chore(deps-dev): bump the dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #651 · webpack/enhanced-resolve

dependabot · 2026-08-17T06:53:06Z

Bumps the dependencies group with 6 updates in the / directory:

Package	From	To
@codspeed/core	`5.6.0`	`5.7.1`
lint-staged	`17.0.8`	`17.3.0`
memfs	`4.57.8`	`4.68.1`
prettier	`3.8.4`	`3.9.6`
tinybench	`6.0.2`	`6.1.3`
webpack	`5.107.2`	`5.109.2`

Updates @codspeed/core from 5.6.0 to 5.7.1

Release notes

Sourced from @codspeed/core's releases.

v5.7.1

What's Changed

fix: emit perf maps when not parsing the full inlining logs from V8 by @GuillaumeLagrange in CodSpeedHQ/codspeed-node#85

Full Changelog: CodSpeedHQ/codspeed-node@v5.7.0...v5.7.1

v5.7.0

Highlights

Dump full inlining information for higher optimization tiers in walltime so we can show more functions on the profiler. To test it out, set CODSPEED_WALLTIME_PROFILER=samply env variable in the codspeed action.

Added support for tinybench v5 and v6 in @codspeed/tinybench-plugin

What's Changed

Add necessary flags to dump optimized inlining info and fix walltime marker placement by @GuillaumeLagrange in CodSpeedHQ/codspeed-node#83

Full Changelog: CodSpeedHQ/codspeed-node@v5.6.0...v5.7.0

Commits

56fa9fc v5.7.1
c88994c fix: have node output perf maps when not parsing V8 inlining logs
36834e8 v5.7.0
16bf967 feat: to fixup tinybench marker clean up
8f2de3c ci: use samply profiler for walltime integration tests
4601945 fix(tinybench-plugin): support tinybench v5 and v6
2475d5b fix(vitest-plugin): bracket walltime window around the measured loop only
e07237e fix(tinybench-plugin): fix profiler capturing tinybench's internal functions
1fb37ef feat(core): emit V8 jitdump and code log for walltime profiling
See full diff in compare view

Updates lint-staged from 17.0.8 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes
#1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:
{
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}
As a concrete example, lint-staged's own configuration is:
/** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};
which means:

for all staged files, run the two commands in parallel with staged filenames appended, for example:

oxfmt --check --no-error-on-unmatched-pattern lib/index.js

oxlint --no-error-on-unmatched-pattern lib/index.js

additionally, if any *.ts files are staged, run tsc without appending any arguments

The two sets of commands also run in parallel
Patch Changes

#1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes
#1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:
{
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}
As a concrete example, lint-staged's own configuration is:
/** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};
which means:

for all staged files, run the two commands in parallel with staged filenames appended, for example:

oxfmt --check --no-error-on-unmatched-pattern lib/index.js

oxlint --no-error-on-unmatched-pattern lib/index.js

additionally, if any *.ts files are staged, run tsc without appending any arguments

The two sets of commands also run in parallel
Patch Changes

#1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes
#1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:
/** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

... (truncated)

Commits

d153443 Merge pull request #1828 from lint-staged/changeset-release/main
5162c14 chore(changeset): release
a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
ea96cab style: enable oxlint "suspicious" category
2fae007 style: add @e18e/eslint-plugin
2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
1453ae6 test: relax assertion so that it passes in worktree
15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
286e25c feat: allow running parallel tasks by nesting arrays
Additional commits viewable in compare view

Updates memfs from 4.57.8 to 4.68.1

Release notes

Sourced from memfs's releases.

Release v4.68.1

What's Changed

fix: 🐛 .unlink() should not delete empty directories by @streamich in streamich/memfs#1278

Full Changelog: streamich/memfs@v4.68.0...v4.68.1

Release v4.68.0

What's Changed

feat: 🎸 add file birthTime support by @streamich in streamich/memfs#1277

Full Changelog: streamich/memfs@v4.67.0...v4.68.0

Release v4.67.0

What's Changed

feat: persist git-fsa directory handle by @lux-in-tenebris-lucet in streamich/memfs#1273

New Contributors

@lux-in-tenebris-lucet made their first contribution in streamich/memfs#1273

Full Changelog: streamich/memfs@v4.66.1...v4.67.0

Release v4.66.1

What's Changed

fix(build): embed sources in published sourcemaps by @xianjianlf2 in streamich/memfs#1275

Full Changelog: streamich/memfs@v4.66.0...v4.66.1

Release v4.66.0

What's Changed

chore: remove tslib from peerDependencies by @xianjianlf2 in streamich/memfs#1269

Pr 1270 file url drive letter by @streamich in streamich/memfs#1276

Full Changelog: streamich/memfs@v4.65.0...v4.66.0

Release v4.65.0

What's Changed

test(fs-node): cover FileHandle close after unlink by @xianjianlf2 in streamich/memfs#1272

feat: 🎸 support recursive flag in FsaNodeFs by @streamich in streamich/memfs#1274

New Contributors

@xianjianlf2 made their first contribution in streamich/memfs#1272

Full Changelog: streamich/memfs@v4.64.0...v4.65.0

Release v4.64.0

What's Changed

... (truncated)

Commits

d1703ac chore: release v4.68.1
8987c43 Merge pull request #1278 from streamich/fix-unlink-dir
559dff9 test: 💍 fixup flaky test
00b1487 fix: 🐛 .unlink() should not delete empty directories
caa708b chore: release v4.68.0
083162d Merge pull request #1277 from streamich/fix-birthtime
f8176b1 feat: 🎸 return cloned Date objects
cc283f3 feat: 🎸 add file birthTime support
9a78fd2 chore: release v4.67.0
fa47ecc chore: persist git-fsa directory handle
Additional commits viewable in compare view

Updates prettier from 3.8.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

Preserve quotes for methods named new (prettier/prettier#19621 by @kovsu)

Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @fisker)

Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @fisker)

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @fisker)

🔗 Changelog

3.9.3

Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @seiyab)

TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @evoactivity)

🔗 Changelog

3.9.1

CLI: Fix ignored file has been cached incorrectly (#19483 by @kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

Fix Flow variance annotation print (#19022 by @marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @kovsu)
// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}
TypeScript: Support import defer (#19624, #19675 by @fisker)
// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";
JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:
Install the plugin:
yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

8f0c950 Release 3.9.6
e910764 Update changelog
ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
73d2efc Update Yuku parser to v0.7.0 (#19664)
dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
b74dd53 Update Yuku parser to v0.6.5 (#19654)
f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
3bbb815 Remove typescript-only directory (#19636)
Additional commits viewable in compare view

Updates tinybench from 6.0.2 to 6.1.3

Release notes

Sourced from tinybench's releases.

v6.1.3

   🐞 Bug Fixes

Enforce optional signature - by @sheremet-va in tinylibs/tinybench#633 (b54b7)

    View changes on GitHub

v6.1.2

   🐞 Bug Fixes

types:

Export HookMode and TimestampProviderName - by @jerome-benoit (0e99b)

utils:

Render rme via formatNumber in the default table converter - by @jerome-benoit (e3acd)

Make mToNsBigint tolerate fractional milliseconds - by @jerome-benoit (bcebe)

    View changes on GitHub

v6.1.1

   🐞 Bug Fixes

ci: Always run documentation commit on release - by @jerome-benoit (fe4ec)

    View changes on GitHub

v6.1.0

   🚀 Features

Add timer-overhead correction, saturation warning, and resolution diagnostic - by @jerome-benoit in tinylibs/tinybench#571 (0647d)

    View changes on GitHub

v6.0.3

   🐞 Bug Fixes

Export mToNs used in README console.table example - by @jerome-benoit in tinylibs/tinybench#592 (66161)

ci: Use format() in workflow conditional to avoid literal text warning - by @jerome-benoit (36fa8)

    View changes on GitHub

Commits

053ecab chore: release v6.1.3
2a46e5b refactor(utils): drop redundant boolean casts and comment-split ternaries
76bd006 style: reflow signatures, imports and calls to formatter width
b54b73b fix: enforce optional signature (#633)
ebe67b3 chore(deps): update all non-major dependencies (#631)
52fb2be chore(deps): lock file maintenance (#627)
1eff6f9 chore(deps): update all non-major dependencies (#630)
f3bf4d3 chore(deps): update all non-major dependencies (#629)
f562c5c chore(deps): update all non-major dependencies (#628)
dbe7c91 chore(deps): update all non-major dependencies (#626)
Additional commits viewable in compare view

Updates webpack from 5.107.2 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

Resolve aliases pointing at a package directory whose name ends with .js again. (by @alexander-akait in #21542)

Name CSS sources in source maps by their resource path, without the css prefix. (by @bjohansebas in #21536)

Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @bjohansebas in #21528)

Report "universal" as the loader context target for the universal target. (by @alexander-akait in #21540)

Skip require().prop in dead branches gated by inlined imported constants. (by @hai-x in #21517)

Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @bjohansebas in #21473)

v5.109.1

Patch Changes

Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @alexander-akait in #21533)

Make require(esm) module.exports re-export analysis independent of module processing order. (by @alexander-akait in #21521)

Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @alexander-akait in #21521)

Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @alexander-akait in #21503)

Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @alexander-akait in #21524)

Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @alexander-akait in #21492)

Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @alexander-akait in #21531)

Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @alexander-akait in #21500)

Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @alexander-akait in #21498)

Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @alexander-akait in #21504)

Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @alexander-akait in #21511)

Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @alexander-akait in #21506)

Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @bjohansebas in #21520)

Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @alexander-akait in #21516)

Enable the Node.js compile cache in the webpack CLI entry point. (by @bjohansebas in #21523)

Encode the persistent cache with V8's value serializer. (by @avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

Resolve aliases pointing at a package directory whose name ends with .js again. (by @alexander-akait in #21542)

Name CSS sources in source maps by their resource path, without the css prefix. (by @bjohansebas in #21536)

Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @bjohansebas in #21528)

Report "universal" as the loader context target for the universal target. (by @alexander-akait in #21540)

Skip require().prop in dead branches gated by inlined imported constants. (by @hai-x in #21517)

Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @bjohansebas in #21473)

5.109.1

Patch Changes

Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @alexander-akait in #21533)

Make require(esm) module.exports re-export analysis independent of module processing order. (by @alexander-akait in #21521)

Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @alexander-akait in #21521)

Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @alexander-akait in #21503)

Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @alexander-akait in #21524)

Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @alexander-akait in #21492)

Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @alexander-akait in #21531)

Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @alexander-akait in #21500)

Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @alexander-akait in #21498)

Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @alexander-akait in #21504)

Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @alexander-akait in #21511)

Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @alexander-akait in #21506)

Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @bjohansebas in #21520)

Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @alexander-akait in #21516)

Enable the Node.js compile cache in the webpack CLI entry point. (by @bjohansebas in #21523)

... (truncated)

Commits

6a24bd6 chore(release): new release (#21534)
d1b5b6d fix: resolve aliases pointing at a package directory ending in .js (#21542)
9cdcc57 fix(target): report "universal" as the loader target (#21540)
774e7e4 feat: annotate schema options with added keywords (#21473)
ff07bdc fix(css): name CSS sources in source maps by their resource path (#21536)
d56d82d fix(cache): reclaim stale filesystem cache files reliably (#21539)
ae67e2a chore(readme): add codspeed (#21497)
964bbfa fix: delete no longer referenced files from the filesystem cache directory (#...
075d0cd feat: skip require().prop in dead branches (#21517)
ec39088 chore(release): new release (#21493)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…6 updates Bumps the dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@codspeed/core](https://github.com/CodSpeedHQ/codspeed-node) | `5.6.0` | `5.7.1` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.3.0` | | [memfs](https://github.com/streamich/memfs) | `4.57.8` | `4.68.1` | | [prettier](https://github.com/prettier/prettier) | `3.8.4` | `3.9.6` | | [tinybench](https://github.com/tinylibs/tinybench) | `6.0.2` | `6.1.3` | | [webpack](https://github.com/webpack/webpack) | `5.107.2` | `5.109.2` | Updates `@codspeed/core` from 5.6.0 to 5.7.1 - [Release notes](https://github.com/CodSpeedHQ/codspeed-node/releases) - [Commits](CodSpeedHQ/codspeed-node@v5.6.0...v5.7.1) Updates `lint-staged` from 17.0.8 to 17.3.0 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.0.8...v17.3.0) Updates `memfs` from 4.57.8 to 4.68.1 - [Release notes](https://github.com/streamich/memfs/releases) - [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md) - [Commits](streamich/memfs@v4.57.8...v4.68.1) Updates `prettier` from 3.8.4 to 3.9.6 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.4...3.9.6) Updates `tinybench` from 6.0.2 to 6.1.3 - [Release notes](https://github.com/tinylibs/tinybench/releases) - [Commits](tinylibs/tinybench@v6.0.2...v6.1.3) Updates `webpack` from 5.107.2 to 5.109.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.107.2...v5.109.2) --- updated-dependencies: - dependency-name: "@codspeed/core" dependency-version: 5.7.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: lint-staged dependency-version: 17.3.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: memfs dependency-version: 4.68.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: prettier dependency-version: 3.9.6 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: tinybench dependency-version: 6.1.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: webpack dependency-version: 5.109.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-08-17T06:53:10Z

⚠️ No Changeset found

Latest commit: 306b96f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-08-17T06:53:39Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@codspeed/core@5.6.0 ⏵ 5.7.1		⁺¹
webpack@5.107.2 ⏵ 5.109.2	⁺¹		⁺¹
memfs@4.57.8 ⏵ 4.68.1	⁺¹
tinybench@6.0.2 ⏵ 6.1.3	⁺¹	⁺¹	⁺⁵
lint-staged@17.0.8 ⏵ 17.3.0	⁺¹		⁺²
prettier@3.8.4 ⏵ 3.9.6		⁺¹	^-2

View full report

socket-security · 2026-08-17T06:53:42Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `webpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/webpack@5.109.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/webpack@5.109.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

codspeed-hq · 2026-08-17T06:59:42Z

Merging this PR will regress 1 benchmark

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 3 improved benchmarks
❌ 1 regressed benchmark
✅ 138 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
❌	Memory	`node-compare: enhanced-resolve async x 1000 (no cache)`	166.8 KB	236.2 KB	-29.4%
⚡	Memory	`concurrent-batch: Promise.all of 15 resolves (warm)`	13 KB	1.9 KB	×6.8
⚡	Simulation	`concurrent-batch: Promise.all of 15 resolves (warm)`	1.6 ms	1.4 ms	+15.08%
⚡	Simulation	`alias-field: browser field (warm)`	1.6 ms	1.5 ms	+10.31%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing dependabot/npm_and_yarn/dependencies-c40250fc74 (306b96f) with main (aefeac3)}

dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 17, 2026

webpack Bot approved these changes Aug 17, 2026

View reviewed changes

webpack Bot enabled auto-merge (squash) August 17, 2026 06:53

Navigation Menu

Uh oh!

Uh oh!

chore(deps-dev): bump the dependencies group across 1 directory with 6 updates - #651

chore(deps-dev): bump the dependencies group across 1 directory with 6 updates#651
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-c40250fc74

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Aug 17, 2026

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

codspeed-hq Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.7.1

What's Changed

v5.7.0

Highlights

What's Changed

v17.3.0

Minor Changes

Patch Changes

v17.2.0

Minor Changes

17.3.0

Minor Changes

Patch Changes

17.2.0

Minor Changes

Release v4.68.1

What's Changed

Release v4.68.0

What's Changed

Release v4.67.0

What's Changed

New Contributors

Release v4.66.1

What's Changed

Release v4.66.0

What's Changed

Release v4.65.0

What's Changed

New Contributors

Release v4.64.0

What's Changed

3.9.6

What's Changed

3.9.5

3.9.4

3.9.3

3.9.1

3.9.0

3.8.5

3.9.6

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

TypeScript: Support import defer (#19624, #19675 by @​fisker)

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

v6.1.3

🐞 Bug Fixes

View changes on GitHub

v6.1.2

🐞 Bug Fixes

View changes on GitHub

v6.1.1

🐞 Bug Fixes

View changes on GitHub

v6.1.0

🚀 Features

View changes on GitHub

v6.0.3

🐞 Bug Fixes

View changes on GitHub

v5.109.2

Patch Changes

v5.109.1

Patch Changes

5.109.2

Patch Changes

5.109.1

Patch Changes

Uh oh!

changeset-bot Bot commented Aug 17, 2026

⚠️ No Changeset found

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

socket-security Bot commented Aug 17, 2026

Uh oh!

codspeed-hq Bot commented Aug 17, 2026

dependabot Bot commented on behalf of github Aug 17, 2026 •

edited

Loading

TypeScript: Preserve quotes for methods named `new` (#19621 by `@kovsu`)

TypeScript: Support `import defer` (#19624, #19675 by `@fisker`)

JavaScript: Added a new official plugin `@prettier/plugin-yuku` (#19628, #19629 by `@fisker`)