fix(deps): update website

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
@github/clipboard-copy-element	1.3.0 → 1.3.2
google-auth (source)	==2.53.0 → ==2.55.1
google-cloud-logging (source)	==3.15.0 → ==3.16.0
google-cloud-storage (source)	==3.10.1 → ==3.12.0
pylint (changelog)	4.0.5 → 4.0.6
sass	1.100.0 → 1.101.0
webpack	5.107.2 → 5.108.1
webpack-cli (source)	7.0.3 → 7.1.0

---

Release Notes

github/clipboard-copy-element (@​github/clipboard-copy-element)

v1.3.2

Compare Source

What's Changed

• Normalize invisible and whitespace characters on copy by @​jonrohan in #​88

New Contributors

• @​jonrohan made their first contribution in #​88

Full Changelog: github/clipboard-copy-element@v1.3.1...v1.3.2

v1.3.1

Compare Source

What's Changed

• Bump follow-redirects from 1.14.9 to 1.15.4 by @​dependabot[bot] in #​72
• Bump ip from 1.1.8 to 1.1.9 by @​dependabot[bot] in #​73
• Bump follow-redirects from 1.15.4 to 1.15.6 by @​dependabot[bot] in #​74
• Bump braces from 3.0.2 to 3.0.3 by @​dependabot[bot] in #​75
• Bump the npm_and_yarn group with 7 updates by @​dependabot[bot] in #​76
• Bump the npm_and_yarn group with 2 updates by @​dependabot[bot] in #​77
• Bump the npm_and_yarn group with 4 updates by @​dependabot[bot] in #​79
• Bump the npm_and_yarn group with 2 updates by @​dependabot[bot] in #​80
• Bump the npm_and_yarn group across 1 directory with 2 updates by @​dependabot[bot] in #​81
• Bump the npm_and_yarn group across 1 directory with 2 updates by @​dependabot[bot] in #​82
• Potential fixes for 2 code scanning alerts by @​cinderellasecure in #​85
• Modify publish workflow to include id-token permission by @​gracepark in #​86
• Normalize non-breaking spaces when copying to clipboard by @​Copilot in #​87

New Contributors

• @​cinderellasecure made their first contribution in #​85
• @​gracepark made their first contribution in #​86
• @​Copilot made their first contribution in #​87

Full Changelog: github/clipboard-copy-element@v1.3.0...v1.3.1

googleapis/google-cloud-python (google-auth)

v2.55.1: google-auth: v2.55.1

Compare Source

Bug Fixes

• auth: lower regional access boundary logs from warning to debug. (#​17571) (1ef4183), closes #​17515

v2.55.0: google-auth: v2.55.0

Compare Source

Features

• make RAB feature production ready (#​17390) (af193931)

Bug Fixes

• run async background boundary refresh on detached session (#​17441) (56cbea85)

v2.54.0

Compare Source

pylint-dev/pylint (pylint)

v4.0.6

Compare Source

What's new in Pylint 4.0.6?

Release date: 2026-06-14

False Positives Fixed

• implicit-str-concat is no longer emitted for an implicit concatenation of
  a raw string with a non-raw one (e.g. r"\d" "\n"). Such literals cannot be
  merged into a single string, so the concatenation is intentional rather than a
  forgotten comma.

  Closes #​6663

• Fix a false positive for invalid-name (C0103) where the default
  typevar-rgx rejected TypeVar names containing digits, such as
  Ec2T.

  Closes #​8499

• Fix a false positive for too-many-arguments in (non-static) methods and classmethods.

  Closes #​8675

• Fix a false positive for no-member when a value is inferred to several
  possible types and at least one of them defines a dynamic __getattr__.

  Closes #​9833

• Fix a false positive for function-redefined (E0102) when reusing names that
  match dummy-variables-rgx (such as _), which is common for
  pytest-bdd step definitions. This restores the behavior from before pylint
  4.0.0; as a consequence the false negative fixed in #​9894 is reintroduced for
  functions whose name matches dummy-variables-rgx.

  Closes #​10665

• Fix undefined-variable false positive when a name used as a metaclass
  argument in a nested class is referenced again later in the module.

  Closes #​10823

• Fix a false positive for unused-variable where global variables matching
  dummy-variables-rgx were still reported as unused when
  allow-global-unused-variables was disabled.

  Closes #​10890

• Fix a false positive for bad-dunder-name when there is a user-defined __suppress_context__ attribute on exception subclasses.

  Closes #​10960

• Fix used-before-assignment false positive for names bound by from X import * in every branch of an if/elif/else chain.

  Refs #​10980

• Check for metaclass call signature when evaluating arguments of a class call.

  Closes #​11032

• Fix false positive method-hidden when cached_property is imported directly with from functools import cached_property.

  Refs #​11037

Other Bug Fixes

• Fix the suggestion of unnecessary-comprehension for a dict comprehension
  that iterates a dict directly, e.g. {a: b for a, b in d}. Iterating a dict
  yields its keys, so the suggestion is now dict(d.keys()) instead of the
  incorrect dict(d), which would simply copy d.

  Closes #​8256

• Fix a crash in consider-using-enumerate when the for loop target is an attribute (e.g. for self.idx in range(len(x))) rather than a simple variable name.

  Closes #​10099

• Fix crash when checking attribute-defined-outside-init on classes that inherit from a base class pylint cannot fully analyze.

  Closes #​10892

• Fix add_message silently overwriting an explicit col_offset=0 (or any other zero-valued line/end_lineno/end_col_offset) with the AST node's value. The internal _add_one_message helper used a falsey check (if not col_offset:) to detect an omitted argument, which incorrectly treated a legitimate 0 the same as None. It now uses an identity check against None.

  Refs #​11020

• Fix a crash in the name checker when a non-constant value is passed as the covariant or contravariant argument of a TypeVar.

  Closes #​11022

• Fix a crash in the variable checker when a name resolves to a dataclass-synthesized __init__, which has no line number.

  Closes #​11023

• Fix a crash in the variables checker when NotImplemented is used as the test of an if statement, which raised a TypeError in a boolean context on Python 3.14.

  Closes #​11025

• Avoided a crash from the implicit booleaness checker for len() calls without arguments.

  Closes #​11028

• Fix a crash in the variables checker when a class declares a metaclass whose
  attribute-access chain does not bottom out at a name (e.g.
  class C(metaclass=None._)).
  Originally reported as pylint-dev/astroid#3066.

  Refs #​11031

• Fix a crash in the name checker when a chained assignment of a TypeAlias
  value has a non-name target such as a Subscript (for example
  a[0] = b = TypeAlias).

  Closes #​11056

• Fix a crash in the deprecated checker when __import__ is called with a
  non-string constant argument (for example __import__(1)).

  Closes #​11059

• Avoid crashing when enum member inference fails while checking enum subclasses.

  Closes #​11069

• Prevent a crash in unexpected-keyword-arg analysis when
  infer_call_result() raises InferenceError while inspecting
  decorator return signatures.

  Closes #​11070

• Fix a crash in the typecheck checker when a class uses a non-class object
  (for example a function) as its metaclass= argument.

  Closes #​11071

• Allow digits in ParamSpec and TypeVarTuple names for invalid-name check.

  The default paramspec-rgx and typevartuple-rgx patterns rejected names
  containing digits (e.g. Ec2P, S3Ts), emitting a false invalid-name
  (C0103). Allow digits in the lowercase segments, consistent with the
  typevar and typealias patterns.

  Closes #​11090

Performance Improvements

• The duplicate-code checker no longer runs when its message (R0801) is disabled, even if reports=yes is set. Previously, the checker's report (RP0801) would cause the expensive similarity computation to run regardless.

  Closes #​3443

sass/dart-sass (sass)

v1.101.0

Compare Source

• Potentially breaking bug fix: The Node package importer now properly
  supports resolving import-only variants of Sass files declared in the
  exports, sass, and style fields of package.json. Previously, these
  files were ignored even when loaded via @import, so any code relying on
  loading module-system-only files this way may break.

webpack/webpack (webpack)

v5.108.1

Compare Source

Patch Changes

• Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #​21280)

• Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #​21269)

v5.108.0

Compare Source

Minor Changes

• Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @​alexander-akait in #​21218)

• Add a bun target that emits ESM and externalizes bun:* and node.js built-in modules. (by @​alexander-akait in #​21248)

• Support CommonJS reexports via Object.defineProperty value and getter descriptors. (by @​alexander-akait in #​21129)

• Support JSON Schema const when generating CLI flags from a schema. (by @​alexander-akait in #​21087)

• Support JSON Schema if/then/else when generating CLI flags from a schema. (by @​alexander-akait in #​21087)

• Skip import specifiers, require() and import() calls in dead conditional branches gated by inlined imported constants (isDEV ? A : B), evaluated via getCondition. (by @​hai-x in #​21136)

• CSS localIdentName [hash] now resolves to the local ident hash (matching css-loader); use [modulehash] for the module hash. (by @​alexander-akait in #​21259)

• Add CSS parser as option and resolve url() inside HTML style attributes. (by @​alexander-akait in #​21157)

• Add dedicated module classes for all built-in module types. (by @​alexander-akait in #​21164)

• Support .html/.css for the default ./src entry under the html/css experiments. (by @​alexander-akait in #​21039)

• Add defineConfig helper for typed configuration files. (by @​alexander-akait in #​21169)

• Add a deno target (with versions, e.g. deno, deno2, deno1.40) that emits ESM, resolves node.js built-ins via the required node: specifier, and keeps Deno's own import protocols (npm:, jsr:, node:, http(s)://) external. (by @​alexander-akait in #​21247)

• Use module-import for electron externals when the target supports ESM. (by @​alexander-akait in #​21184)

• Add output.environment.logicalAssignment to emit ||= in runtime code when the target supports logical assignment operators. (by @​bjohansebas in #​21219)

• Resolve and rewrite asset URLs inside <iframe srcdoc> in HTML modules. (by @​bjohansebas in #​21226)

• Add HMR support for HTML modules with body/title DOM patching on update. (by @​alexander-akait in #​21011)

• Add css-url html source type extracting url() references from CSS-valued attributes. (by @​alexander-akait in #​21250)

• Add module.parser.html.sources option to disable or customize URL-attribute extraction for HTML modules, with script / script-module / stylesheet / stylesheet-inline types for custom attributes (by @​alexander-akait in #​21022)

• Add module.parser.html.template option to transform HTML module source before parsing. (by @​alexander-akait in #​21055)

• Extract more source URLs in HTML modules (SVG, legacy and obsolete attributes). (by @​alexander-akait in #​21241)

• Inline export default <const> when the default-exported value is a primitive constant. (by @​hai-x in #​21189)

• Support optimization.inlineExports for better tree-shaking. (by @​hai-x in #​20973)

• Re-encode inline hash digests ([contenthash]/[chunkhash]/[fullhash]/[modulehash]) from the full content hash, so they carry full entropy and work under optimization.realContentHash and in dynamically-loaded chunk filenames; also preserve leading zero bytes in base-N digests. (by @​alexander-akait in #​21267)

• Allow tree-shaking unused calls to /*#__NO_SIDE_EFFECTS__*/-annotated (pure) exports across module boundaries. (by @​hai-x in #​20907)

• Defer building unused re-export targets of side-effect-free barrel modules. (by @​hai-x in #​21165)

• Keep export mangling enabled for modules whose namespace object is used as a whole value, by materializing a decoupled namespace object that keeps the original export names. (by @​alexander-akait in #​21234)

• Add output.environment.let option (paired with target's let capability) and emit let/const instead of var in generated runtime code wherever it is safe. Bindings that may be wrapped in runtime-condition if blocks (harmony imports, ConcatenatedModule external imports) continue to use var to preserve function scoping. (by @​alexander-akait in #​21010)

• Add output.html to emit an HTML file per entrypoint, injecting its JS/CSS chunks (including dependOn shared chunks). (by @​alexander-akait in #​21215)

• Add module.parser.javascript.pureFunctions to mark top-level names as side-effect-free for tree shaking. (by @​hai-x in #​21063)

• Add universal to compiler.platform, true for universal targets ("universal" or ["web", "node"]). (by @​bjohansebas in #​21252)

• Add output.strictModuleResolution to gate the runtime MODULE_NOT_FOUND guard. (by @​hai-x in #​21067)

• Support an inline digest in hash path placeholders, e.g. [contenthash:base64:8]. (by @​alexander-akait in #​21259)

• Support [uniqueName] and its [uniquename] alias in template paths. (by @​alexander-akait in #​21155)

• Support CSS in Node for universal targets, collecting styles for SSR. (by @​alexander-akait in #​21208)

• Improve commonjs, node-commonjs and global externals for universal targets. (by @​alexander-akait in #​21187)

• Add a universal target preset (browser + web worker + Node.js + Electron + NW.js) that always outputs ECMAScript modules. (by @​alexander-akait in #​21214)

• Support new Worker(new URL(...)) in universal (node + web) targets by resolving the Worker constructor from worker_threads when no global Worker exists. (by @​alexander-akait in #​21195)

• Add output.workerChunkFilename and entry.worker for worker chunk filenames. (by @​alexander-akait in #​21128)

Patch Changes

• Skip re-parsing the inlined entry module when no renaming is needed. (by @​alexander-akait in #​21167)

• Extend the avoidEntryIife no-parse fast path to multi-entry chunks. (by @​alexander-akait in #​21173)

• Reuse the binary deserialize dispatch table to speed up cache restore. (by @​alexander-akait in #​21175)

• Type buildInfo and buildMeta per module type with shared common properties. (by @​alexander-akait in #​21172)

• Avoid copying module runtime requirements when ownership is not transferred. (by @​alexander-akait in #​21140)

• Keep all CommonJS exports when an exported function accesses them via this. (by @​alexander-akait in #​21179)

• Align CLI color-support detection across Node, Deno and Bun. (by @​alexander-akait in #​21257)

• Include the schema origin path in conflicting-schema CLI argument errors. (by @​alexander-akait in #​21087)

• Reject __proto__, constructor and prototype path segments in cli.processArguments to prevent prototype pollution. (by @​alexander-akait in #​21057)

• Speed up Compilation.deleteAsset and Compilation.renameAsset via a lazy reverse index from asset file name to containing chunks. (by @​alexander-akait in #​21035)

• Fix merging of inner modules' top-level declarations in concatenated modules. (by @​alexander-akait in #​21170)

• Reduce allocations in export hashing and concatenation name lookups. (by @​alexander-akait in #​21167)

• Avoid toLowerCase allocations in CSS keyword comparisons. (by @​alexander-akait in #​21109)

• Speed up CSS identifier escaping with a char-class lookup table. (by @​alexander-akait in #​21109)

• Resolve [fullhash] in url() public paths for inlined CSS export types (style/text/css-style-sheet) at runtime. (by @​alexander-akait in #​21054)

• Avoid quadratic line scan when building CSS module exports source maps. (by @​alexander-akait in #​21109)

• Compute CSS comment source locations lazily. (by @​alexander-akait in #​21109)

• Support inline hash digest and length in CSS module localIdentName placeholders. (by @​alexander-akait in #​21259)

• Resolve full CSS escapes (including hex) in CSS-Modules names, so e.g. \75 rl() matches url(). (by @​alexander-akait in #​21196)

• Reduce CSS parser CPU (hoisted per-call regexes, byte-compared @container pure-mode keywords) and stop retaining parsed comments on the reused parser instance between modules. (by @​alexander-akait in #​21202)

• Reduce CSS build time and memory usage. Per-export CSS dependencies are consolidated into one dependency per module, and hot-path allocations and lookups in CSS code generation and the module-graph cache are trimmed. (by @​alexander-akait in #​21114)

• Cache CSS public-path placeholder offsets per module source to avoid re-materializing and re-scanning the source on every render. (by @​alexander-akait in #​21054)

• Fix CSS tokenizer infinite loops and dropped tokens on malformed input. (by @​alexander-akait in #​21102)

• Speed up CSS identifier unescaping with bulk run flushing. (by @​alexander-akait in #​21109)

• Skip already-visited symlink targets when resolving context hashes so cyclic symlink graphs no longer overflow the queue. (by @​alexander-akait in #​21088)

• Resolve DefinePlugin access to an undefined object member as undefined. (by @​alexander-akait in #​21040)

• Avoid materializing dependency source locations when sorting, keeping them lazy to reduce build time and memory. (by @​alexander-akait in #​21228)

• Speed up serialization deserialize by replacing a Buffer.isBuffer call with a typeof check. (by @​hai-x in #​21203)

• Emit assets with absolute target paths as-is to avoid invalid Windows paths. (by @​alexander-akait in #​21223)

• Add output.environment.spread, output.environment.hasOwn, and output.environment.symbol, and use method shorthand, spread, Object.hasOwn, and an unguarded Symbol in generated runtime code where the environment supports it. (by @​alexander-akait in #​21188)

• Drop the unused loadScript runtime from ESM hot-update bundles. (by @​alexander-akait in #​21208)

• Extend value binding optimization to export default expressions. (by @​xiaoxiaojx in #​21117)

• Reduce ExportInfo memory and cache size for inline-exports metadata. (by @​alexander-akait in #​21171)

• Resolve nested exports info paths iteratively to cut per-level array allocations. (by @​alexander-akait in #​21137)

• Fix stale incremental cache for css, html and asset/source/inline modules. (by @​alexander-akait in #​21108)

• CommonJS tree-shaking no longer drops exports accessed before a deferred require binding. (by @​xiaoxiaojx in #​21123)

• Make CSS-referenced asset available in lazy JS chunk during incremental rebuilds. (by @​alexander-akait in #​21100)

• Correct string/template import specifier parsing for filesystem cache build dependencies and fix module-sharing hostname validation. (by @​alexander-akait in #​21232)

• perf: guard isDeferred() behind experiments.deferImport in ConcatenatedModule (by @​shashank-u03 in #​21096)

• Speed up deterministicGrouping and cached comparators on large builds. (by @​alexander-akait in #​21197)

• Reduce allocations on harmony/commonjs dependency hot paths. (by @​alexander-akait in #​21180)

• Force-load a module's new owning chunk during HMR when its only loaded chunk is removed from a runtime, so it keeps receiving updates. (by @​alexander-akait in #​21131)

• Fix HTML parser adoption agency to handle a nobr shielded by a marker. (by @​alexander-akait in #​21274)

• Expand HTML parser tag/attribute coverage and decode character references. (by @​alexander-akait in #​21159)

• Speed up and reduce allocations in the experimental HTML parser's tokenizer, tree builder, and entity decoder. (by @​alexander-akait in #​21152)

• Speed up the experimental HTML parser and reduce its memory usage. (by @​alexander-akait in #​21130)

• Avoid redundant HTML module work: reuse the dependency-template render across the JS and HTML code-generation passes, and memoize sentinel resolution/content hashing per source. (by @​alexander-akait in #​21054)

• Release inner-graph state after use and speed up inlined-export checks. (by @​alexander-akait in #​21167)

• Reduce JavascriptParser allocations on the walk hot path to speed up parsing and lower memory usage. (by @​alexander-akait in #​21139)

• Reduce CPU and memory overhead of the lazy barrel optimization. (by @​alexander-akait in #​21213)

• Keep the error message in module build errors on engines whose Error.stack omits it. (by @​alexander-akait in #​21239)

• Speed up module concatenation by caching repeated per-module computations. (by @​alexander-akait in #​21115)

• Move the hot flag from Module to NormalModule, where it's actually read and written. (by @​alexander-akait in #​21028)

• Move the weak flag from Dependency to ModuleDependency, where it's actually set. (by @​alexander-akait in #​21111)

• Avoid the entry IIFE for multiple inlined entry modules by renaming collisions. (by @​alexander-akait in #​21151)

• Reject new import.defer(...)/new import.source(...) with member access as a SyntaxError. (by @​alexander-akait in #​21211)

• Avoid ProvidePlugin injection for local CommonJS require bindings that use the same variable name. (by @​fireairforce in #​21041)

• Resolve the global new Worker(new URL(...)) to worker_threads on the node target. (by @​alexander-akait in #​21217)

• Use optional chaining in generated runtime code where the environment supports it. (by @​alexander-akait in #​21186)

• Allow output.path to be the filesystem root by treating EISDIR like EEXIST in mkdirp. (by @​alexander-akait in #​21223)

• Reduce memory by not retaining the source location object on every dependency. (by @​alexander-akait in #​21183)

• Keep the full exports object when a require() binding is re-exported. (by @​alexander-akait in #​21144)

• Replace glob-to-regexp dependency with watchpack's globToRegExp utility. (by @​hai-x in #​21176)

• Shrink the persistent cache: add a NULL_AND_I16 binary tier and inline tiny strings instead of larger far back-references. (by @​hai-x in #​21210)

• Type serializer read/write contexts with positional tuples and fix a ProvideSharedDependency version/request swap. (by @​alexander-akait in #​21201)

• Speed up buildChunkGraph by deriving block modules from the first runtime. (by @​alexander-akait in #​21166)

• Cache re-export target resolution in SideEffectsFlagPlugin for faster builds. (by @​alexander-akait in #​21085)

• Skip pure single-star passthrough modules for export * re-exports. (by @​alexander-akait in #​21085)

• Skip dependency error/warning reporting for unchanged modules on rebuilds. (by @​alexander-akait in #​21154)

• Use value descriptors instead of getters for const export bindings. (by @​xiaoxiaojx in #​21021)

• Apply CSS hot updates on the Node side of a universal target. (by @​alexander-akait in #​21217)

• Guard CSS style export-type injection so it no-ops when there is no document. (by @​alexander-akait in #​21193)

• Avoid building warning stats objects when counting warnings without a filter. (by @​alexander-akait in #​21198)

• Recognize forward-slash Windows absolute paths (e.g. C:/dir) consistently. (by @​alexander-akait in #​21223)

webpack/webpack-cli (webpack-cli)

v7.1.0

Compare Source

Minor Changes

• feat(cli): refresh the --help output using commander's configureHelp API — branded headers, section dividers, colorized terms and a clearer footer. Colors and chrome collapse to plain text when output is piped or --no-color is used, so scripts keep working. (by @​alexander-akait in #​4779)

• feat: support .json5, .yaml/.yml and .toml configuration files by parsing them directly, with the parser package (json5, js-yaml, toml) installed on demand by the user and declared as optional peerDependencies so the parsers resolve correctly under Yarn PnP (by @​alexander-akait in #​4777)

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am on wednesday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.