Bump serialize-javascript and webpack by dependabot[bot] · Pull Request #625 · Venly/connect-sdk

dependabot · 2026-03-06T10:04:02Z

Removes serialize-javascript. It's no longer used after updating ancestor dependency webpack. These dependencies need to be updated together.

Removes serialize-javascript

Updates webpack from 4.47.0 to 5.105.4

Release notes

Sourced from webpack's releases.

v5.105.4

Patch Changes

Add Module.getSourceBasicTypes to distinguish basic source types and clarify how modules with non-basic source types like remote still produce JavaScript output. (by @xiaoxiaojx in #20546)

Handle createRequire in expressions. (by @alexander-akait in #20549)

Fixed types for multi stats. (by @alexander-akait in #20556)

Remove empty needless js output for normal css module. (by @JSerFeng in #20162)

Update enhanced-resolve to support new features for tsconfig.json. (by @alexander-akait in #20555)

Narrows export presence guard detection to explicit existence checks on namespace imports only, i.e. patterns like "x" in ns. (by @hai-x in #20561)

v5.105.3

Patch Changes

Context modules now handle rejections correctly. (by @alexander-akait in #20455)

Only mark asset modules as side-effect-free when experimental.futureDefaults is set to true, so asset-copying use cases (e.g. import "./x.png") won’t break unless the option is enabled. (by @hai-x in #20535)

Add the missing webpack_exports declaration in certain cases when bundling a JS entry together with non-JS entries (e.g., CSS entry or asset module entry). (by @hai-x in #20463)

Fixed HMR failure for CSS modules with @import when exportType !== "link". When exportType is not "link", CSS modules now behave like JavaScript modules and don't require special HMR handling, allowing @import CSS to work correctly during hot module replacement. (by @xiaoxiaojx in #20514)

Fixed an issue where empty JavaScript files were generated for CSS-only entry points. The code now correctly checks if entry modules have JavaScript source types before determining whether to generate a JS file. (by @xiaoxiaojx in #20454)

Do not crash when a referenced chunk is not a runtime chunk. (by @alexander-akait in #20461)

Fix some types. (by @alexander-akait in #20412)

Ensure that missing module error are thrown after the interception handler (if present), allowing module interception to customize the module factory. (by @hai-x in #20510)

Added createRequire support for ECMA modules. (by @stefanbinoj in #20497)

Added category for CJS reexport dependency to fix issues with ECMA modules. (by @hai-x in #20444)

Implement immutable bytes for bytes import attribute to match tc39 spec. (by @alexander-akait in #20481)

Fixed deterministic search for graph roots regardless of edge order. (by @veeceey in #20452)

v5.105.2

Patch Changes

Fixed WebpackPluginInstance type regression. (by @alexander-akait in #20440)

v5.105.1

Patch Changes

... (truncated)

Changelog

Sourced from webpack's changelog.

5.105.4

Patch Changes

Add Module.getSourceBasicTypes to distinguish basic source types and clarify how modules with non-basic source types like remote still produce JavaScript output. (by @xiaoxiaojx in #20546)

Handle createRequire in expressions. (by @alexander-akait in #20549)

Fixed types for multi stats. (by @alexander-akait in #20556)

Remove empty needless js output for normal css module. (by @JSerFeng in #20162)

Update enhanced-resolve to support new features for tsconfig.json. (by @alexander-akait in #20555)

Narrows export presence guard detection to explicit existence checks on namespace imports only, i.e. patterns like "x" in ns. (by @hai-x in #20561)

5.105.3

Patch Changes

Context modules now handle rejections correctly. (by @alexander-akait in #20455)

Only mark asset modules as side-effect-free when experimental.futureDefaults is set to true, so asset-copying use cases (e.g. import "./x.png") won’t break unless the option is enabled. (by @hai-x in #20535)

Add the missing webpack_exports declaration in certain cases when bundling a JS entry together with non-JS entries (e.g., CSS entry or asset module entry). (by @hai-x in #20463)

Fixed HMR failure for CSS modules with @import when exportType !== "link". When exportType is not "link", CSS modules now behave like JavaScript modules and don't require special HMR handling, allowing @import CSS to work correctly during hot module replacement. (by @xiaoxiaojx in #20514)

Fixed an issue where empty JavaScript files were generated for CSS-only entry points. The code now correctly checks if entry modules have JavaScript source types before determining whether to generate a JS file. (by @xiaoxiaojx in #20454)

Do not crash when a referenced chunk is not a runtime chunk. (by @alexander-akait in #20461)

Fix some types. (by @alexander-akait in #20412)

Ensure that missing module error are thrown after the interception handler (if present), allowing module interception to customize the module factory. (by @hai-x in #20510)

Added createRequire support for ECMA modules. (by @stefanbinoj in #20497)

Added category for CJS reexport dependency to fix issues with ECMA modules. (by @hai-x in #20444)

Implement immutable bytes for bytes import attribute to match tc39 spec. (by @alexander-akait in #20481)

Fixed deterministic search for graph roots regardless of edge order. (by @veeceey in #20452)

5.105.2

Patch Changes

Fixed WebpackPluginInstance type regression. (by @alexander-akait in #20440)

... (truncated)

Commits

27c13b4 chore(release): new release (#20550)
9b2f41e chore: bump terser plugin (#20569)
eafe060 fix: narrow the export presence guard detection (#20561)
75d605c refactor: add AppendOnlyStackedSet iteration support and tests (#20560)
afa607d refactor: remove unused code (#20562)
4098902 test: add source files for web-webworker and web-webworker-auto-public-path (...
f97be67 refactor: fix duplicated word in Compilation JSDoc (#20547)
9d76fff refactor: add Module.getSourceBasicTypes for basic JS type detection (#20546)
a3d7839 fix: types for multi stats (#20556)
b8e9b05 fix: update enhanced-resolve to support new features for tsconfig.json (#...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for webpack since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

nico-ptrs · 2026-04-07T07:39:11Z

@copilot rebase

Copilot · 2026-04-07T07:40:54Z

@copilot rebase

The branch is already rebased on top of the latest develop branch (commit bb2917ad). No conflicts exist — the PR has exactly 1 commit ahead of develop with the webpack/serialize-javascript changes.

nico-ptrs · 2026-04-07T11:04:21Z

@dependabot rebase

dependabot · 2026-04-07T11:04:25Z

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

nico-ptrs · 2026-04-07T11:04:47Z

@dependabot recreate

Removes [serialize-javascript](https://github.com/yahoo/serialize-javascript). It's no longer used after updating ancestor dependency [webpack](https://github.com/webpack/webpack). These dependencies need to be updated together. Removes `serialize-javascript` Updates `webpack` from 4.47.0 to 5.105.4 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v4.47.0...v5.105.4) --- updated-dependencies: - dependency-name: serialize-javascript dependency-version: dependency-type: indirect - dependency-name: webpack dependency-version: 5.105.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

nico-ptrs · 2026-04-07T12:30:57Z

@copilot the build (npm i) for this branch is failing, I think dependabot didn't update all the dependencies correctly. Can you have a look?

- Update webpack-cli from ^3.3.12 to ^5.1.4 (webpack-cli 3.x only supports webpack 4.x) - Update brace-expansion override from ^2.0.1 to ^2.0.3 (fixes moderate CVE) - Add picomatch override ^2.3.2 (fixes high CVE in transitive deps) - Add @types/eslint override ^8.56.12 (webpack 5 pulls in @types/eslint@9.x which requires TypeScript 4+, pinning to 8.x keeps compatibility with TypeScript 3.9) - Update webpack.config.js: switch from unmaintained awesome-typescript-loader to ts-loader, replace deprecated webpack 4 `query` property with `options` Agent-Logs-Url: https://github.com/Venly/connect-sdk/sessions/5fc89baa-ceef-4e1d-a49a-3c0b14530e84 Co-authored-by: nico-ptrs <11631532+nico-ptrs@users.noreply.github.com>

Copilot · 2026-04-07T12:38:55Z

@copilot the build (npm i) for this branch is failing, I think dependabot didn't update all the dependencies correctly. Can you have a look?

Fixed in commit a6d50f9. There were multiple issues with the webpack 5 upgrade:

npm i failure — webpack-cli@3.3.12 only supports webpack 4.x. Updated to webpack-cli@^5.1.4.
TypeScript compilation failure — webpack 5 pulls in @types/eslint@9.x as a transitive dependency, which requires TypeScript 4+. Added an override to pin @types/eslint to ^8.56.12.
Webpack config failure — webpack.config.js used awesome-typescript-loader with the deprecated query property (removed in webpack 5). Switched to ts-loader (already a devDependency) and updated to options.
Also fixed two CVEs in transitive deps: brace-expansion override updated to ^2.0.3 and added picomatch override ^2.3.2.

* bump develop version v2.11.0-SNAPSHOT.0 * Update develop to release version to avoid merge conflicts * Update develop version back to pre-merge state * task() - Bump qs from 6.14.0 to 6.14.1 (#621) Bumps [qs](https://github.com/ljharb/qs) from 6.14.0 to 6.14.1. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.0...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nico Peeters <11631532+nico-ptrs@users.noreply.github.com> * task() - Fix build * task() - Fix build * task() - Fix build * 2.11.0-develop.0 * Bump minimatch from 3.1.2 to 3.1.5 (#624) Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nico Peeters <11631532+nico-ptrs@users.noreply.github.com> * Bump handlebars from 4.7.8 to 4.7.9 (#626) Bumps [handlebars](https://github.com/handlebars-lang/handlebars.js) from 4.7.8 to 4.7.9. - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9) --- updated-dependencies: - dependency-name: handlebars dependency-version: 4.7.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nico Peeters <11631532+nico-ptrs@users.noreply.github.com> * Bump lodash from 4.17.21 to 4.18.1 (#627) Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nico Peeters <11631532+nico-ptrs@users.noreply.github.com> * Bump qs from 6.14.1 to 6.14.2 (#623) Bumps [qs](https://github.com/ljharb/qs) from 6.14.1 to 6.14.2. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.14.2) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nico Peeters <11631532+nico-ptrs@users.noreply.github.com> * task() - Fix build * Bump serialize-javascript and webpack (#625) * Bump serialize-javascript and webpack Removes [serialize-javascript](https://github.com/yahoo/serialize-javascript). It's no longer used after updating ancestor dependency [webpack](https://github.com/webpack/webpack). These dependencies need to be updated together. Removes `serialize-javascript` Updates `webpack` from 4.47.0 to 5.105.4 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v4.47.0...v5.105.4) --- updated-dependencies: - dependency-name: serialize-javascript dependency-version: dependency-type: indirect - dependency-name: webpack dependency-version: 5.105.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * Fix npm install and build failures for webpack 5 upgrade - Update webpack-cli from ^3.3.12 to ^5.1.4 (webpack-cli 3.x only supports webpack 4.x) - Update brace-expansion override from ^2.0.1 to ^2.0.3 (fixes moderate CVE) - Add picomatch override ^2.3.2 (fixes high CVE in transitive deps) - Add @types/eslint override ^8.56.12 (webpack 5 pulls in @types/eslint@9.x which requires TypeScript 4+, pinning to 8.x keeps compatibility with TypeScript 3.9) - Update webpack.config.js: switch from unmaintained awesome-typescript-loader to ts-loader, replace deprecated webpack 4 `query` property with `options` Agent-Logs-Url: https://github.com/Venly/connect-sdk/sessions/5fc89baa-ceef-4e1d-a49a-3c0b14530e84 Co-authored-by: nico-ptrs <11631532+nico-ptrs@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Nico Peeters <11631532+nico-ptrs@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> * 2.11.0-develop.1 * task() - Fix build * 2.11.0-develop.2 * task() - Fix build * 2.11.0-develop.3 * task() - Fix build * Bump fast-uri from 3.1.0 to 3.1.2 (#628) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.0...v3.1.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * 2.11.0-develop.4 * 2.11.0 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: BMVenly <BMVenly@venly.io> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: nico-ptrs <nico-ptrs@venly.io> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 6, 2026

Copilot started work on behalf of nico-ptrs April 7, 2026 07:39 View session

Copilot AI requested a review from nico-ptrs April 7, 2026 07:41

Copilot finished work on behalf of nico-ptrs April 7, 2026 07:42

nico-ptrs previously approved these changes Apr 7, 2026

View reviewed changes

dependabot Bot dismissed nico-ptrs’s stale review via 1bad0c5 April 7, 2026 11:05

dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-433ff03fb3 branch from 431d9b8 to 1bad0c5 Compare April 7, 2026 11:05

nico-ptrs previously approved these changes Apr 7, 2026

View reviewed changes

Merge branch 'develop' into dependabot/npm_and_yarn/multi-433ff03fb3

c9837f5

Copilot started work on behalf of nico-ptrs April 7, 2026 12:31 View session

Copilot AI dismissed nico-ptrs’s stale review via a6d50f9 April 7, 2026 12:37

nico-ptrs approved these changes Apr 7, 2026

View reviewed changes

Copilot finished work on behalf of nico-ptrs April 7, 2026 12:41

Copilot AI requested a review from nico-ptrs April 7, 2026 12:41

nico-ptrs approved these changes Apr 7, 2026

View reviewed changes

nico-ptrs merged commit 029f6d1 into develop Apr 7, 2026
5 checks passed

nico-ptrs deleted the dependabot/npm_and_yarn/multi-433ff03fb3 branch April 7, 2026 12:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump serialize-javascript and webpack#625

Bump serialize-javascript and webpack#625
nico-ptrs merged 3 commits into
developfrom
dependabot/npm_and_yarn/multi-433ff03fb3

dependabot Bot commented on behalf of github Mar 6, 2026 •

edited

Loading

Uh oh!

nico-ptrs commented Apr 7, 2026

Uh oh!

Copilot AI commented Apr 7, 2026

Uh oh!

nico-ptrs commented Apr 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 7, 2026

Uh oh!

nico-ptrs commented Apr 7, 2026

Uh oh!

nico-ptrs commented Apr 7, 2026

Uh oh!

Copilot AI commented Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.105.4

Patch Changes

v5.105.3

Patch Changes

v5.105.2

Patch Changes

v5.105.1

Patch Changes

5.105.4

Patch Changes

5.105.3

Patch Changes

5.105.2

Patch Changes

Uh oh!

nico-ptrs commented Apr 7, 2026

Uh oh!

Copilot AI commented Apr 7, 2026

Uh oh!

nico-ptrs commented Apr 7, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 7, 2026

Uh oh!

nico-ptrs commented Apr 7, 2026

Uh oh!

nico-ptrs commented Apr 7, 2026

Uh oh!

Copilot AI commented Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Mar 6, 2026 •

edited

Loading