Skip to content

Bump the npm-patching group with 12 updates - #4114

Merged
lewisgoddard merged 2 commits into
masterfrom
dependabot/npm_and_yarn/npm-patching-fb5d761da9
Jul 30, 2026
Merged

Bump the npm-patching group with 12 updates#4114
lewisgoddard merged 2 commits into
masterfrom
dependabot/npm_and_yarn/npm-patching-fb5d761da9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the npm-patching group with 12 updates:

Package From To
webpack 5.108.4 5.109.2
globals 17.7.0 17.8.0
@csstools/selector-resolve-nested 4.0.0 4.0.1
@napi-rs/wasm-runtime 1.1.6 1.2.0
@types/node 26.1.1 26.1.2
acorn 8.17.0 8.18.0
baseline-browser-mapping 2.11.1 2.11.7
electron-to-chromium 1.5.395 1.5.398
enhanced-resolve 5.24.3 5.24.4
postcss 8.5.22 8.5.25
postcss-nesting 14.0.0 14.0.1
sax 1.6.0 1.6.1

Updates webpack from 5.108.4 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

v5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

  • Encode the persistent cache with V8's value serializer. (by @​avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

... (truncated)

Commits
  • 6a24bd6 chore(release): new release (#21534)
  • d1b5b6d fix: resolve aliases pointing at a package directory ending in .js (#21542)
  • 9cdcc57 fix(target): report "universal" as the loader target (#21540)
  • 774e7e4 feat: annotate schema options with added keywords (#21473)
  • ff07bdc fix(css): name CSS sources in source maps by their resource path (#21536)
  • d56d82d fix(cache): reclaim stale filesystem cache files reliably (#21539)
  • ae67e2a chore(readme): add codspeed (#21497)
  • 964bbfa fix: delete no longer referenced files from the filesystem cache directory (#...
  • 075d0cd feat: skip require().prop in dead branches (#21517)
  • ec39088 chore(release): new release (#21493)
  • Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

  • Update globals (2026-07-01) (#347) 7394811

sindresorhus/globals@v17.7.0...v17.8.0

Commits

Updates @csstools/selector-resolve-nested from 4.0.0 to 4.0.1

Changelog

Sourced from @​csstools/selector-resolve-nested's changelog.

4.0.1

July 23, 2026

  • Throw when trying to resolve a nested selector with excessive combinatorial explosion.
Commits

Updates @napi-rs/wasm-runtime from 1.1.6 to 1.2.0

Changelog

Sourced from @​napi-rs/wasm-runtime's changelog.

1.2.0 (2026-07-28)

Features

Commits

Updates @types/node from 26.1.1 to 26.1.2

Commits

Updates acorn from 8.17.0 to 8.18.0

Commits
  • d788421 Mark version 8.18.0
  • b61cb9a Add startLocation option
  • c8d515c Don't compute curLine when locations are off
  • a7bd3cd Reject an unparenthesized arrow function as the left operand of **
  • b7c31b6 Fix mistake in previous patch
  • 5c4af50 Avoid scanning from start of document in loose parser's resetTo
  • See full diff in compare view

Updates baseline-browser-mapping from 2.11.1 to 2.11.7

Release notes

Sourced from baseline-browser-mapping's releases.

v2.9.3 - remove process.loadEnvFile()

What's Changed

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

Commits
  • 0ccf94f Patch to 2.11.7 because browser or feature data changed
  • 95f7399 Browser or feature data changed
  • d927fdf Updating static site
  • 84c12d8 Patch to 2.11.6 because browser or feature data changed
  • 075650b Browser or feature data changed
  • 81f4f03 Patch to 2.11.5 because browser or feature data changed
  • 40a086c Browser or feature data changed
  • 3181ec7 Patch to 2.11.4 because browser or feature data changed
  • 433f067 Browser or feature data changed
  • f10fc63 Updating static site
  • Additional commits viewable in compare view

Updates electron-to-chromium from 1.5.395 to 1.5.398

Commits

Updates enhanced-resolve from 5.24.3 to 5.24.4

Release notes

Sourced from enhanced-resolve's releases.

v5.24.4

Patch Changes

  • Keep the original request resolvable when extensionAlias lists its own extension. (by @​alexander-akait in #641)

  • Fix string restrictions boundary checks: a restriction ending with a separator no longer rejects everything inside it, restrictions are normalized before they are compared, and a Windows path now matches the way path.win32 does, treating / and \ as interchangeable and comparing case-insensitively, while \ stays a filename character in a posix path. The same comparison backs tsconfig path matching. (by @​alexander-akait in #643)

  • Treat a UNC path (\\server\share\…) as a Windows path, so it normalizes, joins and walks up with path.win32 semantics instead of being taken for a bare module request. (by @​alexander-akait in #644)

Changelog

Sourced from enhanced-resolve's changelog.

5.24.4

Patch Changes

  • Keep the original request resolvable when extensionAlias lists its own extension. (by @​alexander-akait in #641)

  • Fix string restrictions boundary checks: a restriction ending with a separator no longer rejects everything inside it, restrictions are normalized before they are compared, and a Windows path now matches the way path.win32 does, treating / and \ as interchangeable and comparing case-insensitively, while \ stays a filename character in a posix path. The same comparison backs tsconfig path matching. (by @​alexander-akait in #643)

  • Treat a UNC path (\\server\share\…) as a Windows path, so it normalizes, joins and walks up with path.win32 semantics instead of being taken for a bare module request. (by @​alexander-akait in #644)

Commits
  • 24c3521 chore(release): new release (#642)
  • 10fcea0 fix: route UNC paths through win32 instead of posix (#644)
  • d8693b6 fix: correct string restrictions path boundary checks (#643)
  • 5e2e296 fix: keep the original request resolvable when extensionAlias lists its own e...
  • 2bcac6e chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 in the dependencies gr...
  • 9997401 chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 (#636)
  • d5f925d chore(deps-dev): bump axios from 1.17.0 to 1.18.1 (#635)
  • a52eed3 chore(deps): bump the dependencies group across 1 directory with 2 updates (#...
  • See full diff in compare view

Updates postcss from 8.5.22 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.
Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.
Commits

Updates postcss-nesting from 14.0.0 to 14.0.1

Changelog

Sourced from postcss-nesting's changelog.

14.0.1

July 23, 2026

Commits

Updates sax from 1.6.0 to 1.6.1

Commits
  • 961ceee 1.6.1
  • e68a39e use Object.create(null) for bags-o-data
  • af1a903 compare CDATA and DOCTYPE more efficiently
  • eeaf427 fix: reject refs outside XML Char production in strict mode
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the npm-patching group with 12 updates
54af850 
Bumps the npm-patching group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [webpack](https://github.com/webpack/webpack) | `5.108.4` | `5.109.2` |
| [globals](https://github.com/sindresorhus/globals) | `17.7.0` | `17.8.0` |
| [@csstools/selector-resolve-nested](https://github.com/csstools/postcss-plugins/tree/HEAD/packages/selector-resolve-nested) | `4.0.0` | `4.0.1` |
| [@napi-rs/wasm-runtime](https://github.com/napi-rs/napi-rs/tree/HEAD/wasm-runtime) | `1.1.6` | `1.2.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` |
| [acorn](https://github.com/acornjs/acorn) | `8.17.0` | `8.18.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.11.1` | `2.11.7` |
| [electron-to-chromium](https://github.com/Kilian/electron-to-chromium) | `1.5.395` | `1.5.398` |
| [enhanced-resolve](https://github.com/webpack/enhanced-resolve) | `5.24.3` | `5.24.4` |
| [postcss](https://github.com/postcss/postcss) | `8.5.22` | `8.5.25` |
| [postcss-nesting](https://github.com/csstools/postcss-plugins/tree/HEAD/plugins/postcss-nesting) | `14.0.0` | `14.0.1` |
| [sax](https://github.com/isaacs/sax-js) | `1.6.0` | `1.6.1` |


Updates `webpack` from 5.108.4 to 5.109.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.108.4...v5.109.2)

Updates `globals` from 17.7.0 to 17.8.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.7.0...v17.8.0)

Updates `@csstools/selector-resolve-nested` from 4.0.0 to 4.0.1
- [Changelog](https://github.com/csstools/postcss-plugins/blob/main/packages/selector-resolve-nested/CHANGELOG.md)
- [Commits](https://github.com/csstools/postcss-plugins/commits/HEAD/packages/selector-resolve-nested)

Updates `@napi-rs/wasm-runtime` from 1.1.6 to 1.2.0
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Changelog](https://github.com/napi-rs/napi-rs/blob/main/wasm-runtime/CHANGELOG.md)
- [Commits](https://github.com/napi-rs/napi-rs/commits/@napi-rs/wasm-runtime@1.2.0/wasm-runtime)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `acorn` from 8.17.0 to 8.18.0
- [Commits](acornjs/acorn@8.17.0...8.18.0)

Updates `baseline-browser-mapping` from 2.11.1 to 2.11.7
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.11.1...v2.11.7)

Updates `electron-to-chromium` from 1.5.395 to 1.5.398
- [Changelog](https://github.com/Kilian/electron-to-chromium/blob/main/CHANGELOG.md)
- [Commits](Kilian/electron-to-chromium@v1.5.395...v1.5.398)

Updates `enhanced-resolve` from 5.24.3 to 5.24.4
- [Release notes](https://github.com/webpack/enhanced-resolve/releases)
- [Changelog](https://github.com/webpack/enhanced-resolve/blob/main/CHANGELOG.md)
- [Commits](webpack/enhanced-resolve@v5.24.3...v5.24.4)

Updates `postcss` from 8.5.22 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.22...8.5.25)

Updates `postcss-nesting` from 14.0.0 to 14.0.1
- [Changelog](https://github.com/csstools/postcss-plugins/blob/main/plugins/postcss-nesting/CHANGELOG.md)
- [Commits](https://github.com/csstools/postcss-plugins/commits/HEAD/plugins/postcss-nesting)

Updates `sax` from 1.6.0 to 1.6.1
- [Commits](isaacs/sax-js@v1.6.0...v1.6.1)

---
updated-dependencies:
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-patching
- dependency-name: globals
  dependency-version: 17.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-patching
- dependency-name: "@csstools/selector-resolve-nested"
  dependency-version: 4.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patching
- dependency-name: "@napi-rs/wasm-runtime"
  dependency-version: 1.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-patching
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patching
- dependency-name: acorn
  dependency-version: 8.18.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-patching
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patching
- dependency-name: electron-to-chromium
  dependency-version: 1.5.398
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patching
- dependency-name: enhanced-resolve
  dependency-version: 5.24.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patching
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patching
- dependency-name: postcss-nesting
  dependency-version: 14.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patching
- dependency-name: sax
  dependency-version: 1.6.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patching
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 29, 2026
@lewisgoddard
lewisgoddard enabled auto-merge (squash) July 30, 2026 11:03
@lewisgoddard
lewisgoddard merged commit db5f4ec into master Jul 30, 2026
5 checks passed
@lewisgoddard
lewisgoddard deleted the dependabot/npm_and_yarn/npm-patching-fb5d761da9 branch July 30, 2026 11:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lewisgoddard lewisgoddard lewisgoddard approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lewisgoddard