build(deps-dev): bump the dev-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the dev-dependencies group with 5 updates in the / directory:

Package	From	To
@babel/cli	8.0.1	8.0.4
ansi-regex	6.2.2	6.3.0
minimatch	10.2.5	10.2.6
serialize-javascript	7.0.7	7.1.1
webpack	5.108.3	5.110.3

Updates @babel/cli from 8.0.1 to 8.0.4

Release notes

Sourced from @​babel/cli's releases.

v8.0.4 (2026-07-09)

👓 Spec Compliance

• babel-parser, babel-plugin-transform-typescript
  • #18120 fix(parser): disallow declare module M {} (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-transform-typescript
  • #18100 fix(parser): forbid let x! and let x! = (@​JLHwung)

🐛 Bug Fix

• babel-traverse
  • #18122 fix: replaceWith in Visitor#exit should not stop traversal (@​liuxingbaoyu)

🏠 Internal

• babel-helper-validator-identifier
  • #18084 refactor: Shrink validator identifier size (@​JLHwung)

Committers: 4

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu

v8.0.3 (2026-06-27)

🐛 Bug Fix

• babel-core, babel-plugin-syntax-typescript
  • #18089 fix: Remove isTSX from babel-plugin-syntax-typescript types (@​liuxingbaoyu)
• babel-standalone
  • #18086 fix: Use runtime: 'classic' in the browser for React (@​liuxingbaoyu)

Committers: 2

• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu

v8.0.2 (2026-06-18)

🐛 Bug Fix

• Other
  • #18083 Use the @babel/core version when asserting version in @babel/standalone (@​nicolo-ribaudo)
• babel-helper-validator-identifier
  • #18075 fix(identifier): avoid double escaping slash (@​JLHwung)

🏠 Internal

• babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env
  • #18081 Update @babel/preset-modules and polyfill packages (@​nicolo-ribaudo)

Committers: 2

• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)

Changelog

Sourced from @​babel/cli's changelog.

v8.0.4 (2026-07-09)

👓 Spec Compliance

• babel-parser, babel-plugin-transform-typescript
  • #18120 fix(parser): disallow declare module M {} (@​JLHwung)
• babel-generator, babel-parser, babel-plugin-transform-typescript
  • #18100 fix(parser): forbid let x! and let x! = (@​JLHwung)

🐛 Bug Fix

• babel-traverse
  • #18122 fix: replaceWith in Visitor#exit should not stop traversal (@​liuxingbaoyu)

🏠 Internal

• babel-helper-validator-identifier
  • #18084 refactor: Shrink validator identifier size (@​JLHwung)

v8.0.3 (2026-06-27)

🐛 Bug Fix

• babel-core, babel-plugin-syntax-typescript
  • #18089 fix: Remove isTSX from babel-plugin-syntax-typescript types (@​liuxingbaoyu)
• babel-standalone
  • #18086 fix: Use runtime: 'classic' in the browser for React (@​liuxingbaoyu)

v8.0.2 (2026-06-18)

🐛 Bug Fix

• Other
  • #18083 Use the @babel/core version when asserting version in @babel/standalone (@​nicolo-ribaudo)
• babel-helper-validator-identifier
  • #18075 fix(identifier): avoid double escaping slash (@​JLHwung)

🏠 Internal

• babel-plugin-proposal-decorators, babel-plugin-transform-regenerator, babel-preset-env
  • #18081 Update @babel/preset-modules and polyfill packages (@​nicolo-ribaudo)

Commits

• 8ed5db1 v8.0.4
• b8e669f chore: bump chokidar to 5.0.0 (#18112)
• See full diff in compare view

Updates ansi-regex from 6.2.2 to 6.3.0

Release notes

Sourced from ansi-regex's releases.

v6.3.0

• Improve performance f1bf1f0

---

chalk/ansi-regex@v6.2.2...v6.3.0

Commits

• 7cf0228 6.3.0
• f1bf1f0 Improve performance
• ff37845 Fix broken tests
• See full diff in compare view

Updates minimatch from 10.2.5 to 10.2.6

Commits

• ded1bbd 10.2.6
• 0215dfe update deps and lint
• 10968ea improve test for .. eating drive letters
• See full diff in compare view

Updates serialize-javascript from 7.0.7 to 7.1.1

Release notes

Sourced from serialize-javascript's releases.

v7.1.1

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @​okuryu in yahoo/serialize-javascript#226
• release: v7.1.1 by @​okuryu in yahoo/serialize-javascript#227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

• feat: add Node.js 26 to test matrix by @​okuryu in yahoo/serialize-javascript#224
• release: v7.1.0 by @​okuryu in yahoo/serialize-javascript#225

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

Commits

• 8c8caa7 release: v7.1.1
• ffda9f1 fix: fix XSS bypass via split </script payload across function bodies
• 739145a release: v7.1.0
• 57865ed feat: add Node.js 26 to test matrix
• See full diff in compare view

Updates webpack from 5.108.3 to 5.110.3

Release notes

Sourced from webpack's releases.

v5.110.3

Patch Changes

• Fix import() options, circular reexport severity and namespace writes. (by @​alexander-akait in #21867)

• Skip ESM interop when require() targets a module outside the concatenation. (by @​hai-x in #21884)

• Fix concatenated require() in a require.ensure callback or a computed request. (by @​hai-x in #21907)

• Keep optimization.minimize a boolean; its options move to minimizeOptions. (by @​alexander-akait in #21886)

• Fix mangled exports read through require() and a leaked internal reference. (by @​alexander-akait in #21905)

• Fix new on a default import of a wrapped CommonJS module. (by @​alexander-akait in #21876)

• Throw when a deferred namespace of an async module is forced while it evaluates. (by @​alexander-akait in #21871)

• Do not report a missing export for a name a side-effect-free barrel defers. (by @​alexander-akait in #21874)

• Fix queue, URL scheme, dotenv, HTTP module and persistent cache edge cases. (by @​alexander-akait in #21901)

• Evaluate a deferred import's async dependencies where the import sits. (by @​alexander-akait in #21902)

• Omit ambiguous export * names from the module namespace. (by @​alexander-akait in #21878)

v5.110.2

Patch Changes

• Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by @​alexander-akait in #21851)

• Minify more HTML and CSS shorthands, and cut two costs off printing. (by @​alexander-akait in #21842)

• Report a named import that is never read when it names a missing export. (by @​alexander-akait in #21856)

• Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by @​alexander-akait in #21852)

• Stop output.html emitting an unused JS chunk for each generated page. (by @​alexander-akait in #21859)

• Stop emitting the CSS chunk loading runtime when every CSS chunk is initial. (by @​alexander-akait in #21862)

• Strip a BOM a loader put on a string, and shift a source map that counted it. (by @​alexander-akait in #21857)

v5.110.1

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @​alexander-akait in #21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by @​alexander-akait in #21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by @​AgentEnder in #21845)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.3

Patch Changes

• Fix import() options, circular reexport severity and namespace writes. (by @​alexander-akait in #21867)

• Skip ESM interop when require() targets a module outside the concatenation. (by @​hai-x in #21884)

• Fix concatenated require() in a require.ensure callback or a computed request. (by @​hai-x in #21907)

• Keep optimization.minimize a boolean; its options move to minimizeOptions. (by @​alexander-akait in #21886)

• Fix mangled exports read through require() and a leaked internal reference. (by @​alexander-akait in #21905)

• Fix new on a default import of a wrapped CommonJS module. (by @​alexander-akait in #21876)

• Throw when a deferred namespace of an async module is forced while it evaluates. (by @​alexander-akait in #21871)

• Do not report a missing export for a name a side-effect-free barrel defers. (by @​alexander-akait in #21874)

• Fix queue, URL scheme, dotenv, HTTP module and persistent cache edge cases. (by @​alexander-akait in #21901)

• Evaluate a deferred import's async dependencies where the import sits. (by @​alexander-akait in #21902)

• Omit ambiguous export * names from the module namespace. (by @​alexander-akait in #21878)

5.110.2

Patch Changes

• Fix analyzable ESM baking around cycles, mixed-served wasm and style url maps. (by @​alexander-akait in #21851)

• Minify more HTML and CSS shorthands, and cut two costs off printing. (by @​alexander-akait in #21842)

• Report a named import that is never read when it names a missing export. (by @​alexander-akait in #21856)

• Fix ESM circular reexports, cyclic const TDZ, and defer evaluation order. (by @​alexander-akait in #21852)

• Stop output.html emitting an unused JS chunk for each generated page. (by @​alexander-akait in #21859)

• Stop emitting the CSS chunk loading runtime when every CSS chunk is initial. (by @​alexander-akait in #21862)

• Strip a BOM a loader put on a string, and shift a source map that counted it. (by @​alexander-akait in #21857)

5.110.1

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @​alexander-akait in #21843)

... (truncated)

Commits

• a2d7b9c chore(release): new release (#21868)
• d6e86c0 test(test262): assert two more errors webpack reports at build time (#21906)
• 6a963fe fix: keep require() into a concatenation substituted and unmangled (#21905)
• e1eb099 fix: concatenated require() in require.ensure callback or computed reques...
• 8d1ab53 chore: escape literal NUL bytes in Compilation.js (#21904)
• 5e6c4d7 fix(defer): evaluate async dependencies where the deferred import sits (#21902)
• 7ea4fa3 fix: handle audited correctness edge cases (#21901)
• c50713c fix: keep code generation data per result instead of per NormalModule (#21900)
• ebd3be4 docs: document the post-minor stabilization week and out-of-band releases (#2...
• 80be700 fix(config): keep the resolved optimization.minimize a boolean (#21886)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions