chore(deps): bump the dependencies group with 5 updates by dependabot[bot] · Pull Request #2344 · webpack/webpack-dev-middleware

dependabot · 2026-07-01T10:33:21Z

Bumps the dependencies group with 5 updates:

Package	From	To
range-parser	`1.2.1`	`1.3.0`
@fastify/express	`4.0.6`	`4.0.7`
fastify	`5.8.5`	`5.9.0`
prettier	`3.8.4`	`3.9.4`
webpack	`5.107.2`	`5.108.3`

Updates range-parser from 1.2.1 to 1.3.0

Release notes

Sourced from range-parser's releases.

v1.3.0

Fixed

Improve number parsing (#58) eba9c7a

Handle invalid start and end byte positions in range parsing (#57) 269cb4e

jshttp/range-parser@v1.2.1...v1.3.0

Commits

f4bf173 Clamp a suffix whose length exceeds the representation (#66)
b49e00f fix: still show ranges if there are multiple ranges, even if some are invalid...
4f3b091 Remove dependabot config (#60)
eba9c7a Improve number parsing (#58)
269cb4e fix: handle invalid start and end byte positions in range parsing (#57)
098e332 build(deps): bump github/codeql-action from 3.31.2 to 4.31.6 (#50)
3599369 build(deps): bump actions/checkout from 3.6.0 to 6.0.0 (#51)
054ea57 build(deps): bump github/codeql-action from 2.23.2 to 4.31.2 (#48)
d230b16 build(deps): bump actions/upload-artifact from 3.1.3 to 5.0.0 (#49)
54f84f4 chore: add funding to package.json (#42)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for range-parser since your current version.

Updates @fastify/express from 4.0.6 to 4.0.7

Release notes

Sourced from @fastify/express's releases.

v4.0.7

⚠️ Security Release

Fix for GHSA-3wf5-7852-vcfq

What's Changed

chore: update depedabot setting by @climba03003 in fastify/fastify-express#193

chore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group by @dependabot[bot] in fastify/fastify-express#194

chore(package.json): fix delvedor's personal url by @Fdawgs in fastify/fastify-express#195

chore: replace http with https in urls by @Fdawgs in fastify/fastify-express#196

New Contributors

@climba03003 made their first contribution in fastify/fastify-express#193

Full Changelog: fastify/fastify-express@v4.0.6...v4.0.7

Commits

b40dfd4 Bumped v4.0.7
7be7196 Merge commit from fork
c6c8f20 chore: replace http with https in urls (#196)
7eed1b1 chore(package.json): fix delvedor's personal url
04ac488 chore: bump fastify-plugin from 5.1.0 to 6.0.0 in the dependencies group (#194)
087f1b2 chore: update depedabot setting
See full diff in compare view

Updates fastify from 5.8.5 to 5.9.0

Release notes

Sourced from fastify's releases.

v5.9.0

What's Changed

feat: add request.mediaType by @climba03003 in fastify/fastify#6653

docs: remove deprecated leveldb plugin and update ecosystem by @Tony133 in fastify/fastify#6661

chore(sponsor): add bestforandroid by @Eomm in fastify/fastify#6659

ci: drop Node.js 20 from yarn matrix in package-manager-ci.yml by @Tony133 in fastify/fastify#6662

fix: prevent duplicate res.end in sendTrailer with sync callbacks by @climba03003 in fastify/fastify#6676

fix: avoid duplicate closeIdleConnections call on native servers by @trivikr in fastify/fastify#6669

fix: error.code not present on some routing errors by @mcollina in fastify/fastify#6678

fix: correct isCustomSerializerCompiler flag check by @eddieran in fastify/fastify#6657

fix: validate invalid route logLevel at registration by @maxpetrusenko in fastify/fastify#6523

docs: update contribution rules by @Tony133 in fastify/fastify#6670

fix: use ContentType parser for response schema lookup by @UlisesGascon in fastify/fastify#6685

ci(ci): use shared quality workflow by @Fdawgs in fastify/fastify#6688

fix(types): allow request.getValidationFunction() to return undefined by @trivikr in fastify/fastify#6665

fix: do not trust forwarded host/proto when socket is missing by @mcollina in fastify/fastify#6684

perf: defer ContentType parsing in getSchemaSerializer until needed by @aquie00t in fastify/fastify#6692

perf: cache parsed ContentType objects in ContentTypeParser by @aquie00t in fastify/fastify#6694

perf: add typeof guard before toString.call in send and onSendEnd by @aquie00t in fastify/fastify#6693

chore: Bump pnpm/action-setup from 5.0.0 to 6.0.4 by @dependabot[bot] in fastify/fastify#6704

chore: Bump actions/github-script from 8 to 9 by @dependabot[bot] in fastify/fastify#6705

chore: Bump JustinBeckwith/linkinator-action from 2.4.0 to 2.4.2 by @dependabot[bot] in fastify/fastify#6706

docs: correct return503OnClosing comment in route.js by @mcollina in fastify/fastify#6712

fix: enable diagnostics tracking for async error handlers by @irzix in fastify/fastify#6458

fix: ignore duplicate trailer completions by @mcollina in fastify/fastify#6714

feat: add support of onMaxParamLength by @climba03003 in fastify/fastify#6716

chore: introduce TSTyche for type testing by @mrazauskas in fastify/fastify#6532

docs(reference): grammar and readability fixes by @Fdawgs in fastify/fastify#6710

chore: update depedabot setting by @climba03003 in fastify/fastify#6715

fix: include hint and docs URL in FSTWRN004 warning message by @aquie00t in fastify/fastify#6723

ci(ci): do not pass secrets to reusable workflow by @Fdawgs in fastify/fastify#6744

docs: add fastify-intlayer to ecosystem documentation by @aymericzip in fastify/fastify#6594

chore: Bump concurrently from 9.2.1 to 10.0.0 by @dependabot[bot] in fastify/fastify#6752

docs(Errors): fix incorrect usage of root fastify inside plugin scope by @Rpaudel379 in fastify/fastify#6731

ci: add node 26 to test matrices by @Fdawgs in fastify/fastify#6728

docs(Warnings): remove retired FSTWRN002 warning code by @leestana01 in fastify/fastify#6754

fix: chunk large HTTP/2 buffer replies by @mcollina in fastify/fastify#6746

chore: migrate type tests to TSTyche assertions (part one) by @mrazauskas in fastify/fastify#6726

chore: migrate type tests to TSTyche assertions (part two) by @mrazauskas in fastify/fastify#6727

docs: fix doubled braces in serializerCompiler signature by @DucMinhNe in fastify/fastify#6747

docs: remove HackerOne reporting link by @jhcpeixoto in fastify/fastify#6735

refactor(decorate): replace find with some in hasKey for correct boolean semantics by @aquie00t in fastify/fastify#6759

fix: replace AssertionError with FST_ERR_PLUGIN_DEPENDENCY_NOT_REGISTERED in checkDependencies by @aquie00t in fastify/fastify#6774

docs(ecosystem): add @inferdi/fastify by @maxrendel in fastify/fastify#6742

docs(typo): Write-Plugin.md by @zakirimadullahprogrammer-tech in fastify/fastify#6776

docs: fix duplicate anchor IDs causing broken TOC links by @AliMahmoudDev in fastify/fastify#6770

docs: add fastify-ata as a JSON Schema validator option by @mertcanaltin in fastify/fastify#6733

chore: rename type test files by @mrazauskas in fastify/fastify#6762

docs: update ajv-errors guidance by @Herrtian in fastify/fastify#6741

chore(warnings): correct duplicate 'not' typos in inline comments by @mixelburg in fastify/fastify#6713

... (truncated)

Commits

2e45a44 Bumped v5.9.0
630715d docs(types): mark request metadata accessors as untrusted input (#6572)
ff993e8 docs: update Serverless guide Dockerfile to a supported Node.js version (#6789)
458f104 docs: fix incorrect code examples in Hooks and Server reference (#6622)
ea454d0 docs: add warning about empty string coercion with nullable types (#6452)
121895b docs: migrate Zod type provider to official @fastify package (#6686)
cc8d9a3 fix: make hasRequestDecorator/hasReplyDecorator recognize constructor-assigne...
6e6be15 chore: Bump actions/checkout from 6 to 7 (#6812)
88bf134 chore: add new sponsor (#6813)
fabd964 chore: replace http with https in urls (#6809)
Additional commits viewable in compare view

Updates prettier from 3.8.4 to 3.9.4

Release notes

Sourced from prettier's releases.

3.9.4

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @fisker)

🔗 Changelog

3.9.3

Markdown: Fix unexpected removal of characters in liquid syntax (prettier/prettier#19489 by @seiyab)

TypeScript: Allow decorators to be used with declare on class fields (prettier/prettier#19492 by @evoactivity)

🔗 Changelog

3.9.1

CLI: Fix ignored file has been cached incorrectly (#19483 by @kovsu)

🔗 Changelog

3.9.0

diff

🔗 Prettier 3.9: Major parser upgrades and Formatting improvements

3.8.5

Fix Flow variance annotation print (#19022 by @marcoww6)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.4

diff

Angular: Format `@content(name)` -> `@content (name)` to align with other block syntax (#19499 by `@fisker`)

<!-- Input -->
<FancyButton [label]="title">
  @content (icon) {
    <span>Icon!</span>
  }
  @content (description) {
    <span>Description text</span>
  }
  <span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.3 -->
<FancyButton [label]="title">
@content(icon) {
<span>Icon!</span>
}
@content(description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>
<!-- Prettier 3.9.4 -->
<FancyButton [label]="title">
@content (icon) {
<span>Icon!</span>
}
@content (description) {
<span>Description text</span>
}
<span>Other children</span>
</FancyButton>

3.9.3

diff

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by `@seiyab`)

</tr></table>

... (truncated)

Commits

b693cb2 Release 3.9.4
2e92ac0 Angular: Format @content(name) -> @content (name) to align with other blo...
abed2c2 Bump Prettier dependency to 3.9.3
6cfbc00 Clean changelog_unreleased
3732e1d Release 3.9.3
a74a7b0 Allow decorators to be used with declare on class fields (#19492)
bd9e11a Correct text identification in liquid syntax (#19489)
269eee3 Bump Prettier dependency to 3.9.1
ec7ccd1 Clean changelog_unreleased
c47654c Release 3.9.1
Additional commits viewable in compare view

Updates webpack from 5.107.2 to 5.108.3

Release notes

Sourced from webpack's releases.

v5.108.3

Patch Changes

Speed up CSS parsing and reduce CSS AST node memory. (by @alexander-akait in #21285)

Fix HMR codegen crash for harmony accept with unresolved imports. (by @xiaoxiaojx in #21302)

Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @alexander-akait in #21303)

v5.108.2

Patch Changes

Fix lazy barrel deferral of ungrouped side-effect imports. (by @hai-x in #21291)

Respect the node: prefix for node.js core modules used as externals. (by @alexander-akait in #21286)

v5.108.1

Patch Changes

Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @xiaoxiaojx in #21280)

Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @alexander-akait in #21269)

v5.108.0

Minor Changes

Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @alexander-akait in #21218)

Add a bun target that emits ESM and externalizes bun:* and node.js built-in modules. (by @alexander-akait in #21248)

Support CommonJS reexports via Object.defineProperty value and getter descriptors. (by @alexander-akait in #21129)

Support JSON Schema const when generating CLI flags from a schema. (by @alexander-akait in #21087)

Support JSON Schema if/then/else when generating CLI flags from a schema. (by @alexander-akait in #21087)

Skip import specifiers, require() and import() calls in dead conditional branches gated by inlined imported constants (isDEV ? A : B), evaluated via getCondition. (by @hai-x in #21136)

CSS localIdentName [hash] now resolves to the local ident hash (matching css-loader); use [modulehash] for the module hash. (by @alexander-akait in #21259)

Add CSS parser as option and resolve url() inside HTML style attributes. (by @alexander-akait in #21157)

Add dedicated module classes for all built-in module types. (by @alexander-akait in #21164)

Support .html/.css for the default ./src entry under the html/css experiments. (by @alexander-akait in #21039)

Add defineConfig helper for typed configuration files. (by @alexander-akait in #21169)

Add a deno target (with versions, e.g. deno, deno2, deno1.40) that emits ESM, resolves node.js built-ins via the required node: specifier, and keeps Deno's own import protocols (npm:, jsr:, node:, http(s)://) external. (by @alexander-akait in #21247)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.108.3

Patch Changes

Speed up CSS parsing and reduce CSS AST node memory. (by @alexander-akait in #21285)

Fix HMR codegen crash for harmony accept with unresolved imports. (by @xiaoxiaojx in #21302)

Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @alexander-akait in #21303)

5.108.2

Patch Changes

Fix lazy barrel deferral of ungrouped side-effect imports. (by @hai-x in #21291)

Respect the node: prefix for node.js core modules used as externals. (by @alexander-akait in #21286)

5.108.1

Patch Changes

Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @xiaoxiaojx in #21280)

Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @alexander-akait in #21269)

5.108.0

Minor Changes

Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @alexander-akait in #21218)

Add a bun target that emits ESM and externalizes bun:* and node.js built-in modules. (by @alexander-akait in #21248)

Support CommonJS reexports via Object.defineProperty value and getter descriptors. (by @alexander-akait in #21129)

Support JSON Schema const when generating CLI flags from a schema. (by @alexander-akait in #21087)

Support JSON Schema if/then/else when generating CLI flags from a schema. (by @alexander-akait in #21087)

Skip import specifiers, require() and import() calls in dead conditional branches gated by inlined imported constants (isDEV ? A : B), evaluated via getCondition. (by @hai-x in #21136)

CSS localIdentName [hash] now resolves to the local ident hash (matching css-loader); use [modulehash] for the module hash. (by @alexander-akait in #21259)

Add CSS parser as option and resolve url() inside HTML style attributes. (by @alexander-akait in #21157)

Add dedicated module classes for all built-in module types. (by @alexander-akait in #21164)

Support .html/.css for the default ./src entry under the html/css experiments. (by @alexander-akait in #21039)

... (truncated)

Commits

6844305 chore(release): new release (#21304)
99286e2 fix: match harmony accept dependencies by module reference (#21303)
0abec4d fix: guard HarmonyAcceptDependency against unresolved module ids (#21302)
606712d perf(css): struct-of-arrays AST for the streaming CSS parser (#21285)
cf9c04e docs: update examples (#21293)
4dfe770 chore(release): new release (#21287)
7534a5e test: add defer import case for #19219 (#21292)
9857fc7 fix: lazy barrel for import with side effects (#21291)
54fa902 Respect the node: prefix for node.js core modules used as externals (#21286)
5e7db5d refactor: extract createHooksRegistry to deduplicate getCompilationHooks patt...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [range-parser](https://github.com/jshttp/range-parser) | `1.2.1` | `1.3.0` | | [@fastify/express](https://github.com/fastify/fastify-express) | `4.0.6` | `4.0.7` | | [fastify](https://github.com/fastify/fastify) | `5.8.5` | `5.9.0` | | [prettier](https://github.com/prettier/prettier) | `3.8.4` | `3.9.4` | | [webpack](https://github.com/webpack/webpack) | `5.107.2` | `5.108.3` | Updates `range-parser` from 1.2.1 to 1.3.0 - [Release notes](https://github.com/jshttp/range-parser/releases) - [Changelog](https://github.com/jshttp/range-parser/blob/master/HISTORY.md) - [Commits](jshttp/range-parser@v1.2.1...v1.3.0) Updates `@fastify/express` from 4.0.6 to 4.0.7 - [Release notes](https://github.com/fastify/fastify-express/releases) - [Commits](fastify/fastify-express@v4.0.6...v4.0.7) Updates `fastify` from 5.8.5 to 5.9.0 - [Release notes](https://github.com/fastify/fastify/releases) - [Commits](fastify/fastify@v5.8.5...v5.9.0) Updates `prettier` from 3.8.4 to 3.9.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.4...3.9.4) Updates `webpack` from 5.107.2 to 5.108.3 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.107.2...v5.108.3) --- updated-dependencies: - dependency-name: range-parser dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@fastify/express" dependency-version: 4.0.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: fastify dependency-version: 5.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: prettier dependency-version: 3.9.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: webpack dependency-version: 5.108.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-07-01T10:33:26Z

⚠️ No Changeset found

Latest commit: e57238f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 1, 2026

webpack Bot approved these changes Jul 1, 2026

View reviewed changes

webpack Bot enabled auto-merge (squash) July 1, 2026 10:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): bump the dependencies group with 5 updates#2344

chore(deps): bump the dependencies group with 5 updates#2344
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-f016fb096a

dependabot Bot commented on behalf of github Jul 1, 2026

Uh oh!

changeset-bot Bot commented Jul 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026

v1.3.0

v4.0.7

⚠️ Security Release

What's Changed

New Contributors

v5.9.0

What's Changed

3.9.4

3.9.3

3.9.1

3.9.0

3.8.5

3.9.4

Angular: Format @content(name) -> @content (name) to align with other block syntax (#19499 by @​fisker)

3.9.3

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by @​seiyab)

v5.108.3

Patch Changes

v5.108.2

Patch Changes

v5.108.1

Patch Changes

v5.108.0

Minor Changes

5.108.3

Patch Changes

5.108.2

Patch Changes

5.108.1

Patch Changes

5.108.0

Minor Changes

Uh oh!

changeset-bot Bot commented Jul 1, 2026

⚠️ No Changeset found

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Angular: Format `@content(name)` -> `@content (name)` to align with other block syntax (#19499 by `@fisker`)

Markdown: Fix unexpected removal of characters in liquid syntax (#19489 by `@seiyab`)