Skip to content

Bump the npm_and_yarn group across 1 directory with 4 updates - #5

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/Server/npm_and_yarn-4d59037a13
Closed

Bump the npm_and_yarn group across 1 directory with 4 updates#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/Server/npm_and_yarn-4d59037a13

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 4 updates in the /Server directory: webpack, fast-uri, picomatch and postcss.

Updates webpack from 5.99.9 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

v5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

  • Encode the persistent cache with V8's value serializer. (by @​avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

... (truncated)

Commits
  • 6a24bd6 chore(release): new release (#21534)
  • d1b5b6d fix: resolve aliases pointing at a package directory ending in .js (#21542)
  • 9cdcc57 fix(target): report "universal" as the loader target (#21540)
  • 774e7e4 feat: annotate schema options with added keywords (#21473)
  • ff07bdc fix(css): name CSS sources in source maps by their resource path (#21536)
  • d56d82d fix(cache): reclaim stale filesystem cache files reliably (#21539)
  • ae67e2a chore(readme): add codspeed (#21497)
  • 964bbfa fix: delete no longer referenced files from the filesystem cache directory (#...
  • 075d0cd feat: skip require().prop in dead branches (#21517)
  • ec39088 chore(release): new release (#21493)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.


Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

Updates picomatch from 4.0.2 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

New Contributors

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

New Contributors

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

Commits
  • 4f41a8e 4.0.5
  • 02cfc1b Update .verb.md and run verb to generate README documentation
  • cc52ff6 Only run the upload code coverage step for 1 matrix permutation
  • 6d426d7 Allow workflow to continue if the code coverage step to fails
  • a00b954 Merge branch 'codeql-coverage'
  • 9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
  • 648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
  • 70e6485 Configure code coverage upload for CodeQL
  • ab8bc4d fix: honor the windows option when matching basenames
  • 6289307 fix: preserve all branches when rewriting risky repeated extglobs
  • Additional commits viewable in compare view

Updates postcss from 8.5.3 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

  • Fixed declaration parsing performance (by @​homanp).

8.5.14

8.5.13

  • Fixed postcss-scss commend regression.

8.5.12

  • Fixed reading any file via user-generated CSS.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

8.5.15

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 4 updates
0c1c8ed 
Bumps the npm_and_yarn group with 4 updates in the /Server directory: [webpack](https://github.com/webpack/webpack), [fast-uri](https://github.com/fastify/fast-uri), [picomatch](https://github.com/micromatch/picomatch) and [postcss](https://github.com/postcss/postcss).


Updates `webpack` from 5.99.9 to 5.109.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.99.9...v5.109.2)

Updates `fast-uri` from 3.1.2 to 3.1.5
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.2...v3.1.5)

Updates `picomatch` from 4.0.2 to 4.0.5
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.2...4.0.5)

Updates `postcss` from 8.5.3 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.3...8.5.25)

---
updated-dependencies:
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026
@github-actions

github-actions Bot commented Jul 31, 2026

Copy link
Copy Markdown

At the moment we are not accepting contributions to the repository.

Feedback for GitHub Copilot for Xcode can be given in the Copilot community discussions.

@github-actions github-actions Bot closed this Jul 31, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/Server/npm_and_yarn-4d59037a13 branch July 31, 2026 13:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants