fix(deps): update all non-major dependencies#141
Merged
Conversation
chenjiahan
approved these changes
May 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.15.33→^1.15.40^5.100.11→^5.100.14^1.4.7→^1.4.8^4.2.1→^4.3.0^12.39.0→^12.40.011.2.1→11.2.2^10.1.3→^10.1.4^7.76.0→^7.76.1^8.0.13→^8.0.14^5.107.0→^5.107.1Release Notes
swc-project/swc (@swc/core)
v1.15.40Compare Source
Bug Fixes
(es/minifier) Preserve args for destructured callbacks (#11830) (21873b0)
(es/minifier) Avoid generating mangled property names that collide with existing properties (#11839) (9b4fab5)
(es/minifier) Respect ecma for iife temp vars (#11873) (e481934)
(es/minifier) Preserve default parameter object props (#11884) (71ff84f)
(es/parser) Reject object-rest assignment to array/object literal (#11875) (7b57d1f)
(es/parser) Reject object rest assignment to literals (#11881) (4ec2eaf)
(es/react) Exclude self-recursive hooks from refresh dependency array (#11838) (9101c71)
(ts/fast-dts) Strip definite assertions in dts (#11858) (2ab1b8a)
(ts/fast-strip) Reject unsafe assertion erasure in binary expressions (#11828) (aa5b539)
(typescript) Strip parameter binding defaults in dts (#11857) (800bc17)
Documentation
Update agent guidance (#11842) (bf2d015)
Add security policy (#11876) (6c43c2d)
Clarify security scope for npm packages (#11877) (4662db8)
Clarify untrusted input security model (#11882) (5463777)
Features
(es/minifier) Fine grained effect analysis of class (#11814) (c9058ad)
(swc_cli) Implement all features for
swc_cli(#11797) (9300ede)Miscellaneous Tasks
(es/minifier) Fix typo in debug log (#11866) (3de0254)
(html) Add webcontainer fallback for
@swc/html(#11860) (7692eed)Performance
(ecma) Reduce transformer compat overhead (#11856) (d03cb71)
(es/codegen) Speed up JsWriter position and srcmap tracking (#11867) (dbceade)
(es/codegen) Remove JsWriter last_srcmap cache (#11869) (3bc1c2b)
(es/minifier) Reduce minifier profiling hotspots (#11853) (28c1091)
Optimize es parser comment finalization (#11852) (2959ddf)
Testing
Ci
Update corepack in publish docker jobs (#11885) (9a7d954)
Pass publish docker env explicitly (#11888) (c5f7547)
Lock issues closed by merged prs (#11887) (6bd74e5)
Provide aarch64 musl linker in publish job (#11889) (20234fd)
Fix publish musl linker and windows tests (#11890) (a798a23)
Make minifier test path explicit (#11891) (e7cba97)
Security
Save CI caches only on main (#11848) (7582529)
Update rkyv and Rust dependencies (#11851) (20d92eb)
Harden PR workflow permissions (#11849) (e199564)
TanStack/query (@tanstack/react-query)
v5.100.14Compare Source
Patch Changes
fix(react-query): do not go into optimistic fetching state when not subscribed (#10759)
Updated dependencies []:
v5.100.13Compare Source
Patch Changes
d423168]:v5.100.12Compare Source
Patch Changes
utooland/utoo (@utoo/pack-cli)
v1.4.8Compare Source
date-fns/date-fns (date-fns)
v4.3.0Compare Source
Kudos to @ImRodry and @puneetdixit200 for their contributions.
Fixed
Fixed missing modularized optimization fallback (for Next.js and others). See #4193.
Fixed
ptlocale first day of week to be Sunday. See #4195 by @ImRodry.Fixed
zh-CN,zh-HK, andzh-TWlocale month parsing for October, November, and December. See #4194 by @puneetdixit200.motiondivision/motion (framer-motion)
v12.40.0Compare Source
Added
pathoption totransition.arc()for motion along an arc.pnpm/pnpm (pnpm)
v11.2.2Compare Source
Patch Changes
configDependencies, the user's CLI flags passed topnpm install(e.g.--no-runtime,--prod,--dev,--no-optional,--node-linker,--cpu/--os/--libc,--offline,--prefer-offline) are now forwarded to pacquet'sinstallsubcommand verbatim. Previously pacquet was invoked with a fixed argument list, so flags like--no-runtimewere silently dropped. Flag forwarding is gated on the command beinginstall/i;add,update, anddedupestill don't forward (their flag surface doesn't line up with pacquet'sinstall).pnpm up(andpnpm add/pnpm remove) failing withpacquet_package_manager::outdated_lockfilewhen pacquet is declared inconfigDependencies. pnpm now passes--ignore-manifest-checkto pacquet so its--frozen-lockfilecheck doesn't fire against the (pre-mutation)package.jsonpnpm hasn't written yet #11797. Requires a pacquet release that supports the flag — bumpPACQUET_VERSIONin the e2e tests once it ships.postcss/postcss-url (postcss-url)
v10.1.4Compare Source
Fixed: update minimatch dependency to address CVEs https://nvd.nist.gov/vuln/detail/CVE-2026-27903 https://nvd.nist.gov/vuln/detail/CVE-2026-27904 https://nvd.nist.gov/vuln/detail/CVE-2026-26996 by @diegocr
react-hook-form/react-hook-form (react-hook-form)
v7.76.1: Version 7.76.1Compare Source
🐞 fix: pass options parameter through setValues to enable validation (#13457)
🐞 fix(setValues): emit whole-form change without stale name/type (#13450)
🚗 perf(setValues): thread skipClone through setFieldValue (#13448)
🚗 perf(setValues): skip redundant per-field deep clones (#13445)
Revert "🐞 fix: treat NaN as empty when valueAsNumber is true in validateField (#13388)"
thanks to @philibea & @maxkostow
vitejs/vite (vite)
v8.0.14Compare Source
Features
Bug Fixes
Miscellaneous Chores
Code Refactoring
Tests
webpack/webpack (webpack)
v5.107.1Compare Source
Patch Changes
Align the experimental HTML tokenizer with the WHATWG spec: fix offset-range bugs in the script-data, content-mode end-tag, attribute-value, and EOF states; surface tokenizer parse errors to consumers via a new
parseErrorcallback ("warning"when the tokenizer recovers and the emitted token is still well-formed,"error"when the offset range is incomplete — e.g.eof-in-tag); and add the full WHATWG named character references table sodecodeHtmlEntitieshandles all named entities (including legacy bare forms like&and multi-code-point entities like≂̸) with proper longest-prefix backtracking. (by @alexander-akait in #21000)Tree-shake CommonJS modules imported through a
const NAME = require(LITERAL)binding when only static members ofNAMEare read. Previously webpack treated every export of such modules as referenced (because the barerequire()dependency reportsEXPORTS_OBJECT_REFERENCED), so unusedexports.x = ...assignments remained in the bundle even withusedExportsenabled. The parser now forwardsNAME.x/NAME.x()/NAME["x"]accesses to the underlyingCommonJsRequireDependencyas referenced exports, falling back to the full exports object the momentNAMEis read in any other context (passed by value, destructured later, accessed with a dynamic key, …). This brings the binding form to parity with the existing destructuring form (const { x } = require(...)). (by @alexander-akait in #21003)Fix
RangeError: Maximum call stack size exceededthrown fromHarmonyImportSideEffectDependency.getModuleEvaluationSideEffectsStateon long linear chains of side-effect-free imports.NormalModule.getSideEffectsConnectionStatepreviously descended throughHarmonyImportSideEffectDependency.getModuleEvaluationSideEffectsStaterecursively, adding two stack frames per module, which overflowed V8's stack at a few thousand modules deep. The traversal is now iterative. (by @alexander-akait in #20993)Fix
NormalModuleFactoryparser/generator types: (by @alexander-akait in #20999)module.generator.htmlnow usesHtmlGeneratorOptionsinstead ofEmptyGeneratorOptions(theextractoption was hidden from thecreateGenerator/generatorhook types).webassembly/async,webassembly/sync) generator hooks now useEmptyGeneratorOptionsinstead ofEmptyParserOptions.NormalModuleFactory#getParser/createParser/getGenerator/createGeneratorare now generic over the module-type string, returning the specific parser/generator class for known types (e.g.JavascriptParserfor"javascript/auto",CssGeneratorfor"css", etc.) instead of always returning the baseParser/Generator.NormalModuleCreateDatais now generic over the module type soparser,parserOptions,generator, andgeneratorOptionsare narrowed to the specific class / options for the giventype.Link import bindings used inside
define(...)callbacks in ES modules. Previously,HarmonyDetectionParserPluginskipped walking the arguments ofdefinecalls in harmony modules, so references to imported bindings inside an inline AMDdefinefactory (e.g.define(function () { console.log(foo); })) were not rewritten to their imported references and could causeReferenceErrorat runtime. Inner graph usage analysis is also fixed for the related patternconst fn = function () { foo; }; define(fn);. (by @alexander-akait in #20990)HTML-entry pipeline (
experiments.html+experiments.css): emit<link rel="stylesheet">tags for CSS chunks reachable from a<script src>entry. Previously when the bundled JS imported CSS, the resulting.cssfile was emitted to disk but never referenced from the extracted HTML (no<link>tag), and whensplitChunksextracted CSS into sibling chunks the HTML cloned the originating<script>for each one — producing<script src="style.js">pointing at non-existent JS filenames instead of<link rel="stylesheet" href="style.css">. CSS chunks are now sorted by the entrypoint's module post-order index so the<link>tags also appear in source import order, fixing the cascade ordering issue documented inhtml-webpack-plugin#1838andwebpack/mini-css-extract-plugin#959for HTML-entry builds.nonce/crossorigin/referrerpolicyare copied from the originating tag onto the emitted<link>. (by @alexander-akait in #21002)Allow
devtoolandSourceMapDevToolPlugin(or multipleSourceMapDevToolPlugininstances) to coexist on the same asset. Previously the second instance would silently skip any asset whoseinfo.related.sourceMaphad already been set by an earlier instance, and even when it ran the asset had been rewrapped as aRawSourceso no source map could be recovered — producing an empty.mapfile. The plugin now keeps a per-compilation stash of pristine source maps, namespaces its persistent cache entries by the options that affect output, and appends additionalrelated.sourceMapentries instead of overwriting them. The classic workaround of pairingdevtool: 'hidden-source-map'with anew webpack.SourceMapDevToolPlugin({ filename: '[file].secondary.map', noSources: true })now produces both maps in a single build. (by @alexander-akait in #21001)Narrow
TemplatePathFncallback types by context.pathData.chunkis now non-optional for chunk filename callbacks (output.filename,chunkFilename,cssFilename,cssChunkFilename,htmlFilename,htmlChunkFilename,optimization.splitChunks.cacheGroups[*].filename), andpathData.moduleis non-optional for module filename callbacks (output.assetModuleFilename, per-modulegenerator.filename/generator.outputPath,module.parser.css.localIdentName). (by @alexander-akait in #20987)Tighten the
CreateDatatypedef inNormalModuleFactory.CreateDatanow represents the fully-populated value passed to thecreateModule,module, andcreateModuleClasshooks (NormalModuleCreateData & { settings: ModuleSettings }), whileResolveData.createDatais typed asPartial<CreateData>to reflect the empty initial state. Plugins tapping those hooks no longer need to cast individual fields away from optional. (by @alexander-akait in #20992)Stop
webpackPrefetch/webpackPreloadmagic comments from leaking acrossimport()call sites that share awebpackChunkName. When two imports targeted the same named chunk and only one of them setwebpackPrefetch: true, the prefetch directive was applied from every parent chunk that referenced the named chunk. Prefetch and preload orders are now resolved perimport()call site instead of from the shared chunk group's accumulated options. (by @alexander-akait in #20994)Fix
[fullhash:N]and[hash:N](with length suffix) inoutput.publicPathnot being interpolated at runtime. The detection regex inRuntimePluginonly matched[fullhash]/[hash]without a length suffix, so thePublicPathRuntimeModulewas not flagged as a full-hash module and__webpack_require__.pwas emitted with the placeholderXXXXleft in place (e.g.out/XXXX/) instead of the real hash truncated to the requested length. (by @alexander-akait in #21004)Re-export
ModuleNotFoundErrorfromwebpack/lib/ModuleNotFoundErrorfor backward compatibility with old plugins that import it from that path. This re-export will be removed in webpack 6. (by @alexander-akait in #20988)Configuration
📅 Schedule: (in timezone Asia/Shanghai)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.