chore: update dependencies by alexander-akait · Pull Request #221 · webpack/schema-utils

alexander-akait · 2026-09-08T09:55:32Z

Updates the dependencies as far as they go. The package still supports Node.js 10.13.0 and above, engines is unchanged - the dev dependencies now require an active LTS release, and CI installs older ones for the versions of Node.js that cannot run them.

Runtime dependencies

ajv to 8.20.0, ajv-formats to 3.0.1, @types/json-schema to 7.0.15. ajv-formats 3 only moves ajv to a peer dependency, the formats themselves are unchanged. Covered by a changeset.

TypeScript 6

rootDir has to be set now, TypeScript 6 no longer infers it and emitted the declarations to declarations/src/ (TS5011). The emitted declarations are byte identical.

Babel 8 and Jest 30

@babel/core 8 runs on Node.js ^22.18.0 || >=24.11.0 and babel-jest needs it, which in turn needs Jest 30, so neither runs on the older versions of Node.js the package supports. CI installs Babel 7 and Jest 27 there and runs the same test suite - the same thing it already did for TypeScript and del-cli:

npm i -D typescript@4 del-cli@^3 jest@^27 babel-jest@^27 \
         @babel/cli@^7 @babel/core@^7 @babel/preset-env@^7 --ignore-scripts

Node.js 20 joins that group, @babel/core 8 does not support it either. The test matrix itself is unchanged, every version from 10 to 26 still runs the full suite on all three operating systems.

Two things were needed to make that work:

Babel 8 keeps ECMAScript modules when the caller does not say what it supports, which @babel/cli does not, so modules is set to commonjs explicitly. Without it dist is published as ECMAScript modules and fails to load with SyntaxError: Unexpected identifier.
Jest 29 changed the defaults of snapshotFormat, so Jest 27 and Jest 30 disagreed on 78 snapshots. They are set explicitly for both to write the same ones. The snapshots in this PR are reformatted accordingly - src is untouched in that commit, so the messages themselves are unchanged.

Jest 30 no longer needs Prettier 2 for inline snapshots, so prettier-2 is gone.

Housekeeping

commitlint and its hook are removed, changesets covers the changelog now.

Testing

Verified against a real Node.js 10.24.1 runtime, replaying the CI steps from a clean checkout with npm 6: install, npm run build:code with Babel 7, then npm run test:coverage -- --ci - 444 tests and 332 snapshots pass, and the snapshot files are byte identical afterwards, so nothing is silently rewritten. Jest 30 on Node.js 22 passes the same 444 and 332 with the same files. Lint, tsc and the declarations check are clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_013wqLmVHkAGBsWQgXknEQCK

Generated by Claude Code

Everything that can move without breaking a job moves: - `ajv` 8.20.0, `ajv-formats` 3.0.1 and `@types/json-schema` 7.0.15 - `ajv-formats` 3 only moves `ajv` to a peer dependency, the formats are unchanged and the suite passes unmodified - `eslint` 10, `@commitlint/*` 21, `lint-staged` 17, `del` 8, `del-cli` 7, `@types/node` 26, `husky` 9, and the latest patches of `@babel/*`, `prettier`, `webpack` and `eslint-config-webpack` `husky` 9 drops `husky install` and the sourcing preamble in the hooks, so `prepare` calls `husky` and the hooks are plain scripts. `.husky/_` now carries its own ignore file, so the one in `.husky` is gone. Held back, each because it would break something: - `@babel/*` 8 needs Node `^22.18 || >=24.11`, but the Node 10 to 18 jobs run `build:code` - `jest` and `babel-jest` 30 need Node `^18.14 || ^20 || ^22 || >=24`, and the same jobs run the tests - `prettier-2` is what `jest.config.js` points `prettierPath` at, so it stays on 2 while `jest` stays on 27 - `typescript` 7 is outside the `>=4.8.4 <7.0.0` peer range of `eslint-config-webpack` - `@changesets/get-github-info` 1 renames the exports the changelog generator uses, and the release path cannot be exercised here without a token, so it and `@changesets/cli` stay where they were just proven `@commitlint/*` 21, `lint-staged` 17 and `eslint` 10 raise the Node needed to develop the package to 22.12, 22.22 and 20.19 - the package itself still supports `>= 10.13.0` and every test job still runs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wqLmVHkAGBsWQgXknEQCK

The changelog comes from the changesets now, not from the commit messages, so conventional commits are no longer load bearing. `less-loader`, whose release setup this repository just adopted, does not have `commitlint` either. Removed the `commitlint` script, both `@commitlint` dev dependencies, `commitlint.config.js`, the `commit-msg` hook and the `Check commit message` step of the lint job. `pre-commit` still runs `lint-staged`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wqLmVHkAGBsWQgXknEQCK

`eslint-config-webpack` still caps `typescript` below 7, so 6 is as far as it goes for now. Two things in `tsconfig.json` had to move with it: - `rootDir` is set explicitly. TypeScript 6 no longer infers the common source directory (TS5011), and without it the declarations were emitted to `declarations/src` instead of `declarations`, which is where `types` points - `moduleResolution` `node` is deprecated in 6 and stops working in 7, so it and `module` are `node16`, which is what this package is - CommonJS resolved by Node The emitted declarations are byte for byte the ones already committed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wqLmVHkAGBsWQgXknEQCK

The dev dependencies now require an active LTS release of Node.js, the package itself still supports Node.js 10.13.0 and above. `@babel/core` 8 runs on Node.js `^22.18.0 || >=24.11.0` and `babel-jest` needs it, which in turn needs Jest 30, so CI installs Babel 7 and Jest 27 on the versions of Node.js that cannot run them and runs the same test suite there - the same thing it already did for TypeScript and `del-cli`. Node.js 20 joins them, `@babel/core` 8 does not support it either. Jest 29 changed the defaults of `snapshotFormat`, so they are set explicitly for both to write the same snapshots. The snapshots are reformatted accordingly - `src` is untouched, so the messages themselves are unchanged. Babel 8 keeps ECMAScript modules when the caller does not say what it supports, which `@babel/cli` does not, so `modules` is set to `commonjs` explicitly. Without it `dist` is published as ECMAScript modules. Jest 30 no longer needs Prettier 2 for inline snapshots, so `prettier-2` is gone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wqLmVHkAGBsWQgXknEQCK

codecov · 2026-09-08T09:56:37Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.78%. Comparing base (d72a15b) to head (eeaf8ba).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #221   +/-   ##
=======================================
  Coverage   95.78%   95.78%           
=======================================
  Files           9        9           
  Lines         949      949           
  Branches      386      387    +1     
=======================================
  Hits          909      909           
  Misses         36       36           
  Partials        4        4

Flag	Coverage Δ
integration	`95.78% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

socket-security · 2026-09-08T09:58:55Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
husky@7.0.4 ⏵ 9.1.7	⁺¹		^-17
jest@27.5.1 ⏵ 30.5.1			⁺²	^-1
@babel/cli@7.28.6 ⏵ 8.0.4	⁺¹			⁺²
@babel/core@7.29.6 ⏵ 8.0.1	⁺²
@babel/preset-env@7.28.6 ⏵ 8.0.2	⁺¹		⁺⁴
del-cli@4.0.1 ⏵ 7.0.0			⁺⁵
del@6.1.1 ⏵ 8.0.1
@types/node@22.19.7 ⏵ 26.5.0			⁺¹
babel-jest@27.5.1 ⏵ 30.5.1	⁺¹		⁺⁶	^-1
ajv-formats@3.0.1
ajv@6.12.6 ⏵ 8.20.0		⁺²
eslint-config-webpack@4.9.0 ⏵ 4.9.6	⁺¹		⁺¹	^-2
typescript@5.9.3 ⏵ 6.0.3	⁺¹		⁺¹
webpack@5.104.1 ⏵ 5.110.3	^-1			⁺¹
prettier@3.8.1 ⏵ 3.9.6			⁺¹
lint-staged@16.2.7 ⏵ 17.5.0	⁺¹			^-2
eslint@9.39.2 ⏵ 10.10.0	⁺¹			⁺⁴⁷

View full report

socket-security · 2026-09-08T09:58:57Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `eslint-plugin-jsdoc` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/eslint-config-webpack@4.9.6` → `npm/eslint-plugin-jsdoc@62.9.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-jsdoc@62.9.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `yargs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/jest@30.5.1` → `npm/yargs@17.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yargs@17.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

npm 6, which Node.js 10, 12 and 14 ship, resolves the downgrade to Babel 7 and Jest 27 without complaint, but npm 7 and above refuse it - the lockfile pins Babel 8 and they report an `ERESOLVE` peer conflict against it instead of replacing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wqLmVHkAGBsWQgXknEQCK

alexander-akait and others added 4 commits September 8, 2026 09:15

alexander-akait merged commit fc918a9 into main Sep 8, 2026
33 checks passed

alexander-akait deleted the claude/filter-errors-quadratic-sibling-dos-1tqe2l branch September 8, 2026 10:37

github-actions Bot mentioned this pull request Sep 8, 2026

chore(release): new release #220

Merged

Navigation Menu

Uh oh!

chore: update dependencies - #221

chore: update dependencies#221
alexander-akait merged 5 commits into
mainfrom
claude/filter-errors-quadratic-sibling-dos-1tqe2l

alexander-akait commented Sep 8, 2026

Uh oh!

codecov Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

alexander-akait commented Sep 8, 2026

Runtime dependencies

TypeScript 6

Babel 8 and Jest 30

Housekeeping

Testing

Uh oh!

codecov Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

socket-security Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codecov Bot commented Sep 8, 2026 •

edited

Loading

socket-security Bot commented Sep 8, 2026 •

edited

Loading

socket-security Bot commented Sep 8, 2026 •

edited

Loading