chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #72 · rstackjs/rspack-dev-middleware

renovate · 2026-10-14T18:41:47Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@hono/node-server	`^2.1.1` → `^2.1.5`	devDependencies	patch
@jsonjoy.com/fs-core (source)	`4.79.0` → `4.80.0`	devDependencies	minor
@rspack/core (source)	`2.2.2` → `2.2.9`	devDependencies	patch
@types/node (source)	`^24.13.3` → `^24.19.2`	devDependencies	minor
cspell (source)	`^10.2.0` → `^10.3.6`	devDependencies	minor	`10.4.0`
express (source)	`^5.2.1` → `^5.3.0`	devDependencies	minor
hono (source)	`^4.13.5` → `^4.13.13`	devDependencies	patch
memfs	`4.79.0` → `4.80.0`	devDependencies	minor
node	`24.19.0` → `24.21.0`	uses-with	minor
pnpm (source)	`11.25.0` → `11.28.5`	packageManager	minor
pnpm/action-setup	`v6.0.10` → `v6.1.0`	action	minor
rstack (source)	`^0.7.1` → `^0.8.3`	devDependencies	minor	`0.8.4`
supertest	`^7.2.2` → `^7.3.1`	devDependencies	minor

Release Notes

honojs/node-server (@hono/node-server)

`v2.1.5`

Compare Source

What's Changed

fix(listener): abort the request signal when an HTTP/2 client resets the stream by @affanmomin in #404
fix(serve-static): only serve GET and HEAD requests by @usualoma in #405

New Contributors

@affanmomin made their first contribution in #404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

`v2.1.4`

Compare Source

What's Changed

chore: allow hono v5 as a peer dependency by @yusukebe in #406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

`v2.1.3`

Compare Source

Security fixes

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

`v2.1.2`

Compare Source

What's Changed

ci: add autofix.ci by @yusukebe in #392
fix: type error in early hints and add typecheck to CI by @BlankParticle in #390
chore: add better benchmarks by @BlankParticle in #391
docs(readme): update the benchmark by @yusukebe in #394
test(request): accept asynchronous body read errors by @usualoma in #403
fix(listener): avoid mutating response headers when setting Content-Length by @usualoma in #402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

streamich/memfs (@jsonjoy.com/fs-core)

`v4.80.0`

Compare Source

What's Changed

feat: allow configuring the synchronous FSA worker timeout by @Firatakti in #1298

New Contributors

@Firatakti made their first contribution in #1298

Full Changelog: streamich/memfs@v4.79.0...v4.80.0

web-infra-dev/rspack (@rspack/core)

`v2.2.9`

Compare Source

Highlights

Less duplicate code. Smaller bundles. 📦

Rspack's chunking algorithm has been improved to reduce duplicate modules across chunks. (#15885)

rspack-chunking.mp4

Smaller package size

Rspack upgrades browserslist-rs and enables deflate compression for its browser data, reducing native binary by 2.13 MB (3.08%). (#16009)

What's Changed

New Features 🎉

feat: propagate available module growth during code splitting by @JSerFeng in #15885

Performance 🚀

perf(binding): query compilation modules lazily by @SyMind in #15906
perf: avoid transferring unused NormalModuleFactory dependencies by @ahabhgk in #15931
perf(sources): compact retained source storage by @SyMind in #15944
perf(stats): cache item type strings in StatsFactory by @stormslowly in #15779
perf: use a hash set to deduplicate extracted comments by @CoderSerio in #15967
perf(watcher): avoid per-node concurrent sets in the root analyzer by @guru-irl in #15965
perf: share Module and KnownBuildInfo accessors by @LingyuCoder in #15883
perf: optimize placeholder and Node external matching by @intellild in #15808
perf(sources): profile allocations and trim source map capacity by @SyMind in #16014
perf(sources): release generated value after static source map by @SyMind in #16022
perf(core): cache assetEmitted source and content per info object by @guru-irl in #15963
perf(binding): share NormalModule accessors by @LingyuCoder in #16039
perf: share equal factorize path lists by content by @LingyuCoder in #16036
perf(split-chunks): reuse function chunks filter results per chunk set by @guru-irl in #15964
perf(binding): materialize module source maps lazily by @LingyuCoder in #15882
perf: share compilation log entry accessors by @LingyuCoder in #16052
perf(cache): restore cached modules off the make main task by @guru-irl in #16050
perf(core): share file counter dependency lists by interned content by @LingyuCoder in #16043

Bug Fixes 🐞

fix(types): allow void returns in needAdditionalPass hooks by @chenjiahan in #15908
fix(types): accept falsy loaders and child compiler plugins by @chenjiahan in #15912
fix(types): allow single loader returns from rule use functions by @chenjiahan in #15920
fix: preserve interned path sharing in cache serialize by @ahabhgk in #15910
fix(types): correct Compilation.getAsset return type by @chenjiahan in #15932
fix(binding): scope importModule publicPath callbacks to compiler by @chenjiahan in #15928
fix(binding): release transient TSFN callbacks by @SyMind in #15938
fix(types): allow omitting child compiler plugins by @chenjiahan in #15948
fix(css): load async stylesheets with a shared runtime by @intellild in #15869
fix(deps): upgrade lightningcss to 1.0.0-alpha.72 by @chenjiahan in #15991
fix: propagate async status through lazy barrel re-exports by @dmchoi77 in #15905
fix(copy): register a missing glob base dir as a missing dependency by @BleedingDev in #15901
fix(css): end unterminated url() at EOF as a url token by @IShinji in #15911
fix: preserve statement boundaries in modern-module output by @LingyuCoder in #16008
fix(ids): rehash identical keys in compact-hashed ids by @n0th1ng-else in #15915
fix(deps): upgrade swc_core to 82.0.0 by @LingyuCoder in #16009
fix: resolve aliases in import.meta.glob patterns by @aryan1306 in #15898
fix: only source map JS and CSS assets from devtool, matching webpack by @Paca-Vaca in #16018
fix: support deferred imports introduced by hot updates by @LingyuCoder in #16015
fix: concatenate empty CommonJS modules without export access by @JSerFeng in #15913
fix(core): ignore source map directives in JavaScript strings by @Tiancheng-Xu in #15969
fix(css-extract): preserve relative paths from publicPath callbacks by @chenjiahan in #15923
fix(lazy-compilation): keep import attributes and phase when building activated modules by @stormslowly in #16023
fix(lazy-compilation): keep activated modules across rebuilds by @stormslowly in #15134
fix(lazy-compilation): keep issuer and resolve options when building activated modules by @stormslowly in #16024
fix(watcher): report watched files inside directories that appear by @guru-irl in #15966
fix(mf): honor singleton options for shared prefixes in manifests by @LingyuCoder in #16012
fix(watcher): report recreated files by their final state by @guru-irl in #16040
fix: preserve pure exports during module concatenation by @LingyuCoder in #16053
fix(resolver): keep RegExp restrictions in ResolverFactory cache key by @stormslowly in #16054

Document 📖

docs: use synchronous tap in getStats example by @chenjiahan in #15981
docs: fix CopyRspackPlugin patterns example by @chenjiahan in #15982
docs: mark asynchronous compiler hook callbacks async by @chenjiahan in #15983
docs: fix asset name in processAssets example by @chenjiahan in #15985
docs: avoid duplicate declarations in resolver example by @chenjiahan in #15987
docs: use supported compilation hooks in examples by @chenjiahan in #15984
docs: clarify source map asset filtering by @chenjiahan in #15990
docs: define RuntimeGlobals in addRuntimeModule example by @chenjiahan in #15986
docs: register run examples on the run hook by @chenjiahan in #15989
docs: await module rebuilds in finishModules example by @chenjiahan in #15988
docs: clarify emitAsset filename conflicts by @chenjiahan in #15992
docs: fix statsNormalize option assignment by @chenjiahan in #15994
docs: document compilation hook factory parameters by @chenjiahan in #15998
docs: document ignoring requests in afterResolve by @chenjiahan in #16001
docs: call the runtime hash getter in example by @chenjiahan in #15996
docs: clarify compilation hash properties by @chenjiahan in #15995
docs: document compile hook parameters by @chenjiahan in #15997
docs: document resolveForScheme hook map and return value by @chenjiahan in #16000
docs: correct statsPreset hook map type by @chenjiahan in #15999
docs: clarify child compiler inheritance by @chenjiahan in #15993
docs: improve page descriptions for documentation discovery by @chenjiahan in #16004
docs: clarify target defaults and Lightning CSS inheritance by @intellild in #15546
docs: add RomeOS to homepage users by @chenjiahan in #16056
docs: document SWC loader reactCompiler option by @chenjiahan in #16060
docs: clarify Rspack-specific SWC loader options by @chenjiahan in #16062
docs: fix missing imports and variables in config examples by @chenjiahan in #16063
docs: fix SWC examples and simplify isolatedModules guidance by @chenjiahan in #16064

