Bump the npm-minor group across 1 directory with 7 updates by dependabot[bot] · Pull Request #2555 · laws-africa/indigo

dependabot · 2026-06-25T09:46:31Z

Bumps the npm-minor group with 7 updates in the / directory:

Package	From	To
eslint-config-standard	`17.0.0`	`17.1.0`
eslint-plugin-import	`2.26.0`	`2.32.0`
lodash	`4.17.21`	`4.18.1`
luxon	`3.4.4`	`3.7.2`
monaco-editor	`0.50.0`	`0.56.0`
vue-template-compiler	`2.6.14`	`2.7.16`
webpack	`5.94.0`	`5.109.2`

Updates eslint-config-standard from 17.0.0 to 17.1.0

Commits

7d01bbc 17.1.0
56978cb Add Node engine
1458f04 Support latest eslint-plugin-n (#271)
80b9734 Merge pull request #253 from standard/no-multiple-empty-lines-bof
9673e0b Add maxBOF setting to no-multiple-empty-lines
bcd0199 Merge pull request #228 from standard/release-stable-17
See full diff in compare view

Updates eslint-plugin-import from 2.26.0 to 2.32.0

Release notes

Sourced from eslint-plugin-import's releases.

v2.32.0

Added

add enforce-node-protocol-usage rule and import/node-version setting (#3024, thanks [@GoldStrikeArch] and [@sevenc-nanashi])

add TypeScript types (#3097, thanks [@G-Rath])

extensions: add `pathGroupOverrides to allow enforcement decision overrides based on specifier (#3105, thanks [@Xunnamius])

[order]: add sortTypesGroup option to allow intragroup sorting of type-only imports (#3104, thanks [@Xunnamius])

[order]: add newlines-between-types option to control intragroup sorting of type-only imports (#3127, thanks [@Xunnamius])

[order]: add consolidateIslands option to collapse excess spacing for aesthetically pleasing imports (#3129, thanks [@Xunnamius])

Fixed

[no-unused-modules]: provide more meaningful error message when no .eslintrc is present (#3116, thanks [@michaelfaith])

configs: added missing name attribute for eslint config inspector (#3151, thanks [@NishargShah])

[order]: ensure arcane imports do not cause undefined behavior (#3128, thanks [@Xunnamius])

[order]: resolve undefined property access issue when using named ordering (#3166, thanks [@Xunnamius])

enforce-node-protocol-usage: avoid a crash with some TS code (#3173, thanks [@ljharb])

[order]: codify invariants from docs into config schema (#3152, thanks [@Xunnamius])

Changed

[Docs] extensions, [order]: improve documentation (#3106, thanks [@Xunnamius])

[Docs] add flat config guide for using tseslint.config() (#3125, thanks [@lnuvy])

[Docs] add missing comma (#3122, thanks [@RyanGst])

[readme] Update flatConfig example to include typescript config (#3138, thanks [@intellix])

[Refactor] [order]: remove unnecessary negative check (#3167, thanks [@JounQin])

[Docs] [no-unused-modules]: add missing double quote (#3191, thanks [@albertpastrana])

[Docs] no-restricted-paths: clarify wording and fix errors (#3172, thanks [@greim])

... (truncated)

Changelog

Sourced from eslint-plugin-import's changelog.

[2.32.0] - 2025-06-20

Added

add [enforce-node-protocol-usage] rule and import/node-version setting (#3024, thanks [@GoldStrikeArch] and [@sevenc-nanashi])

add TypeScript types (#3097, thanks [@G-Rath])

[extensions]: add `pathGroupOverrides to allow enforcement decision overrides based on specifier (#3105, thanks [@Xunnamius])

[order]: add sortTypesGroup option to allow intragroup sorting of type-only imports (#3104, thanks [@Xunnamius])

[order]: add newlines-between-types option to control intragroup sorting of type-only imports (#3127, thanks [@Xunnamius])

[order]: add consolidateIslands option to collapse excess spacing for aesthetically pleasing imports (#3129, thanks [@Xunnamius])

Fixed

[no-unused-modules]: provide more meaningful error message when no .eslintrc is present (#3116, thanks [@michaelfaith])

configs: added missing name attribute for eslint config inspector (#3151, thanks [@NishargShah])

[order]: ensure arcane imports do not cause undefined behavior (#3128, thanks [@Xunnamius])

[order]: resolve undefined property access issue when using named ordering (#3166, thanks [@Xunnamius])

[enforce-node-protocol-usage]: avoid a crash with some TS code (#3173, thanks [@ljharb])

[order]: codify invariants from docs into config schema (#3152, thanks [@Xunnamius])

Changed

[Docs] [extensions], [order]: improve documentation (#3106, thanks [@Xunnamius])

[Docs] add flat config guide for using tseslint.config() (#3125, thanks [@lnuvy])

[Docs] add missing comma (#3122, thanks [@RyanGst])

[readme] Update flatConfig example to include typescript config (#3138, thanks [@intellix])

[Refactor] [order]: remove unnecessary negative check (#3167, thanks [@JounQin])

[Docs] [no-unused-modules]: add missing double quote (#3191, thanks [@albertpastrana])

[Docs] no-restricted-paths: clarify wording and fix errors (#3172, thanks [@greim])

[2.31.0] - 2024-10-03

Added

support eslint v9 (#2996, thanks [@G-Rath] [@michaelfaith])

[order]: allow validating named imports (#3043, thanks [@manuth])

[extensions]: add the checkTypeImports option (#2817, thanks [@phryneas])

Fixed

ExportMap / flat config: include languageOptions in context (#3052, thanks [@michaelfaith])

[no-named-as-default]: Allow using an identifier if the export is both a named and a default export (#3032, thanks [@akwodkiewicz])

[export]: False positive for exported overloaded functions in TS (#3065, thanks [@liuxingbaoyu])

exportMap: export map cache is tainted by unreliable parse results (#3062, thanks [@michaelfaith])

exportMap: improve cacheKey when using flat config (#3072, thanks [@michaelfaith])

adjust "is source type module" checks for flat config (#2996, thanks [@G-Rath])

Changed

[Docs] [no-relative-packages]: fix typo (#3066, thanks [@joshuaobrien])

[Performance] [no-cycle]: dont scc for each linted file (#3068, thanks [@soryy708])

[Docs] [no-cycle]: add disableScc to docs (#3070, thanks [@soryy708])

[Tests] use re-exported RuleTester (#3071, thanks [@G-Rath])

[Docs] [no-restricted-paths]: fix grammar (#3073, thanks [@unbeauvoyage])

[Tests] [no-default-export], [no-named-export]: add test case (thanks [@G-Rath])

... (truncated)

Commits

01c9eb0 v2.32.0
ae57cc1 [Deps] update array-includes, array.prototype.findlastindex, `eslint-modu...
9e1ad6b [Fix] order: codify invariants from docs into config schema
f017790 [Docs] no-restricted-paths: clarify wording and fix errors
7d83a57 [Docs] no-unused-modules: add missing double quote
519eb94 [utils] v2.12.1
71ad145 [actions] split out tests into new vs old eslint
9b096c4 [utils] [dev deps] update @arethetypeswrong/cli, @ljharb/tsconfig, `@type...
da5f6ec [Fix] enforce-node-protocol-usage: avoid a crash with some TS code
6e49a58 [Refactor] order: remove unnecessary negative check
Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

lodash: lodash/lodash@4.18.0-npm...4.18.1-npm

lodash-es: lodash/lodash@4.18.0-es...4.18.1-es

lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd

lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

Add security notice for _.template in threat model and API docs (#6099)

Document lower > upper behavior in _.random (#6115)

Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

lodash.orderby

lodash.tonumber

lodash.trim

lodash.trimend

lodash.sortedindexby

lodash.zipobjectdeep

lodash.unset

lodash.omit

lodash.template

Commits

cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
75535f5 chore: prune stale advisory refs (#6170)
62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
59be2de release(minor): bump to 4.18.0 (#6161)
af63457 fix: broken tests for _.template 879aaa9
1073a76 fix: linting issues
879aaa9 fix: validate imports keys in _.template
fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
b819080 ci: add dist sync validation workflow (#6137)
Additional commits viewable in compare view

Updates luxon from 3.4.4 to 3.7.2

Changelog

Sourced from luxon's changelog.

3.7.2 (2025-07-09)

Fix ES6 packaging

3.7.1 (2025-07-09)

Revert change in ES6 packaging

3.7.0 (2025-07-09)

Added showZeros option to Duration#toHuman

Added Duration#removeZeros method.

Added rounding option to DateTime#toRelative

Added precision option to ISO formatting methods

Added signMode option to Duration#toFormat

Allow escaping single quotes in format strings

Improve output of Info.months and Info.monthsFormat for ja locale

Accept lowercase t as a separator in ISO strings

Accept lowercase z as an offset in ISO strings

Reject non-finite numbers where previously only NaN was rejected

Improve the documentation for Interval

Added a dark theme for the documentation site

3.6.1 (2025-03-31)

Add Fallback for minimalDays being removed from Intl.WeekInfo

Fix various caches when JS keywords like "constructor" are used for names

3.6.0 (2025-03-25)

Add Interval.lastDateTime

Fix a bug that could cause wrong timezone calculations when multiple timezones are in use

3.5.0 (2024-08-03)

Various performance improvements

throwOnInvalid causes the constructor to throw if the year is invalid

Commits

4262a38 Version 3.7.2
738144d Fix the build ES6 code having the wrong file extension and use it in package....
3b2f374 Release version 3.7.1
c67ee7d Revert "build: use the es6 build for ESM exports (#1707)"
cfa58a2 Release version 3.7.0
7d379cc Fix unsupported signDisplay value
4e81ef9 Implement "signMode" on Duration#toFormat
5aa55da Improve documentation regarding Interval's half-openness
b188e10 add dark theme to docs (#1713)
cf67025 build: use the es6 build for ESM exports (#1707)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by diesieben07, a new releaser for luxon since your current version.

Updates monaco-editor from 0.50.0 to 0.56.0

Release notes

Sourced from monaco-editor's releases.

v0.56.0

Changes:

#5392: Bump websocket-driver from 0.7.4 to 0.7.5 in /website

#5396: Release Monaco Editor 0.56.0

#5385: Bump websocket-driver from 0.7.4 to 0.7.5 in /samples

#5379: Removes leftover debugger statements.

#5376: fixes pipeline

#5374: Bump webpack-dev-server from 5.2.4 to 5.2.5 in /samples

#5373: Bump webpack-dev-server from 5.2.4 to 5.2.5 in /website

#5371: Bump undici from 7.24.7 to 7.28.0

#5372: Fixes CI

#5363: Bump launch-editor from 2.10.0 to 2.14.1 in /samples

#5362: Bump @babel/core from 7.17.8 to 7.29.6 in /samples/browser-esm-webpack-typescript-react

#5361: Bump js-yaml from 4.1.1 to 4.2.0

#5360: Bump vite from 7.3.2 to 7.3.5

#5358: Bump shell-quote from 1.8.3 to 1.8.4 in /samples

#5359: Bump ws from 8.20.1 to 8.21.0 in /monaco-lsp-client

#5357: Bump esbuild and vite in /samples/browser-esm-vite-react

#5354: Bump shell-quote from 1.8.3 to 1.8.4 in /website

#5333: Bump dompurify from 3.2.7 to 3.4.5

#5347: Revert "Bump dompurify from 3.2.7 to 3.4.5"

#5337: Bump qs from 6.14.2 to 6.15.2

#5338: Bump qs and express in /samples

#5336: Bump qs and express in /website

#5335: Bump webpack-dev-server from 5.2.1 to 5.2.4 in /website

#5331: Bump ws from 8.18.3 to 8.20.1 in /monaco-lsp-client

#5330: Bump webpack-dev-server from 5.2.1 to 5.2.4 in /samples

#5326: Run npm audit fix and update lockfile

#5323: Bump postcss from 8.5.6 to 8.5.14 in /samples/browser-esm-vite-react

#5322: Bump postcss from 8.5.6 to 8.5.14 in /website

#5320: Bump @babel/plugin-transform-modules-systemjs from 7.17.8 to 7.29.4 in /samples/browser-esm-webpack-typescript-react

#5317: Bump fast-uri from 3.1.0 to 3.1.2 in /webpack-plugin

#5315: Bump fast-uri from 3.0.6 to 3.1.2 in /samples

#5316: Bump fast-uri from 3.1.0 to 3.1.2

#5318: Bump fast-uri from 3.1.0 to 3.1.2 in /website

#5319: Bump fast-uri from 3.1.0 to 3.1.2 in /samples/browser-esm-webpack-typescript-react

#5313: Bump postcss from 8.4.31 to 8.5.13 in /samples

#5308: Bump postcss from 8.5.6 to 8.5.12

#5306: Bump postcss from 8.4.31 to 8.5.10 in /webpack-plugin

#5301: Bump follow-redirects from 1.15.9 to 1.16.0 in /samples

#5300: Bump follow-redirects from 1.15.11 to 1.16.0 in /website

#5299: Bump follow-redirects from 1.15.6 to 1.16.0

#5295: Bump vite from 5.4.21 to 6.4.2 in /samples/browser-esm-vite-react

#5293: Bump lodash from 4.17.23 to 4.18.1 in /website

#5292: Bump lodash from 4.17.23 to 4.18.1 in /samples

... (truncated)

Changelog

Sourced from monaco-editor's changelog.

[0.56.0]

Breaking Changes

Reorganizes the exported ESM modules to provide supported, tree-shakeable entry points (#5155). The monaco-editor entry point continues to load all features and languages. Custom bundles can now import monaco-editor/editor and opt into:

all editor features with monaco-editor/features/register.all, or individual features with monaco-editor/features/<feature>/register;

all language definitions with monaco-editor/languages/definitions/register.all, or individual definitions with monaco-editor/languages/definitions/<language>/register;

the CSS, HTML, JSON, and TypeScript language features with monaco-editor/languages/features/register.all, or their individual register entry points.

Renames the misspelled IOverlayWidgetPosition.stackOridinal property to stackOrdinal.

Removes the deprecated IMirrorModel and IWorkerContext worker API types.

New Features and APIs

Adds editor.doubleClickSelectsBlock.

Adds editor.find.closeOnResult and editor.inlayHints.showLongLineWarning.

Adds offWhenInlineCompletions to QuickSuggestionsValue.

Adds model and provider option support to inline completion providers.

Adds ICodeEditor.revealAllCursors, ICodeEditor.getWidthOfLine, and ICodeEditor.renderAsync.

Adds advanced-external and advanced-wasm diff algorithms.

Exposes typed native LSP client and transport APIs.

Fixes

Treats Markdown returned by language servers as untrusted (#5280).

Updates the editor core to the version used by 0.56.0-dev-20260625.

[0.55.1]

Fixes missing language exports (monaco.json/typescript/...) due to wrong "types" path - #5123

[0.55.0]

Breaking Changes

Moves nested namespaces (languages.css, languages.html, languages.json, languages.typescript) to top level namespaces (css, html, json, typescript) to simplify the build process and align with typescript recommendations.

New Features

Adds native LSP support (see new lsp namespace).

Bug Fixes

Updates dompurify to 3.2.7

[0.54.0]

Adds option editor.mouseMiddleClickAction

Various bug fixes

[0.53.0]

⚠️ This release deprecates the AMD build and ships with significant changes of the AMD build. The AMD build will still be shipped for a while, but we don't offer support for it anymore. Please migrate to the ESM build.

... (truncated)

Commits

13f0c87 Bump websocket-driver from 0.7.4 to 0.7.5 in /website (#5392)
b5f23a3 Merge pull request #5396 from microsoft/hediet/b/release-0.56.0
9d053ab Improve Monaco Editor 0.56.0 changelog
0ba33d0 Release Monaco Editor 0.56.0
6d961b1 Bump websocket-driver from 0.7.4 to 0.7.5 in /samples (#5385)
d8c9ff0 Removes leftover debugger statements. (#5379)
59285ab fixes pipeline (#5376)
aaf58db Bump webpack-dev-server from 5.2.4 to 5.2.5 in /samples (#5374)
d8ac38e Bump webpack-dev-server from 5.2.4 to 5.2.5 in /website (#5373)
874af57 Bump undici from 7.24.7 to 7.28.0 (#5371)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for monaco-editor since your current version.

Updates vue-template-compiler from 2.6.14 to 2.7.16

Release notes

Sourced from vue-template-compiler's releases.

v2.7.16 "Swan Song"

This is the final release for Vue 2.

Vue 2 will reach End of Life on December 31st, 2023. For more details, please read this blog post.

Please refer to CHANGELOG.md for details.

v2.7.16-beta.2

Please refer to CHANGELOG.md for details.

v2.7.16-beta.1

Please refer to CHANGELOG.md for details.

v2.7.15

Please refer to CHANGELOG.md for details.

v2.7.14

Please refer to CHANGELOG.md for details.

v2.7.13

Please refer to CHANGELOG.md for details.

v2.7.12

Please refer to CHANGELOG.md for details.

v2.7.11

Please refer to CHANGELOG.md for details.

v2.7.10

Please refer to CHANGELOG.md for details.

v2.7.9

Please refer to CHANGELOG.md for details.

v2.7.8

Please refer to CHANGELOG.md for details.

v2.7.7

Please refer to CHANGELOG.md for details.

v2.7.6

Please refer to CHANGELOG.md for details.

v2.7.5

Please refer to CHANGELOG.md for details.

v2.7.4

Please refer to CHANGELOG.md for details.

v2.7.3

... (truncated)

Changelog

Sourced from vue-template-compiler's changelog.

2.7.16 Swan Song (2023-12-24)

Bug Fixes

lifecycle: ensure component effect scopes are disconnected (56ce7f8), closes #13134

2.7.16-beta.2 (2023-12-14)

Bug Fixes

account for nested render calls (db9c566), closes #13131

types: export more types for v3 alignment (jsx / component options) (895669f), closes #13078 #13128

2.7.16-beta.1 (2023-12-08)

Bug Fixes

compiler-sfc: check template ref usage, (#12985) (83d9535), closes #12984

compiler-sfc: fix rewriteDefault edge cases (25f97a5), closes #13060 #12892 #12906

keep-alive: fix keep-alive memory leak (2632249), closes #12827

keep-alive: fix memory leak without breaking transition tests (e0747f4)

props: should not unwrap props that are raw refs (08382f0), closes #12930

shallowReactive: should track value if already reactive when set in shallowReactive (0ad8e8d)

style: always set new styles (f5ef882), closes #12901 #12946

types: fix shallowRef's return type (#12979) (a174c29), closes #12978

types: fix type augmentation and compiler-sfc types w/moduleResolution: bundler (#13107) (de0b97b), closes #13106

types: provide types for built-in components (3650c12), closes #13002

types: type VNodeChildren should allow type number (#13067) (24fcf69), closes #12973

utils: unwrap refs when stringifying values in template (ae3e4b1), closes #12884 #12888

watch: new property addition should trigger deep watcher with getter (6d857f5), closes #12967 #12972

2.7.15 (2023-10-23)

Bug Fixes

compiler-sfc: add semicolon after defineProps statement (#12879) (51fef2c)

compiler-sfc: fix macro usage in multi-variable declaration (#12873) (d27c128)

compiler-sfc: Optimize the value of emitIdentifier (#12851) (bb59751)

compiler-sfc: Resolve object expression parsing errors in v-on (#12862) (b8c8b3f)

lifecycle: scope might changed when call hook (#13070) (74ca5a1)

... (truncated)

Commits

13f4e7d release: v2.7.16
56ce7f8 fix(lifecycle): esnure component effect scopes are disconnected
305e4ae release: v2.7.16-beta.2
3e1037e chore: bump vitest to 1.0.4
db9c566 fix: account for nested render calls
895669f fix(types): export more types for v3 alignment (jsx / component options)
73bdf14 release: v2.7.16-beta.1
e0747f4 fix(keep-alive): fix memory leak without breaking transition tests
2632249 fix(keep-alive): fix keep-alive memory leak
3650c12 fix(types): provide types for built-in components
Additional commits viewable in compare view

Updates webpack from 5.94.0 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

Resolve aliases pointing at a package directory whose name ends with .js again. (by @alexander-akait in #21542)

Name CSS sources in source maps by their resource path, without the css prefix. (by @bjohansebas in #21536)

Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @bjohansebas in #21528)

Report "universal" as the loader context target for the universal target. (by @alexander-akait in #21540)

Skip require().prop in dead branches gated by inlined imported constants. (by @hai-x in #21517)

Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @bjohansebas in #21473)

v5.109.1

Patch Changes

Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @alexander-akait in #21533)

Make require(esm) module.exports re-export analysis independent of module processing order. (by @alexander-akait in #21521)

Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @alexander-akait in #21521)

Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @alexander-akait in #21503)

Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @alexander-akait in #21524)

Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @alexander-akait in #21492)

Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @alexander-akait in #21531)

Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @alexander-akait in #21500)

Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @alexander-akait in #21498)

Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @alexander-akait in #21504)

Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @alexander-akait in #21511)

Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @alexander-akait in #21506)

Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @bjohansebas in #21520)

Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @alexander-akait in #21516)

Enable the Node.js compile cache in the webpack CLI entry point. (by @bjohansebas in #21523)

Encode the persistent cache with V8's value serializer. (by @avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

Resolve aliases pointing at a package directory whose name ends with .js again. (by @alexander-akait in #21542)

Name CSS sources in source maps by their resource path, without the css prefix. (by @bjohansebas in #21536)

Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @bjohansebas in #21528)

Report "universal" as the loader context target for the universal target. (by @alexander-akait in #21540)

Skip require().prop in dead branches gated by inlined imported constants. (by @hai-x in #21517)

Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @bjohansebas in #21473)

5.109.1

Patch Changes

Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @alexander-akait in #21533)

Make require(esm) module.exports re-export analysis independent of module processing order. (by @alexander-akait in #21521)

Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @...
Description has been truncated

