Skip to content

chore(deps): bump the dependencies group across 1 directory with 10 updates - #2385

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-51e6c7e706
Open

chore(deps): bump the dependencies group across 1 directory with 10 updates#2385
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-51e6c7e706

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 10 updates in the / directory:

Package From To
memfs 4.57.8 4.68.1
range-parser 1.2.1 1.3.0
@fastify/express 4.0.6 4.0.7
@hapi/hapi 21.4.9 21.4.10
@hono/node-server 2.0.10 2.1.1
fastify 5.8.5 5.12.0
hono 4.13.1 4.13.2
lint-staged 17.0.8 17.3.0
prettier 3.8.4 3.9.6
webpack 5.109.0 5.109.2

Updates memfs from 4.57.8 to 4.68.1

Release notes

Sourced from memfs's releases.

Release v4.68.1

What's Changed

Full Changelog: streamich/memfs@v4.68.0...v4.68.1

Release v4.68.0

What's Changed

Full Changelog: streamich/memfs@v4.67.0...v4.68.0

Release v4.67.0

What's Changed

New Contributors

Full Changelog: streamich/memfs@v4.66.1...v4.67.0

Release v4.66.1

What's Changed

Full Changelog: streamich/memfs@v4.66.0...v4.66.1

Release v4.66.0

What's Changed

Full Changelog: streamich/memfs@v4.65.0...v4.66.0

Release v4.65.0

What's Changed

New Contributors

Full Changelog: streamich/memfs@v4.64.0...v4.65.0

Release v4.64.0

What's Changed

... (truncated)

Commits
  • d1703ac chore: release v4.68.1
  • 8987c43 Merge pull request #1278 from streamich/fix-unlink-dir
  • 559dff9 test: 💍 fixup flaky test
  • 00b1487 fix: 🐛 .unlink() should not delete empty directories
  • caa708b chore: release v4.68.0
  • 083162d Merge pull request #1277 from streamich/fix-birthtime
  • f8176b1 feat: 🎸 return cloned Date objects
  • cc283f3 feat: 🎸 add file birthTime support
  • 9a78fd2 chore: release v4.67.0
  • fa47ecc chore: persist git-fsa directory handle
  • Additional commits viewable in compare view

Updates range-parser from 1.2.1 to 1.3.0

Release notes

Sourced from range-parser's releases.

v1.3.0

Fixed

  • Improve number parsing (#58) eba9c7a
  • Handle invalid start and end byte positions in range parsing (#57) 269cb4e

jshttp/range-parser@v1.2.1...v1.3.0

Commits
  • f4bf173 Clamp a suffix whose length exceeds the representation (#66)
  • b49e00f fix: still show ranges if there are multiple ranges, even if some are invalid...
  • 4f3b091 Remove dependabot config (#60)
  • eba9c7a Improve number parsing (#58)
  • 269cb4e fix: handle invalid start and end byte positions in range parsing (#57)
  • 098e332 build(deps): bump github/codeql-action from 3.31.2 to 4.31.6 (#50)
  • 3599369 build(deps): bump actions/checkout from 3.6.0 to 6.0.0 (#51)
  • 054ea57 build(deps): bump github/codeql-action from 2.23.2 to 4.31.2 (#48)
  • d230b16 build(deps): bump actions/upload-artifact from 3.1.3 to 5.0.0 (#49)
  • 54f84f4 chore: add funding to package.json (#42)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for range-parser since your current version.


Updates @fastify/express from 4.0.6 to 4.0.7

Release notes

Sourced from @​fastify/express's releases.

v4.0.7

⚠️ Security Release

What's Changed

New Contributors

Full Changelog: fastify/fastify-express@v4.0.6...v4.0.7

Commits
  • b40dfd4 Bumped v4.0.7
  • 7be7196 Merge commit from fork
  • c6c8f20 chore: replace http with https in urls (#196)
  • 7eed1b1 chore(package.json): fix delvedor's personal url
  • 04ac488 chore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group (#194)
  • 087f1b2 chore: update depedabot setting
  • See full diff in compare view

Updates @hapi/hapi from 21.4.9 to 21.4.10

Commits
  • 80b7728 21.4.10
  • 0124f0d Don't try to set autoValue cookie when state parsing is disabled
  • 2e418c4 Limit state updates to clearing for error 500 response
  • 435a206 Move cookie to state processing to request
  • 2526488 fix(types): widen Query/Params/Headers to unknown
  • See full diff in compare view

Updates @hono/node-server from 2.0.10 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

Commits

Updates fastify from 5.8.5 to 5.12.0

Release notes

Sourced from fastify's releases.

v5.12.0

What's Changed

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

  • fix fastify version in fastify.js

Full Changelog: fastify/fastify@v5.11.1...v5.11.2

v5.11.1

What's Changed

New Contributors

... (truncated)

Commits

Updates hono from 4.13.1 to 4.13.2

Release notes

Sourced from hono's releases.

v4.13.2

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
  • fix(client): serialize multiple cookies correctly in honojs/hono#5202
  • fix(etag): stabilize digest across stream chunks in honojs/hono#5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
  • perf(cors): pre-join static array header options during initialization in honojs/hono#5210
  • fix(client): send falsy JSON bodies in honojs/hono#5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

Commits
  • 41bdc42 4.13.2
  • 6ea514d feat(secure-headers): add missing W3C Permissions-Policy directives (#5214)
  • 329b6f4 fix(client): send falsy JSON bodies (#5215)
  • a1e4ac7 perf(cors): pre-join static array header options during initialization (#5210)
  • d982f63 fix(url): strip trailing question mark correctly for optional params with reg...
  • 26de731 fix(etag): stabilize digest across stream chunks (#5205)
  • 7075369 Revert " fix(etag): resolve incorrect incremental hashing for chunked respons...
  • f2a72d3 fix(client): serialize multiple cookies correctly (#5202)
  • 8a5852d fix(etag): resolve incorrect incremental hashing for chunked responses (#5199)
  • 765d13b fix(jsx): render async children of document metadata tags instead of [object ...
  • Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes

  • #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

    {
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}

    As a concrete example, lint-staged's own configuration is:

    /** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};

    which means:

    1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
      • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
      • oxlint --no-error-on-unmatched-pattern lib/index.js
    2. additionally, if any *.ts files are staged, run tsc without appending any arguments
    3. The two sets of commands also run in parallel

Patch Changes

  • #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes

  • #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

    {
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}

    As a concrete example, lint-staged's own configuration is:

    /** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};

    which means:

    1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
      • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
      • oxlint --no-error-on-unmatched-pattern lib/index.js
    2. additionally, if any *.ts files are staged, run tsc without appending any arguments
    3. The two sets of commands also run in parallel

Patch Changes

  • #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

... (truncated)

Commits
  • d153443 Merge pull request #1828 from lint-staged/changeset-release/main
  • 5162c14 chore(changeset): release
  • a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
  • ea96cab style: enable oxlint "suspicious" category
  • 2fae007 style: add @e18e/eslint-plugin
  • 2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
  • 1453ae6 test: relax assertion so that it passes in worktree
  • 15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
  • dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
  • 286e25c feat: allow running parallel tasks by nesting arrays
  • Additional commits viewable in compare view

Updates prettier from 3.8.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

  • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

🔗 Changelog

3.9.1

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Updates webpack from 5.109.0 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

v5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

  • Encode the persistent cache with V8's value serializer. (by @​avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

  • Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

  • Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

  • Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

  • Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

  • Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

5.109.1

Patch Changes

  • Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

  • Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

  • Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

  • Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

  • Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

  • Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

  • Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

  • Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

  • Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

  • Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

  • Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

  • Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

  • Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

  • Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

  • Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

... (truncated)

Commits
  • Description has been truncated

@dependabot
chore(deps): bump the dependencies group across 1 directory with 10 u…
a09fe95 
…pdates

Bumps the dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [memfs](https://github.com/streamich/memfs) | `4.57.8` | `4.68.1` |
| [range-parser](https://github.com/jshttp/range-parser) | `1.2.1` | `1.3.0` |
| [@fastify/express](https://github.com/fastify/fastify-express) | `4.0.6` | `4.0.7` |
| [@hapi/hapi](https://github.com/hapijs/hapi) | `21.4.9` | `21.4.10` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.10` | `2.1.1` |
| [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.12.0` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.2` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.3.0` |
| [prettier](https://github.com/prettier/prettier) | `3.8.4` | `3.9.6` |
| [webpack](https://github.com/webpack/webpack) | `5.109.0` | `5.109.2` |



Updates `memfs` from 4.57.8 to 4.68.1
- [Release notes](https://github.com/streamich/memfs/releases)
- [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md)
- [Commits](streamich/memfs@v4.57.8...v4.68.1)

Updates `range-parser` from 1.2.1 to 1.3.0
- [Release notes](https://github.com/jshttp/range-parser/releases)
- [Changelog](https://github.com/jshttp/range-parser/blob/master/HISTORY.md)
- [Commits](jshttp/range-parser@v1.2.1...v1.3.0)

Updates `@fastify/express` from 4.0.6 to 4.0.7
- [Release notes](https://github.com/fastify/fastify-express/releases)
- [Commits](fastify/fastify-express@v4.0.6...v4.0.7)

Updates `@hapi/hapi` from 21.4.9 to 21.4.10
- [Release notes](https://github.com/hapijs/hapi/releases)
- [Commits](hapijs/hapi@v21.4.9...v21.4.10)

Updates `@hono/node-server` from 2.0.10 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.10...v2.1.1)

Updates `fastify` from 5.8.5 to 5.12.0
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.5...v5.12.0)

Updates `hono` from 4.13.1 to 4.13.2
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.2)

Updates `lint-staged` from 17.0.8 to 17.3.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.0.8...v17.3.0)

Updates `prettier` from 3.8.4 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.4...3.9.6)

Updates `webpack` from 5.109.0 to 5.109.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.0...v5.109.2)

---
updated-dependencies:
- dependency-name: memfs
  dependency-version: 4.68.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: range-parser
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@fastify/express"
  dependency-version: 4.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@hapi/hapi"
  dependency-version: 21.4.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: fastify
  dependency-version: 5.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: hono
  dependency-version: 4.13.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: lint-staged
  dependency-version: 17.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 19, 2026
@changeset-bot

changeset-bot Bot commented Aug 19, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: a09fe95

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@webpack
webpack Bot enabled auto-merge (squash) August 19, 2026 10:34
@socket-security

socket-security Bot commented Aug 19, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedwebpack@​5.109.0 ⏵ 5.109.28210093 +199 +1100
Updated@​hapi/​hapi@​21.4.9 ⏵ 21.4.1099 +1110082 +194 +4100
Addedrange-parser@​1.3.01001009587100
Updatedmemfs@​4.57.8 ⏵ 4.68.198 +11009396100
Updated@​fastify/​express@​4.0.6 ⏵ 4.0.7100 +110010094 +2100
Updated@​hono/​node-server@​2.0.10 ⏵ 2.1.1100 +110010096100
Updatedhono@​4.13.1 ⏵ 4.13.2100 +110097 +196100
Updatedlint-staged@​17.0.8 ⏵ 17.3.0100 +110010097 +2100
Updatedprettier@​3.8.4 ⏵ 3.9.69810097 +197 -2100
Updatedfastify@​5.8.5 ⏵ 5.12.098 -110010099 +9100

View full report

@socket-security

socket-security Bot commented Aug 19, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm webpack is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/webpack@5.109.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webpack webpack[bot] webpack[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants