Bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #1 · Jonathancombs782/CopilotForXcode

dependabot · 2026-07-18T08:06:49Z

Bumps the npm_and_yarn group with 5 updates in the /Server directory:

Package	From	To
webpack	`5.99.9`	`5.108.4`
fast-uri	`3.0.6`	`3.1.3`
picomatch	`4.0.2`	`4.0.5`
postcss	`8.5.3`	`8.5.19`
serialize-javascript	`6.0.2`	`7.0.7`

Updates webpack from 5.99.9 to 5.108.4

Release notes

Sourced from webpack's releases.

v5.108.4

Patch Changes

Speed up non-CSS-Modules parsing by not building unused selector AST nodes. (by @alexander-akait in #21324)

Speed up non-CSS-Modules CSS parsing by dropping value tokens nothing reads. (by @alexander-akait in #21324)

Resolve HTML asset URLs against the document <base href>. (by @alexander-akait in #21329)

Add HTML integration tests: generateError output, ignored src, null-char parse. (by @aryanraj45 in #21328)

Reduce CPU and memory overhead of HTML and CSS parsing and code generation. (by @alexander-akait in #21332)

Reduce HTML parser memory and CPU by skipping unused AST nodes. (by @alexander-akait in #21323)

Reduce HTML parser memory by storing the AST in struct-of-arrays form. (by @alexander-akait in #21331)

Key the provided-exports cache on a lazy barrel's still-lazy re-export targets. (by @hai-x in #21326)

Default output.globalObject to globalThis for universal targets. (by @alexander-akait in #21314)

Pass through new URL(...) directory references instead of resolving them. (by @alexander-akait in #21312)

v5.108.3

Patch Changes

Speed up CSS parsing and reduce CSS AST node memory. (by @alexander-akait in #21285)

Fix HMR codegen crash for harmony accept with unresolved imports. (by @xiaoxiaojx in #21302)

Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @alexander-akait in #21303)

v5.108.2

Patch Changes

Fix lazy barrel deferral of ungrouped side-effect imports. (by @hai-x in #21291)

Respect the node: prefix for node.js core modules used as externals. (by @alexander-akait in #21286)

v5.108.1

Patch Changes

Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @xiaoxiaojx in #21280)

Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @alexander-akait in #21269)

v5.108.0

Minor Changes

Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @alexander-akait in #21218)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.108.4

Patch Changes

Speed up non-CSS-Modules parsing by not building unused selector AST nodes. (by @alexander-akait in #21324)

Speed up non-CSS-Modules CSS parsing by dropping value tokens nothing reads. (by @alexander-akait in #21324)

Resolve HTML asset URLs against the document <base href>. (by @alexander-akait in #21329)

Add HTML integration tests: generateError output, ignored src, null-char parse. (by @aryanraj45 in #21328)

Reduce CPU and memory overhead of HTML and CSS parsing and code generation. (by @alexander-akait in #21332)

Reduce HTML parser memory and CPU by skipping unused AST nodes. (by @alexander-akait in #21323)

Reduce HTML parser memory by storing the AST in struct-of-arrays form. (by @alexander-akait in #21331)

Key the provided-exports cache on a lazy barrel's still-lazy re-export targets. (by @hai-x in #21326)

Default output.globalObject to globalThis for universal targets. (by @alexander-akait in #21314)

Pass through new URL(...) directory references instead of resolving them. (by @alexander-akait in #21312)

5.108.3

Patch Changes

Speed up CSS parsing and reduce CSS AST node memory. (by @alexander-akait in #21285)

Fix HMR codegen crash for harmony accept with unresolved imports. (by @xiaoxiaojx in #21302)

Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @alexander-akait in #21303)

5.108.2

Patch Changes

Fix lazy barrel deferral of ungrouped side-effect imports. (by @hai-x in #21291)

Respect the node: prefix for node.js core modules used as externals. (by @alexander-akait in #21286)

5.108.1

Patch Changes

Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @xiaoxiaojx in #21280)

Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @alexander-akait in #21269)

... (truncated)

Commits

bb9ccfd chore(release): new release (#21319)
7639066 fix: invalidate provided-exports cache with lazy barrel (#21326)
ae28c54 perf: reduce CPU and memory overhead of the HTML and CSS pipelines (#21332)
e6fb547 perf: re-encode the HTML AST as struct-of-arrays behind a path-based visitor ...
5ce1c22 fix(html): resolve asset URLs against <base href> (#21329)
0e43c4a test(html): cover generateError, ignored-source, and null-character parse pat...
cebd793 refactor: build export-presence guards from a lazy boolean formula (#21320)
c2628cf fix: don't resolve new URL() directory references as modules (#21312)
00d8b2f perf: speed up non-CSS-Modules CSS parsing by skipping unused AST work (#21324)
f7a3f6d perf: reduce HTML parser memory and CPU with parser-level skip options (#21323)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.

Updates fast-uri from 3.0.6 to 3.1.3

Release notes

Sourced from fast-uri's releases.

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

Fix for GHSA-v39h-62p7-jpjc

What's Changed

Handle malformed fragment decoding as a parse error by @mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

Fix for GHSA-q3j6-qgpj-74h6

What's Changed

build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @dependabot[bot] in fastify/fast-uri#148

build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in fastify/fast-uri#149

chore(.npmrc): ignore scripts by @Fdawgs in fastify/fast-uri#150

build(deps-dev): remove @fastify/pre-commit by @Fdawgs in fastify/fast-uri#151

build(deps): bump actions/setup-node from 4 to 5 by @dependabot[bot] in fastify/fast-uri#152

ci(ci): add concurrency config by @Fdawgs in fastify/fast-uri#153

build(deps): bump actions/setup-node from 5 to 6 by @dependabot[bot] in fastify/fast-uri#154

build(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in fastify/fast-uri#156

chore(license): standardise license notice by @Fdawgs in fastify/fast-uri#159

style: remove trailing whitespace by @Fdawgs in fastify/fast-uri#161

ci: remove unused github files by @Tony133 in fastify/fast-uri#162

chore: update readme by @Tony133 in fastify/fast-uri#164

build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#165

build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @dependabot[bot] in fastify/fast-uri#166

build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @dependabot[bot] in fastify/fast-uri#167

ci: add lock-threads workflow by @Fdawgs in fastify/fast-uri#169

New Contributors

@Tony133 made their first contribution in fastify/fast-uri#162

Full Changelog: fastify/fast-uri@v3.1.0...v3.1.1

v3.1.0

What's Changed

ci: remove master branch support by @Fdawgs in fastify/fast-uri#126

chore(test) remove .gitkeep by @Fdawgs in fastify/fast-uri#128

... (truncated)

Commits

0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
919dd8e Bumped v3.1.2
c65ba57 fixup: linting
6c86c17 Merge commit from fork
a95158a Handle malformed fragment decoding without throwing (#171)
cea547c Bumped v3.1.1
876ce79 Merge commit from fork
dcdf690 ci: add lock-threads workflow (#169)
c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
Additional commits viewable in compare view

Updates picomatch from 4.0.2 to 4.0.5

Release notes

Sourced from picomatch's releases.

4.0.5

What's Changed

fix: preserve all branches when rewriting risky repeated extglobs by @MerlijnW70 in micromatch/picomatch#182

fix: honor the windows option when matching basenames by @MerlijnW70 in micromatch/picomatch#183

New Contributors

@MerlijnW70 made their first contribution in micromatch/picomatch#182

Full Changelog: micromatch/picomatch@4.0.4...4.0.5

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

4.0.3

What's Changed

fix: exception when glob pattern contains constructor by @Jason3S in micromatch/picomatch#144

New Contributors

@Jason3S made their first contribution in micromatch/picomatch#144

Full Changelog: micromatch/picomatch@4.0.2...4.0.3

Commits

4f41a8e 4.0.5
02cfc1b Update .verb.md and run verb to generate README documentation
cc52ff6 Only run the upload code coverage step for 1 matrix permutation
6d426d7 Allow workflow to continue if the code coverage step to fails
a00b954 Merge branch 'codeql-coverage'
9680381 Merge pull request #183 from MerlijnW70/fix/matchbase-windows-basename
648b4f2 Merge pull request #182 from MerlijnW70/fix/repeated-extglob-drops-branches
70e6485 Configure code coverage upload for CodeQL
ab8bc4d fix: honor the windows option when matching basenames
6289307 fix: preserve all branches when rewriting risky repeated extglobs
Additional commits viewable in compare view

Updates postcss from 8.5.3 to 8.5.19

Release notes

Sourced from postcss's releases.

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

8.5.8

Fixed Processor#version.

8.5.7

Improved source map annotation cleaning performance (by CodeAnt AI).

8.5.6

Fixed ContainerWithChildren type discriminating (by @Goodwine).

8.5.5

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

8.5.15

Fixed declaration parsing performance (by @homanp).

8.5.14

Fixed custom syntax regression (by @43081j).

8.5.13

Fixed postcss-scss commend regression.

8.5.12

Fixed reading any file via user-generated CSS.

Added opts.unsafeMap to disable checks.

8.5.11

Fixed nested brackets parsing performance (by @offset).

8.5.10

Fixed XSS via unescaped </style> in non-bundler cases (by @TharVid).

8.5.9

Speed up source map encoding paring in case of the error.

... (truncated)

Commits

9543b22 Release 8.5.19 version
3d13bf9 Fix CI on Windows too
00d0dd2 Keep explicitly set raws.before when inserting nodes into root (#2111)
7a05b33 Temporary fix CI
4c0d194 Release 8.5.18 version
92b4e78 Update dependencies
95663d3 Limit where source map can be loaded for security reasons
74e25ae Release 8.5.17 version
d1518af Fix Maximum call stack size exceeded error
2421312 Fix linter
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates serialize-javascript from 6.0.2 to 7.0.7

Release notes

Sourced from serialize-javascript's releases.

v7.0.7

What's Changed

fix: reject spoofed RegExp objects with non-string source property by @redonkulus in yahoo/serialize-javascript#222

release: v7.0.7 by @okuryu in yahoo/serialize-javascript#223

Full Changelog: yahoo/serialize-javascript@v7.0.6...v7.0.7

v7.0.6

What's Changed

build(deps-dev): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in yahoo/serialize-javascript#215

fix: reject spoofed URL objects with non-string toString() result by @redonkulus in yahoo/serialize-javascript#217

release: v7.0.6 by @okuryu in yahoo/serialize-javascript#221

Full Changelog: yahoo/serialize-javascript@v7.0.5...v7.0.6

v7.0.5

Fixes

Improve robustness and validation for array-like object serialization.

Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

What's Changed

release: v7.0.4 by @okuryu in yahoo/serialize-javascript#211

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207) 2e609d0

build(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#206) 42b7cdb

yahoo/serialize-javascript@v7.0.2...v7.0.3

v7.0.2

What's Changed

ci: bump GitHub Actions to latest versions by @okuryu in yahoo/serialize-javascript#203

ci: setup trusted publishing workflow by @okuryu in yahoo/serialize-javascript#204

release: v7.0.2 by @okuryu in yahoo/serialize-javascript#205

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

... (truncated)

Commits

01bec60 release: v7.0.7
5009715 fix: reject spoofed RegExp objects with non-string source property
153eb43 release: v7.0.6
a83d2cb fix: reject spoofed URL objects with non-string toString() result
451af65 build(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#215)
df3f1c1 release: v7.0.5
f147e90 Merge commit from fork
eec32e0 release: v7.0.4
d505715 7.0.3
2e609d0 fix(CVE-2020-7660): fix for RegExp.flags and Date.prototype.toISOString (#207)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serialize-javascript since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 5 updates in the /Server directory: | Package | From | To | | --- | --- | --- | | [webpack](https://github.com/webpack/webpack) | `5.99.9` | `5.108.4` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.0.6` | `3.1.3` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.2` | `4.0.5` | | [postcss](https://github.com/postcss/postcss) | `8.5.3` | `8.5.19` | | [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.2` | `7.0.7` | Updates `webpack` from 5.99.9 to 5.108.4 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.99.9...v5.108.4) Updates `fast-uri` from 3.0.6 to 3.1.3 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.0.6...v3.1.3) Updates `picomatch` from 4.0.2 to 4.0.5 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.2...4.0.5) Updates `postcss` from 8.5.3 to 8.5.19 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.3...8.5.19) Updates `serialize-javascript` from 6.0.2 to 7.0.7 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](yahoo/serialize-javascript@v6.0.2...v7.0.7) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.108.4 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.19 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: serialize-javascript dependency-version: 7.0.7 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-07-18T08:07:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
webpack@5.99.9 ⏵ 5.108.4	^-13	⁺²	⁺¹
copy-webpack-plugin@13.0.1 ⏵ 14.0.0	⁺¹
terser-webpack-plugin@5.3.14 ⏵ 5.6.1
ts-loader@9.5.4 ⏵ 9.6.2	⁺¹			^-1

View full report

socket-security · 2026-07-18T08:07:09Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `webpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Server/package-lock.json → `npm/webpack@5.108.4` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/webpack@5.108.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 18, 2026

Navigation Menu

Bump the npm_and_yarn group across 1 directory with 5 updates - #1

Bump the npm_and_yarn group across 1 directory with 5 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/Server/npm_and_yarn-56f7c89c0f

dependabot Bot commented on behalf of github Jul 18, 2026

Uh oh!

socket-security Bot commented Jul 18, 2026

Uh oh!

socket-security Bot commented Jul 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 18, 2026

v5.108.4

Patch Changes

v5.108.3

Patch Changes

v5.108.2

Patch Changes

v5.108.1

Patch Changes

v5.108.0

Minor Changes

5.108.4

Patch Changes

5.108.3

Patch Changes

5.108.2

Patch Changes

5.108.1

Patch Changes

v3.1.3

⚠️ Security Release

v3.1.2

⚠️ Security Release

What's Changed

v3.1.1

⚠️ Security Release

What's Changed

New Contributors

v3.1.0

What's Changed

4.0.5

What's Changed

New Contributors

4.0.4

What's Changed

4.0.3

What's Changed

New Contributors

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

8.5.8

8.5.7

8.5.6

8.5.5

8.5.19

8.5.18

8.5.17

8.5.16

8.5.15

8.5.14

8.5.13

8.5.12

8.5.11

8.5.10

8.5.9

v7.0.7

What's Changed

v7.0.6

What's Changed

v7.0.5

Fixes

v7.0.4

What's Changed

v7.0.3

v7.0.2

What's Changed

v7.0.1

Uh oh!

socket-security Bot commented Jul 18, 2026

Uh oh!