chore(deps): update nodejs

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

Package	Change	Age	Confidence
@testing-library/react	16.3.2 → 16.3.3
css-loader	7.1.4 → 7.1.5
fast-uri	4.1.2 → 4.1.3
i18next-cli	1.71.0 → 1.71.3
serialize-javascript	7.1.0 → 7.1.1
typescript-eslint (source)	8.67.0 → 8.68.0
webpack	5.109.2 → 5.110.1
webpack-cli (source)	7.2.2 → 7.2.3

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

testing-library/react-testing-library (@​testing-library/react)

v16.3.3

Compare Source

Bug Fixes

• Avoid act() re-entrant when dispatching events (#​1468) (20ce75f)

webpack/css-loader (css-loader)

v7.1.5

Compare Source

fastify/fast-uri (fast-uri)

v4.1.3

Compare Source

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v4 release line should upgrade to v4.1.3.

Full Changelog: fastify/fast-uri@v4.1.2...v4.1.3

i18next/i18next-cli (i18next-cli)

v1.71.3

Compare Source

• fix: fallbackNS accounting now works when the fallback namespace lives in its own file
  outside a merged output (mergeNamespaces: true), e.g. split out and hidden via
  ignoreNamespaces: status and extract look up a fallback namespace missing from the
  merged file at its per-namespace path, and a function output resolves the merged file
  without a namespace (matching what extract writes), so hybrid layouts are expressible via
  an output function. When a fallbackNS is listed in ignoreNamespaces but its
  translations cannot be found, status now warns instead of silently reporting the keys as
  absent (#​287).

v1.71.2

Compare Source

• fix: extract no longer scales quadratically with the number of keys: selector-API /
  returnObjects keys are matched via an O(key depth) Set lookup instead of one regex per
  object key, and the per-key leaf check uses a precomputed ancestor-prefix Set instead of
  scanning all keys. A 4-minute run on a ~11,500-key monorepo drops to seconds; written
  output is byte-identical (#​286).

v1.71.1

Compare Source

• feat: .reduce()/.reduceRight() over an as const array now bind the element callback
  parameter (the second one, (acc, el) => …) like .map()/.forEach() already did, so
  ERRORS.reduce((acc, n) => { acc[n] = t(`errors.${n}.title`) }, {}) extracts every element
  without the (typeof ERRORS)[number] cast workaround
  (#​285).

yahoo/serialize-javascript (serialize-javascript)

v7.1.1

Compare Source

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @​okuryu in #​226
• release: v7.1.1 by @​okuryu in #​227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

typescript-eslint/typescript-eslint (typescript-eslint)

v8.68.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

webpack/webpack (webpack)

v5.110.1

Compare Source

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @​alexander-akait in #​21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by @​alexander-akait in #​21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by @​AgentEnder in #​21845)

v5.110.0

Compare Source

Minor Changes

• Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #​21519)

• Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #​21841)

• Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #​21705)

• Add OS-independent glob matching to module rules. (by @​alexander-akait in #​21771)

• Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #​21740)

• Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #​21712)

• Give externals the original request of a context module element. (by @​alexander-akait in #​21780)

• Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #​21569)

• Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #​21770)

• Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #​21624)

• Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #​21576)

• Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #​21624)

• Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #​21600)

• Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #​21810)

• Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #​21788)

• Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #​21841)

• Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #​21750)

• Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #​21841)

• Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #​21841)

• Minify HTML further where the parsed document is unchanged: drop redundant quotes, whitespace nothing renders, escapes text does not need, implied tags, optional end tags nothing prints behind, empty attributes and nested empty elements; fold enumerated values and casing; normalize each attribute against the element it is on; and rewrite style, token lists, srcset, sizes, URL, integer and boolean attributes, viewport content, inline <style> and a JSON <script> body through their own grammars. Adds the optimization.minimize.html options collapseWhitespace, mergeStyles, minifyConditionalComments, minifySrcdoc, preserveComments, removeEmptyAttributes, removeEmptyElements, removeImpliedTags, removeRedundantAttributes, sortAttributes and sortTokenLists, and keeps an end tag the parent, the next element or the adoption agency would otherwise restructure the tree over. (by @​alexander-akait in #​21841)

• Suggest the closest name or a casing fix anywhere in a failed request. (by @​alexander-akait in #​21727)

• Add aggregated shutdown hook to MultiCompiler. (by @​bjohansebas in #​21578)

• Report which compilers changed on the MultiCompiler done hook. (by @​bjohansebas in #​21580)

• Add [containedpath]/[containedfile] placeholders, used for [path]/[file] of asset and html modules with experiments.futureDefaults. (by @​alexander-akait in #​21592)

• Support an object for an entry's html that overrides output.html per option. (by @​alexander-akait in #​21574)

• Configure or exclude each asset type's minifier via optimization.minimize. (by @​alexander-akait in #​21663)

• Support printing CSS and HTML beautified as well as minified. (by @​alexander-akait in #​21660)

• Add renderEmbeddedSource, and minify what it offers out of the box. (by @​alexander-akait in #​21830)

• Report bindings named eval, arguments or reserved words in ES module output. (by @​alexander-akait in #​21567)

• Emit no development source map for module libraries, or any with futureDefaults. (by @​alexander-akait in #​21839)

• Speed up builds and cut memory: faster CSS, HTML and JavaScript parsing and minification, a built-in scope analyzer replacing eslint-scope, faster dependency hot paths, module diagnostics, CommonJS export scanning and concatenated module renaming, runtime modules, parsers, generators and dependencies loaded only when used, one file watcher pool shared between MultiCompiler children, and lower parser, graph and startup memory. (by @​alexander-akait in #​21841)

• Improve tree-shaking for a namespace reexported as default, and fix import d from "./mod"; d.member reading undefined in that case. (by @​alexander-akait in #​21841)

• Warn on cross-kind CSS module export conflicts and let the class win. (by @​alexander-akait in #​21538)

• Add output.resourceHints.dedupe to skip prefetch links for already preloaded/prefetched chunks. (by @​alexander-akait in #​21386)

Patch Changes

• Let a memory-cache etag mismatch fall through to the file cache instead of reporting a miss. (by @​alexander-akait in #​21624)

• Determine provided exports in dependency order, so a build's module hashes no longer depend on what the persistent cache held. (by @​alexander-akait in #​21630)

• Emit no dead module and no failing require for an asset-url external. (by @​alexander-akait in #​21713)

• Fix names, hidden devtools and cache reuse for CSS maps inlined into JS. (by @​alexander-akait in #​21558)

• Follow the HTML spec more closely when parsing and printing: frameset content, quirks paragraphs and selects, <![CDATA[ outside foreign content as a bogus comment, <?target data?> as a processing instruction, </> dropped, comment data and DOCTYPE identifiers read from the tokenizer states, attributes merged from a repeated <html>/<body> tag, legacy JavaScript script types, void keygen and font format detection — and hand back the tree a parsed document was built from when printing it. (by @​alexander-akait in #​21841)

• Clear a Watching's blocked flag when its build starts, so it reports only a child actually waiting for its MultiCompiler parent. (by @​bjohansebas in #​21639)

• Fix AMD define() output using the wrong module and exports argument names. (by @​hai-x in #​21814)

• Fix ReferenceError from import.meta.main using the wrong module argument. (by @​hai-x in #​21620)

• Leave a @namespace URI alone instead of resolving and rewriting it as an asset. (by @​alexander-akait in #​21658)

• Resolve escaped CSS names, and scope a grid area cell name as one name. (by @​alexander-akait in #​21665)

• Track exports usage of side-effect-free modules an active import() evaluates. (by @​hai-x in #​21623)

• Resolve absolute symlink targets and treat an unreadable context as missing. (by @​alexander-akait in #​21647)

• Fix corrupted icon URLs in a .webmanifest with a BOM or non-ASCII text. (by @​alexander-akait in #​21655)

• Respect strictThisContextOnImports for require() member calls. (by @​hai-x in #​21601)

• Fix import.meta, [object Object] asset urls and crashes in build-time executed modules. (by @​alexander-akait in #​21841)

• Inherit sideEffects past a type-only nested package.json for files under node_modules. (by @​xiaoxiaojx in #​21686)

• Do not fail directory creation when the file system reports it already exists. (by @​alexander-akait in #​21698)

• Fix top-level using and await using declarations in modules. (by @​alexander-akait in #​21557)

• Fix DefinePlugin optional chains reading an undefined object member. (by @​lazerg in #​21823)

• Fix MultiCompiler: compute the common outputPath by whole path segments, run again after a dependency validation failure, and recover watch mode from a fatal child error without leaking watchings. (by @​alexander-akait in #​21841)

• Keep a nested bundle's runtime tables separate when bundling webpack output. (by @​alexander-akait in #​21568)

• Keep the runtime out of strict mode when output.globalObject reads this. (by @​alexander-akait in #​21715)

• Run an even-priority __webpack_require__.O handler without waiting. (by @​alexander-akait in #​21803)

• Treat top-level this in a classic worker entry as its global scope. (by @​alexander-akait in #​21720)

• Rehash runtime modules whose code changes under a content-named filename. (by @​alexander-akait in #​21828)

• Fix namespace object reexports and string export names in module library output and emit a CommonJS entry's default as export default. (by @​alexander-akait in #​21589)

• Keep tree-shaken JSON arrays as arrays when a prototype property is read. (by @​hai-x in #​21599)

• Generate every CSS and HTML lookup table into lib/{css,html}/data.js from mdn-data, color-name and the spec IDL — including the value-type facts read out of the CSS value-definition grammars — leaving both syntax.js files algorithm only. (by @​alexander-akait in #​21841)

• Support UNC paths in module and context replacement plugins. (by @​avivkeller in #​21645)

• Emit less runtime code: shorter syntax where output.environment allows, no IIFE for a RuntimeModule without locals, no unread __webpack_esm_id__ and exports.id chunk exports, and an ESM entry chunk installing its own modules from its local bindings instead of importing itself. (by @​alexander-akait in #​21841)

• Release the compilation and file system caches retained after compiler.close(). (by @​alexander-akait in #​21603)

webpack/webpack-cli (webpack-cli)

v7.2.3

Compare Source

Patch Changes

• fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @​bjohansebas in #​4834)

• feat: allow toml@5 as a peer dependency for TOML configuration files (by @​alexander-akait in #​4837)

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • "before 7am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign logonoff for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.