Bump the npm-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the npm-dependencies group with 4 updates in the /dash/dash-renderer directory: webpack, @babel/parser, @babel/plugin-transform-typescript and @types/node.

Updates webpack from 5.111.0 to 5.111.1

Release notes

Sourced from webpack's releases.

v5.111.1

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #22142)

• Record hoisted, module and block declarations while parsing, not by re-walking. (by @​alexander-akait in #22147)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.111.1

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #22142)

... (truncated)

Commits

• 5a10675 chore(release): new release (#22105)
• 9c448c4 test: consolidate loose harness files under test/harness (#22163)
• a947604 fix(html): unquote an attribute value carrying a vertical tab (#22162)
• db556f3 test: run the printer equivalence suite against Gecko in CI (#22155)
• d174cdf perf(css): drop a fallback every browserslist target reads past (#22158)
• 39f14f2 refactor(javascript): declare block bindings from the parse (#22161)
• 0835411 test: move suite drivers into test/templates (#22159)
• b48cd77 fix(html): minify by what a value says rather than how it was spelled (#22154)
• a774f10 test: define the webpack major instead of bundling package.json (#22160)
• 4b2eed0 docs: report only what needs a decision while watching a PR (#22156)
• Additional commits viewable in compare view

Updates @babel/parser from 7.29.8 to 7.29.9

Release notes

Sourced from @​babel/parser's releases.

v7.29.9 (2026-09-18)

🐛 Bug Fix

• babel-plugin-transform-typescript
  • #18247 [ts] Allow merging enum into a namespace (@​nicolo-ribaudo)
• babel-parser
  • #18241 Fix parsing of arrow function params inside ternaries with Flow (@​robhogan)

🏠 Internal

• babel-parser
  • #18245 test: test with ts-eslint 8.70.0 (@​JLHwung)

Committers: 4

• Huáng Jùnliàng (@​JLHwung)
• Joelle Mahfoud (@​joelle-a-dev)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• Rob Hogan (@​robhogan)

Commits

• 54405f2 v7.29.9
• bf01dd0 [7.x] Fix parsing of arrow function params inside ternaries with Flow (#18241)
• 092e6e5 test: test with ts-eslint 8.70.0 (#18245)
• See full diff in compare view

Updates @babel/plugin-transform-typescript from 7.29.7 to 7.29.9

Release notes

Sourced from @​babel/plugin-transform-typescript's releases.

v7.29.9 (2026-09-18)

🐛 Bug Fix

• babel-plugin-transform-typescript
  • #18247 [ts] Allow merging enum into a namespace (@​nicolo-ribaudo)
• babel-parser
  • #18241 Fix parsing of arrow function params inside ternaries with Flow (@​robhogan)

🏠 Internal

• babel-parser
  • #18245 test: test with ts-eslint 8.70.0 (@​JLHwung)

Committers: 4

• Huáng Jùnliàng (@​JLHwung)
• Joelle Mahfoud (@​joelle-a-dev)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• Rob Hogan (@​robhogan)

v7.29.8 (2026-07-31)

👓 Spec Compliance

• babel-generator, babel-parser, babel-plugin-transform-spread, babel-traverse, babel-types
  • #17871 Disallow super call after new (@​JLHwung)

🐛 Bug Fix

• babel-generator
  • #18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-node, babel-plugin-transform-modules-systemjs
  • #18044 fix(systemjs): support __proto__ as an export name (@​JLHwung)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

Commits

• 54405f2 v7.29.9
• 127eba4 [ts] Allow merging enum into a namespace (#18247)
• See full diff in compare view

Updates @types/node from 26.5.1 to 26.6.4

Commits

• See full diff in compare view

[github-actions]

Dash performance benchmarks

✅ all within thresholds

	scenario	metric	p90 (ms)	median	growth	baseline p90	note
✅	callback_chain	chain_ms	421.5	407.2	0.94x	499.1
✅	callback_chain	graph_ms	2.1	2.1	1.0x	2.4
✅	callback_fanout	fanout_ms	86.0	80.2	0.89x	92.5
✅	deep_nesting	render_ms	60.5	52.1	0.86x	56.8
✅	full_children_replace	replace_ms	5233.4	1898.3	18.57x	4697.1
✅	initial_render_large	render_ms	605.7	563.0	0.99x	694.4
✅	initial_render_small	render_ms	113.3	95.4	1.15x	104.0
✅	patch_append_nested	append_ms	117.9	82.6	2.31x	192.3
✅	patch_append_toplevel	append_ms	112.1	76.4	2.31x	140.2
✅	patch_scalar_update_large	update_ms	142.5	129.1	0.96x	202.9
✅	wildcard_all_resolve	wildcard_ms	289.0	277.8	0.96x	313.6
✅	wildcard_all_resolve	graph_ms	1.3	1.3	1.0x	1.3

growth = late-third / early-third per-op time; ~1 is flat, a large value means the per-op cost scales with accumulated state.

machine scale vs baseline: 0.99x - divided out of the baseline ratios so they compare like for like (the absolute warn/fail ceilings are left un-scaled); calibrated on initial_render_small.

[T4rk1n]

@dependabot rebase

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud