Skip to content

chore (deps): bump the patch-updates group across 1 directory with 6 updates#2463

Merged
GCHQDeveloper581 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/patch-updates-3abe77e06b
May 29, 2026
Merged

chore (deps): bump the patch-updates group across 1 directory with 6 updates#2463
GCHQDeveloper581 merged 1 commit into
masterfrom
dependabot/npm_and_yarn/patch-updates-3abe77e06b

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 28, 2026 •
edited
Loading

Bumps the patch-updates group with 6 updates in the / directory:

Package From To
dompurify 3.4.5 3.4.6
@babel/plugin-transform-runtime 7.29.0 7.29.7
@babel/preset-env 7.29.5 7.29.7
@babel/runtime 7.29.2 7.29.7
@puppeteer/browsers 3.0.3 3.0.4
webpack 5.107.1 5.107.2

Updates dompurify from 3.4.5 to 3.4.6

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.6

  • Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
  • Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
  • Added more test coverage for IN_PLACE and general DOM Clobbering attacks
  • Bumped several dependencies where possible
Commits

Updates @babel/plugin-transform-runtime from 7.29.0 to 7.29.7

Release notes

Sourced from @​babel/plugin-transform-runtime's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

💅 Polish

  • babel-parser

... (truncated)

Commits

Updates @babel/preset-env from 7.29.5 to 7.29.7

Release notes

Sourced from @​babel/preset-env's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

Commits

Updates @babel/runtime from 7.29.2 to 7.29.7

Release notes

Sourced from @​babel/runtime's releases.

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

v7.29.6 (2026-05-25)

🐛 Bug Fix

Committers: 3

v7.29.5 (2026-05-05)

🏠 Internal

  • babel-preset-env
    • Update @babel/* dependencies

v7.29.4 (2026-05-05)

🐛 Bug Fix

  • babel-plugin-transform-modules-systemjs
    • #17974 [7.x backport]fix(systemjs): improve module string name support (@​JLHwung)

Committers: 1

v7.29.3 (2026-04-30)

👓 Spec Compliance

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
    • #17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
  • babel-register
  • babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env

💅 Polish

  • babel-parser

... (truncated)

Commits

Updates @puppeteer/browsers from 3.0.3 to 3.0.4

Release notes

Sourced from @​puppeteer/browsers's releases.

browsers: v3.0.4

3.0.4 (2026-05-26)

🛠️ Fixes

🏗️ Refactor

Changelog

Sourced from @​puppeteer/browsers's changelog.

Changelog

Combined changelog for puppeteer and puppeteer-core.

25.1.0 (2026-05-26)

🎉 Features

🛠️ Fixes

🏗️ Refactor

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​puppeteer/browsers bumped from 3.0.3 to 3.0.4

📄 Documentation

25.0.4 (2026-05-18)

♻️ Chores

  • puppeteer: Synchronize puppeteer versions

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 25.0.3 to 25.0.4

... (truncated)

Commits

Updates webpack from 5.107.1 to 5.107.2

Release notes

Sourced from webpack's releases.

v5.107.2

Patch Changes

  • Reduce per-file overhead in ContextModuleFactory.resolveDependencies by batching alternativeRequests hook calls. Previously the hook was invoked once per file in the context (with a single-item array), paying per-call overhead (closure allocation, resolverFactory.get, intermediate arrays in RequireContextPlugin) for every file. The hook is now invoked once per directory with all matched files in one batch — RequireContextPlugin's tap already iterates the items array, so the output is unchanged. Steady-state rebuild on a 4000-file require.context drops a further ~15 ms (after the watch-mode purge fix in the same release). (by @​alexander-akait in #21020)

  • Include each external info's runtimeCondition in ConcatenatedModule#updateHash so changes to a concatenated external's runtime condition invalidate persistent caches instead of slipping through with the module id alone. (by @​alexander-akait in #21023)

  • Fix HTML [contenthash] for referenced asset and inline-style URL changes. (by @​alexander-akait in #21018)

  • Resolve chunk-hash placeholders in chunk URLs embedded into extracted HTML. (by @​alexander-akait in #21018)

  • Remove unnecessary __webpack_require__ runtime helpers in ESM library output with multi-module chunks. (by @​xiaoxiaojx in #21032)

  • Rewrite NormalModule#getSideEffectsConnectionState walk as an allocation-light iterative loop instead of a generator trampoline, restoring rebuild performance lost in #20993 while keeping deep import chains stack-safe. (by @​alexander-akait in #21014)

  • Fix runtime ReferenceError on the first activation of a lazy-compiled module when output.library.type produces a closure-wrapped bundle (umd, umd2, amd, amd-require, system). (by @​alexander-akait in #21013)

    External modules of these types reference closure-bound identifiers like __WEBPACK_EXTERNAL_MODULE_react__, supplied by the library wrapper that is generated once per chunk. When lazyCompilation activates an entry or import for the first time, any external dependency the lazily-built module pulls in arrives in a hot-update chunk that lives outside the original wrapper closure, so its factory body cannot resolve the closure identifier and only a manual page refresh recovers.

    The inactive LazyCompilationProxyModule now declares statically-enumerable externals (string and object forms of externals) as its own dependencies, so the initial entry chunk's library wrapper already exposes their closure identifiers. When activation later pulls in those externals through the lazily-compiled module, they resolve to the already-installed factories instead of throwing. Function and RegExp externals are not pre-populated because their effective request set isn't knowable up front.

  • Fill in missing entryOptions when an async block joins an existing entrypoint. (by @​alexander-akait in #21026)

  • Release per-child codeGenerationResults in MultiCompiler and at Compiler.close to reduce memory retention. (by @​alexander-akait in #21015)

  • Reduce peak memory of SourceMapDevToolPlugin on large builds (closes #20961). (by @​alexander-akait in #20963)

  • Fix slow require.context() / dynamic import() rebuilds in watch mode (#13636). When a file inside a watched context directory changed, NodeWatchFileSystem would call inputFileSystem.purge(contextDir). The enhanced-resolve purge implementation matches cache keys with key.startsWith(contextDir), so the stat cache of every file under the directory was discarded on every rebuild — ContextModuleFactory.resolveDependencies then re-stat-ed the whole tree on each rebuild. Single-file rebuilds on a 4000-file context now reuse the warm stat cache, dropping median rebuild from ~1260 ms to ~650 ms in a local reproduction (≈49%). For directory items that are explicitly watched contexts, purge is now called with { exact: true } (added in enhanced-resolve@5.22.0) so only the directory's own entry is invalidated; file-level changes in the same aggregated event continue to purge file stats and the parent readdir as before. (by @​alexander-akait in #21020)

Changelog

Sourced from webpack's changelog.

5.107.2

Patch Changes

  • Reduce per-file overhead in ContextModuleFactory.resolveDependencies by batching alternativeRequests hook calls. Previously the hook was invoked once per file in the context (with a single-item array), paying per-call overhead (closure allocation, resolverFactory.get, intermediate arrays in RequireContextPlugin) for every file. The hook is now invoked once per directory with all matched files in one batch — RequireContextPlugin's tap already iterates the items array, so the output is unchanged. Steady-state rebuild on a 4000-file require.context drops a further ~15 ms (after the watch-mode purge fix in the same release). (by @​alexander-akait in #21020)

  • Include each external info's runtimeCondition in ConcatenatedModule#updateHash so changes to a concatenated external's runtime condition invalidate persistent caches instead of slipping through with the module id alone. (by @​alexander-akait in #21023)

  • Fix HTML [contenthash] for referenced asset and inline-style URL changes. (by @​alexander-akait in #21018)

  • Resolve chunk-hash placeholders in chunk URLs embedded into extracted HTML. (by @​alexander-akait in #21018)

  • Remove unnecessary __webpack_require__ runtime helpers in ESM library output with multi-module chunks. (by @​xiaoxiaojx in #21032)

  • Rewrite NormalModule#getSideEffectsConnectionState walk as an allocation-light iterative loop instead of a generator trampoline, restoring rebuild performance lost in #20993 while keeping deep import chains stack-safe. (by @​alexander-akait in #21014)

  • Fix runtime ReferenceError on the first activation of a lazy-compiled module when output.library.type produces a closure-wrapped bundle (umd, umd2, amd, amd-require, system). (by @​alexander-akait in #21013)

    External modules of these types reference closure-bound identifiers like __WEBPACK_EXTERNAL_MODULE_react__, supplied by the library wrapper that is generated once per chunk. When lazyCompilation activates an entry or import for the first time, any external dependency the lazily-built module pulls in arrives in a hot-update chunk that lives outside the original wrapper closure, so its factory body cannot resolve the closure identifier and only a manual page refresh recovers.

    The inactive LazyCompilationProxyModule now declares statically-enumerable externals (string and object forms of externals) as its own dependencies, so the initial entry chunk's library wrapper already exposes their closure identifiers. When activation later pulls in those externals through the lazily-compiled module, they resolve to the already-installed factories instead of throwing. Function and RegExp externals are not pre-populated because their effective request set isn't knowable up front.

  • Fill in missing entryOptions when an async block joins an existing entrypoint. (by @​alexander-akait in #21026)

  • Release per-child codeGenerationResults in MultiCompiler and at Compiler.close to reduce memory retention. (by @​alexander-akait in #21015)

  • Reduce peak memory of SourceMapDevToolPlugin on large builds (closes #20961). (by @​alexander-akait in #20963)

  • Fix slow require.context() / dynamic import() rebuilds in watch mode (#13636). When a file inside a watched context directory changed, NodeWatchFileSystem would call inputFileSystem.purge(contextDir). The enhanced-resolve purge implementation matches cache keys with key.startsWith(contextDir), so the stat cache of every file under the directory was discarded on every rebuild — ContextModuleFactory.resolveDependencies then re-stat-ed the whole tree on each rebuild. Single-file rebuilds on a 4000-file context now reuse the warm stat cache, dropping median rebuild from ~1260 ms to ~650 ms in a local reproduction (≈49%). For directory items that are explicitly watched contexts, purge is now called with { exact: true } (added in enhanced-resolve@5.22.0) so only the directory's own entry is invalidated; file-level changes in the same aggregated event continue to purge file stats and the parent readdir as before. (by @​alexander-akait in #21020)

Commits
  • cfb24a4 chore(release): new release (#21019)
  • c7d8a3a fix: release per-child Compilation heap pressure in MultiCompiler (#21015)
  • d6cdebe fix: regression in types for ProgressPlugin (#21036)
  • c073890 fix: gap-fill entryOptions when an async block reuses an existing entrypoint ...
  • 78158f0 docs: streamline AGENTS.md to reduce AI hallucination (#21033)
  • c61c649 test: fail on missing per-kind snapshot instead of auto-writing it (#21027)
  • a514897 docs: update examples (#21031)
  • cc4035b fix: remove unnecessary webpack_require in ESM library output (#21032)
  • 12cb825 docs(buildChunkGraph): explain why blocksWithNestedBlocks gates the skip (#21...
  • 75f60f6 fix(ConcatenatedModule): include runtimeCondition of external infos in update...
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 28, 2026
@dependabot dependabot Bot changed the title chore (deps): bump the patch-updates group with 6 updates chore (deps): bump the patch-updates group across 1 directory with 6 updates May 28, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/patch-updates-3abe77e06b branch 2 times, most recently from 77d616a to a293552 Compare May 28, 2026 13:56
@dependabot
chore (deps): bump the patch-updates group across 1 directory with 6 …
2a5d5d1 
…updates

Bumps the patch-updates group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.5` | `3.4.6` |
| [@babel/plugin-transform-runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-runtime) | `7.29.0` | `7.29.7` |
| [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) | `7.29.5` | `7.29.7` |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.29.2` | `7.29.7` |
| [@puppeteer/browsers](https://github.com/puppeteer/puppeteer) | `3.0.3` | `3.0.4` |
| [webpack](https://github.com/webpack/webpack) | `5.107.1` | `5.107.2` |



Updates `dompurify` from 3.4.5 to 3.4.6
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.5...3.4.6)

Updates `@babel/plugin-transform-runtime` from 7.29.0 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-plugin-transform-runtime)

Updates `@babel/preset-env` from 7.29.5 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-preset-env)

Updates `@babel/runtime` from 7.29.2 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-runtime)

Updates `@puppeteer/browsers` from 3.0.3 to 3.0.4
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@v3.0.3...v3.0.4)

Updates `webpack` from 5.107.1 to 5.107.2
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.107.1...v5.107.2)

---
updated-dependencies:
- dependency-name: "@babel/plugin-transform-runtime"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@babel/preset-env"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@babel/runtime"
  dependency-version: 7.29.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@puppeteer/browsers"
  dependency-version: 3.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: dompurify
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: webpack
  dependency-version: 5.107.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/patch-updates-3abe77e06b branch from a293552 to 2a5d5d1 Compare May 28, 2026 15:10
@GCHQDeveloper581 GCHQDeveloper581 enabled auto-merge (squash) May 29, 2026 10:28
GCHQDeveloper581
GCHQDeveloper581 approved these changes May 29, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@GCHQDeveloper581 GCHQDeveloper581 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Due diligence:

  • all valid package versions
  • no reported supply chain issues with any of the new dependencies
  • all tests pass, with no new warnings
  • (minimum age now enforced by dependabot)

@GCHQDeveloper581 GCHQDeveloper581 merged commit bdcd5fa into master May 29, 2026
3 checks passed
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/patch-updates-3abe77e06b branch May 29, 2026 10:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@GCHQDeveloper581 GCHQDeveloper581 GCHQDeveloper581 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@GCHQDeveloper581