chore(deps): update all non-major dependencies - #160

v4.4.3

Compare Source

Functionally identical release to 4.4.1.

Version 4.4.2 is compromised. Please see #​1005.

v3.30.0

Compare Source

3.30.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#​6276)

Pull Requests

• #​6276: Validate bundle stays within output dir (@​lukastaegert)

v7.8.5

Compare Source

Bug Fixes

• 9c8692a #​878 include prereleases in tilde range lower bound with includePrerelease (#​878) (@​chatman-media)

v7.8.4

Compare Source

Bug Fixes

• e583226 #​874 reject numeric segments after x-ranges (@​pupuking723)

v7.8.3

Compare Source

Bug Fixes

• 046da7f #​872 align caret includePrerelease lower bounds (#​872) (@​wayyoungboy)

Chores

• 3485dda #​866 bump @​npmcli/eslint-config from 6.0.1 to 7.0.0 (#​866) (@​dependabot[bot])

v7.8.2

Compare Source

Bug Fixes

• bea6028 #​870 increment dotted prerelease identifiers (#​870) (@​liuzemei, @​SheldonNeo)

v7.8.1

Compare Source

Bug Fixes

• 17aa702 #​869 strip build metadata before comparator trimming (#​869) (@​owlstronaut)
• 5f3ca13 #​867 handle prerelease bounds in subset (#​867) (@​puneetdixit200, Puneet Dixit)

v7.8.0

Compare Source

Features

• 0d0a0a2 #​855 Add truncate function (#​855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #​859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #​853 fix typos in documentation (#​853) (@​ankitkumar572005)
• 37776c3 #​846 fix BNF grammar to distinguish prerelease from build identifiers (#​846) (@​abhu85, @​claude)

Chores

• 9542e09 #​860 template-oss-apply (@​owlstronaut)
• 937bc2c #​860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #​852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#​852) (@​dependabot[bot], @​npm-cli-bot)

v7.7.4

Compare Source

Bug Fixes

• a29faa5 #​835 cli: pass options to semver.valid() for loose version validation (#​835) (@​mldangelo)

Documentation

• 1d28d5e #​836 fix typos and update -n CLI option documentation (#​836) (@​mldangelo)

Dependencies

• 120968b #​840 @npmcli/template-oss@4.29.0 (#​840)

Chores

• 44d7130 #​824 bump @​npmcli/eslint-config from 5.1.0 to 6.0.0 (#​824) (@​dependabot[bot])
• 7073576 #​820 reorder parameters in invalid-versions.js test (#​820) (@​reggi)
• 5816d4c #​829 bump @​npmcli/template-oss from 4.28.0 to 4.28.1 (#​829) (@​dependabot[bot], @​npm-cli-bot)

v7.7.3

Compare Source

Bug Fixes

• e37e0ca #​813 faster paths for compare (#​813) (@​H4ad)
• 2471d75 #​811 x-range build metadata support (i529015)

Chores

• 8f05c87 #​807 bump @​npmcli/template-oss from 4.25.0 to 4.25.1 (#​807) (@​dependabot[bot], @​owlstronaut)

v5.9.3: TypeScript 5.9.3

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)
• fixed issues query for Typescript 5.9.3 (Stable).

Downloads are available on:

• npm

v5.9.2: TypeScript 5.9

Compare Source

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)

Downloads are available on:

• npm

v5.111.1

Compare Source

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #​22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #​22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #​22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #​22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #​22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #​22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #​22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #​22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #​22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #​22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #​22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #​22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #​22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #​22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #​22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #​22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #​22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #​22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #​22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #​22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #​22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #​22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #​22142)

• Record hoisted, module and block declarations while parsing, not by re-walking. (by @​alexander-akait in #​22147)

• Fold more enumerated attribute values and drop those naming no keyword. (by @​alexander-akait in #​22148)

• Halve the CSS minifier's browser-version tables by narrowing their element type. (by @​alexander-akait in #​22140)

• Make each optimization.minimize.css switch govern its own rewrite alone. (by @​alexander-akait in #​22140)

• Join the rules a top-level @layer gather leaves meeting at the seam. (by @​alexander-akait in #​22140)

• Gather a CSS layer past a rule that writes only a different one. (by @​alexander-akait in #​22154)

• Order HTML attributes by what reaches the output, and read values decoded. (by @​alexander-akait in #​22146)

• Drop a fallback declaration every browserslist target reads past. (by @​alexander-akait in #​22158)

• Fix module library exports lost under cache or missing behind a re-export. (by @​hai-x in #​22114)

v5.111.0

Compare Source

Minor Changes

• Enable output.module by default with futureDefaults on ESM-capable targets. (by @​alexander-akait in #​22088)

• Remove experiments.outputModule, set output.module to emit ESM instead. (by @​alexander-akait in #​22011)

• Add output.copy to copy files and directories into the output directory. (by @​alexander-akait in #​21938)

• Accept a file URL in any spelling Node reads where an absolute path is taken. (by @​alexander-akait in #​22012)

• Minify inline CSS and JSON via renderEmbeddedSource, exporting webpack's own. (by @​alexander-akait in #​21993)

• Export cssMinify and htmlMinify on css.syntax and html.syntax. (by @​alexander-akait in #​21953)

• Make processResult async and let a tap rename the asset it rewrote. (by @​alexander-akait in #​21854)

• Lower a CSS spelling a target cannot read and write a color fallback before one. (by @​alexander-akait in #​21926)

• Allow optional filesystem cache build dependencies. (by @​xiaoxiaojx in #​21849)

• Add output.environment.topLevelAwait and await every async ESM entry. (by @​alexander-akait in #​21915)

• Add unusedSymbols and pseudoClasses, and evaluate a CSS color function. (by @​alexander-akait in #​21927)

• Drop an implied shorthand slot, fold a math function, tighten color conversion. (by @​alexander-akait in #​21929)

• Add module.parser.javascript.specNamespaceObject for spec namespace objects. (by @​alexander-akait in #​22049)

• Drop what is already said or only a gone engine reads, add lowerUnsupported. (by @​alexander-akait in #​21931)

• Add normalizeUrlAttributes, mergeScripts, boolean and token switches. (by @​alexander-akait in #​21960)

• Minify an event handler attribute, and name the production each script body is. (by @​alexander-akait in #​21968)

• Add source-map, asset, module, bailout, federation hints; group config checks. (by @​alexander-akait in #​21961)

• Lower CSS nesting, :dir() and custom at-rules; gate case folding and escapes. (by @​alexander-akait in #​21950)

• Add optimization.minimize.css.mergeDistantRules to join rules across a gap. (by @​alexander-akait in #​21969)

Patch Changes

• Minify an embedded body through the embedded path, dropping three html options. (by @​alexander-akait in #​21936)

• Take a minified style attribute's answer whatever quoting it needs. (by @​alexander-akait in #​21936)

• Name chunk imports in the chunk loader, not at each import site. (by @​alexander-akait in #​22076)

• Repair hashed names; under HMR bake hashed url maps and reload moved css names. (by @​alexander-akait in #​21916)

• Enable output.module for module and modern-module library types. (by @​alexander-akait in #​22071)

• Name an anonymous export default class before its static initializers run. (by @​alexander-akait in #​21910)

• Throw on a non-optional read past an undefined DefinePlugin member. (by @​alexander-akait in #​22017)

• Reject a fulfilled async cycle member with the cycle's evaluation error. (by @​alexander-akait in #​21921)

• Escape external requests in generated ESM imports and star reexports. (by @​bjohansebas in #​22078)

• Fix stack overflows in ESM library star reexport cycles with externals. (by @​bjohansebas in #​22080)

• Preserve live bindings when reexporting external ESM exports. (by @​bjohansebas in #​22082)

• Use configured external requests in ESM star reexports; reject property paths. (by @​bjohansebas in #​22079)

• Preserve import attributes on ESM library star reexports of externals. (by @​bjohansebas in #​22081)

• Fail the build when a runtime module's code generation throws while hashing. (by @​alexander-akait in #​22034)

• Settle a css chunk load without a DOM where its stylesheet cannot be read. (by @​alexander-akait in #​21970)

• Await a deferred import's async dependency that is evaluating-async. (by @​alexander-akait in #​21934)

• Keep a color the CSS minifier would round where its channels are read back. (by @​alexander-akait in #​21923)

• Refresh a cached module's resolveOptions from the factory, not the pack. (by @​hai-x in #​21945)

• Read a <script type> decoded, so a reference-spelled type is minified. (by @​alexander-akait in #​21933)

• Read the extension out of a path-scoped rule's alternation, class or braces. (by @​alexander-akait in #​21946)

• Keep an HTML attribute name or list token holding a foreign template delimiter. (by @​alexander-akait in #​22018)

• Answer a name a module does not export from the spec namespace. (by @​alexander-akait in #​22092)

• Give a deferred namespace the spec's exotic shape when the exports are known. (by @​alexander-akait in #​21939)

• Give a JSON, text or CommonJS namespace the spec's exotic shape and identity. (by @​alexander-akait in #​22087)

• Report a missing asset instead of a code generation deadlock. (by @​alexander-akait in #​21992)

• Keep a concatenated CommonJS reference a separate statement, guarding it once. (by @​alexander-akait in #​21962)

• Keep CSS module exports for a direct loader importModule() call. (by @​alexander-akait in #​22047)

• Fix import.meta and require.main, and scope-hoist import.meta.main. (by @​alexander-akait in #​21973)

• Honor resolve.fileSystem and say where module.exprContextCritical moved. (by @​alexander-akait in #​22091)

• Release stale compilation data from nested children and idle watch builds. (by @​alexander-akait in #​22096)

• Resolve a @value once and then localize it, wherever it names an identifier. (by @​alexander-akait in #​22036)

• Release the printed-text store's text when the CSS printer drops it. (by @​alexander-akait in #​21958)

• Skip a foreign dependency whose isLazy is a flag when walking a lazy barrel. (by @​alexander-akait in #​21998)

• Move diagnostics to buildInfo.diagnostics, persisting parse-time bailouts. (by @​hai-x in #​22055)

• Invalidate consumer codegen when an inlined export value changes. (by @​xiaoxiaojx in #​22020)

• Rebuild DelegatedModule when DLL manifest metadata changes. (by @​xiaoxiaojx in #​22028)

• Keep a CSS layer's blocks in order where one of them streams. (by @​alexander-akait in #​22044)

• Refuse inlining const exports across sync cycles with binding reads. (by @​xiaoxiaojx in #​22085)

• Escape a text run ending in </, which the tag after it made a comment of. (by @​aryanraj45 in #​22086)

• Skip JS render sentinel scans on chunks without HTML. (by @​xiaoxiaojx in #​21974)

• Minify an attribute by what its value says, not by how the source spelled it. (by @​aryanraj45 in #​22095)

• Cut allocation and scanning in the CSS and HTML printers, output unchanged. (by @​alexander-akait in #​21997)

• Emit less chunk-loading runtime. (by @​alexander-akait in #​22094)

• Recognize the reflected attributes of frame, frameset, marquee and dir. (by @​alexander-akait in #​22003)

• Drop the neo-async dependency in favor of a faster built-in async helper. (by @​alexander-akait in #​21959)

• Speed up cache serialization by cutting per-object lookups and call frames. (by @​alexander-akait in #​21994)

• Update dependencies and match the ReadFileSync type to Node.js typings. (by @​dependabot in #​21919)

• Match acorn on ** arrows, LS/PS cooking, string export names, program reuse. (by @​alexander-akait in #​21666)

• Parse a regexp literal the running engine cannot build, and keep locations. (by @​alexander-akait in #​22009)

• Parse without acorn, serialize parse-error locations, trim walker allocations. (by @​alexander-akait in #​21667)

• Drop the acorn dependency in favor of webpack's own JavaScript parser. (by @​alexander-akait in #​22042)

• Name HTML chunks after their tags' urls, drop the JS copy, type text/html. (by @​alexander-akait in #​22008)

v5.110.3

Compare Source

Patch Changes

• Fix import() options, circular reexport severity and namespace writes. (by @​alexander-akait in #​21867)

• Skip ESM interop when require() targets a module outside the concatenation. (by @​hai-x in #​21884)

• Fix concatenated require() in a require.ensure callback or a computed request. (by @​hai-x in #​21907)

• Keep optimization.minimize a boolean; its options move to minimizeOptions. (by @​alexander-akait in #​21886)

• Fix mangled exports read through require() and a leaked internal reference. (by @​alexander-akait in #​21905)

• Fix new on a default import of a wrapped CommonJS module. (by @​alexander-akait in #​21876)

• Throw when a deferred namespace of an async module is forced while it evaluates. (by @​alexander-akait in #​21871)

• Do not report a missing export for a name a side-effect-free barrel defers. (by @​alexander-akait in #​21874)

• Fix queue, URL scheme, dotenv, HTTP module and persistent cache edge cases. (by @​alexander-akait in #​21901)

• Evaluate a deferred import's async dependencies where the import sits. (by @​alexander-akait in #​21902)

• Omit ambiguous export * names from the module namespace. (by @​alexander-akait in #​21878)

v5.110.2

Compare Source

Patch Changes

• Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by @​alexander-akait in #​21851)

• Minify more HTML and CSS shorthands, and cut two costs off printing. (by @​alexander-akait in #​21842)

• Report a named import that is never read when it names a missing export. (by @​alexander-akait in #​21856)

• Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by @​alexander-akait in #​21852)

• Stop output.html emitting an unused JS chunk for each generated page. (by @​alexander-akait in #​21859)

• Stop emitting the CSS chunk loading runtime when every CSS chunk is initial. (by @​alexander-akait in #​21862)

• Strip a BOM a loader put on a string, and shift a source map that counted it. (by @​alexander-akait in #​21857)

v5.110.1

Compare Source

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @​alexander-akait in #​21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by @​alexander-akait in #​21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by @​AgentEnder in #​21845)

v5.110.0

Compare Source

Minor Changes

• Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #​21519)

• Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #​21841)

• Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #​21705)

• Add OS-independent glob matching to module rules. (by @​alexander-akait in #​21771)

• Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #​21740)

• Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #​21712)

• Give externals the original request of a context module element. (by @​alexander-akait in #​21780)

• Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #​21569)

• Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #​21770)

• Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #​21624)

• Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #​21576)

• Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #​21624)

• Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #​21600)

• Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #​21810)

• Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #​21788)

• Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #​21841)

• Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #​21750)

• Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #​21841)

• Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #​21841)

• Minify HTML further where the parsed document is unchanged: drop redundant quotes, whitespace nothing renders, escapes text does not need, implied tags, optional end tags nothing prints behind, empty attributes and nested empty elements; fold enumerated values and casing; normalize each attribute against the element it is on; and rewrite style, token lists, srcset, sizes, URL, integer and boolean attributes, viewport content, inline <style> and a JSON <script> body through their own grammars. Adds the optimization.minimize.html options collapseWhitespace, mergeStyles, minifyConditionalComments, minifySrcdoc, preserveComments, removeEmptyAttributes, removeEmptyElements, removeImpliedTags, removeRedundantAttributes, sortAttributes and sortTokenLists, and keeps an end tag the parent, the next element or the adoption agency would otherwise restructure the tree over. (by @​alexander-akait in #​21841)

• Suggest the closest name or a casing fix anywhere in a failed request. (by @​alexander-akait in #​21727)

• Add aggregated shutdown hook to MultiCompiler. (by @​bjohansebas in #​21578)

• Report which compilers changed on the MultiCompiler done hook. (by @​bjohansebas in #​21580)

• Add [containedpath]/[containedfile] placeholders, used for [path]/[file] of asset and html modules with experiments.futureDefaults. (by @​alexander-akait in #​21592)

• Support an object for an entry's html that overrides output.html per option. (by @​alexander-akait in #​21574)

• Configure or exclude each asset type's minifier via optimization.minimize. (by @​alexander-akait in #​21663)

• Support printing CSS and HTML beautified as well as minified. (by @​alexander-akait in #​21660)

• Add renderEmbeddedSource, and minify what it offers out of the box. (by @​alexander-akait in #​21830)

• Report bindings named eval, arguments or reserved words in ES module output. (by @​alexander-akait in #​21567)

• Emit no development source map for module libraries, or any with futureDefaults. (by @​alexander-akait in #​21839)

• Speed up builds and cut memory: faster CSS, HTML and JavaScript parsing and minification, a built-in scope analyzer replacing eslint-scope, faster dependency hot paths, module diagnostics, CommonJS export scanning and concatenated module renaming, runtime modules, parsers, generators and dependencies loaded only when used, one file watcher pool shared between MultiCompiler children, and lower parser, graph and startup memory. (by @​alexander-akait in #​21841)

• Improve tree-shaking for a namespace reexported as default, and fix import d from "./mod"; d.member reading undefined in that case. (by @​alexander-akait in #​21841)

• Warn on cross-kind CSS module export conflicts and let the class win. (by @​alexander-akait in #​21538)

• Add output.resourceHints.dedupe to skip prefetch links for already preloaded/prefetched chunks. (by @​alexander-akait in #​21386)

Patch Changes

• Let a memory-cache etag mismatch fall through to the file cache instead of reporting a miss. (by @​alexander-akait in #​21624)

• Determine provided exports in dependency order, so a build's module hashes no longer depend on what the persistent cache held. (by @​alexander-akait in #​21630)

• Emit no dead module and no failing require for an asset-url external. (by @​alexander-akait in #​21713)

• Fix names, hidden devtools and cache reuse for CSS maps inlined into JS. (by @​alexander-akait in #​21558)

• Follow the HTML spec more closely when parsing and printing: frameset content, quirks paragraphs and selects, <![CDATA[ outside foreig

❗ Important

✂ PR body was truncated to here.