[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
eslint (source)	10.12.0 → 10.13.0
eslint-plugin-jest	29.16.11 → 29.17.0
postcss (source)	8.5.29 → 8.5.31
sass	1.105.1 → 1.105.2
webpack	5.111.1 → 5.112.0
webpack-dev-server	6.0.0 → 6.1.0

---

Release Notes

eslint/eslint (eslint)

v10.13.0

Compare Source

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#​21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#​21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#​21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#​21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#​21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#​21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#​21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#​21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#​21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#​21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#​21390) (ESLint Bot)

jest-community/eslint-plugin-jest (eslint-plugin-jest)

v29.17.0

Compare Source

Features

• no-standalone-expect: allow expect assertions in beforeEach hooks (#​2031) (ddcab00)

29.16.11 (2026-10-10)

Bug Fixes

• no-export: report export all declarations (#​2040) (3ca13a7)
• no-mocks-import: check dynamic imports (#​2039) (3e363d1)

29.16.10 (2026-10-10)

Bug Fixes

• make sure most rules account for optional chaining (#​2038) (2d68f61)

29.16.9 (2026-10-10)

Bug Fixes

• consistent-test-it: don't drop only and skip from each chains (#​2037) (3f6b5aa)

Performance Improvements

• cache parsing of nodes that turn out not to be jest function calls (#​2035) (7b11cbd)

29.16.8 (2026-10-10)

Bug Fixes

• prefer-to-have-been-called-times: don't crash if there is no argument passed to expect (#​2036) (4dc58f0)

29.16.7 (2026-10-10)

Bug Fixes

• unbound-method: account for optional chaining (#​2034) (b918d73)

29.16.6 (2026-08-30)

Bug Fixes

• prefer-to-have-been-called: don't crash on matcher without an argument (#​2016) (58e487f)
• prefer-to-have-length: don't crash on expect chain without a value (#​2014) (3629019)

29.16.5 (2026-08-27)

Bug Fixes

• no-export: handle literal property accessors (#​2011) (d848f70)

29.16.4 (2026-08-27)

Bug Fixes

• no-export: handle nested assignment chains (#​2009) (14b559a)

29.16.3 (2026-08-27)

Bug Fixes

• no-export: check for exports global (#​1988) (f506cb2)

29.16.2 (2026-08-25)

Bug Fixes

• prefer-equality-matcher: don't crash on expect chain without a value (#​2006) (27665cd)

29.16.1 (2026-08-12)

Bug Fixes

• prefer-comparison-matcher: don't crash on expect chain without a value (#​2001) (a4d20e0)
• prefer-expect-resolves: don't crash on expect chain without a value (#​2002) (0cf65de)

postcss/postcss (postcss)

v8.5.31

Compare Source

• Fix better source map on </style> escaping (by @​firefoxic).

v8.5.30

Compare Source

• Fix broken map on </style> escaping (by @​Rufflet).

sass/dart-sass (sass)

v1.105.2

Compare Source

Node.js Embedded Host

• Fix a deadlock when the async compiler fails to start.

webpack/webpack (webpack)

v5.112.0

Compare Source

Minor Changes

• Apply plugins set on a multi-configuration array to the MultiCompiler. (by @​alexander-akait in #​22702)

• Add optimization.minimize.css.dropOverriddenDeclarations, dropping a declaration a later one overrides where no target is named. (by @​alexander-akait in #​22175)

• Export more plugins under their scope, move eleven loose exports under theirs, deprecate the old, and expose template.DependencyTemplate, module.NullFactory and util.makeSerializable. (by @​alexander-akait in #​22261)

• Let util.makeSerializable take several requests, current one first. (by @​alexander-akait in #​22340)

• Emit the source map scopes field, so a debugger resolves imported ESM bindings by name. (by @​alexander-akait in #​21999)

• Add library.entryExports: "all" to expose the exports of every entry module. (by @​alexander-akait in #​22235)

• Recognize a required const binding assigned to exports as a re-export. (by @​hai-x in #​22276)

• Accept glob patterns in more path, module and file filter options. (by @​hai-x in #​22422)

• Bundle a run of inline <script> tags into one chunk the page can inline. (by @​alexander-akait in #​22188)

• Add module.parser.javascript.topLevelThis for classic-script this semantics. (by @​alexander-akait in #​22193)

• Add module.parser.html.chunkName and a webpackChunkName comment for tags. (by @​alexander-akait in #​22200)

• Add include/exclude version and request filters to shared modules. (by @​alexander-akait in #​22297)

• Keep module side-effect information in ESM output as PURE annotations. (by @​alexander-akait in #​21789)

• Add optimization.splitChunks.dedupDepth to discover chunk intersections. (by @​alexander-akait in #​22240)

• Add optimization.minimizeOptions.json, on by default with futureDefaults. (by @​alexander-akait in #​22286)

• Add SSRManifestPlugin and fix server-rendered CSS collection and adoption. (by @​alexander-akait in #​21913)

• Add an ignore hook to output.copy and keep unfollowed from symlinks. (by @​alexander-akait in #​22216)

• Add optimization.minimize.css.convertApproximateColors. (by @​alexander-akait in #​22157)

• Add XML parsing and SVG/XML minification with data URLs and attribute sorting. (by @​alexander-akait in #​22269)

• Extract CSS/HTML license comments like JS and safely shorten CSS gradients. (by @​alexander-akait in #​22408)

• Resolve an async DefinePlugin.runtimeValue over an async beforeParse hook. (by @​alexander-akait in #​22210)

• Add CSS customMedia/customSelectors minimize options; resolve chained names. (by @​alexander-akait in #​22360)

• Rename the Harmony* names to ESM* and deprecate the old spellings. (by @​hai-x in #​22283)

• Reduce css.syntax/html.syntax to parser, printer, SourceProcessor with one node path. (by @​alexander-akait in #​22233)

• Add a JavaScript SyntaxTree read like the CSS one, and toEstreeObject. (by @​alexander-akait in #​22608)

• Fix minified code that threw, and add pure_conversions and pure_heritage. (by @​alexander-akait in #​22473)

• Shorten more CSS values and selectors, fold longhands, order declarations and gather layer blocks. (by @​alexander-akait in #​22442)

• Add optimization.minimize.css.charset; false drops @charset for UTF-8 CSS. (by @​alexander-akait in #​22632)

Patch Changes

• Join rules a gathered @layer leaves adjacent, and an at-rule with a later one (by @​alexander-akait in #​22204)
  stating the same condition; read what a condition declares.

• Read escaped CSS names and functions as spelled, and minify them unescaped. (by @​alexander-akait in #​22262)

• Minify JavaScript, CSS and HTML assets whose names carry a #fragment. (by @​alexander-akait in #​22277)

• Require minimizer-webpack-plugin 5.12, so inline scripts in HTML minify again. (by @​alexander-akait in #​22296)

• Minify the attributes of an HTML tag without rewriting the template in it. (by @​alexander-akait in #​22166)

• Order joined at-rule selector lists and gather a repeated large @layer block. (by @​alexander-akait in #​22224)

• Preserve case-sensitive template identifiers when minifying HTML tag attributes. (by @​bjohansebas in #​22177)

• Match Acorn's strict directives, Unicode identifiers and expression validation. (by @​bjohansebas in #​22185)

• Skip concatenating modules when optimization.providedExports is disabled. (by @​hai-x in #​22410)

• Join rules a nesting lowering or duplicate drop left for a second pass. (by @​aryanraj45 in #​22268)

• Write U+00A0 in a minified HTML attribute as the character, not  . (by @​alexander-akait in #​22208)

• Escape a foreign <script> or <style> body, which is character data. (by @​alexander-akait in #​22233)

• Name the runtime module whose generation fails while hashing. (by @​alexander-akait in #​22203)

• Rebuild a module in watch when its missing unused dependencies swap. (by @​alexander-akait in #​22693)

• Rebuild in watch mode when a file is deleted while a build is running. (by @​alexander-akait in #​22650)

• Take out the declaration a lowered shorthand writes over, which its source spelling made look like a fallback. (by @​aryanraj45 in #​22270)

• Read a foreign <script> or <style> body as character data, not as raw text. (by @​alexander-akait in #​22258)

• Keep an inline <style> body as written when rebuilding a page webpack emitted. (by @​alexander-akait in #​22265)

• Fix minified HTML for style spellings, CSS quotes, <noscript> and a BOM. (by @​alexander-akait in #​22370)

• Record a build dependency required through a spread on Bun. (by @​alexander-akait in #​22230)

• Write a nested selector opening on a combinator against its parent the way the printer writes one. (by @​aryanraj45 in #​22271)

• Fix missing async stylesheets with a shared runtime. (by @​bjohansebas in #​22659)

• Support deferred imports introduced by hot updates. (by @​bjohansebas in #​22668)

• Fix trailing commas in require.resolve() and require.resolveWeak() calls. (by @​bjohansebas in #​22658)

• Keep regular expressions, functions and plugins distinct in resolver caches. (by @​bjohansebas in #​22667)

• Order the list a lowered nested selector lands in on what is written, not on what was. (by @​aryanraj45 in #​22287)

• Hoist a vendor-prefixed nested rule for a target that reads no nesting. (by @​aryanraj45 in #​22308)

• Name a hoisted nested rule in the dark-scheme copy it writes. (by @​alexander-akait in #​22318)

• Minify data: URL payloads in HTML attributes and new URL, and web manifests. (by @​alexander-akait in #​22300)

• fold a fallback's colors over the author's arguments, and print with (by @​aryanraj45 in #​22314)
  recurseBlocks: false rather than throwing

• Read a regular expression repeating a capture group name in linear time. (by @​alexander-akait in #​22187)

• Make lazy barrels defer import declarations and keep no deferral across compilations. (by @​hai-x in #​22359)

• Invalidate unaffected caches when connection activity or async status changes. (by @​bjohansebas in #​22431)

• Order concatenated re-exports deterministically when their source order ties. (by @​alexander-akait in #​22697)

• Regenerate a module's exports when a require() cycle forms or breaks around it. (by @​aryanraj45 in #​22644)

• Recompute re-exports, code and warnings when a module goes missing or returns. (by @​bjohansebas in #​22432)

• Preserve loader resolution dependencies across cached rebuilds. (by @​bjohansebas in #​22430)

• Read unwatched changes afresh and wait for restarted watch compilers to finish. (by @​alexander-akait in #​22646)

• Parse loader output for .wasm as JavaScript when async wasm is auto-enabled. (by @​alexander-akait in #​22556)

• Remove modules an async chunk inherits from a named parent chunk grown later. (by @​hai-x in #​22555)

• Fix JavaScript minifier crashes, altered behavior, lost comments, unparsable output and null source map sources, including parameter aliases, ESTree trees and preserved names, and stop it writing into the caller's parse options. (by @​alexander-akait in #​22352)

• Preserve the source phase of dynamic WebAssembly import contexts. (by @​bjohansebas in #​22604)

• Await every async entry before resolving an ESM library import. (by @​bjohansebas in #​22617)

• Keep unknown import.meta properties per module, alike for aliases and direct use. (by @​bjohansebas in #​22618)

• Return WebAssembly modules directly from eager and weak source imports. (by @​bjohansebas in #​22606)

• Handle missing ESM hot update manifests in Node.js without failing HMR checks. (by @​bjohansebas in #​22613)

• Speed up JavaScript parsing: comment lookup, the tokenizer and the grammar. (by @​bjohansebas in #​22179)

• Name a core module external by its key whichever spelling the code uses. (by @​alexander-akait in #​22565)

• Prefix and drop 2009 flexbox names, keeping them where a box lays out by them. (by @​alexander-akait in #​22320)

• Keep initial where Gecko or WebKit reads the property's keyword apart. (by @​aryanraj45 in #​22176)

• Fold calc() as lightningcss does, keeping it where a bare value is refused. (by @​aryanraj45 in #​22205)

• Keep a color-mix() whose hue rests on a gray's conversion residue. (by @​alexander-akait in #​22198)

• Keep a shorthand's initial keyword where it parts two keywords of another slot. (by @​dependabot in #​22518)

• Group lib/ and lib/dependencies/ sources into directories. (by @​alexander-akait in #​22118)

• Treat a browserslist target given at a bare major version (e.g. safari 10) as <major>.0 when a feature's first supported version is a [major, minor] pair, so it is no longer reported as unsupported. (by @​Eshiv-Pandey in #​22280)

• Keep the last HMR update with output.clean; stop rechecking removed files. (by @​alexander-akait in #​22339)

• Read and print a CSS backslash as the spec does, and a NUL as U+FFFD. (by @​alexander-akait in #​22201)

• Make minified CSS and HTML stable on a second pass, even for truncated input. (by @​alexander-akait in #​22290)

• Minify a merged <style> run as one sheet, closing each where its input ended. (by @​alexander-akait in #​22302)

• Minify JavaScript with webpack's printer under futureDefaults, terser otherwise. (by @​alexander-akait in #​22217)

• Preserve wrappedContextRegExp flags when rebuilding context request matchers. (by @​Eshiv-Pandey in #​22303)

• Minify CSS @supports, @import and @custom-media conditions, and exponent numbers. (by @​alexander-akait in #​22347)

• Fold unitless hsl()/hwb() channels, and only where the separators are valid. (by @​alexander-akait in #​22242)

• Split @value imports on the from keyword, not a substring in the path. (by @​Eshiv-Pandey in #​22306)

• Destructure a dotted DefinePlugin key whose value is falsy or a runtimeValue. (by @​alexander-akait in #​22215)

• Make Stats.hasErrors() read errors through the processErrors hook (via getErrors()), matching hasWarnings(), so a plugin that filters errors out of the hook is no longer contradicted by hasErrors(). (by @​Eshiv-Pandey in #​22281)

• Allow wrapping an external concatenated module, now asked of the module itself, and re-exporting a JSON or asset default as a namespace object. (by @​hai-x in #​22226)

• Match urlHints rules written with and, or, not and glob conditions; profile hook map taps, such as resolver and parser hooks, in ProfilingPlugin; report import.meta option errors inside require.ensure callbacks, not crash; and replace any, object and Function with precise types in the type definitions. (by @​alexander-akait in #​22681)

• Reduce CSS and HTML build time and memory allocation. (by @​alexander-akait in #​22135)

• Reuse free names instead of re-parsing modules for the entry IIFE rename. (by @​hai-x in #​22206)

• Release each module's ast once scope-analysed, and encode each export path once. (by @​alexander-akait in #​22241)

• Export a module library entry's default expression as its own binding, and keep (by @​hai-x in #​22227)
  the export helpers where the entry is not inlined.

• Give a wrapped concatenated body the same function header as a module factory. (by @​hai-x in #​22254)

• Skip reading every asset when no content hash is named. (by @​alexander-akait in #​22256)

• Cut graph, cached set, lazy barrel and ESM import memory and allocations. (by @​alexander-akait in #​22289)

• Stop a module source from being held as both a string and a buffer. (by @​alexander-akait in #​22294)

• Read the browserslist data and options schema only when a build needs them. (by @​alexander-akait in #​22324)

• Release the eval devtool's cached module sources after wrapping them. (by @​alexander-akait in #​22358)

• Release the rendered module sources after emitting the chunks. (by @​alexander-akait in #​22365)

• Cut the peak memory and time of minifying through webpack's printer. (by @​alexander-akait in #​22368)

• Shrink minified JS: unwrap IIFEs, fold calls, drop dead code, split arrays. (by @​alexander-akait in #​22393)

• Cut JavaScript minifier time and memory; keep token positions in large inputs. (by @​bjohansebas in #​22329)

• Keep the calc() around a steps() count jump-none would reject bare. (by @​alexander-akait in #​22168)

• Split the CSS syntax module into a parser file and a printer file. (by @​alexander-akait in #​22222)

• Update enhanced-resolve to 5.26.0. (by @​alexander-akait in #​22358)

• Update watchpack to 2.6.1. (by @​alexander-akait in #​22670)

• Split the HTML syntax module into a parser file and a printer file. (by @​alexander-akait in #​22223)

• Rename classes in lib/ so each says what it does and no two share a name. (by @​alexander-akait in #​22361)

• Keep the remote fallback index aligned with registered container externals when an internal external precedes a real one. (by @​Eshiv-Pandey in #​22362)

• Stop a minified inlined chunk leaving a doubled ; in its <script>. (by @​alexander-akait in #​22370)

• Stop mergeDistantRules mangling rules or reordering all, and merge more. (by @​alexander-akait in #​22370)

• Minify by parsing with webpack's own parser rather than terser's. (by @​alexander-akait in #​22397)

• Read JavaScript with webpack's parser alone when minifying, refusing early errors. (by @​alexander-akait in #​22397)

• Parse an assert(...) call after an import with no semicolon, and a regular expression after yield in a generator method. (by @​alexander-akait in #​22406)

• Keep the private names a direct eval reads when mangling. (by @​aryanraj45 in #​22412)

• Keep a class dropped for its effects where they read a private name it declares. (by @​aryanraj45 in #​22421)

• Parenthesize the right side of a private in, a yield, await, private in or optional chain tagging a template, and a let or async starting a statement or loop head, where the minifier printed code that no longer parsed or read otherwise. (by @​aryanraj45 in #​22437)

• Keep a name a parameter list or catch parameter reads from resolving to what the function body or catch block declares, which the minifier renamed or dropped as unused. (by @​aryanraj45 in #​22439)

• Scope and export a CSS Modules @value the same way whether local or imported. (by @​alexander-akait in #​22443)

• Keep CSS border: none and gradient fallbacks for units a target cannot read. (by @​alexander-akait in #​22567)

• Keep minified CSS safe for older browsers; drop dead fallbacks and overrides. (by @​alexander-akait in #​22696)

• Keep CSS rules apart from a neighbor whose selector no browser parses. (by @​alexander-akait in #​22634)

• Keep an :nth-*() argument with a space after its sign as written. (by @​alexander-akait in #​22700)

• Keep minified CSS readable by browsers the compat data does not cover. (by @​alexander-akait in #​22701)

• Keep a module its chunk still needs after compilation.rebuildModule(). (by @​alexander-akait in #​22705)

• Keep a CSS rule nested under a selector opening on a combinator when lowering. (by @​alexander-akait in #​22707)

• Use module paths for webpack's built-in minimizers so parallel minification can load them directly in workers instead of serializing their function sources. (by @​xiaoxiaojx in #​22309)

• Keep stats from an earlier build readable after a later build no longer has one of their modules. (by @​alexander-akait in #​22695)

webpack/webpack-dev-server (webpack-dev-server)

v6.1.0

Compare Source

Minor Changes

• Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @​alexander-akait in #​5765)

• Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export BaseServer. (by @​alexander-akait in #​5739)

• The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, allowedHosts and the origin checks still apply here, and this server's { type } messages are still sent next to the middleware's, so React Refresh keeps working. client/index.js, client/socket.js and client/clients/WebSocketClient.js still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. client.webSocketTransport: "sse" adds Server-Sent Events, a universal build now runs in Node without the client throwing, and sendMessage(), getClientEntry() and getClientHotEntry() still work, a subclass's overrides included, but are deprecated. (by @​alexander-akait in #​5750)

Patch Changes

• Keep hot and live reload working after a cancelled "Leave site?" dialog. (by @​alexander-akait in #​5744)

• Keep the overlay for a runtime error thrown while the page is still loading. (by @​alexander-akait in #​5745)

• Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @​UlisesGascon in cb1534a)

• Validate options with a precompiled schema to cut ~115ms from startup. (by @​alexander-akait in #​5746)

• Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @​bjohansebas in #​5771)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 01:00 AM and 07:59 AM, only on Monday (* 1-7 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (19b6ba5) to head (005050e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #375   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            6         6           
  Lines          196       196           
  Branches        52        52           
=========================================
  Hits           196       196           

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 19b6ba5...005050e. Read the comment docs.