Skip to content

chore(deps): bump the dependencies group across 1 directory with 11 updates - #2386

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-7014aba2e7
Open

chore(deps): bump the dependencies group across 1 directory with 11 updates#2386
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-7014aba2e7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 11 updates in the / directory:

Package From To
memfs 4.57.8 4.68.1
range-parser 1.2.1 1.3.0
@fastify/express 4.0.6 4.0.7
@hapi/hapi 21.4.9 21.4.10
@hono/node-server 2.0.10 2.1.1
cspell 10.0.1 10.1.0
fastify 5.8.5 5.12.1
hono 4.13.1 4.13.3
lint-staged 17.0.8 17.3.0
prettier 3.8.4 3.9.6
webpack 5.109.0 5.109.2

Updates memfs from 4.57.8 to 4.68.1

Release notes

Sourced from memfs's releases.

Release v4.68.1

What's Changed

Full Changelog: streamich/memfs@v4.68.0...v4.68.1

Release v4.68.0

What's Changed

Full Changelog: streamich/memfs@v4.67.0...v4.68.0

Release v4.67.0

What's Changed

New Contributors

Full Changelog: streamich/memfs@v4.66.1...v4.67.0

Release v4.66.1

What's Changed

Full Changelog: streamich/memfs@v4.66.0...v4.66.1

Release v4.66.0

What's Changed

Full Changelog: streamich/memfs@v4.65.0...v4.66.0

Release v4.65.0

What's Changed

New Contributors

Full Changelog: streamich/memfs@v4.64.0...v4.65.0

Release v4.64.0

What's Changed

... (truncated)

Commits
  • d1703ac chore: release v4.68.1
  • 8987c43 Merge pull request #1278 from streamich/fix-unlink-dir
  • 559dff9 test: 💍 fixup flaky test
  • 00b1487 fix: 🐛 .unlink() should not delete empty directories
  • caa708b chore: release v4.68.0
  • 083162d Merge pull request #1277 from streamich/fix-birthtime
  • f8176b1 feat: 🎸 return cloned Date objects
  • cc283f3 feat: 🎸 add file birthTime support
  • 9a78fd2 chore: release v4.67.0
  • fa47ecc chore: persist git-fsa directory handle
  • Additional commits viewable in compare view

Updates range-parser from 1.2.1 to 1.3.0

Release notes

Sourced from range-parser's releases.

v1.3.0

Fixed

  • Improve number parsing (#58) eba9c7a
  • Handle invalid start and end byte positions in range parsing (#57) 269cb4e

jshttp/range-parser@v1.2.1...v1.3.0

Commits
  • f4bf173 Clamp a suffix whose length exceeds the representation (#66)
  • b49e00f fix: still show ranges if there are multiple ranges, even if some are invalid...
  • 4f3b091 Remove dependabot config (#60)
  • eba9c7a Improve number parsing (#58)
  • 269cb4e fix: handle invalid start and end byte positions in range parsing (#57)
  • 098e332 build(deps): bump github/codeql-action from 3.31.2 to 4.31.6 (#50)
  • 3599369 build(deps): bump actions/checkout from 3.6.0 to 6.0.0 (#51)
  • 054ea57 build(deps): bump github/codeql-action from 2.23.2 to 4.31.2 (#48)
  • d230b16 build(deps): bump actions/upload-artifact from 3.1.3 to 5.0.0 (#49)
  • 54f84f4 chore: add funding to package.json (#42)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for range-parser since your current version.


Updates @fastify/express from 4.0.6 to 4.0.7

Release notes

Sourced from @​fastify/express's releases.

v4.0.7

⚠️ Security Release

What's Changed

New Contributors

Full Changelog: fastify/fastify-express@v4.0.6...v4.0.7

Commits
  • b40dfd4 Bumped v4.0.7
  • 7be7196 Merge commit from fork
  • c6c8f20 chore: replace http with https in urls (#196)
  • 7eed1b1 chore(package.json): fix delvedor's personal url
  • 04ac488 chore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group (#194)
  • 087f1b2 chore: update depedabot setting
  • See full diff in compare view

Updates @hapi/hapi from 21.4.9 to 21.4.10

Commits
  • 80b7728 21.4.10
  • 0124f0d Don't try to set autoValue cookie when state parsing is disabled
  • 2e418c4 Limit state updates to clearing for error 500 response
  • 435a206 Move cookie to state processing to request
  • 2526488 fix(types): widen Query/Params/Headers to unknown
  • See full diff in compare view

Updates @hono/node-server from 2.0.10 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

New Contributors

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

Commits

Updates cspell from 10.0.1 to 10.1.0

Release notes

Sourced from cspell's releases.

v10.1.0

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:

<testsuite tests="3">
  <testcase classname="File1" name"/>
  <testcase classname="File2" name="AnotherSuccessfulTest"/>
  <testcase classname="foo3" name="AFailingTest">
    <failure type="prohibited word"> zzz </failure>
  </testcase>
</testsuite>

This PR follows that shape but wraps it in a <testsuites> root and groups by file (one <testsuite> per file, suite name = file path), since that is the convention used by other widely-consumed JUnit reporters (for example ESLint's JUnit formatter) and is what most CI JUnit parsers expect. The package README documents the full mapping.

  • package.json, tsconfig.json, test framework, and files/exports/publishConfig shape are copied from cspell-json-reporter. Version pinned to 10.0.1 to match the monorepo's locked versioning.
  • No third-party XML library was added. The repo has no existing XML dependency, so a small escaping helper (src/utils/escapeXml.ts) and a pure XML-string builder (src/utils/buildJUnitXml.ts) were written in-repo, consistent with the monorepo's small-utility-file convention.
  • Unit tests (32) cover: no files, a clean file (single passing testcase), a file with issues, escaping of special characters in paths/words/messages, a skipped file, and non-issue processing errors (error emitter routed to a dedicated cspell-errors testsuite using <error>).

Assumptions the issue thread left ambiguous, called out for review:

  1. One <testsuite> per file rather than one flat suite for the whole run. Matches common JUnit reporter convention and keeps per-file counts meaningful in CI UIs.
  2. A clean file gets one synthetic passing <testcase name="no issues found"> so a suite is never reported with tests="0", which some JUnit consumers treat as suspicious.
  3. Settings are intentionally slimmer than cspell-json-reporter's (outFile, suiteName only). JUnit XML has no natural place for arbitrary debug/progress log dumps.
  4. cspell processing errors are reported as <error> elements, distinct from spelling <failure> elements, per the JUnit failure-vs-error distinction.

Verified locally: tsc -b clean, vitest 32/32, eslint and prettier clean, and the full monorepo build:prod succeeds with the package in the workspace. One environment note: the package's CLI smoke-test script wasn't runnable locally (repo requires Node >=22.18.0, local was 22.17.0 — the sibling json-reporter fails identically there), so CI is the first place it will run.

Fixes

fix: allow substitutions across ignored ranges (#9017)

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.1.0 (2026-08-22)

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:

<testsuite tests="3">
  <testcase classname="File1" name"/>
  <testcase classname="File2" name="AnotherSuccessfulTest"/>
  <testcase classname="foo3" name="AFailingTest">
    <failure type="prohibited word"> zzz </failure>
  </testcase>
</testsuite>

This PR follows that shape but wraps it in a <testsuites> root and groups by file (one <testsuite> per file, suite name = file path), since that is the convention used by other widely-consumed JUnit reporters (for example ESLint's JUnit formatter) and is what most CI JUnit parsers expect. The package README documents the full mapping.

  • package.json, tsconfig.json, test framework, and files/exports/publishConfig shape are copied from cspell-json-reporter. Version pinned to 10.0.1 to match the monorepo's locked versioning.
  • No third-party XML library was added. The repo has no existing XML dependency, so a small escaping helper (src/utils/escapeXml.ts) and a pure XML-string builder (src/utils/buildJUnitXml.ts) were written in-repo, consistent with the monorepo's small-utility-file convention.
  • Unit tests (32) cover: no files, a clean file (single passing testcase), a file with issues, escaping of special characters in paths/words/messages, a skipped file, and non-issue processing errors (error emitter routed to a dedicated cspell-errors testsuite using <error>).

Assumptions the issue thread left ambiguous, called out for review:

  1. One <testsuite> per file rather than one flat suite for the whole run. Matches common JUnit reporter convention and keeps per-file counts meaningful in CI UIs.
  2. A clean file gets one synthetic passing <testcase name="no issues found"> so a suite is never reported with tests="0", which some JUnit consumers treat as suspicious.
  3. Settings are intentionally slimmer than cspell-json-reporter's (outFile, suiteName only). JUnit XML has no natural place for arbitrary debug/progress log dumps.
  4. cspell processing errors are reported as <error> elements, distinct from spelling <failure> elements, per the JUnit failure-vs-error distinction.

Verified locally: tsc -b clean, vitest 32/32, eslint and prettier clean, and the full monorepo build:prod succeeds with the package in the workspace. One environment note: the package's CLI smoke-test script wasn't runnable locally (repo requires Node >=22.18.0, local was 22.17.0 — the sibling json-reporter fails identically there), so CI is the first place it will run.

Fixes

fix: allow substitutions across ignored ranges (#9017)

... (truncated)

Commits
  • 401518c v10.1.0
  • acf8449 chore: Prepare Release v10.1.0 (auto-deploy) (#8883)
  • 3078371 fix: Workflow Bot -- Update Dictionaries (main) (#9024)
  • f557824 ci: Workflow Bot -- Update ALL Dependencies (main) (#9014)
  • 1c11da6 ci: Workflow Bot -- Update ALL Dependencies (main) (#8970)
  • 67448c8 chore: bump the development-dependencies group across 1 directory with 16 upd...
  • ce30dc7 chore: bump chalk from 5.6.2 to 6.0.0 (#8973)
  • 9703748 ci: Workflow Bot -- Update ALL Dependencies (main) (#8952)
  • c8b94a7 doc: Update Node version requirement to 22 (#8940)
  • 69c4b7f chore: bump commander from 14.0.3 to 15.0.0 (#8925)
  • Additional commits viewable in compare view

Updates fastify from 5.8.5 to 5.12.1

Release notes

Sourced from fastify's releases.

v5.12.1

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

... (truncated)

Commits

Updates hono from 4.13.1 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

  • fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
  • fix(etag): copy pending stream bytes in honojs/hono#5239
  • fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
  • fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
  • docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
  • fix(trie-router): match suffix wildcard routes in honojs/hono#5236
  • fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252
  • fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250
  • fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247
  • feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

  • fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197
  • fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204
  • fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199
  • fix(client): serialize multiple cookies correctly in honojs/hono#5202
  • fix(etag): stabilize digest across stream chunks in honojs/hono#5205
  • fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209
  • perf(cors): pre-join static array header options during initialization in honojs/hono#5210
  • fix(client): send falsy JSON bodies in honojs/hono#5215
  • feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

Commits
  • 0293343 4.13.3
  • 5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
  • c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
  • eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
  • a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
  • 63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
  • ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
  • 8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
  • 546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
  • 7195c24 fix(etag): copy pending stream bytes (#5239)
  • Additional commits viewable in compare view

Updates lint-staged from 17.0.8 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes

  • #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

    {
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}

    As a concrete example, lint-staged's own configuration is:

    /** @type {import('./lib/index.js').Configuration} */
export default {
  "*": [
    [
      "oxfmt --check --no-error-on-unmatched-pattern",
      "oxlint --no-error-on-unmatched-pattern",
    ],
  ],
  "*.ts": () => "tsc",
};

    which means:

    1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
      • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
      • oxlint --no-error-on-unmatched-pattern lib/index.js
    2. additionally, if any *.ts files are staged, run tsc without appending any arguments
    3. The two sets of commands also run in parallel

Patch Changes

  • #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

v17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  "*.ts": () => "tsc", // Run "tsc" when any TS file is changed (for entire project)
};

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes

  • #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

    {
  "*.ts": ["first", "second", ["third", "third"], "fourth"]
}

    As a concrete example, lint-staged's own configuration is:

    /** @type {import('./lib/index.js').Configuration} */
export default {
  '*': [
    ['oxfmt --check --no-error-on-unmatched-pattern', 'oxlint --no-error-on-unmatched-pattern'],
  ],
  '*.ts': () => 'tsc',
}

    which means:

    1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
      • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
      • oxlint --no-error-on-unmatched-pattern lib/index.js
    2. additionally, if any *.ts files are staged, run tsc without appending any arguments
    3. The two sets of commands also run in parallel

Patch Changes

  • #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

17.2.0

Minor Changes

  • #1823 ee156cc - The chunking of tasks based on maximum command line argument length has been re-implemented to be more precise. Now the chunking happens based on the final generated command string, instead of just the list of staged files like previously. This benefits mainly Windows platforms and function commands like:

    /** @type {import('lint-staged').Configuration} */
export default {
  '*.ts': () => 'tsc', // Run "tsc" when any TS file is changed (for entire project)
}

    Where the spawned command is literally "tsc" without any extra arguments. Previously, this was still chunked when a lot of files were staged. Now, it probably won't be chunked because the length of the command is just three letters.

... (truncated)

Commits
  • d153443 Merge pull request #1828 from lint-staged/changeset-release/main
  • 5162c14 chore(changeset): release
  • a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
  • ea96cab style: enable oxlint "suspicious" category
  • 2fae007 style: add @e18e/eslint-plugin
  • 2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
  • 1453ae6 test: relax assertion so that it passes in worktree
  • 15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
  • dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
  • 286e25c feat: allow running parallel tasks by nesting arrays
  • Additional commits viewable in compare view

Updates prettier from 3.8.4 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

🔗 Changelog

3.9.5

🔗 Changelog

3.9.4

  • Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

🔗 Changelog

3.9.3

🔗 Changelog

3.9.1

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

  1. Install the plugin:

    yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

Updates webpack from 5.109.0 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

  • Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #...

    Description has been truncated

@dependabot
chore(deps): bump the dependencies group across 1 directory with 11 u…
3eaf72a 
…pdates

Bumps the dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [memfs](https://github.com/streamich/memfs) | `4.57.8` | `4.68.1` |
| [range-parser](https://github.com/jshttp/range-parser) | `1.2.1` | `1.3.0` |
| [@fastify/express](https://github.com/fastify/fastify-express) | `4.0.6` | `4.0.7` |
| [@hapi/hapi](https://github.com/hapijs/hapi) | `21.4.9` | `21.4.10` |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.0.10` | `2.1.1` |
| [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.0.1` | `10.1.0` |
| [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.12.1` |
| [hono](https://github.com/honojs/hono) | `4.13.1` | `4.13.3` |
| [lint-staged](https://github.com/lint-staged/lint-staged) | `17.0.8` | `17.3.0` |
| [prettier](https://github.com/prettier/prettier) | `3.8.4` | `3.9.6` |
| [webpack](https://github.com/webpack/webpack) | `5.109.0` | `5.109.2` |



Updates `memfs` from 4.57.8 to 4.68.1
- [Release notes](https://github.com/streamich/memfs/releases)
- [Changelog](https://github.com/streamich/memfs/blob/master/CHANGELOG.md)
- [Commits](streamich/memfs@v4.57.8...v4.68.1)

Updates `range-parser` from 1.2.1 to 1.3.0
- [Release notes](https://github.com/jshttp/range-parser/releases)
- [Changelog](https://github.com/jshttp/range-parser/blob/master/HISTORY.md)
- [Commits](jshttp/range-parser@v1.2.1...v1.3.0)

Updates `@fastify/express` from 4.0.6 to 4.0.7
- [Release notes](https://github.com/fastify/fastify-express/releases)
- [Commits](fastify/fastify-express@v4.0.6...v4.0.7)

Updates `@hapi/hapi` from 21.4.9 to 21.4.10
- [Release notes](https://github.com/hapijs/hapi/releases)
- [Commits](hapijs/hapi@v21.4.9...v21.4.10)

Updates `@hono/node-server` from 2.0.10 to 2.1.1
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.0.10...v2.1.1)

Updates `cspell` from 10.0.1 to 10.1.0
- [Release notes](https://github.com/streetsidesoftware/cspell/releases)
- [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md)
- [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.1.0/packages/cspell)

Updates `fastify` from 5.8.5 to 5.12.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.8.5...v5.12.1)

Updates `hono` from 4.13.1 to 4.13.3
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.1...v4.13.3)

Updates `lint-staged` from 17.0.8 to 17.3.0
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v17.0.8...v17.3.0)

Updates `prettier` from 3.8.4 to 3.9.6
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.4...3.9.6)

Updates `webpack` from 5.109.0 to 5.109.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.0...v5.109.2)

---
updated-dependencies:
- dependency-name: memfs
  dependency-version: 4.68.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: range-parser
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@fastify/express"
  dependency-version: 4.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@hapi/hapi"
  dependency-version: 21.4.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: cspell
  dependency-version: 10.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: fastify
  dependency-version: 5.12.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: hono
  dependency-version: 4.13.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: lint-staged
  dependency-version: 17.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prettier
  dependency-version: 3.9.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: webpack
  dependency-version: 5.109.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 26, 2026
@changeset-bot

changeset-bot Bot commented Aug 26, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 3eaf72a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@webpack
webpack Bot enabled auto-merge (squash) August 26, 2026 10:34
@socket-security

socket-security Bot commented Aug 26, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedwebpack@​5.109.0 ⏵ 5.109.28210093 +199 +1100
Updated@​hapi/​hapi@​21.4.9 ⏵ 21.4.1099 +1110082 +194 +4100
Addedrange-parser@​1.3.01001009586100
Updatedcspell@​10.0.1 ⏵ 10.1.09810010091 +2100
Updatedmemfs@​4.57.8 ⏵ 4.68.198 +11009395 -1100
Updated@​fastify/​express@​4.0.6 ⏵ 4.0.7100 +110010094 +2100
Updated@​hono/​node-server@​2.0.10 ⏵ 2.1.1100 +110010095 -1100
Updatedprettier@​3.8.4 ⏵ 3.9.69810097 +196100
Updatedhono@​4.13.1 ⏵ 4.13.3100 +110097 +196100
Updatedlint-staged@​17.0.8 ⏵ 17.3.0100 +110010097 +2100
Updatedfastify@​5.8.5 ⏵ 5.12.198 -110010099 +9100

View full report

@socket-security

socket-security Bot commented Aug 26, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm webpack is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package-lock.json → npm/webpack@5.109.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@webpack webpack[bot] webpack[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants