[dependabot]

Bumps the javascript group with 9 updates:

Package	From	To
@swc/core	1.15.43	1.15.47
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8
react-on-rails	17.0.0-rc.6	17.0.1
shakapacker	10.2.0	10.3.0
webpack	5.108.3	5.109.2
webpack-cli	7.1.0	7.2.2
daisyui	5.6.7	5.7.7
webpack-dev-server	5.2.5	6.0.0

Updates @swc/core from 1.15.43 to 1.15.47

Changelog

Sourced from @​swc/core's changelog.

[1.15.47] - 2026-07-29

Bug Fixes

• (es) Preserve numeric property key identity (#12050) (46900a3)

• (es/ast) Support hashing non-finite numbers (#12043) (f4b85a6)

• (es/codegen) Emit non-finite numeric literals (#12047) (883abc4)

• (es/decorators) Avoid class state leakage for nested undecorated classes (#12076) (4c9d277)

• (es/minifier) Apply ToInt32 when folding bitwise NOT (#12058) (550e2f7)

• (es/minifier) Avoid inexact number radix folding (#12057) (506a0ea)

• (es/minifier) Preserve invalid Array lengths (#12056) (3ce9e16)

• (es/minifier) Preserve non-canonical arguments access (#12052) (850230b)

• (es/minifier) Apply ToUint16 in fromCharCode (#12055) (9ae7b92)

• (es/minifier) Index strings by UTF-16 code unit (#12054) (bc263d2)

• (es/minifier) Use numeric literals for non-finite values (#12048) (b830786)

• (es/minifier) Preserve top-level declarations referenced only by direct eval (#12029) (ad0e3b4)

• (es/optimization) Preserve JSON numeric values (#12051) (667af8c)

• (es/transforms) Use numeric literals for non-finite enum values (#12049) (1e3ed5c)

• (es/typescript) Evaluate cooked enum templates (#12059) (49d0b0f)

... (truncated)

Commits

• 0febbba chore: Publish 1.15.47 with swc_core v75.0.0
• 68abe42 chore: Publish 1.15.47-nightly-20260729.1 with swc_core v75.0.0
• 9383162 chore: Publish 1.15.46 with swc_core v74.0.1
• 035084a chore: Publish 1.15.46-nightly-20260719.1 with swc_core v74.0.1
• 42d599f chore: Publish 1.15.45-nightly-20260719.1 with swc_core v74.0.1
• 715eab8 chore: Publish 1.15.44-nightly-20260718.1 with swc_core v74.0.0
• d6833cc refactor(es/lexer): remove smartstring dependency (#12013)
• 5761a2b refactor: remove direct rkyv dependencies (#12010)
• f36e4b6 refactor(es/helpers): Generate inline helpers from canonical ESM sources (#12...
• 2f47530 fix(es/module): Rewrite SystemJS transform (#11996)
• Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-on-rails from 17.0.0-rc.6 to 17.0.1

Release notes

Sourced from react-on-rails's releases.

v17.0.1

Fixed

• Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

v17.0.1.rc.0

Fixed

• Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

v17.0.0

Breaking Changes

• [Pro] Removed the undocumented ReactOnRailsPro::Cache.fetch_react_component class API: Pro apps should use the supported cached helper APIs (cached_react_component, cached_react_component_hash, and related helpers) instead of calling the low-level cache class directly. The helper cache path still preserves generated-pack loading on cache hits, tag registration, and expires_at handling internally. Fixes #4497. #4541 by justin808.
• [Pro] React Server Components now require the stable React 19.2.x RSC line: Pro RSC apps on React on Rails 17 require react-on-rails-rsc >= 19.2.1 < 19.3, React >= 19.2.7, and matching React DOM. Non-RSC Pro apps retain React 18 support. The Pro generator scaffolds that coordinated stable runtime and rejects all prerelease RSC packages while the stable floor is active. The adopted react-on-rails-rsc artifact uses the React on Rails Pro commercial terms rather than MIT and reports SEE LICENSE IN LICENSE.md in npm metadata. Set REACT_ON_RAILS_PRO_DISABLE_VERSION_CHECK=1 only as an emergency rollout escape hatch to downgrade startup errors to warnings. #4357. #4490 and #4670 by justin808.
• Removed the inert config.server_render_method option: The open-source configuration no longer accepts config.server_render_method. The option never selected a server render method — the open-source gem always renders with ExecJS — and its validator raised ReactOnRails::Error at boot for any value other than blank or "ExecJS". Setting it now raises NoMethodError at boot, so delete any config.server_render_method = ... line from config/initializers/react_on_rails.rb; rake react_on_rails:doctor also flags the stale line. For a standalone Node rendering process, use React on Rails Pro's Node renderer, configured via ReactOnRailsPro.configure. Fixes #4415. #4423 by justin808.
• Removed three deprecated configuration options (config.generated_assets_dirs, config.skip_display_none, config.defer_generated_component_packs): These were deprecated in v16 and are gone in v17. Setting any of them now raises NoMethodError at boot; delete the stale lines from config/initializers/react_on_rails.rb (rake react_on_rails:doctor flags them). Migration: delete config.generated_assets_dirs — public asset paths come from public_output_path in config/shakapacker.yml; delete config.skip_display_none — it had no runtime effect; replace config.defer_generated_component_packs = true with config.generated_component_packs_loading_strategy = :defer, and simply delete config.defer_generated_component_packs = false (the removed option was truthy-gated — only = true set :defer; = false was a no-op that fell through to the default strategy, so it did not mean :sync; set :sync explicitly only if you relied on synchronous loading). The default strategy is :async for Pro or :defer for non-Pro on Shakapacker 8.2.0+, and :sync on older Shakapacker. Fixes #4419. #4432 by justin808.
• Removed the never-wired RenderRequest / JsCodeBuilder / RenderingStrategy rendering layer: The internal strategy-pattern classes ReactOnRails::RenderRequest, ReactOnRails::JsCodeBuilder, ReactOnRails::RenderingStrategy (with ExecJsStrategy), and — in Pro — ReactOnRailsPro::JsCodeBuilder and ReactOnRailsPro::RenderingStrategy::NodeStrategy, plus the undocumented ReactOnRails.rendering_strategy and ReactOnRails.js_code_builder module accessors, are removed. This scaffolding was built for the strategy-pattern refactor in #2905 (closed without wiring it in) and was never invoked on any production server-rendering path — SSR runs through ServerRenderingJsCode and ServerRenderingPool, which never touched this layer. These constants and accessors were internal and undocumented; if you reference them in application code, remove the reference (the layer performed no work). Fixes #4414. #4437 by justin808.
• Removed undocumented ReactOnRails::Utils helpers: React on Rails 17 removes the unused ReactOnRails::Utils.server_rendering_is_enabled? and ReactOnRails::Utils.rails_version_less_than helper methods. Remove any application calls to those helpers; release-example generation now owns its private Rails-version check outside the public Utils surface. Fixes #4418. #4431 by justin808.
• Ruby 3.3+ is required for React on Rails v17: The open-source gem now requires Ruby >= 3.3.0, aligning it with React on Rails Pro, create-react-on-rails-app, and the CI minimum matrix. React on Rails v16 remains the upgrade path for applications that must stay on Ruby 3.2 or older. #3500 by justin808.
• [Pro] Node Renderer now requires Ruby 3.3+ for the async-http transport: The react-on-rails-pro gem now requires Ruby >= 3.3 (raised from >= 3.0) because async-http depends on Ruby 3.3 features. Upgrade Ruby before moving to this release. See docs/pro/updating.md for the full upgrade guide. #3320 by AbanoubGhadban.
• [Pro] config.renderer_http_pool_size now limits async-http connections per renderer client: Existing numeric values now cap concurrent async-http connections for each renderer client instead of sizing a persistent process-wide connection pool. HTTP/2 may multiplex request streams over those pooled connections. Setting nil keeps the default connection limit and does not make the async-http client unlimited. Persistent connection reuse is automatic when a long-lived Fiber.scheduler is present. See docs/pro/updating.md for the full upgrade guide. #3320 by AbanoubGhadban.

Added

• [Pro] React 18 support for non-RSC streaming SSR: stream_react_component with synchronous props is now explicitly supported on React 18 as well as React 19. Permanent packed-artifact coverage verifies a production Webpack build and progressive Suspense output on React 18 without installing or bundling react-on-rails-rsc; async props and React Server Components remain React 19-only. Fixes #4642. #4658 by justin808.
• Generated Rails response TypeScript contracts: Rails apps can now register explicit JSON response contracts with ReactOnRails::TypeScriptResponseTypes and run rake react_on_rails:generate_response_types to emit importable .d.ts declarations plus a

... (truncated)

Changelog

Sourced from react-on-rails's changelog.

[17.0.1] - 2026-07-26

Fixed

• Corrected the OSS npm package license metadata and packed license: react-on-rails now declares MIT, includes a package-local MIT license in the published tarball, and verifies the packed artifact cannot inherit React on Rails Pro commercial terms. PR 4792 by justin808.

[17.0.0] - 2026-07-16

Breaking Changes

• [Pro] Removed the undocumented ReactOnRailsPro::Cache.fetch_react_component class API: Pro apps should use the supported cached helper APIs (cached_react_component, cached_react_component_hash, and related helpers) instead of calling the low-level cache class directly. The helper cache path still preserves generated-pack loading on cache hits, tag registration, and expires_at handling internally. Fixes Issue 4497. PR 4541 by justin808.
• [Pro] React Server Components now require the stable React 19.2.x RSC line: Pro RSC apps on React on Rails 17 require react-on-rails-rsc >= 19.2.1 < 19.3, React >= 19.2.7, and matching React DOM. Non-RSC Pro apps retain React 18 support. The Pro generator scaffolds that coordinated stable runtime and rejects all prerelease RSC packages while the stable floor is active. The adopted react-on-rails-rsc artifact uses the React on Rails Pro commercial terms rather than MIT and reports SEE LICENSE IN LICENSE.md in npm metadata. Set REACT_ON_RAILS_PRO_DISABLE_VERSION_CHECK=1 only as an emergency rollout escape hatch to downgrade startup errors to warnings. Issue 4357. PR 4490 and PR 4670 by justin808.
• Removed the inert config.server_render_method option: The open-source configuration no longer accepts config.server_render_method. The option never selected a server render method — the open-source gem always renders with ExecJS — and its validator raised ReactOnRails::Error at boot for any value other than blank or "ExecJS". Setting it now raises NoMethodError at boot, so delete any config.server_render_method = ... line from config/initializers/react_on_rails.rb; rake react_on_rails:doctor also flags the stale line. For a standalone Node rendering process, use React on Rails Pro's Node renderer, configured via ReactOnRailsPro.configure. Fixes Issue 4415. PR 4423 by justin808.
• Removed three deprecated configuration options (config.generated_assets_dirs, config.skip_display_none, config.defer_generated_component_packs): These were deprecated in v16 and are gone in v17. Setting any of them now raises NoMethodError at boot; delete the stale lines from config/initializers/react_on_rails.rb (rake react_on_rails:doctor flags them). Migration: delete config.generated_assets_dirs — public asset paths come from public_output_path in config/shakapacker.yml; delete config.skip_display_none — it had no runtime effect; replace config.defer_generated_component_packs = true with config.generated_component_packs_loading_strategy = :defer, and simply delete config.defer_generated_component_packs = false (the removed option was truthy-gated — only = true set :defer; = false was a no-op that fell through to the default strategy, so it did not mean :sync; set :sync explicitly only if you relied on synchronous loading). The default strategy is :async for Pro or :defer for non-Pro on Shakapacker 8.2.0+, and :sync on older Shakapacker. Fixes Issue 4419. PR 4432 by justin808.
• Removed the never-wired RenderRequest / JsCodeBuilder / RenderingStrategy rendering layer: The internal strategy-pattern classes ReactOnRails::RenderRequest, ReactOnRails::JsCodeBuilder, ReactOnRails::RenderingStrategy (with ExecJsStrategy), and — in Pro — ReactOnRailsPro::JsCodeBuilder and ReactOnRailsPro::RenderingStrategy::NodeStrategy, plus the undocumented ReactOnRails.rendering_strategy and ReactOnRails.js_code_builder module accessors, are removed. This scaffolding was built for the strategy-pattern refactor in Issue 2905 (closed without wiring it in) and was never invoked on any production server-rendering path — SSR runs through ServerRenderingJsCode and ServerRenderingPool, which never touched this layer. These constants and accessors were internal and undocumented; if you reference them in application code, remove the reference (the layer performed no work). Fixes Issue 4414. PR 4437 by justin808.
• Removed undocumented ReactOnRails::Utils helpers: React on Rails 17 removes the unused ReactOnRails::Utils.server_rendering_is_enabled? and ReactOnRails::Utils.rails_version_less_than helper methods. Remove any application calls to those helpers; release-example generation now owns its private Rails-version check outside the public Utils surface. Fixes Issue 4418. PR 4431 by justin808.
• Ruby 3.3+ is required for React on Rails v17: The open-source gem now requires Ruby >= 3.3.0, aligning it with React on Rails Pro, create-react-on-rails-app, and the CI minimum matrix. React on Rails v16 remains the upgrade path for applications that must stay on Ruby 3.2 or older. PR 3500 by justin808.
• [Pro] Node Renderer now requires Ruby 3.3+ for the async-http transport: The react-on-rails-pro gem now requires Ruby >= 3.3 (raised from >= 3.0) because async-http depends on Ruby 3.3 features. Upgrade Ruby before moving to this release. See docs/pro/updating.md for the full upgrade guide. PR 3320 by AbanoubGhadban.
• [Pro] config.renderer_http_pool_size now limits async-http connections per renderer client: Existing numeric values now cap concurrent async-http connections for each renderer client instead of sizing a persistent process-wide connection pool. HTTP/2 may multiplex request streams over those pooled connections. Setting nil keeps the default connection limit and does not make the async-http client unlimited. Persistent connection reuse is automatic when a long-lived Fiber.scheduler is present. See docs/pro/updating.md for the full upgrade guide. PR 3320 by AbanoubGhadban.

Added

• [Pro] React 18 support for non-RSC streaming SSR: stream_react_component with synchronous props is now explicitly supported on React 18 as well as React 19. Permanent packed-artifact coverage verifies a production Webpack build and progressive Suspense output on React 18 without installing or bundling react-on-rails-rsc; async props and React Server Components remain React 19-only. Fixes Issue 4642. PR 4658 by justin808.

• Generated Rails response TypeScript contracts: Rails apps can now register explicit JSON response contracts with ReactOnRails::TypeScriptResponseTypes and run rake react_on_rails:generate_response_types to emit importable .d.ts declarations plus a RailsResponseTypes lookup map for TanStack Query clients. Fixes Issue 4247. PR 4259 by justin808.

• Typed Rails action callers for TanStack Query mutations: The react-on-rails/railsAction subpath now exports createRailsAction, a same-origin JSON caller that attaches Rails CSRF headers and lets mutation code type responses with the generated RailsResponseType<'controller.action'> lookup. Fixes Issue 4248. PR 4260 by justin808.

... (truncated)

Commits

• See full diff in compare view

Updates shakapacker from 10.2.0 to 10.3.0

Release notes

Sourced from shakapacker's releases.

v10.3.0

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

Changelog

Sourced from shakapacker's changelog.

[v10.3.0] - July 5, 2026

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

Commits

• 73ba063 Release 10.3.0
• e8cb3c8 Bump version to v10.3.0 in CHANGELOG.md
• 7ae6b33 Update changelog for v10.2.1 (#1210)
• 564cc4e Add v10 upgrade guide (#1208)
• bef38d6 Fallback to Babel for implicit SWC webpack configs (#1206)
• fc16549 fix: allow webpack-dev-server v6 (#1102)
• 29f855a Fix Claude OAuth token env for Actions (#1202)
• 9b56482 [codex] Document and harden helper binstub PATH fix (#1201)
• aa94c79 [codex] Delegate helper binstub Node resolution to exec (#1200)
• See full diff in compare view

Updates webpack from 5.108.3 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

• Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

• Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

• Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

• Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

• Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

• Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

v5.109.1

Patch Changes

• Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

• Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

• Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

• Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

• Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

• Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

• Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

• Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

• Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

• Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

• Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

• Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

• Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

• Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

• Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

• Encode the persistent cache with V8's value serializer. (by @​avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

• Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

• Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

• Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

• Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

• Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

• Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

5.109.1

Patch Changes

• Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

• Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

• Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

• Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

• Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

• Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

• Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

• Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

• Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

• Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

• Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

• Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

• Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

• Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

• Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

... (truncated)

Commits

• 6a24bd6 chore(release): new release (#21534)
• d1b5b6d fix: resolve aliases pointing at a package directory ending in .js (#21542)
• 9cdcc57 fix(target): report "universal" as the loader target (#21540)
• 774e7e4 feat: annotate schema options with added keywords (#21473)
• ff07bdc fix(css): name CSS sources in source maps by their resource path (#21536)
• d56d82d fix(cache): reclaim stale filesystem cache files reliably (#21539)
• ae67e2a chore(readme): add codspeed (#21497)
• 964bbfa fix: delete no longer referenced files from the filesystem cache directory (#...
• 075d0cd feat: skip require().prop in dead branches (#21517)
• ec39088 chore(release): new release (#21493)
• Additional commits viewable in compare view

Updates webpack-cli from 7.1.0 to 7.2.2

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.2.2

Patch Changes

• perf: enable the Node.js compile cache (module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @​bjohansebas in #4818)

webpack-cli@7.2.1

Patch Changes

• fix: CLIPlugin dynamic import interop under Bun (by @​alexander-akait in #4799)

webpack-cli@7.2.0

Minor Changes

• feat: allow webpack-dev-server v6 as an optional peer dependency (^5.0.0 || ^6.0.0) (by @​bjohansebas in #4793)

• Support tsx as a fallback loader for TypeScript and JSX configuration files (.ts, .tsx, .cts, .mts and .jsx), used when none of the loaders known to interpret (such as ts-node) are installed. (by @​alexander-akait in #4796)

Changelog

Sourced from webpack-cli's changelog.

7.2.2

Patch Changes

• perf: enable the Node.js compile cache (module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @​bjohansebas in #4818)

7.2.1

Patch Changes

• fix: CLIPlugin dynamic import interop under Bun (by @​alexander-akait in #4799)

7.2.0

Minor Changes

• feat: allow webpack-dev-server v6 as an optional peer dependency (^5.0.0 || ^6.0.0) (by @​bjohansebas in #4793)

• Support tsx as a fallback loader for TypeScript and JSX configuration files (.ts, .tsx, .cts, .mts and .jsx), used when none of the loaders known to interpret (such as ts-node) are installed. (by @​alexander-akait in #4796)

Commits

• 191fa9f chore(release): new release (#4820)
• 1082235 chore(deps-dev): bump js-yaml from 5.2.1 to 5.2.2 (#4821)
• e36ae82 chore: add publish workflow and script for pkg.pr.new integration (#4819)
• b0a2024 perf: enable the Node.js compile cache (#4818)
• 53f6d72 chore(deps): bump actions/checkout in the dependencies group (#4816)
• 8856346 chore: add allowscripts to work with npm 12 (#4811)
• 0b0f1ee chore(deps): bump fast-uri from 3.1.2 to 3.1.4 (#4815)
• d60a777 chore(deps-dev): bump postcss from 8.5.10 to 8.5.22 (#4814)
• 8c1719a chore(deps): bump shell-quote from 1.8.4 to 1.10.0 (#4813)
• Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.