Skip to content

chore(deps): bump the dependencies group across 1 directory with 41 updates - #5738

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-f01597c923
Closed

chore(deps): bump the dependencies group across 1 directory with 41 updates#5738
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-f01597c923

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 41 updates in the / directory:

Package From To
@types/express-serve-static-core 5.1.1 5.1.3
bonjour-service 1.3.0 1.4.4
compression 1.8.1 1.8.2
http-proxy-middleware 4.1.1 4.2.0
ipaddr.js 2.3.0 2.5.0
open 11.0.0 11.0.4
p-retry 8.0.0 8.0.1
schema-utils 4.3.3 4.5.0
tinyglobby 0.2.15 0.2.17
webpack-dev-middleware 8.0.3 8.3.0
ws 8.21.0 8.21.3
@babel/cli 7.28.6 7.29.7
@babel/core 7.29.6 7.29.7
@babel/eslint-parser 7.28.6 7.29.7
@babel/plugin-transform-object-assign 7.27.1 7.29.7
@babel/preset-env 7.29.2 7.29.7
@changesets/cli 2.31.0 2.31.1
@hono/node-server 1.19.15 1.19.17
@types/node 24.10.1 24.13.4
@types/picomatch 4.0.2 4.0.3
acorn 8.16.0 8.18.0
babel-loader 10.0.0 10.1.1
core-js 3.47.0 3.50.0
css-loader 7.1.2 7.1.5
eslint-config-webpack 4.9.6 4.13.0
eslint-plugin-n 17.23.1 17.24.0
expect 30.4.1 30.5.1
hono 4.12.34 4.13.8
html-webpack-plugin 5.6.5 5.6.8
httpxy 0.5.3 0.5.5
jest-mock 30.4.1 30.5.1
less 4.5.1 4.9.1
less-loader 12.3.0 12.3.3
memfs 4.57.1 4.78.0
prettier 3.6.2 3.9.6
pretty-format 30.4.1 30.5.1
puppeteer 25.3.0 25.11.0
tcp-port-used 1.0.2 1.0.3
typescript-eslint 8.59.3 8.70.0
webpack 5.108.0 5.111.0
webpack-cli 7.2.1 7.2.3

Updates @types/express-serve-static-core from 5.1.1 to 5.1.3

Commits

Updates bonjour-service from 1.3.0 to 1.4.4

Release notes

Sourced from bonjour-service's releases.

1.4.4

What's Changed

New Contributors

Full Changelog: onlxltd/bonjour-service@1.4.3...1.4.4

1.4.3

Full Changelog: onlxltd/bonjour-service@1.4.2...1.4.3

Update for index.ts to fix imports #79 Thanks to @​andersk & @​Nerivec for their work identifying this issue.

1.4.2

What's Changed

Full Changelog: onlxltd/bonjour-service@1.4.1...1.4.2

1.4.1

What's Changed

Full Changelog: onlxltd/bonjour-service@1.4.0...1.4.1

1.4.0

What's Changed

New Contributors

Full Changelog: onlxltd/bonjour-service@1.3.0...1.4.0

Commits
  • e72ca10 Update yarn.lock
  • 693311c Merge branch 'dependabot/npm_and_yarn/js-yaml-4.3.0'
  • 2f0b012 Merge branch 'dependabot/npm_and_yarn/tar-7.5.22'
  • f870315 Bump js-yaml from 4.2.0 to 4.3.0
  • a17fe30 Bump tar from 7.5.16 to 7.5.22
  • 38fadf7 Export classes as types too, not just values
  • ee3a3c0 Update for imports
  • 1eda77d Update .npmignore
  • d7746b1 Update yarn.lock
  • 6fe0a0d Bump js-yaml from 4.1.1 to 4.2.0
  • Additional commits viewable in compare view

Updates compression from 1.8.1 to 1.8.2
Updates http-proxy-middleware from 4.1.1 to 4.2.0

Release notes

Sourced from http-proxy-middleware's releases.

v4.2.0

What's Changed

New Contributors

Full Changelog: chimurai/http-proxy-middleware@v4.1.1...v4.2.0

Changelog

Sourced from http-proxy-middleware's changelog.

v4.2.0

  • feat(types): export OnProxyEvent type
  • feat(debug-proxy-errors-plugin): diagnostic message for POST + bodyParser + ECONNRESET error
  • chore(package.json): update to httpxy v0.5.4
Commits
  • 4abb1ba chore(package.json): v4.2.0 (#1276)
  • d40ae3e chore(package.json): update dependencies (#1275)
  • 89a78d0 chore(debug-proxy-errors-plugin): fix BODY_PARSER_ERROR_MESSAGE formatting (#...
  • 7ba87a9 feat(debug-proxy-errors-plugin): debug message for bodyParser + ECONNRESET er...
  • 006f1a4 test(e2e): assert invalid multipart error log (#1272)
  • 22281bf test(e2e): add HttpAgent keepAlive test (#472) (#1267)
  • 5b37301 chore(package.json): bump dev deps (#1265)
  • 3695b93 refactor(errors): use HttpProxyMiddlewareError class (#1264)
  • b9242af feat(types): export OnProxyEvent type (#1263)
  • See full diff in compare view

Updates ipaddr.js from 2.3.0 to 2.5.0

Changelog

Sourced from ipaddr.js's changelog.

2.5.0 - 2026-08-04

  • remove ipaddr.min.js, end users must provide own minification/bundling
  • fix: compress the leftmost zero run in toString (RFC 5952, 4.2.3)
  • fix: strict IPv6 validation — reject :: with zero compression and hextets >4 hex digits
  • fix: reject non-numeric prefix length in subnetMaskFromPrefixLength
  • fix: compress trailing zero run in toString when a zoneIndex is present
  • fix: throw a descriptive error for malformed input in IPv6.parse

2.4.0 - 2026-05-03

  • remove Bower support
  • add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges
Commits

Updates open from 11.0.0 to 11.0.4

Release notes

Sourced from open's releases.

v11.0.4

  • Fix browser/browserPrivate not detecting Safari or Brave as the default browser 6ae6196

sindresorhus/open@v11.0.3...v11.0.4

v11.0.3

  • Fix Windows launches being killed when the parent process exits 734b821

sindresorhus/open@v11.0.2...v11.0.3

v11.0.2

  • Update dependencies 6f006ad

sindresorhus/open@v11.0.1...v11.0.2

v11.0.1

  • Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4

sindresorhus/open@v11.0.0...v11.0.1

Commits

Updates p-retry from 8.0.0 to 8.0.1

Release notes

Sourced from p-retry's releases.

v8.0.1

  • Fix error for invalid fractional retry counts 3c22035

sindresorhus/p-retry@v8.0.0...v8.0.1

Commits

Updates schema-utils from 4.3.3 to 4.5.0

Release notes

Sourced from schema-utils's releases.

v4.5.0

Minor Changes

  • The absolutePath keyword reads a file: URL the way Node's own URL parser does: the scheme may be followed by any number of slashes, so file:/directory is accepted alongside file:///directory, and it is matched case-insensitively, so FILE:///directory is too. A scheme with no slash after it — file:directory — still names no absolute path and is rejected. (by @​alexander-akait in #226)

v4.4.0

Minor Changes

  • The absolutePath keyword accepts an optional file:// prefix now, so a path from import.meta.resolve() can be passed to an option that takes an absolute path. Options that take a relative path reject such a value instead, they used to accept it. (by @​laymonage, @​alexander-akait in #222)

  • process.env.SKIP_VALIDATION is now read when schema-utils is loaded rather than on every validation, so set it before starting the process. enableValidation()/disableValidation() still take effect immediately and now share their state with every copy of schema-utils in the process directly. (by @​alexander-akait in #217)

  • At most 100 errors of a list are listed in the message now, the rest is counted as and N more errors. errors still holds every error. (by @​alexander-akait in #217)

Patch Changes

  • read the format keyword as part of the type, i.e. should be a date string instead of should be a string (should match format "date") (by @​alexander-akait in #225)

  • output the type of object properties in error messages, i.e. object { foo?: boolean, bar?: integer } (by @​alexander-akait in #224)

  • Updated ajv to 8.20.0, ajv-formats to 3.0.1 and @types/json-schema to 7.0.15. ajv-formats 3 only moves ajv to a peer dependency, the formats themselves are unchanged. (by @​alexander-akait in #221)

  • A string an absolutePath keyword applies to is described as an absolute path string or a relative path string rather than as a bare string, which read as though any string would do. A failure a schema reaches through more than one branch is listed once instead of repeatedly, so a relative path given to a rule condition is reported as the one line that says so. (by @​alexander-akait in #223)

  • Fixed error filtering being quadratic in the amount of reported errors, which let a large invalid configuration lock up the process, and stopped errors from being dropped when one instance path merely contained another as a substring - two sibling properties where one name is a prefix of the other were enough to lose an error. An array of options reporting a lot of errors no longer throws RangeError: Maximum call stack size exceeded instead of a ValidationError. (by @​alexander-akait in #217)

All notable changes to this project will be documented in this file.

4.3.3 (2025-10-02)

Bug Fixes

  • reexport ValidationErrorConfiguration type (#204) (49af922)

4.3.2 (2025-04-22)

Bug Fixes

4.3.1 (2025-04-22)

Bug Fixes

  • export Schema and additional schemas (#197) (f72cd60)
Changelog

Sourced from schema-utils's changelog.

4.5.0

Minor Changes

  • The absolutePath keyword reads a file: URL the way Node's own URL parser does: the scheme may be followed by any number of slashes, so file:/directory is accepted alongside file:///directory, and it is matched case-insensitively, so FILE:///directory is too. A scheme with no slash after it — file:directory — still names no absolute path and is rejected. (by @​alexander-akait in #226)

4.4.0

Minor Changes

  • The absolutePath keyword accepts an optional file:// prefix now, so a path from import.meta.resolve() can be passed to an option that takes an absolute path. Options that take a relative path reject such a value instead, they used to accept it. (by @​laymonage, @​alexander-akait in #222)

  • process.env.SKIP_VALIDATION is now read when schema-utils is loaded rather than on every validation, so set it before starting the process. enableValidation()/disableValidation() still take effect immediately and now share their state with every copy of schema-utils in the process directly. (by @​alexander-akait in #217)

  • At most 100 errors of a list are listed in the message now, the rest is counted as and N more errors. errors still holds every error. (by @​alexander-akait in #217)

Patch Changes

  • read the format keyword as part of the type, i.e. should be a date string instead of should be a string (should match format "date") (by @​alexander-akait in #225)

  • output the type of object properties in error messages, i.e. object { foo?: boolean, bar?: integer } (by @​alexander-akait in #224)

  • Updated ajv to 8.20.0, ajv-formats to 3.0.1 and @types/json-schema to 7.0.15. ajv-formats 3 only moves ajv to a peer dependency, the formats themselves are unchanged. (by @​alexander-akait in #221)

  • A string an absolutePath keyword applies to is described as an absolute path string or a relative path string rather than as a bare string, which read as though any string would do. A failure a schema reaches through more than one branch is listed once instead of repeatedly, so a relative path given to a rule condition is reported as the one line that says so. (by @​alexander-akait in #223)

  • Fixed error filtering being quadratic in the amount of reported errors, which let a large invalid configuration lock up the process, and stopped errors from being dropped when one instance path merely contained another as a substring - two sibling properties where one name is a prefix of the other were enough to lose an error. An array of options reporting a lot of errors no longer throws RangeError: Maximum call stack size exceeded instead of a ValidationError. (by @​alexander-akait in #217)

All notable changes to this project will be documented in this file.

Commits
  • 1cb9c8d chore(release): new release (#227)
  • 9578e1a feat: read a file: URL the way Node does in absolutePath (#226)
  • b4fd660 chore(release): new release (#220)
  • 0f99aa9 feat: read the format keyword as part of the type (#225)
  • 4baf113 feat: output the type of object properties in error messages (#224)
  • 49bb7ce fix: say which strings an absolutePath keyword accepts (#223)
  • 5c21244 feat: allow file:// protocol prefix in absolute paths (#222)
  • fc918a9 chore: update dependencies (#221)
  • d72a15b chore: release with changesets (#219)
  • 1d0404e test: cover collecting a subtree of errors and grouping a nested anyOf (#218)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for schema-utils since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates tinyglobby from 0.2.15 to 0.2.17

Release notes

Sourced from tinyglobby's releases.

0.2.17

Changed

  • Enabled staged publishing for stronger supply-chain security

Fixed

  • Defaults when undefined is passed to any of the options by @​chloeelim
  • Drive-relative paths on Windows by @​Andrej730
  • FileSystemAdapter is now exported again

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

0.2.16

Fixed

Changed

  • Overhauled and optimized most internals by @​Torathion
  • Ignore patterns are no longer compiled twice by @​webpro

Consider sponsoring if you'd like to support the development of this project and the goal of reaching a lighter and faster ecosystem

Changelog

Sourced from tinyglobby's changelog.

0.2.17

Changed

  • Enabled staged publishing for stronger supply-chain security

Fixed

  • Defaults when undefined is passed to any of the options by chloeelim
  • Drive-relative paths on Windows by Andrej730
  • FileSystemAdapter is now exported again

0.2.16

Fixed

Changed

  • Overhauled and optimized most internals by Torathion
  • Ignore patterns are no longer compiled twice by webpro
Commits

Updates webpack-dev-middleware from 8.0.3 to 8.3.0

Release notes

Sourced from webpack-dev-middleware's releases.

v8.3.0

Minor Changes

  • Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @​bjohansebas in #2370)

  • Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @​alexander-akait in #2392)

Patch Changes

  • Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @​bjohansebas in #2378)

  • Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @​bjohansebas in #2404)

  • Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @​alexander-akait in #2396)

  • Update dependencies. (by @​alexander-akait in #2394)

v8.2.0

Minor Changes

  • Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @​bjohansebas in #2322)

v8.1.1

Patch Changes

  • Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @​bjohansebas in #2347)

v8.1.0

Minor Changes

  • Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @​bjohansebas in #2371)

v8.0.4

Patch Changes

  • Replace the on-finished dependency with Node.js built-in stream.finished. (by @​bjohansebas in #2346)
Changelog

Sourced from webpack-dev-middleware's changelog.

8.3.0

Minor Changes

  • Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @​bjohansebas in #2370)

  • Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @​alexander-akait in #2392)

Patch Changes

  • Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @​bjohansebas in #2378)

  • Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @​bjohansebas in #2404)

  • Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @​alexander-akait in #2396)

  • Update dependencies. (by @​alexander-akait in #2394)

8.2.0

Minor Changes

  • Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @​bjohansebas in #2322)

8.1.1

Patch Changes

  • Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @​bjohansebas in #2347)

8.1.0

Minor Changes

  • Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @​bjohansebas in #2371)

8.0.4

Patch Changes

  • Replace the on-finished dependency with Node.js built-in stream.finished. (by @​bjohansebas in #2346)
Commits

Updates ws from 8.21.0 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

  • The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

  • Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

  • Empty fragments are now counted toward the limit (a2f4e7c0).
  • The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).
Commits
  • c791e70 [dist] 8.21.3
  • e97a20e [fix] Reject offers with client_max_window_bits below config
  • 787ebf2 [dist] 8.21.2
  • b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
  • e4bb883 [security] Use GitHub PVR as main reporting channel
  • 2eb3be0 [test] Skip test on Node.js versions where it does not apply
  • ae1de54 [dist] 8.21.1
  • 8e9511b [ci] Trust Coveralls Homebrew tap
  • f197ac6 [fix] Lower default values of maxBufferedChunks and maxFragments
  • 8df8265 [ci] Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates @babel/cli from 7.28.6 to 7.29.7

Release notes

Sourced from @​babel/cli's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

💅 Polish

  • babel-parser

... (truncated)

Commits

Updates @babel/core from 7.29.6 to 7.29.7

Release notes

Sourced from @​babel/core's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

Commits

Updates @babel/eslint-parser from 7.28.6 to 7.29.7

Release notes

Sourced from @​babel/eslint-parser's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

    ...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2026
@changeset-bot

changeset-bot Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 1b59d6d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@socket-security

socket-security Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​babel/​plugin-transform-object-assign@​7.27.1 ⏵ 7.29.71001006589 -1100
Updatedless@​4.5.1 ⏵ 4.9.16610096 +1699 +3100
Updatedexpect@​30.4.1 ⏵ 30.5.11001007392100
Updated@​types/​picomatch@​4.0.2 ⏵ 4.0.31001007381100
Updatedtypescript-eslint@​8.59.3 ⏵ 8.70.010010074 +198100
Updated@​types/​express-serve-static-core@​5.1.1 ⏵ 5.1.3100 +110075 +186100
Updated@​babel/​preset-env@​7.29.2 ⏵ 7.29.7971007695 -2100
Updated@​babel/​cli@​7.28.6 ⏵ 7.29.7991007695100
Updated@​babel/​eslint-parser@​7.28.6 ⏵ 7.29.71001007789100
Updatedtinyglobby@​0.2.15 ⏵ 0.2.17100 +11007782100
Updated@​babel/​core@​7.29.6 ⏵ 7.29.7971007993100
Updated@​types/​node@​24.10.1 ⏵ 24.13.4100 +110081 +196100
Updatedp-retry@​8.0.0 ⏵ 8.0.1100100100 +182 -4100
Updatedipaddr.js@​2.3.0 ⏵ 2.5.0100 +1100100 +184 +3100
Updatedcss-loader@​7.1.2 ⏵ 7.1.59910010084100
Updatedtcp-port-used@​1.0.2 ⏵ 1.0.310010010085 +5100
Updatedbonjour-service@​1.3.0 ⏵ 1.4.410010010085 -6100
Updatedhttpxy@​0.5.3 ⏵ 0.5.5100 +1100100 +185100
Updatedbabel-loader@​10.0.0 ⏵ 10.1.110010010085100
Updatedcore-js@​3.47.0 ⏵ 3.50.094 +110099 +186100
Updatedacorn@​8.16.0 ⏵ 8.18.0100 +1100100 +187100
Updatedless-loader@​12.3.0 ⏵ 12.3.3100 +110010088100
Updatedeslint-plugin-n@​17.23.1 ⏵ 17.24.09810010088 -6100
Updatedhtml-webpack-plugin@​5.6.5 ⏵ 5.6.899 +110010089 +2100
Updatedcompression@​1.8.1 ⏵ 1.8.299100100 +189100
Updatedws@​8.21.0 ⏵ 8.21.39910010089100
Updatedhttp-proxy-middleware@​4.1.1 ⏵ 4.2.099 +110010091 -2100
Updatedeslint-config-webpack@​4.9.6 ⏵ 4.13.091 +3100100 +1598 +3100
Updatedopen@​11.0.0 ⏵ 11.0.4100 +1100100 +191100
Updated@​hono/​node-server@​1.19.15 ⏵ 1.19.1710010010092100
Updatedpuppeteer@​25.3.0 ⏵ 25.11.092 +110093 +196 -1100
Updatedjest-mock@​30.4.1 ⏵ 30.5.1100100100 +192100
See 9 more rows in the dashboard

View full report

@dependabot
chore(deps): bump the dependencies group across 1 directory with 41 u…
1b59d6d 
…pdates

Bumps the dependencies group with 41 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/express-serve-static-core](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express-serve-static-core) | `5.1.1` | `5.1.3` |
| [bonjour-service](https://github.com/onlxltd/bonjour-service) | `1.3.0` | `1.4.4` |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `4.1.1` | `4.2.0` |
| [ipaddr.js](https://github.com/whitequark/ipaddr.js) | `2.3.0` | `2.5.0` |
| [open](https://github.com/sindresorhus/open) | `11.0.0` | `11.0.4` |
| [p-retry](https://github.com/sindresorhus/p-retry) | `8.0.0` | `8.0.1` |
| [schema-utils](https://github.com/webpack/schema-utils) | `4.3.3` | `4.5.0` |
| [tinyglobby](https://github.com/SuperchupuDev/tinyglobby) | `0.2.15` | `0.2.17` |
| [webpack-dev-middleware](https://github.com/webpack/webpack-dev-middleware) | `8.0.3` | `8.3.0` |
| [ws](https://github.com/websockets/ws) | `8.21.0` | `8.21.3` |
| [@babel/cli](https://github.com/babel/babel/tree/HEAD/packages/babel-cli) | `7.28.6` | `7.29.7` |
| [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) | `7.29.6` | `7.29.7` |
| [@babel/eslint-parser](https://github.com/babel/babel/tree/HEAD/eslint/babel-eslint-parser) | `7.28.6` | `7.29.7` |
| [@babel/plugin-transform-object-assign](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-object-assign) | `7.27.1` | `7.29.7` |
| [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) | `7.29.2` | `7.29.7` |
| [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli) | `2.31.0` | `2.31.1` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.15` | `1.19.17` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.10.1` | `24.13.4` |
| [@types/picomatch](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/picomatch) | `4.0.2` | `4.0.3` |
| [acorn](https://github.com/acornjs/acorn) | `8.16.0` | `8.18.0` |
| [babel-loader](https://github.com/babel/babel-loader) | `10.0.0` | `10.1.1` |
| [core-js](https://github.com/zloirock/core-js/tree/HEAD/packages/core-js) | `3.47.0` | `3.50.0` |
| [css-loader](https://github.com/webpack/css-loader) | `7.1.2` | `7.1.5` |
| [eslint-config-webpack](https://github.com/webpack/eslint-config-webpack) | `4.9.6` | `4.13.0` |
| [eslint-plugin-n](https://github.com/eslint-community/eslint-plugin-n) | `17.23.1` | `17.24.0` |
| [expect](https://github.com/jestjs/jest/tree/HEAD/packages/expect) | `30.4.1` | `30.5.1` |
| [hono](https://github.com/honojs/hono) | `4.12.34` | `4.13.8` |
| [html-webpack-plugin](https://github.com/jantimon/html-webpack-plugin) | `5.6.5` | `5.6.8` |
| [httpxy](https://github.com/unjs/httpxy) | `0.5.3` | `0.5.5` |
| [jest-mock](https://github.com/jestjs/jest/tree/HEAD/packages/jest-mock) | `30.4.1` | `30.5.1` |
| [less](https://github.com/less/less.js) | `4.5.1` | `4.9.1` |
| [less-loader](https://github.com/webpack/less-loader) | `12.3.0` | `12.3.3` |
| [memfs](https://github.com/streamich/memfs) | `4.57.1` | `4.78.0` |
| [prettier](https://github.com/prettier/prettier) | `3.6.2` | `3.9.6` |
| [pretty-format](https://github.com/jestjs/jest/tree/HEAD/packages/pretty-format) | `30.4.1` | `30.5.1` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `25.3.0` | `25.11.0` |
| [tcp-port-used](https://github.com/stdarg/tcp-port-used) | `1.0.2` | `1.0.3` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.59.3` | `8.70.0` |
| [webpack](https://github.com/webpack/webpack) | `5.108.0` | `5.111.0` |
| [webpack-cli](https://github.com/webpack/webpack-cli) | `7.2.1` | `7.2.3` |



Updates `@types/express-serve-static-core` from 5.1.1 to 5.1.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express-serve-static-core)

Updates `bonjour-service` from 1.3.0 to 1.4.4
- [Release notes](https://github.com/onlxltd/bonjour-service/releases)
- [Commits](onlxltd/bonjour-service@1.3.0...1.4.4)

Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](expressjs/compression@v1.8.1...v1.8.2)

Updates `http-proxy-middleware` from 4.1.1 to 4.2.0
- [Release notes](https://github.com/chimurai/http-proxy-middleware/releases)
- [Changelog](https://github.com/chimurai/http-proxy-middleware/blob/master/CHANGELOG.md)
- [Commits](chimurai/http-proxy-middleware@v4.1.1...v4.2.0)

Updates `ipaddr.js` from 2.3.0 to 2.5.0
- [Changelog](https://github.com/whitequark/ipaddr.js/blob/main/Changes.md)
- [Commits](https://github.com/whitequark/ipaddr.js/commits)

Updates `open` from 11.0.0 to 11.0.4
- [Release notes](https://github.com/sindresorhus/open/releases)
- [Commits](sindresorhus/open@v11.0.0...v11.0.4)

Updates `p-retry` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/sindresorhus/p-retry/releases)
- [Commits](sindresorhus/p-retry@v8.0.0...v8.0.1)

Updates `schema-utils` from 4.3.3 to 4.5.0
- [Release notes](https://github.com/webpack/schema-utils/releases)
- [Changelog](https://github.com/webpack/schema-utils/blob/main/CHANGELOG.md)
- [Commits](webpack/schema-utils@v4.3.3...v4.5.0)

Updates `tinyglobby` from 0.2.15 to 0.2.17
- [Release notes](https://github.com/SuperchupuDev/tinyglobby/releases)
- [Changelog](https://github.com/SuperchupuDev/tinyglobby/blob/main/CHANGELOG.md)
- [Commits](SuperchupuDev/tinyglobby@0.2.15...0.2.17)

Updates `webpack-dev-middleware` from 8.0.3 to 8.3.0
- [Release notes](https://github.com/webpack/webpack-dev-middleware/releases)
- [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-middleware@v8.0.3...v8.3.0)

Updates `ws` from 8.21.0 to 8.21.3
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.0...8.21.3)

Updates `@babel/cli` from 7.28.6 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-cli)

Updates `@babel/core` from 7.29.6 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `@babel/eslint-parser` from 7.28.6 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/eslint/babel-eslint-parser)

Updates `@babel/plugin-transform-object-assign` from 7.27.1 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-object-assign)

Updates `@babel/preset-env` from 7.29.2 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-preset-env)

Updates `@changesets/cli` from 2.31.0 to 2.31.1
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/@changesets/cli@2.31.1/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@2.31.1/packages/cli)

Updates `@hono/node-server` from 1.19.15 to 1.19.17
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](https://github.com/honojs/node-server/commits/v1.19.17)

Updates `@types/node` from 24.10.1 to 24.13.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/picomatch` from 4.0.2 to 4.0.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/picomatch)

Updates `acorn` from 8.16.0 to 8.18.0
- [Commits](acornjs/acorn@8.16.0...8.18.0)

Updates `babel-loader` from 10.0.0 to 10.1.1
- [Release notes](https://github.com/babel/babel-loader/releases)
- [Changelog](https://github.com/babel/babel-loader/blob/main/CHANGELOG.md)
- [Commits](babel/babel-loader@v10.0.0...v10.1.1)

Updates `core-js` from 3.47.0 to 3.50.0
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/commits/v3.50.0/packages/core-js)

Updates `css-loader` from 7.1.2 to 7.1.5
- [Release notes](https://github.com/webpack/css-loader/releases)
- [Changelog](https://github.com/webpack/css-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/css-loader@v7.1.2...v7.1.5)

Updates `eslint-config-webpack` from 4.9.6 to 4.13.0
- [Release notes](https://github.com/webpack/eslint-config-webpack/releases)
- [Changelog](https://github.com/webpack/eslint-config-webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/eslint-config-webpack@v4.9.6...v4.13.0)

Updates `eslint-plugin-n` from 17.23.1 to 17.24.0
- [Release notes](https://github.com/eslint-community/eslint-plugin-n/releases)
- [Changelog](https://github.com/eslint-community/eslint-plugin-n/blob/master/CHANGELOG.md)
- [Commits](eslint-community/eslint-plugin-n@v17.23.1...v17.24.0)

Updates `expect` from 30.4.1 to 30.5.1
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.5.1/packages/expect)

Updates `hono` from 4.12.34 to 4.13.8
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.34...v4.13.8)

Updates `html-webpack-plugin` from 5.6.5 to 5.6.8
- [Release notes](https://github.com/jantimon/html-webpack-plugin/releases)
- [Changelog](https://github.com/jantimon/html-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](jantimon/html-webpack-plugin@v5.6.5...v5.6.8)

Updates `httpxy` from 0.5.3 to 0.5.5
- [Release notes](https://github.com/unjs/httpxy/releases)
- [Changelog](https://github.com/unjs/httpxy/blob/main/CHANGELOG.md)
- [Commits](unjs/httpxy@v0.5.3...v0.5.5)

Updates `jest-mock` from 30.4.1 to 30.5.1
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.5.1/packages/jest-mock)

Updates `less` from 4.5.1 to 4.9.1
- [Release notes](https://github.com/less/less.js/releases)
- [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md)
- [Commits](less/less.js@v4.5.1...v4.9.1)

Updates `less-loader` from 12.3.0 to 12.3.3
- [Release notes](https://github.com/webpack/less-loader/releases)
- [Changelog](https://github.com/webpack/less-loader/blob/main/CHANGELOG.md)
- [Commits](webpack/less-loader@v12.3.0...v12.3.3)

Updates `memfs` from 4.57.1 to 4.78.0
- [Release notes](https://github.com/streamich/memfs/releases)
- [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md)
- [Commits](streamich/memfs@v4.57.1...v4.78.0)

Updates `prettier` from 3.6.2 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.6.2...3.9.6)

Updates `pretty-format` from 30.4.1 to 30.5.1
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.5.1/packages/pretty-format)

Updates `puppeteer` from 25.3.0 to 25.11.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-v25.3.0...puppeteer-v25.11.0)

Updates `tcp-port-used` from 1.0.2 to 1.0.3
- [Commits](https://github.com/stdarg/tcp-port-used/commits)

Updates `typescript-eslint` from 8.59.3 to 8.70.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.0/packages/typescript-eslint)

Updates `webpack` from 5.108.0 to 5.111.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.108.0...v5.111.0)

Updates `webpack-cli` from 7.2.1 to 7.2.3
- [Release notes](https://github.com/webpack/webpack-cli/releases)
- [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webpack/webpack-cli/compare/webpack-cli@7.2.1...webpack-cli@7.2.3)

---
updated-dependencies:
- dependency-name: "@babel/cli"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@babel/eslint-parser"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@babel/plugin-transform-object-assign"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@babel/preset-env"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@changesets/cli"
  dependency-version: 2.31.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/express-serve-static-core"
  dependency-version: 5.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 24.13.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/picomatch"
  dependency-version: 4.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: acorn
  dependency-version: 8.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: babel-loader
  dependency-version: 10.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: bonjour-service
  dependency-version: 1.4.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: core-js
  dependency-version: 3.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: css-loader
  dependency-version: 7.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: eslint-config-webpack
  dependency-version: 4.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint-plugin-n
  dependency-version: 17.24.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: expect
  dependency-version: 30.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: hono
  dependency-version: 4.13.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: html-webpack-plugin
  dependency-version: 5.6.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: http-proxy-middleware
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: httpxy
  dependency-version: 0.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ipaddr.js
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: jest-mock
  dependency-version: 30.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: less
  dependency-version: 4.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: less-loader
  dependency-version: 12.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: memfs
  dependency-version: 4.75.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: open
  dependency-version: 11.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: p-retry
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pretty-format
  dependency-version: 30.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: puppeteer
  dependency-version: 25.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: schema-utils
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: tcp-port-used
  dependency-version: 1.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: tinyglobby
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.70.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: webpack
  dependency-version: 5.110.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: webpack-cli
  dependency-version: 7.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: webpack-dev-middleware
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: ws
  dependency-version: 8.21.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-f01597c923 branch from dddc445 to 1b59d6d Compare September 18, 2026 13:22
@alexander-akait alexander-akait mentioned this pull request Sep 18, 2026
Merged
alexander-akait added a commit that referenced this pull request Sep 18, 2026
@alexander-akait
chore(deps): update dependencies, including majors
eaca64d 
Applies the in-range bumps from #5738 (41 packages, lockfile only) and
takes 17 of the 23 available majors. `eslint` and `typescript` are held
back as asked.

`@babel/core`, `@babel/cli`, `@babel/preset-env` and
`babel-plugin-transform-import-meta` are also held back: Babel 8 has no
stable `@babel/plugin-transform-object-assign`, only `8.0.0-beta.*`, and
that plugin is what the client build uses to keep `Object.assign` working
on old browsers. Taking Babel 8 would mean shipping a beta or dropping
that support, so it needs its own decision.

What the upgrades required:

- `execa` 10 no longer returns an event emitter, so `cp.on("exit")` and
  `cp.on("error")` are gone. The CLI lifecycle tests now settle on the
  subprocess promise, with `reject: false` where a non-zero exit is the
  expected outcome. It also dropped its default export.
- `@changesets/get-github-info` 1 replaced `getInfo`/`getInfoFromPullRequest`
  with `getCommitInfo`/`getPullRequestInfo`, which return structured objects
  that may be `undefined` rather than a `links` map of markdown strings.
  The changelog generator is ported to that shape. The package is ESM-only
  behind an `exports` map the import resolver cannot follow, so
  `import/no-unresolved` is disabled for that one file.
- `@types/node` 26 types `socket.server`, so a `@ts-expect-error` in
  `lib/Server.js` became unused and had to go.
- webpack 5.111 (in range) reworded its module-parse diagnostic to name the
  module type and include a code frame; the four overlay snapshots that
  capture that text are regenerated.
- prettier 3.9 (in range) reformats `lib/Server.js`, `test/e2e/client.test.js`
  and `migration-v4.md`. These are its output, not hand edits — #5738 on its
  own would fail `fmt:check` without them.

No changeset: the published `dependencies` ranges are unchanged, so nothing
here reaches consumers.
alexander-akait added a commit that referenced this pull request Sep 18, 2026
@alexander-akait @claude
chore(deps): update dependencies, including majors (#5743)
9b4dd8c 
* chore(deps): update dependencies, including majors

Applies the in-range bumps from #5738 (41 packages, lockfile only) and
takes 17 of the 23 available majors. `eslint` and `typescript` are held
back as asked.

`@babel/core`, `@babel/cli`, `@babel/preset-env` and
`babel-plugin-transform-import-meta` are also held back: Babel 8 has no
stable `@babel/plugin-transform-object-assign`, only `8.0.0-beta.*`, and
that plugin is what the client build uses to keep `Object.assign` working
on old browsers. Taking Babel 8 would mean shipping a beta or dropping
that support, so it needs its own decision.

What the upgrades required:

- `execa` 10 no longer returns an event emitter, so `cp.on("exit")` and
  `cp.on("error")` are gone. The CLI lifecycle tests now settle on the
  subprocess promise, with `reject: false` where a non-zero exit is the
  expected outcome. It also dropped its default export.
- `@changesets/get-github-info` 1 replaced `getInfo`/`getInfoFromPullRequest`
  with `getCommitInfo`/`getPullRequestInfo`, which return structured objects
  that may be `undefined` rather than a `links` map of markdown strings.
  The changelog generator is ported to that shape. The package is ESM-only
  behind an `exports` map the import resolver cannot follow, so
  `import/no-unresolved` is disabled for that one file.
- `@types/node` 26 types `socket.server`, so a `@ts-expect-error` in
  `lib/Server.js` became unused and had to go.
- webpack 5.111 (in range) reworded its module-parse diagnostic to name the
  module type and include a code frame; the four overlay snapshots that
  capture that text are regenerated.
- prettier 3.9 (in range) reformats `lib/Server.js`, `test/e2e/client.test.js`
  and `migration-v4.md`. These are its output, not hand edits — #5738 on its
  own would fail `fmt:check` without them.

No changeset: the published `dependencies` ranges are unchanged, so nothing
here reaches consumers.

* chore(deps): drop commitlint, update babel to 8 and the github actions

Four cleanups that all reduce what the repository has to install or pin.

Remove commitlint. It is no longer used, so the two `@commitlint/*` packages,
`commitlint.config.js`, the `.husky/commit-msg` hook, the npm script and the
pull request step in CI all go. `fetch-depth: 0` stays on the lint job's
checkout: `validate:changeset` still diffs against `origin/$GITHUB_BASE_REF`.

Stop declaring the eslint plugins. `eslint-config-webpack` depends on
`@eslint/markdown`, `eslint-config-prettier`, `eslint-plugin-import`,
`eslint-plugin-jsdoc`, `eslint-plugin-n` and `typescript-eslint` itself, and
flat config resolves a plugin from the config that names it rather than from
the project root, so declaring them here only pins a second, drifting copy —
ours held `eslint-plugin-jsdoc` a major ahead of the config's own range.
`eslint` and `typescript` stay, as the config's two peers.
`@babel/eslint-parser` goes too: nothing references it.

Update babel to 8. The blocker was `@babel/plugin-transform-object-assign`,
which babel never released for 8 — it is pinned to `@babel/core@^7` even on
its `8.0.0-beta.4` tag. The plugin is twelve lines and the client build does
need it, because the bundled `webpack/lib/logging/runtime.js` calls
`Object.assign`, so it is now a local plugin next to the one this repo already
had. Babel 8 also parses `import()` as `ImportExpression` rather than a
`CallExpression` with an `Import` callee, which silently stopped
`rewrite-relative-dynamic-import` from rewriting anything; it now visits the
new node and declines an `import()` carrying attributes, which has no
`require()` equivalent. `babel-plugin-transform-import-meta` 3 moves with it —
it requires `@babel/core@^8.0.1`.

`dist/` is byte-identical to the babel 7 output, both with the local plugin on
babel 7 and after the upgrade. `client/` differs only in where babel emits its
`_inherits` helper.

Update the github actions: checkout 6 to 7, setup-node 6 to 7,
upload-artifact 4 to 7, download-artifact 4 to 8, codecov-action 6 to 7 and
changesets/action 1 to 2, each pinned to the release tag's commit.
`changesets/action` 2 is the one with a migration: it is the version built for
changesets 3, which this repository now installs, and it renamed the three
inputs used here. It also no longer touches `.npmrc`, so the `NPM_TOKEN: ""`
workaround is gone; `GITHUB_TOKEN` stays because `changeset version` runs the
changelog generator, which queries the GitHub API.

`schema-utils` 4.5.0 prints the type of a simple optional property, so the
`validate-options` snapshots that quote it are regenerated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA

* test: stop the two things that make a run's failures depend on the run

`validate-options` snapshotted `thrownError.toString()`, which is
`schema-utils` rendering the whole of `lib/options.json` into prose: every
sibling property's type, the `description` and `link` text, the entire `anyOf`
tree. None of that is this project's behaviour, so the snapshots moved whenever
schema-utils or ajv did — 4.5.0 rewrote ten of them, and CI went red, by
spelling out the type of simple optional properties (`directory?` became
`directory?: non-empty string`) in options the release never touched.

What is ours is which option path the error blames, so that is what it
snapshots now, alongside an assertion that a `ValidationError` was thrown and
named at least one path. `allowedHosts: [""]` still reads as
`options.allowedHosts[0]` rather than `options.allowedHosts`, so a schema
mis-nesting still fails, and the file is 355 lines shorter and reviewable.

The second one only shows up as a difference between runs. A test that throws
between `server.start()` and `server.stop()` never reaches its own cleanup, so
the server keeps the port and every later test in the file fails with
`EADDRINUSE`. One genuine failure is then reported as dozens, and which ones
depends on timing — `host.test.js` gave 25, 27 and 33 failures on three runs of
identical code. The harness now tracks listening servers and stops whatever a
test leaves behind, exempting the ones a `before` hook started for a whole
suite, which are already listening when the first test begins.

Nothing in the suite stops relying on its own cleanup; this only bounds the
damage when that cleanup is skipped. On this machine, whose sandbox has no
IPv6 and no routable address, `host.test.js` goes from 5 passing to 15, with no
`EADDRINUSE` left and the same 15/15 split on three consecutive runs, and the
e2e suite as a whole from 453 passing to 463.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA

* test: make the cli lifecycle tests run the cli

`CodeRabbit` pointed out that with `reject: false` a subprocess which never
started settles like a healthy one, so `cp.then(() => resolve())` resolves the
test without reaching any assertion. That is right, and it turned out not to be
hypothetical: the two SIGINT tests passed `["--port", port, cliPath]` to node,
which takes `--port` as one of its own options and exits 9 with
`node: bad option: --port` before the CLI is ever loaded. No output, no signal
sent, and both tests green. They have been vacuous since long before this
branch; the execa migration carried the shape over, and only asserting on the
result exposes it.

So the CLI path now goes first, and all four record whether their trigger fired
and assert on how the subprocess ended: a clean exit for the SIGINT pair, which
is the evidence the CLI's trap ran rather than that something killed it, and
for the stdin pair too. Windows has no POSIX signals — `kill("SIGINT")`
terminates outright, so the trap cannot run — and only that assertion is
skipped there.

Put back the old argument order and all four now fail, where before they
passed.

The stdin writes can land after the subprocess is gone; an unhandled `error` on
that stream would take the test process down, so it is swallowed and the
subprocess result is the verdict.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA

* test: keep a server tracked until its shutdown resolves

`CodeRabbit` is right that the sweep dropped a server from the tracked set the
moment `stop()` was called rather than when it finished. A shutdown that
rejects leaves the port held and the server untracked, so `afterEach` saw
nothing to clean up and the next test got the `EADDRINUSE` the sweep exists to
prevent; a `stop()` a test never awaits has the same shape. No test does the
latter today, but the sweep is there for when things go wrong, so both count.

A server now leaves the set only once its shutdown has actually resolved, and
`afterEach` settles any shutdown still in flight before deciding what leaked.
When the retry rejects too, the listener is closed directly: `stop()` can
reject before it ever reaches `this.server.close()`, and that port is exactly
what the next test pays for.

`test/harness-server-cleanup.test.js` covers the three ways a server survives
its test — left running, stopped without awaiting, and a shutdown that rejects
— each followed by a test that has to bind the same port again. All six pass
with the sweep; five fail without it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA

* test: stop watchFiles tests demanding one reload per changed file

`watch-files.test.js` hung for its full 400s timeout on CI. The cause is
structural rather than environmental: the two multi-path tests write two files
and then wait for `changed === 2`, where each `change` handler awaits its own
`page.waitForNavigation()`. The server sends one reload for both writes —
measured, two change events at +0ms and exactly one main-frame navigation — so
the two handlers are both relying on latching onto that single navigation.

They only do when both change events land in the same tick. In different poll
cycles the first handler consumes the navigation and the second registers after
it has already finished, waits out the 120s navigation timeout, and has its
rejection swallowed because the handler is an uncaught `async` function. The
outer promise then never settles and the test burns the whole timeout with a
message that names nothing.

So those two now wait for one navigation and assert what is actually under
test: that the watcher reports both paths.

The single-file tests are rewritten the same way, arming both waits before the
write and joining them with `Promise.all`. The race does not arise there — the
write is synchronous and the handler runs in the same tick — but the swallowed
rejection does: any navigation failure became a 400s hang rather than a
`TimeoutError` naming the page. `multi-compiler.test.js` and `logging.test.js`
look similar and are deliberately untouched: their `waitForNavigation()` is
already called in the same synchronous block as the write, so there is nothing
to fix and the churn would only hide this change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UjuMAuk9o6UazjHzcAQCTA

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 18, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dependencies-f01597c923 branch September 18, 2026 20:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants