Update all non-major dependencies#1505
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.29.0→7.29.77.29.5→7.29.74.3.5→4.3.63.6.5→3.6.76.0.0→6.1.00.6.0→0.6.211.2.6→11.2.713.1.10→13.1.122.4.3→2.4.48.0.8→8.0.125.106.2→5.107.24.14.1→4.15.02.9.2→2.10.1Release Notes
babel/babel (@babel/core)
v7.29.7Compare Source
v7.29.7 (2026-05-25)
Re-release all packages with npm provenance attestations
v7.29.6Compare Source
v7.29.6 (2026-05-25)
🐛 Bug Fix
babel-generatorbabel-corebabel-core,babel-generatorCommitters: 3
api-platform/core (api-platform/core)
v4.3.6Compare Source
Bug fixes
doctrine/orm (doctrine/orm)
v3.6.7Compare Source
This release contains the changes from https://github.com/doctrine/orm/releases/tag/2.20.13
v3.6.6Compare Source
Release Notes for 3.6.6
3.6.x bugfix release (patch)
3.6.6
Bugfixes
CI
apache/echarts (echarts)
v6.1.0Compare Source
dataMinanddataMaxoption for calculating a nice axis extent. #20838 (Justin-ZS, Ovilia)"value"/"time"/"category"/"log") to render series (typically"bar"/"pictorialBar"/"candlestick"/"boxplot") without overflow (including the case"category"axis withboundaryGap: false); providecontainShapeoption; provide some correspondingclipoption. dbfaf6a73 fe932a2aa 3973b21ee (100pah) #21511 (Akash Sonune)"log"axis. dedc5dc18 (100pah)axisLabel.formatterto receive its index for working withcustomValues. #21220 #21432 (Szymon Pachucki, Ovilia, plainheart)triggerEventoption for more control over mouse event. #21001 (Steven Cobb, plainheart)tangential-nofliprotation mode to keep labels tangential without flipping. #21258 (春秋半夏, Ovilia)progress.colorsupports'auto'. #21224 (StNimmerlein, Ovilia)clockwiseoption. #21143 (Dai Xuezhou, Ovilia)cursoroption forcandlestickseries and addcursorGraboption &cursorGrabbingfor'inside'dataZoom. #21558 (zuming, Ovilia, 100pah, Ovilia)clipoption on"scatter"/"effectScatter"ongeo. 417592289 (100pah)seriesTargetsoption for multiple series-dimension mappings. #20703 (Justin-ZS, plainheart)matrix.x/y.lengthfor conveniently creating a headless matrix without composing an array. #21191 (100pah, plainheart)triggerEventoption to support triggering event on matrix cells. #21390 (Natsuo Kawai, 100pah)customValueswithformatterin time axis (axis.type: 'time') label. #21352 (Srajan Sanjay Saxena, plainheart)alignTickstrategy, and fixLogScaleprecision. a6ab2458f ffcc636fb (100pah)axis.type: 'time') orcustomValues, which causes jitter ofsplitArea; fix theshowMin/MaxLabelhandling of a category axis (axis.type: 'category'); enable a uniformbandWidthcalculation in numeric axis (axis.type: 'value' | 'time' | 'log'). 8de2b64fa 15af0db02 8ddaa5c69 (100pah)axis.type: 'time') bug when value scale is in millisecond. 40b77b464 (100pah)roundTripis not enabled. #21320 (Mayank Mehta, plainheart)series.encodeon horizontal layout. #21325 (Purbayan Pramanik, 100pah)gridcomponent). 18a23a875 (100pah)scaleLimitis specified #21427 (TateLiu, 100pah)tooltipXSS vulnerability in lines series (series.type: 'lines'). #21608 (plainheart)tooltipcontent does not refresh when changing tooltip trigger from'axis'to'item'. #20710 (Justin-ZS, plainheart)valueFormattercallback paramdataIndexshould berawDataIndexrather thandataZoomfiltereddataIndex. #21479 (100pah, plainheart)axisPointershadow and enable clipping - it is previously only applicable to"category"axis, but is buggy in numeric axis with"bar"series. 8de2b64fa (100pah)axisPointerrestoration. 56a32c0bb (100pah)markerfails to render withdatasetandencode. #21439 (plainheart, 100pah).dataZoomwhen theserieshas only one data point. #21196 (alesmit, Ovilia)dataZoombug that data info disappears when dragging released; fixdataZoomdragging cursor style. 64305a4b8 (100pah)dataZoomcontrols axes withalignTicks: true. d168bf237 (100pah)AxisProxycan not be cleared whendataZoomoption changed; fix relatedonZerobehaviors. 52ceb924a 2e82d33c3 (100pah)areaStylerender error when dimension name is empty string. #21219 (Justin-ZS, Ovilia)emphasiscolor is the same as the default color. #21384 (Ovilia) b094f987d (100pah)dataViewcomponent does not fit the dark mode. #21176 (notthistrain, Ovilia)labelLine.smoothcan not be reset. #21425 (fanwww, plainheart)roundRecthelper. zrender#1155 (plainheart)encodeBase64compatibility to make it available in more environments like Web Worker/NodeJS/Bun. zrender#1145 (plainheart)echartsinstance object asrawinVue. #21293 (plainheart)langDE. #21571 (A-Loot, plainheart)TS,ESMandCJScompatibility. #21411 (Akash Sonune, 100pah)TSexport types. #21147 (100pah, Ovilia)nodeScaleRatiooption type forgraphseries. #21229 (ocshawn, plainheart)emphasis.handleLabelofsliderdataZoomshould be an optional type. #21175 (Ovilia, plainheart)unpkgentry topackage.json. #21177 (Yue JIN, plainheart)eachmethod ofSeriesData. #21294 (Yurun, plainheart)test/webkit-dep.htmtest case. #21508 (zuming, Ovilia)v6.0.0:tooltip.valueFormattercallback is changed fromdataIndex(i.e., the index afterseriesdata filtered bydataZoom) torawDataIndex(i.e., the index of the original inputseriesdata).startValuewas also used asaxis.minif axis.min was not provided. The new version decouples them - explicitly setting them both (e.g.,startValue: 111, min: 111) is equivalent to the previous behavior (startValue: 111andminis not specified)."bar"/"pictorialBar"/"candlestick"/"boxplot"series could overflow the Cartesian rectangle (grid) at the edge shapes. The new version eliminates that overflow. The previous behavior can be restored viaaxis.containShape: false.igor-php/igor-php (igor-php/igor-php)
v0.6.2Compare Source
Changelog
cd7c9d7fix: recognize unset() as a valid property reset in ResetInterfacev0.6.1Compare Source
Changelog
7428208Fix/symfony resilience (#27)formatjs/formatjs (intl-messageformat)
v11.2.7Compare Source
sebastianbergmann/phpunit (phpunit/phpunit)
v13.1.12: PHPUnit 13.1.12Compare Source
Fixed
-dsettings forwarded to child processes (breaks PCOV coverage)Learn how to install or update PHPUnit 13.1 in the documentation.
Keep up to date with PHPUnit:
v13.1.11: PHPUnit 13.1.11Compare Source
Fixed
=need to be quoted before forwarding via-dLearn how to install or update PHPUnit 13.1 in the documentation.
Keep up to date with PHPUnit:
rectorphp/rector (rector/rector)
v2.4.4: Released Rector 2.4.4Compare Source
New Features 🥳
Bugfixes 🐛
Removed 💀
rectorphp/rector-symfony
rectorphp/rector-downgrade-php
symfony/twig-bridge (symfony/twig-bridge)
v8.0.12Compare Source
Changelog (symfony/twig-bridge@v8.0.8...v8.0.12)
webpack/webpack (webpack)
v5.107.2Compare Source
Patch Changes
Reduce per-file overhead in
ContextModuleFactory.resolveDependenciesby batchingalternativeRequestshook calls. Previously the hook was invoked once per file in the context (with a single-item array), paying per-call overhead (closure allocation,resolverFactory.get, intermediate arrays inRequireContextPlugin) for every file. The hook is now invoked once per directory with all matched files in one batch —RequireContextPlugin's tap already iterates the items array, so the output is unchanged. Steady-state rebuild on a 4000-filerequire.contextdrops a further ~15 ms (after the watch-mode purge fix in the same release). (by @alexander-akait in #21020)Include each external info's
runtimeConditioninConcatenatedModule#updateHashso changes to a concatenated external's runtime condition invalidate persistent caches instead of slipping through with the module id alone. (by @alexander-akait in #21023)Fix HTML
[contenthash]for referenced asset and inline-style URL changes. (by @alexander-akait in #21018)Resolve chunk-hash placeholders in chunk URLs embedded into extracted HTML. (by @alexander-akait in #21018)
Remove unnecessary
__webpack_require__runtime helpers in ESM library output with multi-module chunks. (by @xiaoxiaojx in #21032)Rewrite
NormalModule#getSideEffectsConnectionStatewalk as an allocation-light iterative loop instead of a generator trampoline, restoring rebuild performance lost in #20993 while keeping deep import chains stack-safe. (by @alexander-akait in #21014)Fix runtime
ReferenceErroron the first activation of a lazy-compiled module whenoutput.library.typeproduces a closure-wrapped bundle (umd,umd2,amd,amd-require,system). (by @alexander-akait in #21013)External modules of these types reference closure-bound identifiers like
__WEBPACK_EXTERNAL_MODULE_react__, supplied by the library wrapper that is generated once per chunk. WhenlazyCompilationactivates an entry or import for the first time, any external dependency the lazily-built module pulls in arrives in a hot-update chunk that lives outside the original wrapper closure, so its factory body cannot resolve the closure identifier and only a manual page refresh recovers.The inactive
LazyCompilationProxyModulenow declares statically-enumerable externals (string and object forms ofexternals) as its own dependencies, so the initial entry chunk's library wrapper already exposes their closure identifiers. When activation later pulls in those externals through the lazily-compiled module, they resolve to the already-installed factories instead of throwing. Function and RegExp externals are not pre-populated because their effective request set isn't knowable up front.Fill in missing
entryOptionswhen an async block joins an existing entrypoint. (by @alexander-akait in #21026)Release per-child
codeGenerationResultsinMultiCompilerand atCompiler.closeto reduce memory retention. (by @alexander-akait in #21015)Reduce peak memory of
SourceMapDevToolPluginon large builds (closes #20961). (by @alexander-akait in #20963)Fix slow
require.context()/ dynamicimport()rebuilds in watch mode (#13636). When a file inside a watched context directory changed,NodeWatchFileSystemwould callinputFileSystem.purge(contextDir). The enhanced-resolvepurgeimplementation matches cache keys withkey.startsWith(contextDir), so the stat cache of every file under the directory was discarded on every rebuild —ContextModuleFactory.resolveDependenciesthen re-stat-ed the whole tree on each rebuild. Single-file rebuilds on a 4000-file context now reuse the warm stat cache, dropping median rebuild from ~1260 ms to ~650 ms in a local reproduction (≈49%). For directory items that are explicitly watched contexts,purgeis now called with{ exact: true }(added inenhanced-resolve@5.22.0) so only the directory's own entry is invalidated; file-level changes in the same aggregated event continue to purge file stats and the parentreaddiras before. (by @alexander-akait in #21020)v5.107.1Compare Source
Patch Changes
Align the experimental HTML tokenizer with the WHATWG spec: fix offset-range bugs in the script-data, content-mode end-tag, attribute-value, and EOF states; surface tokenizer parse errors to consumers via a new
parseErrorcallback ("warning"when the tokenizer recovers and the emitted token is still well-formed,"error"when the offset range is incomplete — e.g.eof-in-tag); and add the full WHATWG named character references table sodecodeHtmlEntitieshandles all named entities (including legacy bare forms like&and multi-code-point entities like≂̸) with proper longest-prefix backtracking. (by @alexander-akait in #21000)Tree-shake CommonJS modules imported through a
const NAME = require(LITERAL)binding when only static members ofNAMEare read. Previously webpack treated every export of such modules as referenced (because the barerequire()dependency reportsEXPORTS_OBJECT_REFERENCED), so unusedexports.x = ...assignments remained in the bundle even withusedExportsenabled. The parser now forwardsNAME.x/NAME.x()/NAME["x"]accesses to the underlyingCommonJsRequireDependencyas referenced exports, falling back to the full exports object the momentNAMEis read in any other context (passed by value, destructured later, accessed with a dynamic key, …). This brings the binding form to parity with the existing destructuring form (const { x } = require(...)). (by @alexander-akait in #21003)Fix
RangeError: Maximum call stack size exceededthrown fromHarmonyImportSideEffectDependency.getModuleEvaluationSideEffectsStateon long linear chains of side-effect-free imports.NormalModule.getSideEffectsConnectionStatepreviously descended throughHarmonyImportSideEffectDependency.getModuleEvaluationSideEffectsStaterecursively, adding two stack frames per module, which overflowed V8's stack at a few thousand modules deep. The traversal is now iterative. (by @alexander-akait in #20993)Fix
NormalModuleFactoryparser/generator types: (by @alexander-akait in #20999)module.generator.htmlnow usesHtmlGeneratorOptionsinstead ofEmptyGeneratorOptions(theextractoption was hidden from thecreateGenerator/generatorhook types).webassembly/async,webassembly/sync) generator hooks now useEmptyGeneratorOptionsinstead ofEmptyParserOptions.NormalModuleFactory#getParser/createParser/getGenerator/createGeneratorare now generic over the module-type string, returning the specific parser/generator class for known types (e.g.JavascriptParserfor"javascript/auto",CssGeneratorfor"css", etc.) instead of always returning the baseParser/Generator.NormalModuleCreateDatais now generic over the module type soparser,parserOptions,generator, andgeneratorOptionsare narrowed to the specific class / options for the giventype.Link import bindings used inside
define(...)callbacks in ES modules. Previously,HarmonyDetectionParserPluginskipped walking the arguments ofdefinecalls in harmony modules, so references to imported bindings inside an inline AMDdefinefactory (e.g.define(function () { console.log(foo); })) were not rewritten to their imported references and could causeReferenceErrorat runtime. Inner graph usage analysis is also fixed for the related patternconst fn = function () { foo; }; define(fn);. (by @alexander-akait in #20990)HTML-entry pipeline (
experiments.html+experiments.css): emit<link rel="stylesheet">tags for CSS chunks reachable from a<script src>entry. Previously when the bundled JS imported CSS, the resulting.cssfile was emitted to disk but never referenced from the extracted HTML (no<link>tag), and whensplitChunksextracted CSS into sibling chunks the HTML cloned the originating<script>for each one — producing<script src="style.js">pointing at non-existent JS filenames instead of<link rel="stylesheet" href="style.css">. CSS chunks are now sorted by the entrypoint's module post-order index so the<link>tags also appear in source import order, fixing the cascade ordering issue documented inhtml-webpack-plugin#1838andwebpack/mini-css-extract-plugin#959for HTML-entry builds.nonce/crossorigin/referrerpolicyare copied from the originating tag onto the emitted<link>. (by @alexander-akait in #21002)Allow
devtoolandSourceMapDevToolPlugin(or multipleSourceMapDevToolPlugininstances) to coexist on the same asset. Previously the second instance would silently skip any asset whoseinfo.related.sourceMaphad already been set by an earlier instance, and even when it ran the asset had been rewrapped as aRawSourceso no source map could be recovered — producing an empty.mapfile. The plugin now keeps a per-compilation stash of pristine source maps, namespaces its persistent cache entries by the options that affect output, and appends additionalrelated.sourceMapentries instead of overwriting them. The classic workaround of pairingdevtool: 'hidden-source-map'with anew webpack.SourceMapDevToolPlugin({ filename: '[file].secondary.map', noSources: true })now produces both maps in a single build. (by @alexander-akait in #21001)Narrow
TemplatePathFncallback types by context.pathData.chunkis now non-optional for chunk filename callbacks (output.filename,chunkFilename,cssFilename,cssChunkFilename,htmlFilename,htmlChunkFilename,optimization.splitChunks.cacheGroups[*].filename), andpathData.moduleis non-optional for module filename callbacks (output.assetModuleFilename, per-modulegenerator.filename/generator.outputPath,module.parser.css.localIdentName). (by @alexander-akait in #20987)Tighten the
CreateDatatypedef inNormalModuleFactory.CreateDatanow represents the fully-populated value passed to thecreateModule,module, andcreateModuleClasshooks (NormalModuleCreateData & { settings: ModuleSettings }), whileResolveData.createDatais typed asPartial<CreateData>to reflect the empty initial state. Plugins tapping those hooks no longer need to cast individual fields away from optional. (by @alexander-akait in #20992)Stop
webpackPrefetch/webpackPreloadmagic comments from leaking acrossimport()call sites that share awebpackChunkName. When two imports targeted the same named chunk and only one of them setwebpackPrefetch: true, the prefetch directive was applied from every parent chunk that referenced the named chunk. Prefetch and preload orders are now resolved perimport()call site instead of from the shared chunk group's accumulated options. (by @alexander-akait in #20994)Fix
[fullhash:N]and[hash:N](with length suffix) inoutput.publicPathnot being interpolated at runtime. The detection regex inRuntimePluginonly matched[fullhash]/[hash]without a length suffix, so thePublicPathRuntimeModulewas not flagged as a full-hash module and__webpack_require__.pwas emitted with the placeholderXXXXleft in place (e.g.out/XXXX/) instead of the real hash truncated to the requested length. (by @alexander-akait in #21004)Re-export
ModuleNotFoundErrorfromwebpack/lib/ModuleNotFoundErrorfor backward compatibility with old plugins that import it from that path. This re-export will be removed in webpack 6. (by @alexander-akait in #20988)v5.107.0Compare Source
Minor Changes
Add
module.generator.javascript.anonymousDefaultExportNameoption to control whether webpack sets.nameto"default"for anonymous default export functions and classes per ES spec. Defaults totruefor applications andfalsefor libraries (whenoutput.libraryis set) to avoid unnecessary bundle size overhead. Also extract anonymous default export.namefix-up into a shared runtime helper (__webpack_require__.dn), replacing repeated inlineObject.defineProperty/Object.getOwnPropertyDescriptorcalls with a single short call per module to reduce output size. (by @xiaoxiaojx in #20894)Support module concatenation (scope hoisting) for CSS modules with
text,css-style-sheet,style, andlinkexport types (by @xiaoxiaojx in #20851)The
generator.exportsConventionfunction form for CSS modules now acceptsstring[]in addition tostring. (by @alexander-akait in #20914)Add
linkInserthook toCssLoadingRuntimeModule.getCompilationHooks(compilation)so plugin developers can control where stylesheet<link>elements are inserted into the document. (by @alexander-akait in #20947)Add
CssModulesPlugin.getCompilationHooks(compilation).orderModuleshook. (by @alexander-akait in #20978)Add a
pureparser option forcss/moduleandcss/autotypes matchingpostcss-modules-local-by-default's pure mode: every selector must contain at least one local class or id, otherwise webpack emits a build error. (by @alexander-akait in #20946)Support CSS Modules
@valueidentifiers as@importURLs and insideurl()functions, e.g.@value path: "./other.css"; @​import path;and@value bg: "./image.png"; .a { background: url(bg); }(by @alexander-akait in #20925)Add experimental TypeScript support via
experiments.typescript: true(auto-enabled byexperiments.futureDefaults). Uses Node.js's built-inmodule.stripTypeScriptTypes(Node.js >= 22.6 with the stablemode: "strip"API, including Node.js 26) to transform.ts,.cts,.mts,data:text/typescript, anddata:application/typescriptmodules — no type checking, only erasable TypeScript (types, generics,import type, casts)..tsx/JSX and non-erasable syntax (enum,namespace, parameter-property constructors, decorator metadata) are NOT supported; use a TSX-capable loader (e.g.ts-loader,swc-loader) for those. (by @alexander-akait in #20964)Added an
experiments.htmlflag that reserves thehtmlmodule type for the first-class HTML entry-point support. (by @aryanraj45 in #20902)Preserve
defer/sourceimport phase keywords on external dependencies in ESM output, the same way import attributes are preserved. (by @alexander-akait in #20934)Support the
#__NO_SIDE_EFFECTS__annotation to mark functions as pure for better tree-shaking. (by @hai-x in #20775)Add
module.generator.html.extractfor HTML modules and the matchingoutput.htmlFilename/output.htmlChunkFilenamefilename templates (defaults derived fromoutput.filename/output.chunkFilenamewith.jsswapped for.html, mirroring the CSS pipeline). When extraction is on, the parsed and URL-rewritten HTML is emitted as a standalone.htmloutput file alongside the module's JavaScript export. (by @alexander-akait in #20979)Add
"module-sync"to defaultconditionNamesfor resolver defaults to align with Node.js, which exposes themodule-synccommunity condition for synchronously-loadable ESM. (by @alexander-akait in #20933)Patch Changes
Fix CSS modules
composessocomposes: foo from "./self.module.css"from insideself.module.cssno longer creates a duplicate module instance. Fix CSS modulescomposesparsing solocal()andglobal()function wrappers are tracked per class name. Fix CSS modulescomposes: ... from "<file>"so the composed files load in an order consistent with every rule's local composes order, instead of source first-appearance order. (by @alexander-akait in #20929)Avoid emitting the
__webpack_require__runtime in CSS bundles when all imported CSS modules were concatenated into the same scope. (by @alexander-akait in #20936)Recompute the CSS chunk's
[contenthash]and the rendered CSS bytes when an asset referenced byurl()/src()/string in CSS changes its hashed filename. (by @alexander-akait in #20938)Embed an inline
sourceMappingURLdata URI inside the CSS when theparser.exportTypeoption aretext,style, orcss-style-sheet. Also merge@imported CSS at build time fortextandcss-style-sheetexportTypes so the bundle ships a single accurate inline source map covering every contributing file. Map each generated CSS-module class export line in the JS bundle back to its selector position in the original CSS file (e.g.btn: "..."→.btn { ... }). (by @alexander-akait in #20886)Fix CSS modules deduplication so a
.module.<ext>file imported both directly (JS) and via icss (composes from/:import) becomes a single module instance. (by @alexander-akait in #20929)Preserve
@charsetat-rule when CSS modules useexportType: "text". (by @alexander-akait in [Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.