Skip to content

Bump the javascript-dev group across 1 directory with 4 updates - #534

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/javascript-dev-d1dd930456
Open

Bump the javascript-dev group across 1 directory with 4 updates#534
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/javascript-dev-d1dd930456

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the javascript-dev group with 4 updates in the / directory: core-js, jscpd, less and webpack.

Updates core-js from 3.49.0 to 3.50.0

Release notes

Sourced from core-js's releases.

3.50.0 - 2026.08.05

  • Changes v3.49.0...v3.50.0 (138 commits)
  • Joint iteration proposal:
    • Built-ins:
      • Iterator.zip
      • Iterator.zipKeyed
    • Moved to stable ES, May 2026 TC39 meeting
    • Added es. namespace modules, /es/ and /stable/ namespace entries
  • Iterator chunking proposal:
    • Built-ins:
      • Iterator.prototype.chunks
      • Iterator.prototype.windows
    • Throw a TypeError instead of RangeError on non-integer number chunkSize / windowSize, following [tc39/proposal-iterator-chunking/#30](tc39/proposal-iterator-chunking#30)
    • Moved to stage 3, May 2026 TC39 meeting
    • Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
  • Added Iterator includes stage 3 proposal:
    • Added built-in:
      • Iterator.prototype.includes
  • Added Iterator join stage 3 proposal:
    • Added built-in:
      • Iterator.prototype.join
  • Added Await dictionary of Promises stage 3 proposal:
    • Added built-ins:
      • Promise.allKeyed
      • Promise.allSettledKeyed
  • Throw a RangeError on finite unsafe integer limit in Iterator.prototype.{ drop, take }, following [tc39/ecma262/#3776](tc39/ecma262#3776)
  • Use PromiseResolve semantics in Promise.try, following [tc39/ecma262/#3883](tc39/ecma262#3883)
  • Added detection of missed Webkit ~ Safari < 26.2 Iterator.prototype.flatMap bug case, #1538
  • Deno 2.9+ replaces Object.prototype.__proto__ instead of removing it, so the feature detection updated
  • Fixed JSON.stringify polyfill with an array replacer - keys order now follows the replacer, inherited and non-enumerable properties are no longer ignored, #1539
  • Make URL / URLSearchParams parsing a little more correct (char sets, percent coding, etc)
  • Ensure opaque paths always roundtrip in URL polyfill (still without adding to feature detection), whatwg/url#844
  • Fix URL#toJSON when URL#toString is reassigned after core-js is imported
  • Fixed possible crash on some keys in Symbol.for
  • Some get-iterator / get-iterator-method fixes
  • Fixed String.prototype.{ match, search } polyfills conversion order
  • Added missed MAX_SAFE_INTEGER excess check in Array.from and { Map, Object }.groupBy polyfills
  • Improved the way of inner iterators cleaning in iterator helpers
  • Improved accuracy of Math.{ asinh, cbrt, log1p } polyfills with big and small values
  • Improved performance of Uint8Array base64 methods
  • Improved performance of escape
  • Slight performance improvement for engines with native Array.prototype.fill on ArrayBuffer constructor and %TypedArray%.prototype.fill
  • Clarify supported Node versions in package.json of some missed packages (just to satisfy publint)
  • Compat data improvements:

... (truncated)

Changelog

Sourced from core-js's changelog.

3.50.0 - 2026.08.05

  • Changes v3.49.0...v3.50.0 (138 commits)
  • Joint iteration proposal:
    • Built-ins:
      • Iterator.zip
      • Iterator.zipKeyed
    • Moved to stable ES, May 2026 TC39 meeting
    • Added es. namespace modules, /es/ and /stable/ namespace entries
  • Iterator chunking proposal:
    • Built-ins:
      • Iterator.prototype.chunks
      • Iterator.prototype.windows
    • Throw a TypeError instead of RangeError on non-integer number chunkSize / windowSize, following [tc39/proposal-iterator-chunking/#30](tc39/proposal-iterator-chunking#30)
    • Moved to stage 3, May 2026 TC39 meeting
    • Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
  • Added Iterator includes stage 3 proposal:
    • Added built-in:
      • Iterator.prototype.includes
  • Added Iterator join stage 3 proposal:
    • Added built-in:
      • Iterator.prototype.join
  • Added Await dictionary of Promises stage 3 proposal:
    • Added built-ins:
      • Promise.allKeyed
      • Promise.allSettledKeyed
  • Throw a RangeError on finite unsafe integer limit in Iterator.prototype.{ drop, take }, following [tc39/ecma262/#3776](tc39/ecma262#3776)
  • Use PromiseResolve semantics in Promise.try, following [tc39/ecma262/#3883](tc39/ecma262#3883)
  • Added detection of missed Webkit ~ Safari < 26.2 Iterator.prototype.flatMap bug case, #1538
  • Deno 2.9+ replaces Object.prototype.__proto__ instead of removing it, so the feature detection updated
  • Fixed JSON.stringify polyfill with an array replacer - keys order now follows the replacer, inherited and non-enumerable properties are no longer ignored, #1539
  • Make URL / URLSearchParams parsing a little more correct (char sets, percent coding, etc)
  • Ensure opaque paths always roundtrip in URL polyfill (still without adding to feature detection), whatwg/url#844
  • Fix URL#toJSON when URL#toString is reassigned after core-js is imported
  • Fixed possible crash on some keys in Symbol.for
  • Some get-iterator / get-iterator-method fixes
  • Fixed String.prototype.{ match, search } polyfills conversion order
  • Added missed MAX_SAFE_INTEGER excess check in Array.from and { Map, Object }.groupBy polyfills
  • Improved the way of inner iterators cleaning in iterator helpers
  • Improved accuracy of Math.{ asinh, cbrt, log1p } polyfills with big and small values
  • Improved performance of Uint8Array base64 methods
  • Improved performance of escape
  • Slight performance improvement for engines with native Array.prototype.fill on ArrayBuffer constructor and %TypedArray%.prototype.fill
  • Clarify supported Node versions in package.json of some missed packages (just to satisfy publint)
  • Compat data improvements:

... (truncated)

Commits
  • 486e8d6 v3.50.0
  • 6a78c6a Cache URL#toString (#1533)
  • 5d4f138 fix: correct Iterator zip entry exports
  • 7e8e1cc rename method for consistency
  • 2507115 fix JSON.stringify polyfill with an array replacerJSON.stringify polyfill...
  • 4036342 make URL / URLSearchParams parsing a little more correct (char sets, perc...
  • 37375ba fix order of detection
  • 276de47 add detection of missed Webkit ~ Safari < 26.2 Iterator.prototype.flatMap b...
  • 6e4a942 use PromiseResolve semantics in Promise.try
  • ff52b9f backport await dictionary stage 3 proposal
  • Additional commits viewable in compare view

Updates jscpd from 4.2.4 to 4.3.0

Release notes

Sourced from jscpd's releases.

Release v4.3.0

New Features

  • Color auto-detection — ANSI colors are disabled automatically when stdout is not a TTY (piped or redirected output), with new --colors / --no-colors flags and a colors config key to override. Precedence: explicit flag/config → FORCE_COLOR → NO_COLOR → TTY detection. The statistics table is covered too. (#893, #899)
  • jscpd-server: MCP protocol revision 2026-07-28 — migrated to the official MCP SDK v2 with the stateless 2026-07-28 revision and a legacy fallback for 2025-era clients, DNS-rebinding protection (Origin/Host allowlists with --allowed-origin/--allowed-host) on both /mcp and the REST API, a loopback default bind (127.0.0.1), and a hardened start/stop lifecycle. (#902)

Bug Fixes

  • consoleFull no longer prints clones twice — the progress announcer is skipped for reporters that print every clone themselves (ai, consoleFull); jscpd-server shares the same wiring. (#900)
  • Inclusive source line counts — fixes off-by-one line counts in statistics and reports. (#881)
  • jscpd-server log colors — server output now respects NO_COLOR/FORCE_COLOR and TTY detection like the CLI.

Security

  • Resolved all 27 open Dependabot alerts on transitive dependencies (fast-uri, hono, js-yaml, brace-expansion, nanoid, postcss, ip-address, body-parser and others) by restoring the pnpm override mechanism — overrides now live in pnpm-workspace.yaml, where pnpm 10 actually reads them. CI installs use --frozen-lockfile so lockfile drift fails loudly.

Thank You ❤️

This release was shaped by community contributions — huge thanks to:

Published Packages

  • @jscpd/badge-reporter@4.2.5 on npm
  • @jscpd/core@4.2.5 on npm
  • @jscpd/html-reporter@4.2.5 on npm
  • @jscpd/leveldb-store@4.2.6 on npm
  • @jscpd/redis-store@4.2.6 on npm
  • jscpd-sarif-reporter@4.2.5 on npm

Not Yet Published

  • jscpd-server@4.3.0 (published: 4.3.0)
  • jscpd@4.3.0 (published: 5.0.15)
  • @jscpd/finder@4.3.0 (published: 4.2.5)
  • @jscpd/tokenizer@4.2.6 (published: 4.2.5)

Release v4.2.5

Bug Fixes

  • JSON reporter duplicate token counts — was always reported as in JSON output; now computed from token positions () (#801).
  • Gitignore parent-directory walk — files in parent directories up to the repo root are now read and combined with scan-directory files. Also reads and the global for full parity with Git's ignore resolution (#741).
  • Commander v15 migration — CLI option parsing migrated from direct property access (, etc.) to the API required by Commander v8+. The / flag handling was rewritten to use Commander's native negation support instead of inspection.

... (truncated)

Changelog

Sourced from jscpd's changelog.

4.3.0 — 2026-08-13

New Features

  • Color auto-detection — ANSI colors are disabled automatically when stdout is not a TTY (piped or redirected output), with new --colors / --no-colors flags and a colors config key to override. Precedence: explicit flag/config → FORCE_COLOR → NO_COLOR → TTY detection. The statistics table is covered too. (#893, #899)
  • jscpd-server: MCP protocol revision 2026-07-28 — migrated to the official MCP SDK v2 with the stateless 2026-07-28 revision and a legacy fallback for 2025-era clients, DNS-rebinding protection (Origin/Host allowlists with --allowed-origin/--allowed-host) on both /mcp and the REST API, a loopback default bind (127.0.0.1), and a hardened start/stop lifecycle. (#902)

Bug Fixes

  • consoleFull no longer prints clones twice — the progress announcer is skipped for reporters that print every clone themselves (ai, consoleFull); jscpd-server shares the same wiring. (#900)
  • Inclusive source line counts — fixes off-by-one line counts in statistics and reports. (#881)
  • jscpd-server log colors — server output now respects NO_COLOR/FORCE_COLOR and TTY detection like the CLI.

Security

  • Resolved all 27 open Dependabot alerts on transitive dependencies (fast-uri, hono, js-yaml, brace-expansion, nanoid, postcss, ip-address, body-parser and others) by restoring the pnpm override mechanism — overrides now live in pnpm-workspace.yaml, where pnpm 10 actually reads them. CI installs use --frozen-lockfile so lockfile drift fails loudly.

Thank You ❤️

This release was shaped by community contributions — huge thanks to:

4.2.5 — 2026-06-07

Bug Fixes

  • JSON reporter duplicate token counts — tokens was always reported as 0 in JSON output; now computed from token positions (end.position - start.position) (#801).
  • Gitignore parent-directory walk — .gitignore files in parent directories up to the repo root are now read and combined with scan-directory .gitignore files. Also reads .git/info/exclude and the global core.excludesFile for full parity with Git's ignore resolution (#741).
  • Commander v15 migration — CLI option parsing migrated from direct property access (cli.minTokens, etc.) to the cli.opts() API required by Commander v8+. The --no-gitignore / --gitignore flag handling was rewritten to use Commander's native negation support instead of rawArgs inspection.
  • Vitest 4.1.0 — bumped from 3.2.4 to address CVE-2026-47429.
  • Commander v15 — bumped from v5 to v15, enabling modern Node.js compatibility.
  • Pug 3.0.4, node-sarif-builder 4.1.0, nodemon 3.1.14 — dependency bumps for security and compatibility.

4.2.0 — 2026-05-14

Breaking Changes

  • Vue SFC tokenization — .vue files are no longer tokenized as markup. Each block is now dispatched to its own sub-format: <script> → javascript, <script lang="ts"> → typescript, \<template> → markup, <style> → css, <style lang="scss"> → scss, <style lang="less"> → less. Clone reports for .vue files now appear under these resolved sub-format names. Any tooling or configuration that relied on .vue clones being reported under markup must be updated.
  • --formatsExts users — custom mappings that pointed .vue to markup (e.g. "formatsExts": { "markup": ["vue"] }) will no longer take effect because .vue is handled by the dedicated vue format processor. Remove or update such mappings.

New Features

... (truncated)

Commits

Updates less from 4.6.4 to 4.9.0

Release notes

Sourced from less's releases.

Release v4.9.0

Changes

See CHANGELOG.md for details.

Installation

npm install less@4.9.0

Release v4.8.1

Changes

See CHANGELOG.md for details.

Installation

npm install less@4.8.1

Release v4.8.0

Changes

See CHANGELOG.md for details.

Installation

npm install less@4.8.0

Release v4.7.0

Changes

See CHANGELOG.md for details.

Installation

npm install less@4.7.0

Release v4.6.7

Changes

See CHANGELOG.md for details.

Installation

... (truncated)

Changelog

Sourced from less's changelog.

v4.9.0 (2026-08-13)

Changes

v4.8.1 (2026-07-26)

Changes

  • #4483 fix(release): sync release version from PR title (@​matthew-dean)
  • #4479 fix: leave math functions for the browser when an argument is a runtime CSS var() (@​Lfan-ke)
  • #4477 fix: forwarding an unset variadic no longer overrides callee defaults (@​Lfan-ke)
  • #4474 chore: release v4.8.0 — deprecate legacy identifier forms and dynamic @​charset (@​app/github-actions)

v4.8.0 (2026-07-22)

Changes

  • #4473 fix(mixing): resolves issue #4234 (@​puckowski)
  • #4472 Fix boolean() parsing for comparisons between inline condition expressions (@​app/copilot-swe-agent)

Deprecation Warnings

  • #4475 Deprecate numeric-leading and dash-only variable names, dash-only mixin names, and dynamic @charset interpolation for removal in Less 5.x. Less 4 preserves the existing output while warning; migrate names to valid identifiers and use a static quoted @charset declaration. (@​matthew-dean)

v4.7.0 (2026-07-18)

Changes

v4.6.7 (2026-06-20)

Changes

  • #4457 Fix failing "Request Copilot review" CI job (@​app/copilot-swe-agent)
  • #4451 chore: release v4.6.6 (@​app/github-actions)

v4.6.6 (2026-06-14)

... (truncated)

Commits

Updates webpack from 5.107.2 to 5.110.0

Release notes

Sourced from webpack's releases.

v5.110.0

Minor Changes

  • Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

  • Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

  • Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

  • Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

  • Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

  • Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

  • Give externals the original request of a context module element. (by @​alexander-akait in #21780)

  • Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

  • Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

  • Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

  • Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

  • Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

  • Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

  • Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

  • Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

  • Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

  • Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

  • Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

  • Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #21841)

  • Minify HTML further where the parsed document is unchanged: drop redundant quotes, whitespace nothing renders, escapes text does not need, implied tags, optional end tags nothing prints behind, empty attributes and nested empty elements; fold enumerated values and casing; normalize each attribute against the element it is on; and rewrite style, token lists, srcset, sizes, URL, integer and boolean attributes, viewport content, inline <style> and a JSON <script> body through their own grammars. Adds the optimization.minimize.html options collapseWhitespace, mergeStyles, minifyConditionalComments, minifySrcdoc, preserveComments, removeEmptyAttributes, removeEmptyElements, removeImpliedTags, removeRedundantAttributes, sortAttributes and sortTokenLists, and keeps an end tag the parent, the next element or the adoption agency would otherwise restructure the tree over. (by @​alexander-akait in #21841)

  • Suggest the closest name or a casing fix anywhere in a failed request. (by @​alexander-akait in #21727)

  • Add aggregated shutdown hook to MultiCompiler. (by @​bjohansebas in #21578)

  • Report which compilers changed on the MultiCompiler done hook. (by @​bjohansebas in #21580)

  • Add [containedpath]/[containedfile] placeholders, used for [path]/[file] of asset and html modules with experiments.futureDefaults. (by @​alexander-akait in #21592)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.0

Minor Changes

  • Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

  • Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

  • Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

  • Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

  • Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

  • Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

  • Give externals the original request of a context module element. (by @​alexander-akait in #21780)

  • Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

  • Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

  • Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

  • Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

  • Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

  • Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

  • Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

  • Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

  • Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

  • Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

  • Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

  • Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #21841)

  • Minify HTML further where the parsed document is unchanged: drop redundant quotes, whitespace nothing renders, escapes text does not need, implied tags, optional end tags nothing prints behind, empty attributes and nested empty elements; fold enumerated values and casing; normalize each attribute against the element it is on; and rewrite style, token lists, srcset, sizes, URL, integer and boolean attributes, viewport content, inline <style> and a JSON <script> body through their own grammars. Adds the optimization.minimize.html options collapseWhitespace, mergeStyles, minifyConditionalComments, minifySrcdoc, preserveComments, removeEmptyAttributes, removeEmptyElements, removeImpliedTags, removeRedundantAttributes, sortAttributes and sortTokenLists, and keeps an end tag the parent, the next element or the adoption agency would otherwise restructure the tree over. (by @​alexander-akait in #21841)

  • Suggest the closest name or a casing fix anywhere in a failed request. (by @​alexander-akait in #21727)

  • Add aggregated shutdown hook to MultiCompiler. (by @​bjohansebas in #21578)

  • Report which compilers changed on the MultiCompiler done hook. (by @​bjohansebas in #21580)

... (truncated)

Commits
  • 3a7c0e6 chore(release): new release (#21545)
  • 75891c8 chore(changesets): union same-subject entries (#21841)
  • 6b96de7 feat(config): emit no development source map for library builds (#21839)
  • ff0c832 feat(css,html): reach embedded source from cssMinify and htmlMinify (#21838)
  • 06bedfb chore(deps): bump test/wpt in the dependencies group (#21836)
  • 0cde758 feat(css,html): fold every case-insensitive CSS name, and name each minifier ...
  • 0b5c4e9 perf(css): scope duplicate rules, and reuse interned names and minified style...
  • 8750c1f feat(css,html): add renderEmbeddedSource for source one language embeds in an...
  • 4f4ba91 feat(esm): bake analyzable urls where the name settles late (#21828)
  • 7651c03 perf(css): read every target ability off the browsers, and cut what the minif...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 19, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/javascript-dev-d1dd930456 branch from bafed45 to a101a8f Compare September 7, 2026 17:14
@dependabot
Bump the javascript-dev group across 1 directory with 4 updates
f00b9c2 
Bumps the javascript-dev group with 4 updates in the / directory: [core-js](https://github.com/zloirock/core-js/tree/HEAD/packages/core-js), [jscpd](https://github.com/kucherenko/jscpd/tree/HEAD/rust/jscpd), [less](https://github.com/less/less.js) and [webpack](https://github.com/webpack/webpack).


Updates `core-js` from 3.49.0 to 3.50.0
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/commits/v3.50.0/packages/core-js)

Updates `jscpd` from 4.2.4 to 4.3.0
- [Release notes](https://github.com/kucherenko/jscpd/releases)
- [Changelog](https://github.com/kucherenko/jscpd/blob/v4.3.0/CHANGELOG.md)
- [Commits](https://github.com/kucherenko/jscpd/commits/v4.3.0/rust/jscpd)

Updates `less` from 4.6.4 to 4.9.0
- [Release notes](https://github.com/less/less.js/releases)
- [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/less/less.js/commits/v4.9.0)

Updates `webpack` from 5.107.2 to 5.110.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.107.2...v5.110.0)

---
updated-dependencies:
- dependency-name: core-js
  dependency-version: 3.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: javascript-dev
- dependency-name: jscpd
  dependency-version: 4.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: javascript-dev
- dependency-name: less
  dependency-version: 4.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: javascript-dev
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: javascript-dev
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/javascript-dev-d1dd930456 branch from a101a8f to f00b9c2 Compare September 10, 2026 17:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants