Update all

[renovate[bot]]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@rollup/plugin-replace (source)	5.0.5 -> 5.0.7					devDependencies	patch
@types/node (source)	18.19.22 -> 18.19.86					devDependencies	patch
acorn	8.11.3 -> 8.14.1					devDependencies	minor
acorn-walk	8.3.2 -> 8.3.4					devDependencies	patch
babel-loader	9.1.3 -> 9.2.1					devDependencies	minor
css-loader	6.10.0 -> 6.11.0					devDependencies	minor
magic-string	0.30.8 -> 0.30.17					devDependencies	patch
mini-css-extract-plugin	2.8.1 -> 2.9.2					devDependencies	minor
node (source)	18.19.1 -> 18.20.8					volta	minor
preact (source)	10.19.6 -> 10.26.5					dependencies	minor
prettier (source)	3.2.5 -> 3.5.3					devDependencies	minor
rimraf	5.0.5 -> 5.0.10					devDependencies	patch
rollup-plugin-terser	7.0.2 -> 0.1.0					devDependencies	replacement
shx	0.3.4 -> 0.4.0					devDependencies	minor
typescript (source)	5.4.2 -> 5.8.3					devDependencies	minor

This is a special PR that replaces rollup-plugin-terser with the community suggested minimal stable replacement version.

---

Release Notes

rollup/plugins (@​rollup/plugin-replace)

v5.0.7

2024-06-05

Bugfixes

• fix: add missing sourceMap documentation (#​1698)

v5.0.6

2024-06-05

Bugfixes

• fix: ternary operator replacement (#​1712)

acornjs/acorn (acorn)

v8.14.1

Compare Source

v8.14.0

Compare Source

v8.13.0

Compare Source

v8.12.1

Compare Source

v8.12.0

Compare Source

babel/babel-loader (babel-loader)

v9.2.1

Compare Source

What's Changed

• Avoid error on missing getLogger by @​nicolo-ribaudo in https://github.com/babel/babel-loader/pull/1045

Full Changelog: https://github.com/babel/babel-loader/compare/v9.2.0...v9.2.1

v9.2.0

Compare Source

What's Changed

• Remove caller option check by @​JLHwung in https://github.com/babel/babel-loader/pull/1007
• Update deps by @​JLHwung in https://github.com/babel/babel-loader/pull/1025
• docs: clarify that cacheIdentifier is computed from the merged options by @​JLHwung in https://github.com/babel/babel-loader/pull/1000
• Add babel-loader logger by @​JLHwung in https://github.com/babel/babel-loader/pull/1037

Full Changelog: https://github.com/babel/babel-loader/compare/v9.1.3...v9.2.0

webpack-contrib/css-loader (css-loader)

v6.11.0

Compare Source

Features

• supports multiple composes (#​1582) (bbca614)

Bug Fixes

• do not break @scope at-rule without params (#​1581) (e022e3b)

rich-harris/magic-string (magic-string)

v0.30.17

Compare Source

Bug Fixes

• remove problematic type: module (092697b)

v0.30.16

Compare Source

Bug Fixes

• missing mapping after a line break with hires: 'boundary' (#​298) (24cb8ea)

Features

• introduce offset (#​297) (29f260e)

v0.30.15

Compare Source

Features

• add sideEffects: false to package.json (#​295) (889bd73)

v0.30.14

Compare Source

Features

• Include debugId in SourceMap types (#​294) (5d93dcf)

v0.30.13

Compare Source

Features

• Add support for sourcemap debugId property (#​292) (ef531a8)

v0.30.12

Compare Source

Performance Improvements

• skip line break mappings (#​284) (5b1ecf7)

v0.30.11

Compare Source

Bug Fixes

• not use negative indices for remove in empty string (#​281) (5c1cba0)

v0.30.10

Compare Source

Bug Fixes

• types: improve chainable types (#​278) (072188f)

v0.30.9

Compare Source

Performance Improvements

• avoid create uncessary overrides for replace (a1b857c)

webpack-contrib/mini-css-extract-plugin (mini-css-extract-plugin)

v2.9.2

Compare Source

v2.9.1

Compare Source

v2.9.0

Compare Source

Features

• add support for link preload/prefetch (#​1043) (ee25e51)
• added the defaultExport option to generate default and named export together (#​1084) (74ae781)

Bug Fixes

• avoid reloading all csses when hot load (#​1090) (1a56673)

2.8.1 (2024-02-27)

Bug Fixes

• add nonce if __webpack_nonce__ has been defined (c7f0aee)

nodejs/node (node)

v18.20.8: 2025-03-27, Version 18.20.8 'Hydrogen' (LTS), @​richardlau

Compare Source

Notable Changes

This release updates OpenSSL to 3.0.16 and root certificates to NSS 3.108.

Commits

• [f737a79073] - async_hooks,inspector: implement inspector api without async_wrap (Gabriel Bota) #​51501
• [fce923ba69] - build: update gcovr to 7.2 and codecov config (Benjamin E. Coe) #​54019
• [8b7ffd807c] - build: fix compatibility with V8's depot_tools (Richard Lau) #​57330
• [ee9a343413] - crypto: update root certificates to NSS 3.108 (Node.js GitHub Bot) #​57381
• [738bf8aea4] - crypto: update root certificates to NSS 3.104 (Richard Lau) #​55681
• [69d661d591] - deps: update undici to v5.29.0 (Matteo Collina) #​57557
• [59fcf43b0e] - deps: update corepack to 0.32.0 (Node.js GitHub Bot) #​57265
• [1b72869503] - deps: update archs files for openssl-3.0.16 (Node.js GitHub Bot) #​57335
• [a566560235] - deps: upgrade openssl sources to quictls/openssl-3.0.16 (Node.js GitHub Bot) #​57335
• [50c4e1da2f] - doc: add missing deprecated badges in fs.md (Yukihiro Hasegawa) #​57384
• [c3babb4671] - doc: update Xcode version used for arm64 and pkg (Michaël Zasso) #​57104
• [784da606a6] - doc: fix link and history of SourceMap sections (Antoine du Hamel) #​57098
• [f5dbceccbe] - test: update error code in tls-psk-circuit for for OpenSSL 3.4 (sebastianas) #​56420

v18.20.7: 2025-02-20, Version 18.20.7 'Hydrogen' (LTS), @​aduh95

Compare Source

Notable Changes

• [ea5eb0e98b] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #​56566

Commits

• [bb2977ca6c] - build: use glob for dependencies of out/Makefile (Richard Lau) #​55789
• [92896945b8] - build: support python 3.13 (Chengzhong Wu) #​53190
• [ea5eb0e98b] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #​56566
• [d03a23577d] - deps: V8: cherry-pick 26fd1df (Shu-yu Guo) #​55873
• [53bb21b093] - deps: V8: backport ae5a4db (Shu-yu Guo) #​55873
• [5eb6dfe284] - deps: update zlib to 1.3.0.1-motley-82a5fec (Node.js GitHub Bot) #​55980
• [734515a0f7] - deps: update zlib to 1.3.0.1-motley-7e2e4d7 (Node.js GitHub Bot) #​54432
• [d64cc98324] - deps: update simdutf to 5.6.4 (Node.js GitHub Bot) #​56255
• [9eab21dd1d] - deps: update simdutf to 5.6.3 (Node.js GitHub Bot) #​55973
• [2e3367b46a] - deps: update simdutf to 5.6.2 (Node.js GitHub Bot) #​55889
• [df74d66207] - deps: update simdutf to 5.6.1 (Node.js GitHub Bot) #​55850
• [ade37ee0b3] - deps: update acorn to 8.14.0 (Node.js GitHub Bot) #​55699
• [a3c367adbd] - deps: update corepack to 0.31.0 (Node.js GitHub Bot) #​56795
• [2cff6a8428] - deps: update corepack to 0.30.0 (Node.js GitHub Bot) #​55977
• [8b8c9a2cf5] - doc: update macOS and Xcode versions for releases (Michaël Zasso) #​56337
• [706af28113] - doc: add "Skip to content" button (Antoine du Hamel) #​56750
• [634a6b3a14] - doc: improve accessibility of expandable lists (Antoine du Hamel) #​56749
• [f0b60c5bf9] - doc: fix arrow vertical alignment in HTML version (Akash Yeole) #​52193
• [91cce27ebb] - doc: remove flicker on page load on dark theme (Dima Demakov) #​50942
• [522fbb00a8] - doc: make theme consistent across api and other docs (Dima Demakov) #​50877
• [1486465520] - doc: save user preference for JS flavor (Vidar Eldøy) #​49526
• [d74cff7e59] - doc: rename possibly confusing variable and CSS class (Antoine du Hamel) #​49536
• [4829d976fe] - doc: add main ARIA landmark to API docs (Rich Trott) #​49882
• [6c4ce1f1d4] - doc: add navigation ARIA landmark to doc ToC (Rich Trott) #​49882
• [33548f8c1f] - doc: add history entries for JSON modules stabilization (Antoine du Hamel) #​55855
• [e12bdf6141] - meta: bump actions/upload-artifact from 4.4.3 to 4.6.0 (dependabot[bot]) #​56861
• [6f44ef388b] - meta: bump actions/upload-artifact from 4.4.0 to 4.4.3 (dependabot[bot]) #​55685
• [ae39211117] - meta: bump actions/upload-artifact from 4.3.4 to 4.4.0 (dependabot[bot]) #​54703
• [4cf80b37c7] - meta: bump actions/upload-artifact from 4.3.3 to 4.3.4 (dependabot[bot]) #​54166
• [4d402b79cb] - meta: bump actions/download-artifact from 4.1.7 to 4.1.8 (dependabot[bot]) #​54167
• [1c01f93497] - meta: bump actions/upload-artifact from 4.3.1 to 4.3.3 (dependabot[bot]) #​52785
• [6558a516ec] - meta: bump actions/download-artifact from 4.1.4 to 4.1.7 (dependabot[bot]) #​52784
• [dd70860ec8] - meta: bump actions/download-artifact from 4.1.3 to 4.1.4 (dependabot[bot]) #​52314
• [4a24d92a45] - meta: bump actions/upload-artifact from 4.3.0 to 4.3.1 (dependabot[bot]) #​51941
• [655b9071b9] - meta: bump actions/download-artifact from 4.1.1 to 4.1.3 (dependabot[bot]) #​51938
• [0e6ad795aa] - meta: bump actions/download-artifact from 4.1.0 to 4.1.1 (dependabot[bot]) #​51644
• [61babc5037] - meta: bump actions/upload-artifact from 4.0.0 to 4.3.0 (dependabot[bot]) #​51643
• [8b16d80029] - meta: update artifact actions to v4 (Michaël Zasso) #​51219
• [d47e8cb86d] - test: do not use deprecated import assertions (Antoine du Hamel) #​55873
• [06c523d693] - test: mark test-inspector-stop-profile-after-done as flaky (Antoine du Hamel) #​57001
• [dafea86962] - test: mark test-perf-hooks as flaky on macOS (Antoine du Hamel) #​57001
• [8e53f1f43d] - test: mark test-inspector-multisession-ws as flaky (Antoine du Hamel) #​57001
• [350eb50bbe] - test: mark test-performance-function as flaky (Antoine du Hamel) #​57001
• [a1f428a343] - test: skip test-perf-hooks on SmartOS (Antoine du Hamel) #​57001
• [199f52fcc0] - test: make test-crypto-hash compatible with OpenSSL > 3.4.0 (Jelle van der Waa) #​56160
• [b08ce67d48] - test: compare paths on Windows without considering case (Early Riser) #​53993
• [6e84d211a1] - test: deflake test-perf-hooks.js (Joyee Cheung) #​49892
• [a7f565fc7f] - tools: fix failing lint-sh workflow (Antoine du Hamel) #​56995

v18.20.6: 2025-01-21, Version 18.20.6 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• CVE-2025-23085 - src: fix HTTP2 mem leak on premature close and ERR_PROTO (Medium)
• CVE-2025-23084 - path: fix path traversal in normalize() on Windows (Medium)

Dependency update:

• CVE-2025-22150 - Use of Insufficiently Random Values in undici fetch() (Medium)

Commits

• [c03ad5ed63] - build: use rclone instead of aws CLI (Michaël Zasso) #​55617
• [8232463294] - build, tools: drop leading / from r2dir (Richard Lau) #​53951
• [b26bcd3394] - build, tools: copy release assets to staging R2 bucket once built (flakey5) #​51394
• [56df127b7b] - build,tools: simplify upload of shasum signatures (Michaël Zasso) #​53892
• [a63e9372ed] - (CVE-2025-22150) deps: update undici to v5.28.5 (Matteo Collina) nodejs-private/node-private#657
• [da2d177f91] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#555
• [6cc8d58e6f] - (CVE-2025-23085) src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS) nodejs-private/node-private#650

v18.20.5: 2024-11-12, Version 18.20.5 'Hydrogen' (LTS), @​aduh95

Compare Source

Notable Changes

• [ac37e554a5] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #​55333

Commits

• [c2e6a8f215] - benchmark: fix napi/ref addon (Michaël Zasso) #​53233
• [4c2e07aaac] - build: pin doc workflow to Node.js 20 (Richard Lau) #​55755
• [6ba4ebd060] - build: fix build with Python 3.12 (Luigi Pinca) #​50582
• [c50f01399e] - crypto: ensure invalid SubtleCrypto JWK data import results in DataError (Filip Skokan) #​55041
• [5c46782137] - crypto: make deriveBits length parameter optional and nullable (Filip Skokan) #​53601
• [6e7274fa53] - crypto: reject dh,x25519,x448 in {Sign,Verify}Final (Huáng Jùnliàng) #​53774
• [d2442044db] - crypto: reject Ed25519/Ed448 in Sign/Verify prototypes (Filip Skokan) #​52340
• [93670de499] - deps: upgrade npm to 10.8.2 (npm team) #​53799
• [8531c95587] - deps: upgrade npm to 10.8.1 (npm team) #​53207
• [fd9933ea0f] - deps: upgrade npm to 10.8.0 (npm team) #​53014
• [03852495d7] - deps: update simdutf to 5.6.0 (Node.js GitHub Bot) #​55379
• [3597be4146] - deps: update simdutf to 5.5.0 (Node.js GitHub Bot) #​54434
• [52d2c03738] - deps: update simdutf to 5.3.4 (Node.js GitHub Bot) #​54312
• [dd882ac483] - deps: update simdutf to 5.3.1 (Node.js GitHub Bot) #​54196
• [5fb8e1b428] - deps: update simdutf to 5.3.0 (Node.js GitHub Bot) #​53837
• [c952fd886d] - deps: update simdutf to 5.2.8 (Node.js GitHub Bot) #​52727
• [a1ae050ed5] - deps: update simdutf to 5.2.6 (Node.js GitHub Bot) #​52727
• [96ec48da7f] - deps: update brotli to 1.1.0 (Node.js GitHub Bot) #​50804
• [11242bcfb4] - deps: update zlib to 1.3.0.1-motley-71660e1 (Node.js GitHub Bot) #​53464
• [64f98a9869] - deps: update zlib to 1.3.0.1-motley-c2469fd (Node.js GitHub Bot) #​53464
• [4b815550e0] - deps: update zlib to 1.3.0.1-motley-68e57e6 (Node.js GitHub Bot) #​53464
• [f6b2f68ce7] - deps: update zlib to 1.3.0.1-motley-8b7eff8 (Node.js GitHub Bot) #​53464
• [e151ebef86] - deps: update zlib to 1.3.0.1-motley-e432200 (Node.js GitHub Bot) #​53464
• [637a306e02] - deps: update zlib to 1.3.0.1-motley-887bb57 (Node.js GitHub Bot) #​53464
• [569a739569] - deps: update zlib to 1.3.0.1-motley-209717d (Node.js GitHub Bot) #​53156
• [033f1e2ba5] - deps: update zlib to 1.3.0.1-motley-4f653ff (Node.js GitHub Bot) #​53052
• [aaa857fc01] - deps: update ada to 2.8.0 (Node.js GitHub Bot) #​53254
• [d577321877] - deps: update acorn to 8.13.0 (Node.js GitHub Bot) #​55558
• [55b3c8a41f] - deps: update acorn-walk to 8.3.4 (Node.js GitHub Bot) #​54950
• [50a9456f1e] - deps: update acorn-walk to 8.3.3 (Node.js GitHub Bot) #​53466
• [f56cfe776b] - deps: update acorn to 8.12.1 (Node.js GitHub Bot) #​53465
• [fce3ab686d] - deps: update archs files for openssl-3.0.15+quic1 (Node.js GitHub Bot) #​55184
• [46c782486e] - deps: upgrade openssl sources to quictls/openssl-3.0.15+quic1 (Node.js GitHub Bot) #​55184
• [4a18581dc3] - deps: update corepack to 0.29.4 (Node.js GitHub Bot) #​54845
• [67e98831ab] - deps: update archs files for openssl-3.0.14+quic1 (Node.js GitHub Bot) #​54336
• [c60c6630af] - deps: upgrade openssl sources to quictls/openssl-3.0.14+quic1 (Node.js GitHub Bot) #​54336
• [935a506377] - deps: update corepack to 0.29.3 (Node.js GitHub Bot) #​54072
• [dbdfdd0226] - deps: update corepack to 0.29.2 (Node.js GitHub Bot) #​53838
• [395ee44608] - deps: update corepack to 0.28.2 (Node.js GitHub Bot) #​53253
• [6ba8bc0618] - deps: update c-ares to 1.29.0 (Node.js GitHub Bot) #​53155
• [81c3260cd2] - deps: update corepack to 0.28.1 (Node.js GitHub Bot) #​52946
• [e4739e9aa6] - doc: only apply content-visibility on all.html (Filip Skokan) #​53510
• [4d2ac5d98f] - doc: move release key for Myles Borins (Richard Lau) #​54059
• [1c4decc998] - doc: add release key for aduh95 (Antoine du Hamel) #​55349
• [a4f6f0918f] - doc: add names next to release key bash commands (Aviv Keller) #​52878
• [c679348f83] - errors: use determineSpecificType in more error messages (Antoine du Hamel) #​49580
• [3059262185] - esm: fix broken assertion in legacyMainResolve (Antoine du Hamel) #​55708
• [ac37e554a5] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #​55333
• [84b0ead758] - esm: fix hook name in error message (Bruce MacNaughton) #​50466
• [0092358d00] - http: handle multi-value content-disposition header (Arsalan Ahmad) #​50977
• [d814fe935c] - src: account for OpenSSL unexpected version (Shelley Vohr) #​54038
• [6615fe5db1] - src: fix dynamically linked OpenSSL version (Richard Lau) #​53456
• [d6114cb2e2] - test: fix test when compiled without engine support (Richard Lau) #​53232
• [ac3a39051c] - test: fix test-tls-junk-closes-server (Michael Dawson) #​55089
• [c8520ff7d2] - test: fix OpenSSL version checks (Richard Lau) #​53503
• [9824827937] - test: update tls test to support OpenSSL32 (Michael Dawson) #​55030
• [1a4d497936] - test: adjust tls-set-ciphers for OpenSSL32 (Michael Dawson) #​55016
• [341496a5a2] - test: add asserts to validate test assumptions (Michael Dawson) #​54997
• [37a2f7eaa4] - test: adjust key sizes to support OpenSSL32 (Michael Dawson) #​54972
• [75ff0cdf66] - test: update test to support OpenSSL32 (Michael Dawson) #​54968
• [b097d85dfe] - test: adjust test-tls-junk-server for OpenSSL32 (Michael Dawson) #​54926
• [e9997388a6] - test: adjust tls test for OpenSSL32 (Michael Dawson) #​54909
• [c7de027adb] - test: fix test test-tls-dhe for OpenSSL32 (Michael Dawson) #​54903
• [68156cbae1] - test: fix test-tls-client-mindhsize for OpenSSL32 (Michael Dawson) #​54739
• [d5b73e5683] - test: increase key size for ca2-cert.pem (Michael Dawson) #​54599
• [5316314755] - test: update TLS test for OpenSSL 3.2 (Richard Lau) #​54612
• [a1f0c87859] - test: fix test-tls-client-auth test for OpenSSL32 (Michael Dawson) #​54610
• [e9e3306426] - test: use assert.{s,deepS}trictEqual() (Sonny) #​54208
• [1320fb9475] - test: update TLS trace tests for OpenSSL >= 3.2 (Richard Lau) #​53229
• [cc3cdf7cc0] - test: check against run-time OpenSSL version (Richard Lau) #​53456
• [fc43c6803e] - test: update TLS tests for OpenSSL 3.2 (Richard Lau) #​53384
• [627d3993f0] - test: fix unreliable assumption in js-native-api/test_cannot_run_js (Joyee Cheung) #​51898
• [9f521f456e] - test: update tests for OpenSSL 3.0.14 (Richard Lau) #​53373
• [0fb652eba9] - tools: update gyp-next to v0.16.1 (Michaël Zasso) #​50380
• [fa72b2c2de] - tools: skip ruff on tools/gyp (Michaël Zasso) #​50380

v18.20.4: 2024-07-08, Version 18.20.4 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

• CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
• CVE-2024-22020 - Bypass network import restriction via data URL (Medium)

Commits

• [85abedf1ff] - lib,esm: handle bypass network-import via data: (RafaelGSS) nodejs-private/node-private#522
• [eccd63b865] - src: handle permissive extension on cmd check (RafaelGSS) nodejs-private/node-private#596

v18.20.3: 2024-05-21, Version 18.20.3 'Hydrogen' (LTS), @​richardlau

Compare Source

Notable Changes

This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.

A fix has also been included for compiling Node.js from source with newer versions of Clang.

The list of keys used to sign releases has been synchronized with the current list from the main branch.

Updated dependencies

• acorn updated to 8.11.3.
• acorn-walk updated to 8.3.2.
• ada updated to 2.7.8.
• c-ares updated to 1.28.1.
• corepack updated to 0.28.0.
• nghttp2 updated to 1.61.0.
• ngtcp2 updated to 1.3.0.
• npm updated to 10.7.0. Includes a fix from [email protected] to limit the number of open connections npm/cli#7324.
• simdutf updated to 5.2.4.
• zlib updated to 1.3.0.1-motley-7d77fb7.

Commits

• [0c260e10e7] - deps: update zlib to 1.3.0.1-motley-7d77fb7 (Node.js GitHub Bot) #​52516
• [1152d7f919] - deps: update zlib to 1.3.0.1-motley-24c07df (Node.js GitHub Bot) #​52199
• [755399db9d] - deps: update zlib to 1.3.0.1-motley-24342f6 (Node.js GitHub Bot) #​52123
• [af3e32073b] - deps: update ada to 2.7.8 (Node.js GitHub Bot) #​52517
• [e4ea2db58b] - deps: update c-ares to 1.28.1 (Node.js GitHub Bot) #​52285
• [14e857bea2] - deps: update corepack to 0.28.0 (Node.js GitHub Bot) #​52616
• [7f5dd44ca6] - deps: upgrade npm to 10.7.0 (npm team) #​52767
• [78f84ebb09] - deps: update ngtcp2 to 1.3.0 (Node.js GitHub Bot) #​51796
• [[1f489a3753](https://redirect.github.com/

---

Configuration

📅 Schedule: Branch creation - "* 0-3 * * 1" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• [ ] If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.