Bumps the npm-minor group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [eslint-config-standard](https://github.com/standard/eslint-config-standard) | `17.0.0` | `17.1.0` | | [eslint-plugin-import](https://github.com/import-js/eslint-plugin-import) | `2.26.0` | `2.32.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | | [luxon](https://github.com/moment/luxon) | `3.4.4` | `3.7.2` | | [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.50.0` | `0.56.0` | | [vue-template-compiler](https://github.com/vuejs/vue) | `2.6.14` | `2.7.16` | | [webpack](https://github.com/webpack/webpack) | `5.94.0` | `5.109.2` | Updates `eslint-config-standard` from 17.0.0 to 17.1.0 - [Commits](standard/eslint-config-standard@v17.0.0...v17.1.0) Updates `eslint-plugin-import` from 2.26.0 to 2.32.0 - [Release notes](https://github.com/import-js/eslint-plugin-import/releases) - [Changelog](https://github.com/import-js/eslint-plugin-import/blob/main/CHANGELOG.md) - [Commits](import-js/eslint-plugin-import@v2.26.0...v2.32.0) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `luxon` from 3.4.4 to 3.7.2 - [Changelog](https://github.com/moment/luxon/blob/master/CHANGELOG.md) - [Commits](moment/luxon@3.4.4...3.7.2) Updates `monaco-editor` from 0.50.0 to 0.56.0 - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.50.0...v0.56.0) Updates `vue-template-compiler` from 2.6.14 to 2.7.16 - [Release notes](https://github.com/vuejs/vue/releases) - [Changelog](https://github.com/vuejs/vue/blob/main/CHANGELOG.md) - [Commits](vuejs/vue@v2.6.14...v2.7.16) Updates `webpack` from 5.94.0 to 5.109.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.94.0...v5.109.2) --- updated-dependencies: - dependency-name: eslint-config-standard dependency-version: 17.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: eslint-plugin-import dependency-version: 2.32.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: luxon dependency-version: 3.7.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: monaco-editor dependency-version: 0.55.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: vue-template-compiler dependency-version: 2.7.16 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor - dependency-name: webpack dependency-version: 5.108.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 25, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-d2b62c9e36 branch from 14fea1b to 3220567 Compare July 6, 2026 17:43

dependabot Bot changed the base branch from master to main July 13, 2026 13:14

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-d2b62c9e36 branch 2 times, most recently from 3996e5b to f6d72ec Compare July 21, 2026 17:43

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-d2b62c9e36 branch from f6d72ec to e3c0148 Compare July 28, 2026 17:43

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-d2b62c9e36 branch from e3c0148 to e1260c2 Compare August 4, 2026 17:44

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-d2b62c9e36 branch from e1260c2 to 6034c7c Compare August 25, 2026 17:43

Navigation Menu

Uh oh!

Bump the npm-minor group across 1 directory with 7 updates - #2555

Bump the npm-minor group across 1 directory with 7 updates#2555
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-d2b62c9e36

dependabot Bot commented on behalf of github Jun 25, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.32.0

Added

Fixed

Changed

[2.32.0] - 2025-06-20

Added

Fixed

Changed

[2.31.0] - 2024-10-03

Added

Fixed

Changed

4.18.1

Bugs

4.18.0

v4.18.0

Security

Docs

lodash.* modular packages

3.7.2 (2025-07-09)

3.7.1 (2025-07-09)

3.7.0 (2025-07-09)

3.6.1 (2025-03-31)

3.6.0 (2025-03-25)

3.5.0 (2024-08-03)

v0.56.0

Changes:

[0.56.0]

Breaking Changes

New Features and APIs

Fixes

[0.55.1]

[0.55.0]

Breaking Changes

New Features

Bug Fixes

[0.54.0]

[0.53.0]

v2.7.16 "Swan Song"

v2.7.16-beta.2

v2.7.16-beta.1

v2.7.15

v2.7.14

v2.7.13

v2.7.12

v2.7.11

v2.7.10

v2.7.9

v2.7.8

v2.7.7

v2.7.6

v2.7.5

v2.7.4

v2.7.3

2.7.16 Swan Song (2023-12-24)

Bug Fixes

2.7.16-beta.2 (2023-12-14)

Bug Fixes

2.7.16-beta.1 (2023-12-08)

Bug Fixes

2.7.15 (2023-10-23)

Bug Fixes

v5.109.2

Patch Changes

v5.109.1

Patch Changes

5.109.2

Patch Changes

5.109.1

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

dependabot Bot commented on behalf of github Jun 25, 2026 •

edited

Loading

`lodash.*` modular packages