Other Changes

test: migrate more configurations to TypeScript by @chenjiahan in #15919
test: migrate nine more configurations to TypeScript by @chenjiahan in #15925
test: migrate persistent caching example to TypeScript by @chenjiahan in #15937
chore(deps): update rust crate swc_config to 6.0.1 by @renovate[bot] in #15954
chore(deps): update dependency @shikijs/transformers to ^4.5.0 by @renovate[bot] in #15956
chore(deps): update dependency enhanced-resolve to v5.26.0 by @renovate[bot] in #15957
chore(deps): update dependency memfs to v4.80.0 by @renovate[bot] in #15958
chore(deps): update patch npm dependencies by @renovate[bot] in #15953
chore(deps): update dependency playwright to v1.63.0 by @renovate[bot] in #15959
chore(deps): update rust crate xxhash-rust to v0.8.16 [security] by @renovate[bot] in #15961
chore(deps): update github-actions by @renovate[bot] in #15976
chore(deps): update patch npm dependencies by @renovate[bot] in #15971
chore(deps): update dependency ws to ^8.22.0 by @renovate[bot] in #15975
chore(deps): update dependency tinypool to ^2.2.0 by @renovate[bot] in #15973
chore(deps): update dependency mermaid to ^12.1.0 by @renovate[bot] in #15972
chore(deps): update dependency webpack-sources to v3.6.0 by @renovate[bot] in #15974
chore(deps): update patch crates by @renovate[bot] in #15645
chore(deps): upgrade winnow to v1 by @chenjiahan in #16003
chore(deps): update Rstest to ^0.12.3 by @renovate[bot] in #16033
chore(deps): update pnpm to v11.28.5 by @renovate[bot] in #16032
chore(deps): update rust crate async-recursion to 1.2.0 by @renovate[bot] in #16034
chore(ci): align Dylint with the project Rust toolchain by @intellild in #16042
chore: disable resolve cache by default for new cache by @ahabhgk in #16055
chore(deps): upgrade rstack to v0.8.3 by @chenjiahan in #16059

New Contributors

@dmchoi77 made their first contribution in #15905
@IShinji made their first contribution in #15911
@aryan1306 made their first contribution in #15898
@Paca-Vaca made their first contribution in #16018
@Tiancheng-Xu made their first contribution in #15969

Full Changelog: web-infra-dev/rspack@v2.2.8...v2.2.9

`v2.2.8`

Compare Source

What's Changed

New Features 🎉

feat: support JavaScript URL entries with factory type probes by @intellild in #15666
feat: resolver cache in the new cache system by @ahabhgk in #15839

Performance 🚀

perf(core): box optional match resource data by @chenjiahan in #15831
perf: reduce exports info and parser memory footprint by @LingyuCoder in #15821
perf(core): box optional RSC metadata by @chenjiahan in #15837
perf(concatenated): store binding references as indices by @LingyuCoder in #15834
perf: reuse compilation dependency arrays and strings by @SyMind in #15763
perf(core): box import attributes by @chenjiahan in #15844
perf(core): shrink dependency location storage by @chenjiahan in #15849
perf(core): store module requests as boxed strings by @chenjiahan in #15856
perf: reduce retained dependency and source capacity by @LingyuCoder in #15854
perf(javascript): share the used-by-exports payload of a dependency by @LingyuCoder in #15851
perf: skip unused code splitting cache copies by @JSerFeng in #15867
perf(stats): release handles per module while converting stats to JS by @stormslowly in #15788

Bug Fixes 🐞

fix(types): allow void context module waterfall callbacks by @chenjiahan in #15832
fix: revert "feat: support JavaScript URL entries with factory type probes" by @intellild in #15840
fix: preserve deferred evaluation in modern-module output by @JSerFeng in #15846
fix(resolve): resolve relative tsconfig paths against cwd by @intellild in #15713
fix(rstest): resolve mock APIs through the runtime registry by @9aoy in #15823
fix: interrupt compaction at cache shutdown by @ahabhgk in #15850
fix(types): make SharePlugin enhanced option optional by @chenjiahan in #15855
fix(types): align externals function signatures by @chenjiahan in #15857
fix(types): correct externals resolver overloads by @chenjiahan in #15863
fix: reset MultiCompiler done state on watch restart by @chenjiahan in #15865
fix(types): allow unnamed module federation consumers by @chenjiahan in #15868
fix: require a name for shared dependency tree shaking by @chenjiahan in #15872
fix(types): allow stats printer hooks to return void by @chenjiahan in #15874
fix(types): support custom stats fields in extract hooks by @chenjiahan in #15880
fix(types): allow shouldEmit hooks to return void by @chenjiahan in #15881
fix(types): allow Node fs as intermediate file system by @chenjiahan in #15895
fix(types): accept entry dependencies in ModuleGraph queries by @chenjiahan in #15896
fix(cli): enable compile cache before loading CLI by @chenjiahan in #15903
fix: respect CI=false and skip compile cache in CI by @chenjiahan in #15904
fix(rstest): transform non-hoisted mock APIs in expression position by @fi3ework in #15877
fix: avoid retaining source copies in RealContentHash by @JSerFeng in #15902
fix(loader): avoid mutating lightningcss-loader options by @tiagovilasboas in #15900
fix(loader): normalize builtin options for inline requests by @SoonIter in #15909

Document 📖

docs: clarify externals usage and consolidate function reference by @chenjiahan in #15866

Other Changes

chore(deps): upgrade Rstack to 0.8.0 by @SoonIter in #15838
chore(test): migrate 60 more configs to TypeScript by @chenjiahan in #15836
test: migrate 47 more configs to TypeScript by @chenjiahan in #15843
chore(test): migrate 20 cache and callback configs to TypeScript by @chenjiahan in #15852
chore(deps): update dependency memfs to v4.79.0 by @renovate[bot] in #15891
chore(deps): update rust crate swc_ecma_minifier to 61.0.9 by @renovate[bot] in #15890
chore(deps): update patch npm dependencies by @renovate[bot] in #15889
chore(deps): update dependency webpack-sources to v3.5.3 by @renovate[bot] in #15888
test: migrate HTTP integrity configuration to TypeScript by @chenjiahan in #15892
test: migrate five configurations to TypeScript by @chenjiahan in #15893

New Contributors

@tiagovilasboas made their first contribution in #15900

Full Changelog: web-infra-dev/rspack@v2.2.7...v2.2.8

`v2.2.7`

Compare Source

Highlights

Smaller bundles with improved code splitting

The new optimization.splitChunks.dedupDepth option lets Rspack spend more build time finding shared code and reducing duplication, giving you more control over the balance between bundle size and build time. In one application with many routes, this option reduced total output size by 9.9%.

It defaults to 1 in production and 0 in development. #15497

Build performance improvements

This release reduces repeated work and allocations during chunk graph construction and CSS Modules class name generation. JavaScript loaders also avoid copying their input content on each invocation, further reducing processing overhead.

Optimize chunk graph construction: #15278, #15805.
Reuse metadata and template values when generating CSS Modules class names: #15783, #15804.
Avoid cloning JavaScript loader content: #15817.

What's Changed

New Features 🎉

feat(split-chunks): add configurable dedupDepth by @JSerFeng in #15497
feat: file system info path classification by @ahabhgk in #15752
feat: support nested async dependency blocks by @intellild in #15741
feat: cache context modules with filesystem snapshots by @ahabhgk in #15790

Performance 🚀

perf: reduce build chunk graph overhead by @LingyuCoder in #15278
perf(css): avoid rebuilding local ident metadata per class name by @LingyuCoder in #15783
perf(resolver): memoize the interned package.json path by @LingyuCoder in #15797
perf(css): cache invariant local ident rendering values by @intellild in #15804
perf: store runtime keys as SmolStr by @intellild in #15807
perf: reduce build chunk graph code splitter overhead by @LingyuCoder in #15805
perf(css-extract): avoid per-loader configuration callbacks by @chenjiahan in #15812
perf(loader): avoid cloning JS loader content by @SyMind in #15817
perf(core): reuse module identifier for identical requests by @chenjiahan in #15820
perf(loader): statically import worker_threads by @chenjiahan in #15825
perf(core): reuse resource string for identical user requests by @chenjiahan in #15827

Bug Fixes 🐞

fix: keep shadowing exports bindings in nested runtime deconfliction by @LingyuCoder in #15742
fix(binding): release loader TSFNs on compiler close by @SyMind in #15735
fix: render CommonJS externals directly in modern-module output by @JSerFeng in #15238
fix: skip entry modules without JavaScript in the chunk startup by @cezaraugusto in #15767
fix(html): keep the doctype when a comment is above it by @LingyuCoder in #15778
fix(types): allow RslibPlugin without options by @chenjiahan in #15801
fix: ignore fragment-only CSS URL dependencies by @intellild in #15800
fix(bench): exclude compiler teardown from runtime requirements by @intellild in #15813
fix(types): declare code generation Sources.get and migrate configs by @chenjiahan in #15814
fix(types): allow RegExp resolve restrictions and migrate configs by @chenjiahan in #15819
fix(cli): initialize profiling once for multiple configs by @chenjiahan in #15829

Document 📖

docs: remove redundant CLAUDE.md setup tip by @chenjiahan in #15815
docs: clarify default parallel loader worker count by @chenjiahan in #15824

Other Changes

test: migrate inner-graph and HTTP test helpers to ESM by @chenjiahan in #15748
test: migrate common test loaders to ESM by @chenjiahan in #15751
ci: print ecosystem benchmark repository commit by @SyMind in #15746
test: migrate test loaders, helpers and plugins to ESM by @chenjiahan in #15753
test: migrate stateful and diagnostic loaders to ESM by @chenjiahan in #15758
chore: add CLAUDE.md that imports AGENTS.md by @stormslowly in #15760
test: support TypeScript case configurations by @chenjiahan in #15761
chore(deps): upgrade Rstack to 0.7.6 and Rstest to 0.12 by @chenjiahan in #15762
test: type-check case configs and migrate simple configs to TypeScript by @chenjiahan in #15765
chore(deps): update dependency enhanced-resolve to v5.25.1 by @renovate[bot] in #15771
test: migrate case configs to TypeScript (batch 1) by @chenjiahan in #15774
test: migrate case configs to TypeScript (batch 2) by @chenjiahan in #15775
test: migrate case configs to TypeScript (batch 3) by @chenjiahan in #15776
test: migrate case configs to TypeScript (batch 4) by @chenjiahan in #15777
chore(deps): update patch npm dependencies by @renovate[bot] in #15769
chore(deps): update dependency jsdom to ^30.1.0 by @renovate[bot] in #15772
test: migrate more case configs to TypeScript by @chenjiahan in #15787
chore: remove redundant CLAUDE.md by @chenjiahan in #15791
test: migrate 32 configs to TypeScript and normalize spacing by @chenjiahan in #15789
chore(deps): upgrade lite-tapable to v1.2.0 by @chenjiahan in #15794
test: migrate 77 configs and clean helpers to TypeScript by @chenjiahan in #15795
test: migrate 61 configs and four helpers to TypeScript by @chenjiahan in #15803
test: migrate more configs to TypeScript by @chenjiahan in #15806
test: migrate more configs and helpers to TypeScript by @chenjiahan in #15811

Full Changelog: web-infra-dev/rspack@v2.2.6...v2.2.7

`v2.2.6`

Compare Source

What's Changed

New Features 🎉

feat(loader): support buildInfo custom fields in parallel loaders by @stormslowly in #15629

Performance 🚀

perf: streamline SplitChunks candidate preparation by @JSerFeng in #15691
perf(loader): track loader dependencies with sets by @stormslowly in #15659
perf(watch): defer internal Watchpack timestamp collection by @LingyuCoder in #15686
perf: replace BigUint with FixedBitSet in code splitter by @SyMind in #15712
perf: use SsoHashSet for small module chunk memberships by @SyMind in #15731
perf: vectorize CSS string and URL scanning with memchr by @LingyuCoder in #15738

Bug Fixes 🐞

fix: retain mf manifest expose assets shared with providers by @LingyuCoder in #15700
fix(core): make module source maps context independent by @SyMind in #15671
fix(loader): revert native loader hook invocation by @intellild in #15719

Document 📖

docs: update hyfdev profile links by @hyfdev-agent in #15729

Other Changes

test: make @rspack/test-tools a dual package by @chenjiahan in #15698
test: migrate basic test entry points to ESM by @chenjiahan in [#15701](https://redirect.github.com/web-infra-dev/rspack/pull

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- Between 12:00 AM and 03:59 AM, on day 1 and 15 of the month (* 0-3 1,15 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): update all non-major dependencies

8caca5c

renovate Bot merged commit 05cc4b0 into main Oct 14, 2026
6 checks passed

renovate Bot deleted the renovate/all-minor-patch branch October 14, 2026 21:27

Navigation Menu

Repository navigation

chore(deps): update all non-major dependencies - #72

chore(deps): update all non-major dependencies#72
renovate[bot] merged 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

What's Changed

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

What's Changed

What's Changed

New Contributors

Highlights

Less duplicate code. Smaller bundles. 📦

Smaller package size

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

Document 📖

Other Changes

New Contributors

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

Document 📖

Other Changes

New Contributors

Highlights

Smaller bundles with improved code splitting

Build performance improvements

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

Document 📖

Other Changes

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

Document 📖

Other Changes

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Oct 14, 2026 •

edited

Loading

`serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths