (single passing testcase), a file with issues, escaping of special characters in paths/words/messages, a skipped file, and non-issue processing errors (error emitter routed to a dedicated cspell-errors testsuite using <error>).

Assumptions the issue thread left ambiguous, called out for review:

One <testsuite> per file rather than one flat suite for the whole run. Matches common JUnit reporter convention and keeps per-file counts meaningful in CI UIs.

A clean file gets one synthetic passing <testcase name="no issues found"> so a suite is never reported with tests="0", which some JUnit consumers treat as suspicious.

Settings are intentionally slimmer than cspell-json-reporter's (outFile, suiteName only). JUnit XML has no natural place for arbitrary debug/progress log dumps.

cspell processing errors are reported as <error> elements, distinct from spelling <failure> elements, per the JUnit failure-vs-error distinction.

Verified locally: tsc -b clean, vitest 32/32, eslint and prettier clean, and the full monorepo build:prod succeeds with the package in the workspace. One environment note: the package's CLI smoke-test script wasn't runnable locally (repo requires Node >=22.18.0, local was 22.17.0 — the sibling json-reporter fails identically there), so CI is the first place it will run.

Fixes

fix: allow substitutions across ignored ranges (#9017)

... (truncated)

Commits

401518c v10.1.0
acf8449 chore: Prepare Release v10.1.0 (auto-deploy) (#8883)
3078371 fix: Workflow Bot -- Update Dictionaries (main) (#9024)
f557824 ci: Workflow Bot -- Update ALL Dependencies (main) (#9014)
1c11da6 ci: Workflow Bot -- Update ALL Dependencies (main) (#8970)
67448c8 chore: bump the development-dependencies group across 1 directory with 16 upd...
ce30dc7 chore: bump chalk from 5.6.2 to 6.0.0 (#8973)
9703748 ci: Workflow Bot -- Update ALL Dependencies (main) (#8952)
c8b94a7 doc: Update Node version requirement to 22 (#8940)
69c4b7f chore: bump commander from 14.0.3 to 15.0.0 (#8925)
Additional commits viewable in compare view

Updates eslint from 10.7.0 to 10.9.0

Release notes

Sourced from eslint's releases.

v10.9.0

Features

08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)

55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)

8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)

684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))

87f66f4 docs: Update README (GitHub Actions Bot)

585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)

f3993b0 docs: Update README (GitHub Actions Bot)

ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)

1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)

4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)

510d1a2 docs: Update README (GitHub Actions Bot)

Chores

899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])

9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)

dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)

f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])

4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])

v10.8.1

Bug Fixes

18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)

151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)

6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)

4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)

677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

7d0cbf8 docs: Update README (GitHub Actions Bot)

0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)

678c90b docs: Update README (GitHub Actions Bot)

8a10424 docs: Update README (GitHub Actions Bot)

69bb948 docs: Update README (GitHub Actions Bot)

Chores

0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])

05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)

5611035 test: add error locations info to no-void (#21185) (Lee Daeun)

ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])

f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)

1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)

d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)

... (truncated)

Commits

c27bc92 10.9.0
fa831d9 Build: changelog update for 10.9.0
899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243)
08de88e feat: handle underflow in no-loss-of-precision (#21218)
9ef407a docs: use eslint.config.* wherever config file names are listed (#21216)
9aa3873 chore: update ecosystem plugins (#21235)
2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213)
dc1e7a8 chore: update ecosystem plugins (#21208)
87f66f4 docs: Update README
8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204)
Additional commits viewable in compare view

Updates js-yaml from 5.2.2 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

Added completely new documentation.

Exported DUMP_SCHEMA, the default schema used by the dumper.

Added YAMLException.throwAt() for throwing an error at a source position.

Changed

Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.

Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

Deprecated flat constant exports. Use grouped ones instead.

Removed

Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

Validate << sequence items at merge time, so aliased merge sources are checked too.

Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

[5.2.3] - 2026-08-01

Fixed

Prevent prototype fallback when resolving tags and mapping entries, #782.

Resolve !!timestamp years 0000-0099 correctly, #775.

Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.

Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

Commits

04db458 5.3.0 released
22ce0a0 Changelog update
fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
cc665ec docs: review and update annotations
2aa24a6 Changelog update
eec6902 Restore deprecated parser constant exports
03397ac Move throwErrorAt to YAMLException as throwAt
d9dd2c7 docs: new condensed theme
0f898e6 docs: annotation tweaks
Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes
#1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:
{
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}
As a concrete example, lint-staged's own configuration is:
/** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};
which means:

for all staged files, run the two commands in parallel with staged filenames appended, for example:

oxfmt --check --no-error-on-unmatched-pattern lib/index.js

oxlint --no-error-on-unmatched-pattern lib/index.js

additionally, if any *.ts files are staged, run tsc without appending any arguments

The two sets of commands also run in parallel
Patch Changes

#1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes
#1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:
{
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}
As a concrete example, lint-staged's own configuration is:
/** @type {import('./lib/index.js').Configuration} */
export default {
  '*': [
    ['oxfmt --check --no-error-on-unmatched-pattern', 'oxlint --no-error-on-unmatched-pattern'],
  ],
  '*.ts': () => 'tsc',
}
which means:

for all staged files, run the two commands in parallel with staged filenames appended, for example:

oxfmt --check --no-error-on-unmatched-pattern lib/index.js

oxlint --no-error-on-unmatched-pattern lib/index.js

additionally, if any *.ts files are staged, run tsc without appending any arguments

The two sets of commands also run in parallel
Patch Changes

#1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  '*.ts': () => 'tsc', // Run "tsc" when any TS file is changed (for entire project)
}
Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

... (truncated)

Commits

d153443 Merge pull request #1828 from lint-staged/changeset-release/main
5162c14 chore(changeset): release
a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
ea96cab style: enable oxlint "suspicious" category
2fae007 style: add @e18e/eslint-plugin
2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
1453ae6 test: relax assertion so that it passes in worktree
15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
286e25c feat: allow running parallel tasks by nesting arrays
Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.79 to 0.0.88

Commits

b594954 release: v0.0.88
d293ab2 release: v0.0.87
cc27684 release: v0.0.86
7ec965c release: v0.0.85
41bf979 release: v0.0.84
80d1b1b release: v0.0.83
2c98680 release: v0.0.82
889fedb release: v0.0.81
1091262 release: v0.0.80
568f597 feat(cli): support --bin for monorepos (#524)
Additional commits viewable in compare view

Updates prettier from 3.9.5 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

Preserve quotes for methods named new (prettier/prettier#19621 by @kovsu)

Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @fisker)

Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @kovsu)
// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}
TypeScript: Support import defer (#19624, #19675 by @fisker)
// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";
JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:
Install the plugin:
yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

8f0c950 Release 3.9.6
e910764 Update changelog
ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
73d2efc Update Yuku parser to v0.7.0 (#19664)
dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
b74dd53 Update Yuku parser to v0.6.5 (#19654)
f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
3bbb815 Remove typescript-only directory (#19636)
Additional commits viewable in compare view

Updates sass from 1.101.0 to 1.103.1

Release notes

Sourced from sass's releases.

Dart Sass 1.103.1

To install Sass 1.103.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.103.0

To install Sass 1.103.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Potentially breaking compatibility fix: Colors now preserve "analogous sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none) instead of lab(50% 0 0).

See the full changelog for changes in earlier releases.

Dart Sass 1.102.0

To install Sass 1.102.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.7

To install Sass 1.101.7, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

No user-visible changes.

See the full changelog for changes in earlier releases.

Dart Sass 1.101.6

To install Sass 1.101.6, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

... (truncated)

Changelog

Sourced from sass's changelog.

1.103.1

No user-visible changes.

1.103.0

Potentially breaking compatibility fix: Colors now preserve "analogous sets" of missing channels during conversions, per the CSS spec. For example, color.to-space(lch(50% none none), lab) now returns lab(50% none none) instead of lab(50% 0 0).

1.102.0

Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

1.101.7

No user-visible changes.

1.101.6

No user-visible changes.

1.101.5

No user-visible changes.

1.101.4

Avoid emitting rgb() or rgba() functions with non-percent decimal channels. Older browsers only support integer values or (potentially decimal) percentages for these functions, so in order to preserve backwards-compatibility while retaining full precision for modern browsers, legacy colors that contain at least one non-integer channel will now use percentages for their channels (for example, rgb(0%, 100%, 50%) rather than rgb(0, 255, 127.5)).

Fix a bug where the values of plain-CSS if() expressions were emitted using their meta.inspect() format rather than their CSS serialization format.

1.101.3

No user-visible changes.

1.101.2

Fix a bug where the deprecation warning for vendor-prefixed expression() functions would incorrectly indicate whether or not the function would be invalid Sass in Dart Sass 2.0.0.

... (truncated)

Commits

62243d4 Set committer metadata when creating a tag (#2838)
ed4dcc7 Use more dot shorthands (#2837)
ac3d928 Support analogous sets of missing channels (#2810)
1e0cf28 Merge pull request #2834 from ntkme/fix-release
f3bd86a Merge pull request #2835 from sass/dart-sdk-version
287f9ba Code review
91831b8 Fix dartdoc error
0971ea9 Bump bufbuild/buf-action from 1.4.0 to 1.5.0 in /.github/util/initialize (#2826)
c45223b Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.2 (#2828)
cbb1db1 Bump dart-lang/setup-dart from 1.7.2 to 1.8.0 (#2829)
Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

npm package (@latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

preserve async ESM require fallback (55cbece)

This release is also available on:

npm package (@latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

support nyc coverage discovery (#710) (ec1bcd5)

This release is also available on:

npm package (@latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

map Node test locations (2f55884)

support data URLs in tsImport (b94f46f)

This release is also available on:

npm package (@latest dist-tag)

v4.23.8

... (truncated)

Commits

ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
651f5be test: cover CommonJS TypeScript import.meta paths
bd3bc64 test: cover CommonJS loader source fallback
55cbece fix: preserve async ESM require fallback
6c5ba85 docs: document CommonJS default interop
ec1bcd5 fix: support nyc coverage discovery (#710)
b6e5b48 docs: clarify CommonJS default imports
2f55884 fix: map Node test locations
de935d5 docs: document Node source-map stack formatting
b94f46f fix: support data URLs in tsImport
Additional commits viewable in compare view

Updates webpack from 5.108.4 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

Resolve aliases pointing at a package directory whose name ends with .js again. (by @alexander-akait in #21542)

Name CSS sources in source maps by their resource path, without the css prefix. (by @bjohansebas in #21536)

Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @bjohansebas in #21528)

Report "universal" as the loader context target for the universal target. (by @alexander-akait in

…pdates Bumps the dependencies group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@swc/core](https://github.com/swc-project/swc/tree/HEAD/packages/core) | `1.15.43` | `1.16.1` | | [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.0.1` | `10.1.0` | | [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.9.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `5.2.2` | `5.3.0` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.3.0` | | [pkg-pr-new](https://github.com/stackblitz-labs/pkg.pr.new/tree/HEAD/packages/cli) | `0.0.79` | `0.0.88` | | [prettier](https://github.com/prettier/prettier) | `3.9.5` | `3.9.6` | | [sass](https://github.com/sass/dart-sass) | `1.101.0` | `1.103.1` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` | | [webpack](https://github.com/webpack/webpack) | `5.108.4` | `5.109.2` | | [webpack-bundle-analyzer](https://github.com/webpack/webpack-bundle-analyzer) | `5.3.1` | `5.3.2` | | [@inquirer/expand](https://github.com/SBoudrias/Inquirer.js) | `5.1.1` | `5.1.2` | | [@inquirer/select](https://github.com/SBoudrias/Inquirer.js) | `5.2.1` | `5.2.2` | Updates `@swc/core` from 1.15.43 to 1.16.1 - [Release notes](https://github.com/swc-project/swc/releases) - [Changelog](https://github.com/swc-project/swc/blob/main/CHANGELOG.md) - [Commits](https://github.com/swc-project/swc/commits/v1.16.1/packages/core) Updates `cspell` from 10.0.1 to 10.1.0 - [Release notes](https://github.com/streetsidesoftware/cspell/releases) - [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md) - [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.1.0/packages/cspell) Updates `eslint` from 10.7.0 to 10.9.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.7.0...v10.9.0) Updates `js-yaml` from 5.2.2 to 5.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.2.2...5.3.0) Updates `lint-staged` from 17.0.8 to 17.3.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.8...v17.3.0) Updates `pkg-pr-new` from 0.0.79 to 0.0.88 - [Commits](https://github.com/stackblitz-labs/pkg.pr.new/commits/v0.0.88/packages/cli) Updates `prettier` from 3.9.5 to 3.9.6 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.5...3.9.6) Updates `sass` from 1.101.0 to 1.103.1 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.101.0...1.103.1) Updates `tsx` from 4.23.1 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.1...v4.23.12) Updates `webpack` from 5.108.4 to 5.109.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.108.4...v5.109.2) Updates `webpack-bundle-analyzer` from 5.3.1 to 5.3.2 - [Release notes](https://github.com/webpack/webpack-bundle-analyzer/releases) - [Changelog](https://github.com/webpack/webpack-bundle-analyzer/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-bundle-analyzer@v5.3.1...v5.3.2) Updates `@inquirer/expand` from 5.1.1 to 5.1.2 - [Release notes](https://github.com/SBoudrias/Inquirer.js/releases) - [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/expand@5.1.1...@inquirer/expand@5.1.2) Updates `@inquirer/select` from 5.2.1 to 5.2.2 - [Release notes](https://github.com/SBoudrias/Inquirer.js/releases) - [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/select@5.2.1...@inquirer/select@5.2.2) --- updated-dependencies: - dependency-name: "@swc/core" dependency-version: 1.16.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: cspell dependency-version: 10.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: eslint dependency-version: 10.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: js-yaml dependency-version: 5.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: lint-staged dependency-version: 17.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: pkg-pr-new dependency-version: 0.0.88 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: sass dependency-version: 1.103.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: tsx dependency-version: 4.23.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: webpack dependency-version: 5.109.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: webpack-bundle-analyzer dependency-version: 5.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@inquirer/expand" dependency-version: 5.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@inquirer/select" dependency-version: 5.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-08-27T12:09:11Z

⚠️ No Changeset found

Latest commit: 488e0a3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-27T12:09:42Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
pkg-pr-new@0.0.79 ⏵ 0.0.88	⁺¹	⁺¹	⁺³
tsx@4.23.1 ⏵ 4.23.12		⁺¹
webpack@5.108.4 ⏵ 5.109.2		⁺¹
js-yaml@5.2.2 ⏵ 5.3.0	⁺¹	^-12	⁺¹
@inquirer/select@5.2.1 ⏵ 5.2.2			^-4
@inquirer/expand@5.1.1 ⏵ 5.1.2			^-4
webpack-bundle-analyzer@5.3.1 ⏵ 5.3.2			^-2
cspell@10.0.1 ⏵ 10.1.0			⁺²
@swc/core@1.15.43 ⏵ 1.16.1			⁺²
prettier@3.9.5 ⏵ 3.9.6		⁺¹
lint-staged@17.0.8 ⏵ 17.3.0	⁺¹		⁺²
eslint@10.7.0 ⏵ 10.9.0	⁺¹		⁺²
sass@1.101.0 ⏵ 1.103.1			⁺²

View full report

socket-security · 2026-08-27T12:09:45Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `webpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/webpack@5.109.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/webpack@5.109.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-08-27T12:11:06Z

This PR is packaged and the instant preview is available (488e0a3).

Install it locally:

npm

npm i -D webpack-cli@https://pkg.pr.new/webpack-cli@488e0a3

yarn

yarn add -D webpack-cli@https://pkg.pr.new/webpack-cli@488e0a3

pnpm

pnpm add -D webpack-cli@https://pkg.pr.new/webpack-cli@488e0a3

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 27, 2026

webpack Bot approved these changes Aug 27, 2026

View reviewed changes

webpack Bot enabled auto-merge (squash) August 27, 2026 12:10

Navigation Menu

Uh oh!

Uh oh!

chore(deps): bump the dependencies group across 1 directory with 13 updates - #4835

chore(deps): bump the dependencies group across 1 directory with 13 updates#4835
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-cba31bbdee

dependabot Bot commented on behalf of github Aug 27, 2026

Uh oh!

changeset-bot Bot commented Aug 27, 2026

Uh oh!

socket-security Bot commented Aug 27, 2026

Uh oh!

socket-security Bot commented Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 27, 2026

[1.16.1] - 2026-08-19

Bug Fixes

[1.16.0] - 2026-08-14

Bug Fixes

v10.1.0

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Fixes

fix: allow substitutions across ignored ranges (#9017)

v10.1.0 (2026-08-22)

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Fixes

fix: allow substitutions across ignored ranges (#9017)

v10.9.0

Features

Bug Fixes

Documentation

Chores

v10.8.1

Bug Fixes

Documentation

Chores

[5.3.0] - 2026-08-14

Added

Changed

Deprecated

Removed

Fixed

[5.2.3] - 2026-08-01

Fixed

v17.3.0

Minor Changes

Patch Changes

v17.2.0

Minor Changes

17.3.0

Minor Changes

Patch Changes

17.2.0

Minor Changes

3.9.6

What's Changed

3.9.6

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

TypeScript: Support import defer (#19624, #19675 by @​fisker)

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

Dart Sass 1.103.1

Changes

Dart Sass 1.103.0

Changes

Dart Sass 1.102.0

Changes

Dart Sass 1.101.7

Changes

Dart Sass 1.101.6

1.103.1

1.103.0

1.102.0

1.101.7

1.101.6

1.101.5

1.101.4

1.101.3

1.101.2

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

v4.23.9

4.23.9 (2026-08-06)

TypeScript: Preserve quotes for methods named `new` (#19621 by `@kovsu`)

TypeScript: Support `import defer` (#19624, #19675 by `@fisker`)

JavaScript: Added a new official plugin `@prettier/plugin-yuku` (#19628, #19629 by `@fisker`)