chore(deps-dev): bump the dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the dependencies group with 4 updates in the / directory: prettier, source-map, tinybench and webpack.

Updates prettier from 3.9.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Updates source-map from 0.7.6 to 0.8.0

Changelog

Sourced from source-map's changelog.

0.8.0

• #528 mozilla/source-map#528 Adding security policy
• #525 mozilla/source-map#525 Use Object.create for sourceContents
• #520 mozilla/source-map#520 Fixes types for SourceMapConsumer.initialize

Commits

• ac0a1a6 0.8.0
• aa7ae07 Adding security policy (#528)
• a75f52b Use Object.create for sourceContents (#525)
• 6bf82ff Added missing periods for consistency and correctness (#514)
• f4f1a90 Merge pull request #519 from mozilla/nchevobbe-patch-1
• a36f46f Merge pull request #520 from arcanis/patch-1
• 25ff939 Update source-map.d.ts
• 0ccf5ec prettier
• f9aa371 Update CHANGELOG.md
• See full diff in compare view

Maintainer changes

This version was pushed to npm by hmanilla, a new releaser for source-map since your current version.

Updates tinybench from 6.0.2 to 6.1.3

Release notes

Sourced from tinybench's releases.

v6.1.3

   🐞 Bug Fixes

• Enforce optional signature  -  by @​sheremet-va in tinylibs/tinybench#633 (b54b7)

    View changes on GitHub

v6.1.2

   🐞 Bug Fixes

• types:
  • Export HookMode and TimestampProviderName  -  by @​jerome-benoit (0e99b)
• utils:
  • Render rme via formatNumber in the default table converter  -  by @​jerome-benoit (e3acd)
  • Make mToNsBigint tolerate fractional milliseconds  -  by @​jerome-benoit (bcebe)

    View changes on GitHub

v6.1.1

   🐞 Bug Fixes

• ci: Always run documentation commit on release  -  by @​jerome-benoit (fe4ec)

    View changes on GitHub

v6.1.0

   🚀 Features

• Add timer-overhead correction, saturation warning, and resolution diagnostic  -  by @​jerome-benoit in tinylibs/tinybench#571 (0647d)

    View changes on GitHub

v6.0.3

   🐞 Bug Fixes

• Export mToNs used in README console.table example  -  by @​jerome-benoit in tinylibs/tinybench#592 (66161)
• ci: Use format() in workflow conditional to avoid literal text warning  -  by @​jerome-benoit (36fa8)

    View changes on GitHub

Commits

• 053ecab chore: release v6.1.3
• 2a46e5b refactor(utils): drop redundant boolean casts and comment-split ternaries
• 76bd006 style: reflow signatures, imports and calls to formatter width
• b54b73b fix: enforce optional signature (#633)
• ebe67b3 chore(deps): update all non-major dependencies (#631)
• 52fb2be chore(deps): lock file maintenance (#627)
• 1eff6f9 chore(deps): update all non-major dependencies (#630)
• f3bf4d3 chore(deps): update all non-major dependencies (#629)
• f562c5c chore(deps): update all non-major dependencies (#628)
• dbe7c91 chore(deps): update all non-major dependencies (#626)
• Additional commits viewable in compare view

Updates webpack from 5.108.3 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

• Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

• Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

• Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

• Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

• Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

• Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

v5.109.1

Patch Changes

• Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

• Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

• Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

• Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

• Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

• Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

• Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

• Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

• Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

• Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

• Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

• Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

• Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

• Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

• Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

• Encode the persistent cache with V8's value serializer. (by @​avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

• Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

• Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

• Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

• Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

• Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

• Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

5.109.1

Patch Changes

• Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

• Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

• Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

• Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

• Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

• Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

• Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

• Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

• Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

• Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

• Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

• Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

• Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

• Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

• Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

... (truncated)

Commits

• 6a24bd6 chore(release): new release (#21534)
• d1b5b6d fix: resolve aliases pointing at a package directory ending in .js (#21542)
• 9cdcc57 fix(target): report "universal" as the loader target (#21540)
• 774e7e4 feat: annotate schema options with added keywords (#21473)
• ff07bdc fix(css): name CSS sources in source maps by their resource path (#21536)
• d56d82d fix(cache): reclaim stale filesystem cache files reliably (#21539)
• ae67e2a chore(readme): add codspeed (#21497)
• 964bbfa fix: delete no longer referenced files from the filesystem cache directory (#...
• 075d0cd feat: skip require().prop in dead branches (#21517)
• ec39088 chore(release): new release (#21493)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: ebd84b6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	webpack@​5.108.3 ⏵ 5.109.2			+1	+1
	source-map@​0.7.6 ⏵ 0.8.0
	tinybench@​6.0.2 ⏵ 6.1.3	+1		+1	+5
	prettier@​3.9.4 ⏵ 3.9.6				-2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/webpack@5.109.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codspeed-hq]

Merging this PR will degrade performance by 2.47%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 13 improved benchmarks
❌ 10 regressed benchmarks
✅ 189 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Memory	raw-source memory: new RawSource(string)	1.1 KB	13.5 KB	-92%
❌	Memory	concat-source memory: source() concatenates children	252 KB	401 KB	-37.15%
❌	Memory	source-map-source memory: map({ columns: true })	784 B	1,200 B	-34.67%
❌	Memory	compat-source memory: new CompatSource(sourceLike)	784 B	1,104 B	-28.99%
❌	Memory	concat-source memory: map({ columns: true }) composes child maps	2.5 MB	3.5 MB	-27.63%
❌	Memory	source-map-source memory: new SourceMapSource(simple)	784 B	944 B	-16.95%
❌	Memory	cached-source memory: construct from cachedData (no warm-up)	648 B	776 B	-16.49%
❌	Memory	size-only-source memory: new SizeOnlySource()	90.8 KB	108.1 KB	-15.98%
❌	Simulation	cached-source: new CachedSource()	315.8 µs	372 µs	-15.13%
❌	Memory	replace-source memory: map({ columns: true }) splices mappings	4.1 MB	4.6 MB	-10.21%
⚡	Memory	replace-source memory: construct + 100 insertions	9.9 KB	2.7 KB	×3.7
⚡	Memory	clear-cache memory: shared modules (visited set — single allocation)	776 B	392 B	+97.96%
⚡	Memory	cached-source memory: getCachedData() allocates BufferedMap	648 B	392 B	+65.31%
⚡	Memory	cached-source memory: warm sourceAndMap() returns cached references	384 B	256 B	+50%
⚡	Memory	prefix-source memory: source() allocates rewritten string	1.4 KB	1.2 KB	+24.32%
⚡	Simulation	raw-source: new RawSource(buffer)	140.5 µs	118.7 µs	+18.35%
⚡	Simulation	raw-source: new RawSource(string)	142.3 µs	120.5 µs	+18.07%
⚡	Simulation	raw-source: buffer() (from buffer)	149.3 µs	127 µs	+17.56%
⚡	Simulation	raw-source: source() (string)	150.6 µs	128.8 µs	+16.93%
⚡	Simulation	raw-source: buffers() (from buffer)	156.8 µs	134.1 µs	+16.87%
...	...	...	...	...	...

ℹ️ Only the first 20 benchmarks are displayed. Go to the app to view all benchmarks.

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/npm_and_yarn/dependencies-d9d4ec0eab (ebd84b6) with main (1aa76ca)}