Skip to content

chore(deps-dev): bump the dependencies group across 1 directory with 4 updates - #263

Merged
webpack[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-d9d4ec0eab
Aug 30, 2026
Merged

chore(deps-dev): bump the dependencies group across 1 directory with 4 updates#263
webpack[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-d9d4ec0eab

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 4 updates in the / directory: prettier, source-map, tinybench and webpack.

Updates prettier from 3.9.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Updates source-map from 0.7.6 to 0.8.0

Changelog

Sourced from source-map's changelog.

0.8.0

Commits
Maintainer changes

This version was pushed to npm by hmanilla, a new releaser for source-map since your current version.


Updates tinybench from 6.0.2 to 6.1.3

Release notes

Sourced from tinybench's releases.

v6.1.3

   🐞 Bug Fixes

    View changes on GitHub

v6.1.2

   🐞 Bug Fixes

    View changes on GitHub

v6.1.1

   🐞 Bug Fixes

    View changes on GitHub

v6.1.0

   🚀 Features

    View changes on GitHub

v6.0.3

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 053ecab chore: release v6.1.3
  • 2a46e5b refactor(utils): drop redundant boolean casts and comment-split ternaries
  • 76bd006 style: reflow signatures, imports and calls to formatter width
  • b54b73b fix: enforce optional signature (#633)
  • ebe67b3 chore(deps): update all non-major dependencies (#631)
  • 52fb2be chore(deps): lock file maintenance (#627)
  • 1eff6f9 chore(deps): update all non-major dependencies (#630)
  • f3bf4d3 chore(deps): update all non-major dependencies (#629)
  • f562c5c chore(deps): update all non-major dependencies (#628)
  • dbe7c91 chore(deps): update all non-major dependencies (#626)
  • Additional commits viewable in compare view

Updates webpack from 5.108.3 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

v5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

  • Encode the persistent cache with V8's value serializer. (by @​avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

... (truncated)

Commits
  • 6a24bd6 chore(release): new release (#21534)
  • d1b5b6d fix: resolve aliases pointing at a package directory ending in .js (#21542)
  • 9cdcc57 fix(target): report "universal" as the loader target (#21540)
  • 774e7e4 feat: annotate schema options with added keywords (#21473)
  • ff07bdc fix(css): name CSS sources in source maps by their resource path (#21536)
  • d56d82d fix(cache): reclaim stale filesystem cache files reliably (#21539)
  • ae67e2a chore(readme): add codspeed (#21497)
  • 964bbfa fix: delete no longer referenced files from the filesystem cache directory (#...
  • 075d0cd feat: skip require().prop in dead branches (#21517)
  • ec39088 chore(release): new release (#21493)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 19, 2026
@changeset-bot

changeset-bot Bot commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: ab9fd8e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@webpack
webpack Bot enabled auto-merge (squash) August 19, 2026 10:43
@socket-security

socket-security Bot commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedwebpack@​5.108.3 ⏵ 5.109.28210093 +199 +1100
Updatedsource-map@​0.7.6 ⏵ 0.8.010010010089100
Updatedtinybench@​6.0.2 ⏵ 6.1.3100 +1100100 +195 +5100
Updatedprettier@​3.9.4 ⏵ 3.9.6981009795100

View full report

@socket-security

socket-security Bot commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm webpack is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/webpack@5.109.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@codspeed-hq

codspeed-hq Bot commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Merging this PR will degrade performance by 18.69%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 11 improved benchmarks
❌ 26 regressed benchmarks
✅ 175 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

Mode Benchmark BASE HEAD Efficiency
❌ Memory prefix-source memory: new PrefixSource() 1.2 KB 113.6 KB -98.98%
❌ Memory original-source memory: map({ columns: false }) line-only mappings 104.5 KB 418.9 KB -75.05%
❌ Memory original-source memory: map({ columns: true }) builds full mappings 468.1 KB 973.7 KB -51.93%
❌ Memory original-source memory: sourceAndMap({ columns: true }) 467.7 KB 967.4 KB -51.65%
❌ Memory size-only-source memory: new SizeOnlySource() 57.8 KB 99.9 KB -42.09%
❌ Memory source-map-source memory: map({ columns: true }) 784 B 1,168 B -32.88%
❌ Memory compat-source memory: delegated source() + map() through wrapper 22.5 KB 30.3 KB -25.95%
❌ Memory clear-cache memory: shared modules (visited set — single allocation) 392 B 520 B -24.62%
❌ Memory raw-source memory: new RawSource(buffer) 784 B 1,040 B -24.62%
❌ Memory raw-source memory: new RawSource(string) 784 B 1,040 B -24.62%
❌ Simulation cached-source: source() (cold) 207.3 µs 273.7 µs -24.25%
❌ Memory concat-source memory: map({ columns: true }) composes child maps 3.6 MB 4.4 MB -18.43%
❌ Memory replace-source memory: source() concatenates result 3.3 KB 4 KB -16.63%
❌ Simulation size-only-source: new SizeOnlySource() 164.6 µs 196.5 µs -16.23%
❌ Simulation raw-source: map() 129.2 µs 153.7 µs -15.9%
❌ Simulation source-map-source: new (string map) 212.4 µs 246.6 µs -13.86%
❌ Simulation source-map-source: new (buffer map) 212.3 µs 246.4 µs -13.84%
❌ Simulation source-map-source: new (buffer value) 212.9 µs 247 µs -13.78%
❌ Simulation raw-source: isBuffer() 153.2 µs 177.4 µs -13.62%
❌ Simulation size-only-source: size() 204.6 µs 236.5 µs -13.49%
... ... ... ... ... ...

ℹ️ Only the first 20 benchmarks are displayed. Go to the app to view all benchmarks.

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

Comparing dependabot/npm_and_yarn/dependencies-d9d4ec0eab (ab9fd8e) with main (e40fef5)

Open in CodSpeed

@dependabot
chore(deps-dev): bump the dependencies group across 1 directory with …
ab9fd8e 
…4 updates

Bumps the dependencies group with 4 updates in the / directory: [prettier](https://github.com/prettier/prettier), [source-map](https://github.com/mozilla/source-map), [tinybench](https://github.com/tinylibs/tinybench) and [webpack](https://github.com/webpack/webpack).


Updates `prettier` from 3.9.4 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.9.4...3.9.6)

Updates `source-map` from 0.7.6 to 0.8.0
- [Release notes](https://github.com/mozilla/source-map/releases)
- [Changelog](https://github.com/mozilla/source-map/blob/master/CHANGELOG.md)
- [Commits](mozilla/source-map@0.7.6...v0.8.0)

Updates `tinybench` from 6.0.2 to 6.1.3
- [Release notes](https://github.com/tinylibs/tinybench/releases)
- [Commits](tinylibs/tinybench@v6.0.2...v6.1.3)

Updates `webpack` from 5.108.3 to 5.109.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.108.3...v5.109.2)

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: source-map
  dependency-version: 0.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: tinybench
  dependency-version: 6.1.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dependencies-d9d4ec0eab branch from ebd84b6 to ab9fd8e Compare August 30, 2026 11:42
@webpack
webpack Bot merged commit 3a3d643 into main Aug 30, 2026
34 of 35 checks passed
@webpack
webpack Bot deleted the dependabot/npm_and_yarn/dependencies-d9d4ec0eab branch August 30, 2026 11:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webpack webpack[bot] webpack[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants