Skip to content

Bump the npm-dependencies group across 1 directory with 9 updates - #3996

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/components/dash-table/npm-dependencies-9b92f814c9
Open

Bump the npm-dependencies group across 1 directory with 9 updates#3996
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/components/dash-table/npm-dependencies-9b92f814c9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 9 updates in the /components/dash-table directory:

Package From To
@types/chai 4.3.20 5.2.3
@types/ramda 0.31.1 0.32.0
webpack-dev-server 5.2.6 6.0.0
@types/express 4.17.25 5.0.6
@types/express-serve-static-core 4.19.9 5.1.3
@types/node 22.20.3 26.6.2
@types/send 0.17.6 1.2.1
@types/serve-static 1.15.10 2.2.0
webpack-dev-middleware 7.4.6 8.3.0

Updates @types/chai from 4.3.20 to 5.2.3

Commits

Updates @types/ramda from 0.31.1 to 0.32.0

Commits

Updates webpack-dev-server from 5.2.6 to 6.0.0

Release notes

Sourced from webpack-dev-server's releases.

v6.0.0

Major Changes

  • Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @​bjohansebas in #5674)

  • Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0. (by @​bjohansebas in #5674)

  • Drop support for Node.js < 22.15.0. (by @​bjohansebas in #5674)

  • Convert the source to native ES modules. The package keeps "type": "module" and now exposes both an ESM and a CommonJS build via the exports field: ESM consumers import the native lib/, while CommonJS consumers require() a transpiled dist/ build, allowing the package to be consumed from both ESM and CommonJS without relying on require(ESM) for CommonJS consumers. (by @​bjohansebas in #5674)

  • Remove CLI flags. Use the serve command from webpack-cli together with a configuration file or the programmatic API instead. (by @​bjohansebas in #5674)

  • Remove the internalIP and internalIPSync static methods from Server. Resolve the local IP yourself if you need it. (by @​bjohansebas in #5674)

  • Remove the bypass option from proxy configuration. Use the router or context options provided by http-proxy-middleware instead. (by @​bjohansebas in #5674)

  • Remove SockJS support. The webSocketServer option no longer accepts "sockjs"; use the default "ws" transport instead. (by @​bjohansebas in #5674)

  • Remove the spdy dependency. Use the built-in node:http2 module via the server option for HTTP/2 support. (by @​bjohansebas in #5674)

  • Update http-proxy-middleware to v4. See the http-proxy-middleware v3 release notes and v4 release notes for the full list of breaking changes. (by @​bjohansebas in #5674)

  • Update webpack-dev-middleware to v8 and sync originalUrl for middleware compatibility. server.middleware.getFilenameFromUrl() is now asynchronous and resolves to { filename, extra: { stats, outputFileSystem } }. See the webpack-dev-middleware v8 release notes for details. (by @​bjohansebas in #5674)

Minor Changes

  • Add plugin support. webpack-dev-server can now be used as a webpack plugin, integrating with the compiler lifecycle without explicitly passing a compiler, preventing multiple server starts on recompilation, ensuring clean shutdown, and supporting MultiCompiler setups with multiple independent plugin servers. (by @​bjohansebas in #5674)

  • Enable the compression middleware for HTTP/2 connections. (by @​bjohansebas in #5674)

  • Remove the colorette dependency in favor of native ANSI styling. (by @​bjohansebas in #5674)

  • Update chokidar to v5 and extend watchFiles.options.ignored to support glob string patterns via tinyglobby. (by @​bjohansebas in #5674)

  • Use compiler.platform to determine the target environment instead of inspecting the resolved target string. Universal targets ("universal" or ["web", "node"], where compiler.platform.universal is true since webpack 5.108.0) are treated as web targets so the client runtime is injected. (by @​bjohansebas in #5674)

  • Use the WHATWG URL API instead of the deprecated url.parse. (by @​bjohansebas in #5674)

Patch Changes

  • Bump production dependencies, notably open to v11 and p-retry to v8. (by @​bjohansebas in #5674)

  • Reject cross-site requests to the internal open-editor and invalidate endpoints. They performed state-changing actions (opening a file in the editor, forcing a recompilation) on any GET request, so a page the developer visited could trigger them. They now require a same-origin request, validated via Sec-Fetch-Site with an Origin/Host fallback. (by @​bjohansebas in #5691)

  • Treat loopback aliases (127.0.0.1, ::1, localhost) as equivalent in isSameOrigin so the WebSocket client does not reject valid same-origin connections. (by @​bjohansebas in #5674)

  • Migrate the test suite from Jest to node:test and set up the jsdom environment. (by @​bjohansebas in #5674)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

6.0.0

Major Changes

  • Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @​bjohansebas in #5674)

  • Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0. (by @​bjohansebas in #5674)

  • Drop support for Node.js < 22.15.0. (by @​bjohansebas in #5674)

  • Convert the source to native ES modules. The package keeps "type": "module" and now exposes both an ESM and a CommonJS build via the exports field: ESM consumers import the native lib/, while CommonJS consumers require() a transpiled dist/ build — so the package works from both ESM and CommonJS, including environments where require(ESM) is not supported. (by @​bjohansebas in #5674)

  • Remove CLI flags. Use the serve command from webpack-cli together with a configuration file or the programmatic API instead. (by @​bjohansebas in #5674)

  • Remove the internalIP and internalIPSync static methods from Server. Resolve the local IP yourself if you need it. (by @​bjohansebas in #5674)

  • Remove the bypass option from proxy configuration. Use the router or context options provided by http-proxy-middleware instead. (by @​bjohansebas in #5674)

  • Remove SockJS support. The webSocketServer option no longer accepts "sockjs"; use the default "ws" transport instead. (by @​bjohansebas in #5674)

  • Remove the spdy dependency. Use the built-in node:http2 module via the server option for HTTP/2 support. (by @​bjohansebas in #5674)

  • Update http-proxy-middleware to v4. See the http-proxy-middleware v3 release notes and v4 release notes for the full list of breaking changes. (by @​bjohansebas in #5674)

  • Update webpack-dev-middleware to v8 and sync originalUrl for middleware compatibility. server.middleware.getFilenameFromUrl() is now asynchronous and resolves to { filename, extra: { stats, outputFileSystem } }. See the webpack-dev-middleware v8 release notes for details. (by @​bjohansebas in #5674)

Minor Changes

  • Add plugin support. webpack-dev-server can now be used as a webpack plugin, integrating with the compiler lifecycle without explicitly passing a compiler, preventing multiple server starts on recompilation, ensuring clean shutdown, and supporting MultiCompiler setups with multiple independent plugin servers. (by @​bjohansebas in #5674)

  • Enable the compression middleware for HTTP/2 connections. (by @​bjohansebas in #5674)

  • Remove the colorette dependency in favor of native ANSI styling. (by @​bjohansebas in #5674)

  • Update chokidar to v5 and extend watchFiles.options.ignored to support glob string patterns via tinyglobby. (by @​bjohansebas in #5674)

  • Use compiler.platform to determine the target environment instead of inspecting the resolved target string. Universal targets ("universal" or ["web", "node"], where compiler.platform.universal is true since webpack 5.108.0) are treated as web targets so the client runtime is injected. (by @​bjohansebas in #5674)

  • Use the WHATWG URL API instead of the deprecated url.parse. (by @​bjohansebas in #5674)

Patch Changes

  • Bump production dependencies, notably open to v11 and p-retry to v8. (by @​bjohansebas in #5674)

  • Reject cross-site requests to the internal open-editor and invalidate endpoints. They performed state-changing actions (opening a file in the editor, forcing a recompilation) on any GET request, so a page the developer visited could trigger them. They now require a same-origin request, validated via Sec-Fetch-Site with an Origin/Host fallback. (by @​bjohansebas in #5691)

  • Treat loopback aliases (127.0.0.1, ::1, localhost) as equivalent in isSameOrigin so the WebSocket client does not reject valid same-origin connections. (by @​bjohansebas in #5674)

  • Migrate the test suite from Jest to node:test and set up the jsdom environment. (by @​bjohansebas in #5674)

... (truncated)

Commits
  • 05cb792 chore(release): new release (#5692)
  • a451839 fix: handle middleware teardown in plugin mode (#5703)
  • c2d23a7 fix: load ESM-only dependencies with native import() in the CommonJS build (#...
  • ba54764 fix: reject cross-site requests to open-editor and invalidate endpoints (#5691)
  • 2b369b3 fixup!
  • 08a0ea7 fix: ensure undefined options default to an empty object in Server constructor
  • 797b9e7 fix: handle undefined options in Server constructor
  • e90221c feat: plugin support (#5650)
  • 4c351e1 feat: support universal platform as a web target (#5690)
  • 2236aa4 chore: update http-proxy-middleware to version 4.1.1 and add tests for pathRe...
  • Additional commits viewable in compare view

Updates @types/express from 4.17.25 to 5.0.6

Commits

Updates @types/express-serve-static-core from 4.19.9 to 5.1.3

Commits

Updates @types/node from 22.20.3 to 26.6.2

Commits

Updates @types/send from 0.17.6 to 1.2.1

Commits

Updates @types/serve-static from 1.15.10 to 2.2.0

Commits

Updates webpack-dev-middleware from 7.4.6 to 8.3.0

Release notes

Sourced from webpack-dev-middleware's releases.

v8.3.0

Minor Changes

  • Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @​bjohansebas in #2370)

  • Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @​alexander-akait in #2392)

Patch Changes

  • Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @​bjohansebas in #2378)

  • Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @​bjohansebas in #2404)

  • Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @​alexander-akait in #2396)

  • Update dependencies. (by @​alexander-akait in #2394)

v8.2.0

Minor Changes

  • Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @​bjohansebas in #2322)

v8.1.1

Patch Changes

  • Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @​bjohansebas in #2347)

v8.1.0

Minor Changes

  • Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @​bjohansebas in #2371)

v8.0.4

Patch Changes

  • Replace the on-finished dependency with Node.js built-in stream.finished. (by @​bjohansebas in #2346)

v8.0.3

Patch Changes

  • Respect req.url when modified by middleware such as connect-history-api-fallback. (by @​bjohansebas in #2304)

v8.0.2

Patch Changes

v8.0.1

Patch Changes

... (truncated)

Changelog

Sourced from webpack-dev-middleware's changelog.

8.3.0

Minor Changes

  • Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @​bjohansebas in #2370)

  • Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @​alexander-akait in #2392)

Patch Changes

  • Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @​bjohansebas in #2378)

  • Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @​bjohansebas in #2404)

  • Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @​alexander-akait in #2396)

  • Update dependencies. (by @​alexander-akait in #2394)

8.2.0

Minor Changes

  • Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @​bjohansebas in #2322)

8.1.1

Patch Changes

  • Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @​bjohansebas in #2347)

8.1.0

Minor Changes

  • Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @​bjohansebas in #2371)

8.0.4

Patch Changes

  • Replace the on-finished dependency with Node.js built-in stream.finished. (by @​bjohansebas in #2346)

8.0.3

Patch Changes

  • Respect req.url when modified by middleware such as connect-history-api-fallback. (by @​bjohansebas in #2304)

8.0.2

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
@github-actions

github-actions Bot commented Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Dash performance benchmarks

⚠️ regressions to review

scenario metric p90 (ms) median growth baseline p90 note
⚠️ full_children_replace replace_ms 5842.1 2126.5 19.26x 4697.1 1.3x baseline (norm)
✅ callback_chain chain_ms 548.7 514.8 1.0x 499.1
✅ callback_chain graph_ms 2.0 2.0 1.0x 2.4
✅ callback_fanout fanout_ms 105.4 81.6 0.83x 92.5
✅ deep_nesting render_ms 58.5 53.1 1.15x 56.8
✅ initial_render_large render_ms 578.8 542.2 1.01x 694.4
✅ initial_render_small render_ms 101.6 88.6 1.02x 104.0
✅ patch_append_nested append_ms 164.5 116.8 2.65x 192.3
✅ patch_append_toplevel append_ms 135.4 96.4 2.62x 140.2
✅ patch_scalar_update_large update_ms 181.8 172.1 0.91x 202.9
✅ wildcard_all_resolve wildcard_ms 299.9 288.0 0.96x 313.6
✅ wildcard_all_resolve graph_ms 1.1 1.1 1.0x 1.3

growth = late-third / early-third per-op time; ~1 is flat, a large value means the per-op cost scales with accumulated state.

machine scale vs baseline: 0.92x - divided out of the baseline ratios so they compare like for like (the absolute warn/fail ceilings are left un-scaled); calibrated on initial_render_small.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/components/dash-table/npm-dependencies-9b92f814c9 branch 2 times, most recently from 9fb74bf to f21ce65 Compare September 21, 2026 22:31
@dependabot
Bump the npm-dependencies group across 1 directory with 9 updates
008aaaf 
Bumps the npm-dependencies group with 9 updates in the /components/dash-table directory:

| Package | From | To |
| --- | --- | --- |
| [@types/chai](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/chai) | `4.3.20` | `5.2.3` |
| [@types/ramda](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ramda) | `0.31.1` | `0.32.0` |
| [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | `5.2.6` | `6.0.0` |
| [@types/express](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express) | `4.17.25` | `5.0.6` |
| [@types/express-serve-static-core](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/express-serve-static-core) | `4.19.9` | `5.1.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.20.3` | `26.6.2` |
| [@types/send](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/send) | `0.17.6` | `1.2.1` |
| [@types/serve-static](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/serve-static) | `1.15.10` | `2.2.0` |
| [webpack-dev-middleware](https://github.com/webpack/webpack-dev-middleware) | `7.4.6` | `8.3.0` |



Updates `@types/chai` from 4.3.20 to 5.2.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/chai)

Updates `@types/ramda` from 0.31.1 to 0.32.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ramda)

Updates `webpack-dev-server` from 5.2.6 to 6.0.0
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.2.6...v6.0.0)

Updates `@types/express` from 4.17.25 to 5.0.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express)

Updates `@types/express-serve-static-core` from 4.19.9 to 5.1.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/express-serve-static-core)

Updates `@types/node` from 22.20.3 to 26.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/send` from 0.17.6 to 1.2.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/send)

Updates `@types/serve-static` from 1.15.10 to 2.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/serve-static)

Updates `webpack-dev-middleware` from 7.4.6 to 8.3.0
- [Release notes](https://github.com/webpack/webpack-dev-middleware/releases)
- [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-middleware@v7.4.6...v8.3.0)

---
updated-dependencies:
- dependency-name: "@types/chai"
  dependency-version: 5.2.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@types/express"
  dependency-version: 5.0.6
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@types/express-serve-static-core"
  dependency-version: 5.1.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@types/ramda"
  dependency-version: 0.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: "@types/send"
  dependency-version: 1.2.1
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: "@types/serve-static"
  dependency-version: 2.2.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: webpack-dev-middleware
  dependency-version: 8.3.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
- dependency-name: webpack-dev-server
  dependency-version: 6.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/components/dash-table/npm-dependencies-9b92f814c9 branch from f21ce65 to 008aaaf Compare September 22, 2026 19:53
@sonarqubecloud

sonarqubecloud Bot commented Sep 22, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants