chore(deps): bump the dependencies group with 5 updates by dependabot[bot] · Pull Request #4879 · webpack/webpack-cli

dependabot · 2026-10-23T15:05:03Z

Bumps the dependencies group with 5 updates:

Package	From	To
eslint	`10.12.0`	`10.13.0`
webpack-dev-server	`6.0.0`	`6.1.0`
@inquirer/expand	`5.1.6`	`5.1.7`
@inquirer/select	`5.2.6`	`5.2.7`
ejs	`7.0.1`	`7.0.2`

Updates eslint from 10.12.0 to 10.13.0

Release notes

Sourced from eslint's releases.

v10.13.0

Features

48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)

a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)

66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

4783a68 docs: Update README (GitHub Actions Bot)

43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])

95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)

317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)

b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)

47b7063 chore: update dependency @eslint/json to ^2.1.1 (#21398) (renovate[bot])

e5aea41 chore: update ecosystem plugins (#21390) (ESLint Bot)

Commits

4637f98 10.13.0
96df05c Build: changelog update for 10.13.0
4783a68 docs: Update README
b59d889 chore: update github/codeql-action action to v4.38.3 (#21412)
95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410)
317fcb3 chore: update ecosystem plugins (#21409)
48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238)
43f0ac9 docs: clarify parameter description in getText (#21287)
a39d9fb feat: add globalThis to no-obj-calls (#21382)
b92decf perf: skip no-redeclare scan for single-declaration variables (#21365)
Additional commits viewable in compare view

Updates webpack-dev-server from 6.0.0 to 6.1.0

Release notes

Sourced from webpack-dev-server's releases.

v6.1.0

Minor Changes

Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @alexander-akait in #5765)

Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export BaseServer. (by @alexander-akait in #5739)

The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, allowedHosts and the origin checks still apply here, and this server's { type } messages are still sent next to the middleware's, so React Refresh keeps working. client/index.js, client/socket.js and client/clients/WebSocketClient.js still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. client.webSocketTransport: "sse" adds Server-Sent Events, a universal build now runs in Node without the client throwing, and sendMessage(), getClientEntry() and getClientHotEntry() still work, a subclass's overrides included, but are deprecated. (by @alexander-akait in #5750)

Patch Changes

Keep hot and live reload working after a cancelled "Leave site?" dialog. (by @alexander-akait in #5744)

Keep the overlay for a runtime error thrown while the page is still loading. (by @alexander-akait in #5745)

Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @UlisesGascon in cb1534a)

Validate options with a precompiled schema to cut ~115ms from startup. (by @alexander-akait in #5746)

Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @bjohansebas in #5771)

Changelog

Sourced from webpack-dev-server's changelog.

6.1.0

Minor Changes

Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @alexander-akait in #5765)

Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export BaseServer. (by @alexander-akait in #5739)

The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, allowedHosts and the origin checks still apply here, and this server's { type } messages are still sent next to the middleware's, so React Refresh keeps working. client/index.js, client/socket.js and client/clients/WebSocketClient.js still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. client.webSocketTransport: "sse" adds Server-Sent Events, a universal build now runs in Node without the client throwing, and sendMessage(), getClientEntry() and getClientHotEntry() still work, a subclass's overrides included, but are deprecated. (by @alexander-akait in #5750)

Patch Changes

Keep hot and live reload working after a cancelled "Leave site?" dialog. (by @alexander-akait in #5744)

Keep the overlay for a runtime error thrown while the page is still loading. (by @alexander-akait in #5745)

Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @UlisesGascon in cb1534a)

Validate options with a precompiled schema to cut ~115ms from startup. (by @alexander-akait in #5746)

Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @bjohansebas in #5771)

Commits

50f2c43 chore(release): new release (#5740)
807c441 fix: validate host headers and handle malformed editor URLs (#5771)
b4eb797 feat: run as a plugin from the top-level plugins of a multi-configuration (#5...
9915359 fix: update generated websocket proxy types (#5767)
cb1534a Merge commit from fork
be1ca90 chore(deps): bump the dependencies group across 1 directory with 19 updates (...
dc9a72c feat: run on webpack-dev-middleware's client, with compatibility kept here (#...
d16ad96 chore(deps): bump the dependencies group with 3 updates (#5762)
69077c9 chore(deps-dev): bump hono (#5756)
6a11ab1 chore(deps): bump the dependencies group across 1 directory with 4 updates (#...
Additional commits viewable in compare view

Updates @inquirer/expand from 5.1.6 to 5.1.7

Commits

ea3130e chore: Publish new release
3663711 chore: ignore test-only file changes in lerna versioning (#2319)
2faf5a2 fix(@inquirer/core): cancel pending initial render on cleanup (#2318)
af8b2c1 fix(number): treat whitespace-only input as empty (#2307)
754a1ad chore(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (#2316)
d5bb9ca chore(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#2315)
dc00e15 chore(deps): Bump github/codeql-action/init from 4.38.2 to 4.38.3 (#2314)
a9c11e5 chore(deps-dev): Bump turbo from 2.11.6 to 2.11.7 in the build group (#2313)
a68b220 chore(deps-dev): Bump the linting group with 5 updates (#2311)
46db96f chore(deps): Bump github/codeql-action/analyze from 4.38.2 to 4.38.3 (#2310)
Additional commits viewable in compare view

Updates @inquirer/select from 5.2.6 to 5.2.7

Commits

ea3130e chore: Publish new release
3663711 chore: ignore test-only file changes in lerna versioning (#2319)
2faf5a2 fix(@inquirer/core): cancel pending initial render on cleanup (#2318)
af8b2c1 fix(number): treat whitespace-only input as empty (#2307)
754a1ad chore(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (#2316)
d5bb9ca chore(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#2315)
dc00e15 chore(deps): Bump github/codeql-action/init from 4.38.2 to 4.38.3 (#2314)
a9c11e5 chore(deps-dev): Bump turbo from 2.11.6 to 2.11.7 in the build group (#2313)
a68b220 chore(deps-dev): Bump the linting group with 5 updates (#2311)
46db96f chore(deps): Bump github/codeql-action/analyze from 4.38.2 to 4.38.3 (#2310)
Additional commits viewable in compare view

Updates ejs from 7.0.1 to 7.0.2

Release notes

Sourced from ejs's releases.

v7.0.2

Version 7.0.2

Commits

539f158 Version 7.0.2
af616e4 Move release notes into notes/
9a22c75 Add release notes for v6 and v7
f66c5fe Correct whitespace docs for slurp tags and rmWhitespace
3e1e0ac Speed up template compilation by building tag strings once
16a9413 Escape literal <%% and %%> tags safely with custom delimiters
5131ac1 Treat null or undefined renderFile data as no data
fee8de0 Render an empty template returned by an includer
e451b12 Add CONTRIBUTING.md with a policy on AI-generated pull requests
17fae08 Fix ejs --help output: unrendered placeholders and wrong option docs
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.13.0` | | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `6.0.0` | `6.1.0` | | [@inquirer/expand](https://github.com/SBoudrias/Inquirer.js) | `5.1.6` | `5.1.7` | | [@inquirer/select](https://github.com/SBoudrias/Inquirer.js) | `5.2.6` | `5.2.7` | | [ejs](https://github.com/mde/ejs) | `7.0.1` | `7.0.2` | Updates `eslint` from 10.12.0 to 10.13.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.12.0...v10.13.0) Updates `webpack-dev-server` from 6.0.0 to 6.1.0 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v6.0.0...v6.1.0) Updates `@inquirer/expand` from 5.1.6 to 5.1.7 - [Release notes](https://github.com/SBoudrias/Inquirer.js/releases) - [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/expand@5.1.6...@inquirer/expand@5.1.7) Updates `@inquirer/select` from 5.2.6 to 5.2.7 - [Release notes](https://github.com/SBoudrias/Inquirer.js/releases) - [Commits](https://github.com/SBoudrias/Inquirer.js/compare/@inquirer/select@5.2.6...@inquirer/select@5.2.7) Updates `ejs` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v7.0.1...v7.0.2) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: webpack-dev-server dependency-version: 6.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@inquirer/expand" dependency-version: 5.1.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@inquirer/select" dependency-version: 5.2.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: ejs dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

changeset-bot · 2026-10-23T15:05:10Z

⚠️ No Changeset found

Latest commit: cb404be

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-10-23T15:05:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Maintenance
webpack-dev-server@6.0.0 ⏵ 6.1.0	⁺¹	^-6
ejs@7.0.1 ⏵ 7.0.2	⁺¹	⁺⁵
@inquirer/select@5.2.6 ⏵ 5.2.7
@inquirer/expand@5.1.6 ⏵ 5.1.7
eslint@10.12.0 ⏵ 10.13.0	⁺¹	⁺²

View full report

github-actions · 2026-10-23T15:30:28Z

This PR is packaged and the instant preview is available (cb404be).

Install it locally:

npm

npm i -D create-webpack-app@https://pkg.pr.new/create-webpack-app@cb404be webpack-cli@https://pkg.pr.new/webpack-cli@cb404be

yarn

yarn add -D create-webpack-app@https://pkg.pr.new/create-webpack-app@cb404be webpack-cli@https://pkg.pr.new/webpack-cli@cb404be

pnpm

pnpm add -D create-webpack-app@https://pkg.pr.new/create-webpack-app@cb404be webpack-cli@https://pkg.pr.new/webpack-cli@cb404be

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026

webpack Bot approved these changes Oct 23, 2026

View reviewed changes

webpack Bot enabled auto-merge (squash) October 23, 2026 15:30

Navigation Menu

Repository navigation

chore(deps): bump the dependencies group with 5 updates - #4879

chore(deps): bump the dependencies group with 5 updates#4879
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-d6facfe144

dependabot Bot commented on behalf of github Oct 23, 2026

Uh oh!

changeset-bot Bot commented Oct 23, 2026

Uh oh!

socket-security Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 23, 2026

v10.13.0

Features

Bug Fixes

Documentation

Chores

v6.1.0

Minor Changes

Patch Changes

6.1.0

Minor Changes

Patch Changes

v7.0.2

Uh oh!

changeset-bot Bot commented Oct 23, 2026

⚠️ No Changeset found

Uh oh!

socket-security Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants