chore(deps-dev): bump the webpack group across 1 directory with 3 updates by dependabot[bot] · Pull Request #1489 · CycloneDX/cyclonedx-javascript-library

dependabot · 2026-07-08T09:27:17Z

Bumps the webpack group with 3 updates in the / directory: ts-loader, webpack and webpack-cli.

Updates ts-loader from 9.6.0 to 9.6.2

Release notes

v9.6.2

chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micromatch → picomatch - thanks @johnnyreilly

Officially ts-loader has supported 3.6.3+ versions of TypeScript. This change means that certain scenarios with older versions of TS will now certainly fail. If anyone is actually using these versions it would be surprising.

v9.6.1

fix: rspack support - thanks @johnnyreilly and @bhollis

Changelog

Sourced from ts-loader's changelog.

9.6.2

chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micromatch → picomatch - thanks @johnnyreilly

Officially ts-loader has supported 3.6.3+ versions of TypeScript. This change means that certain scenarios with older versions of TS will now certainly fail. If anyone is actually using these versions it would be surprising.

9.6.1

fix: rspack support - thanks @johnnyreilly and @bhollis

Commits

b347bb7 chore: trim runtime dependencies — remove enhanced-resolve/semver, swap micro...
32d82e6 fix: rspack support (#1699)
6bd992e chore: Update GitHub Actions workflow for release
See full diff in compare view

Updates webpack from 5.107.2 to 5.112.2

Release notes

Sourced from webpack's releases.

v5.112.2

Patch Changes

Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)

Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)

Return the value of every module type loaded with importModule(). (by @alexander-akait in #22869)

v5.112.1

Patch Changes

Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @aryanraj45 in #22699)

Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @aryanraj45 in #22749)

Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @alexander-akait in #22791)

Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @lazerg in #22833)

Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @codeXsidd in #22846)

Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @alexander-akait in #22794)

Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @alexander-akait in #22804)

Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @dependabot in #22811)

Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @alexander-akait in #22733)

Await asynchronous modules that ProvidePlugin injects into ES modules. (by @alexander-akait in #22728)

Keep a resolve that ends after the compiler closed from throwing. (by @alexander-akait in #22795)

Preserve string names passed to SharedWorker constructors. (by @bjohansebas in #22770)

Preserve string contents when extracting source map comments. (by @bjohansebas in #22768)

Scope strict-mode, async and generator block function declarations to their block. (by @alexander-akait in #22800)

Preserve raw dotenv values when reusing cached environment files. (by @Eshiv-Pandey in #22787)

Preserve assigned or patched built-ins, conversions and pattern targets. (by @aryanraj45 in #22761)

Keep globals a globalThis write replaces, and slice on a patched array. (by @alexander-akait in #22862)

Skip HTML script tags for shared chunks that emit no JavaScript. (by @bjohansebas in #22779)

Keep the digits Firefox lays out a minified CSS percentage with. (by @alexander-akait in #22718)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.112.2

Patch Changes

Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)

Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)

Return the value of every module type loaded with importModule(). (by @alexander-akait in #22869)

5.112.1

Patch Changes

Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @aryanraj45 in #22699)

Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @aryanraj45 in #22749)

Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @alexander-akait in #22791)

Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @lazerg in #22833)

Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @codeXsidd in #22846)

Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @alexander-akait in #22794)

Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @alexander-akait in #22804)

Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @dependabot in #22811)

Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @alexander-akait in #22733)

Await asynchronous modules that ProvidePlugin injects into ES modules. (by @alexander-akait in #22728)

Keep a resolve that ends after the compiler closed from throwing. (by @alexander-akait in #22795)

Preserve string names passed to SharedWorker constructors. (by @bjohansebas in #22770)

Preserve string contents when extracting source map comments. (by @bjohansebas in #22768)

Scope strict-mode, async and generator block function declarations to their block. (by @alexander-akait in #22800)

Preserve raw dotenv values when reusing cached environment files. (by @Eshiv-Pandey in #22787)

Preserve assigned or patched built-ins, conversions and pattern targets. (by @aryanraj45 in #22761)

Keep globals a globalThis write replaces, and slice on a patched array. (by @alexander-akait in #22862)

Skip HTML script tags for shared chunks that emit no JavaScript. (by @bjohansebas in #22779)

... (truncated)

Commits

e95a7f2 chore(release): new release (#22867)
6e43fc2 fix: return the value of every module type from importModule() (#22869)
4ffac8d ci: rename the parser job to spec and run CSS, HTML and XML in one leg (#22870)
0c02242 test: split the syntax unit tests into tokenizer, parser and printer (#22825)
660608c perf(css): cut CPU and allocation in the CSS minifier (#22868)
8c3cbd3 perf: avoid allocating unused CSS module sets (#22866)
a1e5f6a perf: avoid duplicate scans in module concatenation (#22865)
759b539 chore(release): new release (#22720)
539f8de fix(minify): keep globals a globalThis write replaces, and slice on a pat...
9668155 ci: run the deep-imports check in the lint job (#22859)
Additional commits viewable in compare view

Updates webpack-cli from 7.0.3 to 7.3.1

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.3.1

Patch Changes

fix: detect missing package managers and failed installations, without a lock file the CLI chose npm even when it wasn't installed instead of yarn or pnpm, and it continued after a package failed to install (by @alexander-akait in #4889)

chore: replace the import-local and cross-spawn dependencies with Node.js built-ins (by @alexander-akait in #4889)

chore: load configuration files with import() instead of eval (by @alexander-akait in #4893)

webpack-cli@7.3.0

Minor Changes

feat: run webpack-dev-server@6 as a compiler plugin. The CLI drives watch compilation, prints build stats and closes the compiler on shutdown. Older dev servers continue to manage their own compilation. (by @bjohansebas in #4847)

In multi-compiler mode, every dev server serves all compilers by default. Use the new --dev-server-per-compiler option of webpack serve to serve each compiler only by the dev server from its own configuration.

feat: add shell completions for zsh, bash, fish and powershell through the complete command (by @alexander-akait in #4840)

Patch Changes

fix: keep multi-compiler options such as parallelism and plugins set on a configuration array when --config-name or extends rebuild it (by @alexander-akait in #4871)

perf: share the compile cache with child processes and worker threads, such as minimizer workers, so they start warm too (by @alexander-akait in #4872)

fix: assign distinct ports to dev servers of configurations that share the same devServer object. (by @alexander-akait in #4886)

webpack-cli@7.2.3

Patch Changes

fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @bjohansebas in #4834)

feat: allow toml@5 as a peer dependency for TOML configuration files (by @alexander-akait in #4837)

webpack-cli@7.2.2

Patch Changes

perf: enable the Node.js compile cache (module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @bjohansebas in #4818)

webpack-cli@7.2.1

Patch Changes

fix: CLIPlugin dynamic import interop under Bun (by @alexander-akait in #4799)

webpack-cli@7.2.0

Minor Changes

feat: allow webpack-dev-server v6 as an optional peer dependency (^5.0.0 || ^6.0.0) (by @bjohansebas in #4793)

Support tsx as a fallback loader for TypeScript and JSX configuration files (.ts, .tsx, .cts, .mts and .jsx), used when none of the loaders known to interpret (such as ts-node) are installed. (by @alexander-akait in #4796)

... (truncated)

Changelog

Sourced from webpack-cli's changelog.

7.3.1

Patch Changes

fix: detect missing package managers and failed installations, without a lock file the CLI chose npm even when it wasn't installed instead of yarn or pnpm, and it continued after a package failed to install (by @alexander-akait in #4889)

chore: replace the import-local and cross-spawn dependencies with Node.js built-ins (by @alexander-akait in #4889)

chore: load configuration files with import() instead of eval (by @alexander-akait in #4893)

7.3.0

Minor Changes

feat: run webpack-dev-server@6 as a compiler plugin. The CLI drives watch compilation, prints build stats and closes the compiler on shutdown. Older dev servers continue to manage their own compilation. (by @bjohansebas in #4847)

In multi-compiler mode, every dev server serves all compilers by default. Use the new --dev-server-per-compiler option of webpack serve to serve each compiler only by the dev server from its own configuration.

feat: add shell completions for zsh, bash, fish and powershell through the complete command (by @alexander-akait in #4840)

Patch Changes

fix: keep multi-compiler options such as parallelism and plugins set on a configuration array when --config-name or extends rebuild it (by @alexander-akait in #4871)

perf: share the compile cache with child processes and worker threads, such as minimizer workers, so they start warm too (by @alexander-akait in #4872)

fix: assign distinct ports to dev servers of configurations that share the same devServer object. (by @alexander-akait in #4886)

7.2.3

Patch Changes

fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @bjohansebas in #4834)

feat: allow toml@5 as a peer dependency for TOML configuration files (by @alexander-akait in #4837)

7.2.2

Patch Changes

perf: enable the Node.js compile cache (module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @bjohansebas in #4818)

7.2.1

Patch Changes

fix: CLIPlugin dynamic import interop under Bun (by @alexander-akait in #4799)

7.2.0

... (truncated)

Commits

3a695da chore(release): new release (#4891)
4a88999 chore: load configuration files without eval (#4893)
02a85ac chore(deps): bump the dependencies group across 1 directory with 5 updates (#...
3942417 chore: replace import-local and cross-spawn with Node.js built-ins (#4889)
349b660 chore(release): new release (#4841)
d4ee8bd fix: assign distinct ports to dev servers sharing devServer options (#4886)
9bcb6d5 feat: run webpack-dev-server as a compiler plugin (#4847)
b32b0c9 test: make the generator and dev server tests stable (#4885)
351f1c9 chore(deps): bump the dependencies group across 1 directory with 9 updates (#...
701e74b chore(deps-dev): bump del-cli from 7.0.0 to 8.0.1 (#4880)
Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

codacy-production · 2026-07-08T09:28:11Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

read-the-docs-community · 2026-08-10T11:04:08Z

Documentation build overview

📚 CycloneDX JavaScript Library | 🛠️ Build #35718045 | 📁 Comparing 90220bf against latest (6a1b76a)

🔍 Preview build

10 files changed · + 4 added · ± 6 modified

+ Added

± Modified

jkowalleck · 2026-08-17T10:40:40Z

@dependabot rebase

…ates Bumps the webpack group with 3 updates in the / directory: [ts-loader](https://github.com/TypeStrong/ts-loader), [webpack](https://github.com/webpack/webpack) and [webpack-cli](https://github.com/webpack/webpack-cli). Updates `ts-loader` from 9.6.0 to 9.6.2 - [Release notes](https://github.com/TypeStrong/ts-loader/releases) - [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md) - [Commits](TypeStrong/ts-loader@v9.6.0...v9.6.2) Updates `webpack` from 5.107.2 to 5.112.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.107.2...v5.112.2) Updates `webpack-cli` from 7.0.3 to 7.3.1 - [Release notes](https://github.com/webpack/webpack-cli/releases) - [Changelog](https://github.com/webpack/webpack-cli/blob/main/CHANGELOG.md) - [Commits](https://github.com/webpack/webpack-cli/compare/webpack-cli@7.0.3...webpack-cli@7.3.1) --- updated-dependencies: - dependency-name: ts-loader dependency-version: 9.6.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: webpack - dependency-name: webpack dependency-version: 5.108.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: webpack - dependency-name: webpack-cli dependency-version: 7.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: webpack ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 8, 2026

dependabot Bot requested a review from a team as a code owner July 8, 2026 09:27

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 8, 2026

dependabot Bot mentioned this pull request Jul 8, 2026

chore(deps-dev): bump the webpack group across 1 directory with 3 updates #1483

Closed

dependabot Bot force-pushed the dependabot/npm_and_yarn/webpack-1b8ded6555 branch from ae6784e to b833f33 Compare July 11, 2026 11:32

dependabot Bot force-pushed the dependabot/npm_and_yarn/webpack-1b8ded6555 branch from b833f33 to 88a3bac Compare August 10, 2026 10:52

dependabot Bot force-pushed the dependabot/npm_and_yarn/webpack-1b8ded6555 branch from 88a3bac to 7b6d6e5 Compare August 15, 2026 11:32

dependabot Bot force-pushed the dependabot/npm_and_yarn/webpack-1b8ded6555 branch 2 times, most recently from a12b8d4 to 41716e9 Compare August 22, 2026 11:32

dependabot Bot force-pushed the dependabot/npm_and_yarn/webpack-1b8ded6555 branch from 41716e9 to 57a9aff Compare August 29, 2026 11:32

dependabot Bot force-pushed the dependabot/npm_and_yarn/webpack-1b8ded6555 branch from 57a9aff to 639178c Compare September 19, 2026 11:33

dependabot Bot force-pushed the dependabot/npm_and_yarn/webpack-1b8ded6555 branch from 639178c to d4a6d6f Compare October 31, 2026 11:32

dependabot Bot force-pushed the dependabot/npm_and_yarn/webpack-1b8ded6555 branch from d4a6d6f to 90220bf Compare November 7, 2026 11:32

Navigation Menu

Repository navigation

chore(deps-dev): bump the webpack group across 1 directory with 3 updates - #1489

chore(deps-dev): bump the webpack group across 1 directory with 3 updates#1489
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/webpack-1b8ded6555

dependabot Bot commented on behalf of github Jul 8, 2026 •

edited

Loading

Uh oh!

codacy-production Bot commented Jul 8, 2026

Uh oh!

read-the-docs-community Bot commented Aug 10, 2026 •

edited

Loading

Uh oh!

jkowalleck commented Aug 17, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v9.6.2

v9.6.1

9.6.2

9.6.1

v5.112.2

Patch Changes

v5.112.1

Patch Changes

5.112.2

Patch Changes

5.112.1

Patch Changes

webpack-cli@7.3.1

Patch Changes

webpack-cli@7.3.0

Minor Changes

Patch Changes

webpack-cli@7.2.3

Patch Changes

webpack-cli@7.2.2

Patch Changes

webpack-cli@7.2.1

Patch Changes

webpack-cli@7.2.0

Minor Changes

7.3.1

Patch Changes

7.3.0

Minor Changes

Patch Changes

7.2.3

Patch Changes

7.2.2

Patch Changes

7.2.1

Patch Changes

7.2.0

Uh oh!

codacy-production Bot commented Jul 8, 2026

Up to standards ✅

Uh oh!

read-the-docs-community Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

jkowalleck commented Aug 17, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 8, 2026 •

edited

Loading

read-the-docs-community Bot commented Aug 10, 2026 •

edited

Loading