Bump micromatch, laravel-mix, webpack and webpack-cli in /hugo

[dependabot]

Bumps micromatch to 4.0.8 and updates ancestor dependencies micromatch, laravel-mix, webpack and webpack-cli. These dependencies need to be updated together.

Updates micromatch from 3.1.10 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

4.0.4

• fix: Update picomatch to fix regression #179 (8becb55)

4.0.3

• Enforce newer version of picomatch with bugfixes

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

• backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

• this is basically v4.0.5, with some README updates
• it is vulnerable to CVE-2024-4067
• Updated braces to v3.0.3 to avoid CVE-2024-4068
• does NOT break API compatibility

[4.0.6] - 2024-05-21

• Added hasBraces to check if a pattern contains braces.
• Fixes CVE-2024-4067
• BREAKS API COMPATIBILITY
• Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

• Adds support for options.onMatch. See the readme for details
• Adds support for options.onIgnore. See the readme for details
• Adds support for options.onResult. See the readme for details

Breaking changes

• Require Node.js >= 8.6
• Removed support for passing an array of brace patterns to micromatch.braces().
• To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
• cache - caching and all related options and methods have been removed
• options.unixify was renamed to options.windows
• options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
• options.snapdragon was removed, as snapdragon is no longer used.
• options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

• micromatch results are directly compared to bash results
• in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
• micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

• 8bd704e 4.0.8
• a0e6841 run verb to generate README documentation
• 4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
• 03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
• 814f5f7 lint
• 67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
• 113f2e3 fix: CVE numbers in CHANGELOG
• d9dbd9a feat: updated CHANGELOG
• 2ab1315 fix: use actions/setup-node@v4
• 1406ea3 feat: rework test to work on macos with node 10,12 and 14
• Additional commits viewable in compare view

Updates laravel-mix from 4.1.4 to 6.0.49

Release notes

Sourced from laravel-mix's releases.

v6.0.0

This release brings Laravel Mix current with webpack 5. It additionally includes a variety of bug fixes and enhancements.

• Changelog
• Upgrade Guide

v6.0.0-alpha.0

Add webpack 5 support.

v5.0.5

No release notes provided.

v5.0.0

• Add support for sass-loader 8

Changelog

Sourced from laravel-mix's changelog.

Changelog

6.0.14

• BabelConfig.fetchBabelRc / static BabelConfig.default / static BabelConfig.generate have all been deprecated. They are no longer used by Mix itself but remain for backwards compatability.
• MixDefinitionsPlugin.getDefinitions and static MixDefinitionsPlugin.build have been deprecated. They are no longer used by Mix itself but remain for backwards compatability.
• static Chunks._instance / static Chunks.instance() / static Chunks.reset() are now deprecated and will be removed in a future release.
• The static methods on HotReloading are now deprecated. They have been replaced with instance methods.
• The use of the globals Mix, Config, and webpackConfig are now deprecated and will warn on use in Mix v7.

We are working toward an API for access to Mix for extensions that does not assume that it is a global or that it is the same instance in all cases.

In the mean time:

• Uses of Chunks.instance() may be replaced with Mix.chunks
• Uses of Config may be replaced with Mix.config
• Uses of webpackConfig may be replaced with Mix.webpackConfig
• Uses of HotReloading.* methods Mix.hot.*

6.0

View upgrade guide.

Added

• Support for webpack 5
• New npx mix executable for triggering your build
• Support for Vue 3 applications
• Support for PostCSS 8
• New mix.vue() and mix.react() commands
• New mix.alias() command (Learn More)
• Support for changing the webpack manifest output path (Learn More)
• New mix.before() hook (Learn More)
• Improved mix.combine() wildcard support
• Improved mix.extract() priority and tree-shaking logic

Changed

• Fixed "empty CSS file" extraction bug when using dynamic imports
• Fixed mix.ts() TypeScript bug that skipped Babel transformation in certain cases
• Fixed and improved PostCSS plugin autoloading and merging
• Fixed an issue related to hot module reloading when versioning is enabled
• Added TypeScript types for API

Upgrade guide

Sourced from laravel-mix's upgrade guide.

Upgrade to Mix 6

• Review Your Dependencies
• Check Your Node Version
• Update Your NPM Scripts
• Watch Ignores Node_Modules
• API for JavaScript Frameworks
• Vue Configuration
• Legacy Node Polyfills
• Autoprefixer Options
• Unused Library Extraction
• Automatically Ignored Node Modules
• Did We Miss Something?

npm install laravel-mix@latest

Review Your Dependencies

Laravel Mix 6 ships with support for the latest versions of numerous dependencies, including webpack 5, PostCSS 8, Vue Loader 16, and more. These are significant releases with their own sets of breaking changes. We've done our best to normalize these changes, but it's still particularly important that you take the time to fully test your build after upgrading to Mix 6.

Please review your package.json dependencies list for any third-party tools or plugins that may not yet be compatible with webpack 5 or PostCSS 8.

Check Your Node Version

Mix has bumped its minimum Node requirement from version 8 to 12.14.0. Please check which version you have installed (node -v) and ensure that it meets this requirement.

Update Your NPM Scripts

If your build throws an error such as Unknown argument: --hide-modules, the scripts section of your package.json file will need to be updated. The Webpack 5 CLI removed a number of options that your NPM scripts was likely referencing.

While you're at it, go ahead and switch over to the new Mix CLI.

Before

"scripts": {
    "development": "cross-env NODE_ENV=development node_modules/webpack/bin/webpack.js --progress --hide-modules --config=node_modules/laravel-mix/setup/webpack.config.js",
    "watch": "npm run development -- --watch",
    "watch-poll": "npm run watch -- --watch-poll",
    "hot": "cross-env NODE_ENV=development node_modules/webpack-dev-server/bin/webpack-dev-server.js --inline --hot --disable-host-check --config=node_modules/laravel-mix/setup/webpack.config.js",
    "production": "cross-env NODE_ENV=production node_modules/webpack/bin/webpack.js --no-progress --hide-modules --config=node_modules/laravel-mix/setup/webpack.config.js"
}
</tr></table> 

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by thecrypticace, a new releaser for laravel-mix since your current version.

Updates webpack from 4.47.0 to 5.96.1

Release notes

Sourced from webpack's releases.

v5.96.1

Bug Fixes

• [Types] Add @types/eslint-scope to dependencieS
• [Types] Fixed regression in validate

v5.96.0

Bug Fixes

• Fixed Module Federation should track all referenced chunks
• Handle Data URI without base64 word
• HotUpdateChunk have correct runtime when modified with new runtime
• Order of chunks ids in generated chunk code
• No extra Javascript chunks when using asset module as an entrypoint
• Use optimistically logic for output.environment.dynamicImport to determine chunk format when no browserslist or target
• Collision with global variables for optimization.avoidEntryIife
• Avoid through variables in inlined module
• Allow chunk template strings in output.devtoolNamespace
• No extra runtime for get javascript/css chunk filename
• No extra runtime for prefetch and preload in JS runtime when it was unsed in CSS
• Avoid cache invalidation using ProgressPlugin
• Increase parallelism when using importModule on the execution stage
• Correctly parsing string in export and import
• Typescript types
• [CSS] css/auto considers a module depending on its filename as css (pure CSS) or css/local, before it was css/global and css/local
• [CSS] Always interpolate classes even if they are not involved in export
• [CSS] No extra runtime in Javascript runtime chunks for asset modules used in CSS
• [CSS] No extra runtime in Javascript runtime chunks for external asset modules used in CSS
• [CSS] No extra runtime for the node target
• [CSS] Fixed url()s and @import parsing
• [CSS] Fixed - emit a warning on broken :local and :global

New Features

• Export CSS and ESM runtime modules
• Single Runtime Chunk and Federation eager module hoisting
• [CSS] Support /* webpackIgnore: true */ for CSS files
• [CSS] Support src() support
• [CSS] CSS nesting in CSS modules

v5.95.0

Bug Fixes

• Fixed hanging when attempting to read a symlink-like file that it can't read
• Handle default for import context element dependency
• Merge duplicate chunks call after split chunks
• Generate correctly code for dynamically importing the same file twice and destructuring
• Use content hash as [base] and [name] for extracted DataURI's
• Distinguish module and import in module-import for externals import's

... (truncated)

Commits

• d4ced73 chore(release): 5.96.1
• 7d6dbea fix: types regression in validate
• 5c556e3 fix: types regression in validate
• 2420eae fix: add @types/eslint-scope to dependencies due types regression
• ec45d2d fix: add @types/eslint-scope to dependencies
• aff0c3e chore(release): 5.96.0
• 6f11ec1 refactor: module source types code
• b07142f refactor: module source types code
• 7d98b3c fix: Module Federation should track all referenced chunks
• 6d09769 chore: linting
• Additional commits viewable in compare view

Updates webpack-cli from 3.3.12 to 5.1.4

Release notes

Sourced from webpack-cli's releases.

v5.1.4

5.1.4 (2023-06-07)

Bug Fixes

• multi compiler progress output (f659624)

v5.1.3

5.1.3 (2023-06-04)

Bug Fixes

• regression for custom configurations (#3834) (bb4f8eb)

v5.1.2

5.1.2 (2023-06-04)

Bug Fixes

• improve check for custom webpack and webpack-dev-server package existance (0931ab6)
• improve help for some flags (f468614)
• improved support for .cts and .mts extensions (a77daf2)

v5.1.1

5.1.1 (2023-05-09)

Bug Fixes

• false positive warning when --watch used (#3783) (c0436ba)

v5.1.0

5.1.0 (2023-05-07)

Features

• shareable webpack configs using extends (#3738) (d04d0b9)

Performance Improvements

• simplify logic, reduce extra loops and perf (#3767) (6afe1d3)

v5.0.2

5.0.2 (2023-04-21)

Bug Fixes

• error message for missing default export in configuration (#3685) (e0a4a09)
• perf: reduced startup time (3b79059)

v5.0.1

... (truncated)

Changelog

Sourced from webpack-cli's changelog.

5.1.4 (2023-06-07)

Bug Fixes

• multi compiler progress output (f659624)

5.1.3 (2023-06-04)

Bug Fixes

• regression for custom configurations (#3834) (bb4f8eb)

5.1.2 (2023-06-04)

Bug Fixes

• improve check for custom webpack and webpack-dev-server package existance (0931ab6)
• improve help for some flags (f468614)
• improved support for .cts and .mts extensions (a77daf2)

5.1.1 (2023-05-09)

Bug Fixes

• false positive warning when --watch used (#3783) (c0436ba)

5.1.0 (2023-05-07)

Features

• shareable webpack configs using extends (#3738) (d04d0b9)

Performance Improvements

• simplify logic, reduce extra loops and perf (#3767) (6afe1d3)

5.0.2 (2023-04-21)

Bug Fixes

• error message for missing default export in configuration (#3685) (e0a4a09)
• perf: reduced startup time (3b79059)

5.0.1 (2022-12-05)

Bug Fixes

• make define-process-env-node-env alias node-env (#3514) (346a518)

5.0.0 (2022-11-17)

... (truncated)

Commits

• e07f0e5 chore(release): publish new version
• 0345c6f chore(deps-dev): bump @​typescript-eslint/parser from 5.59.8 to 5.59.9 (#3839)
• f659624 fix: multi compiler progress output
• 0d1ff01 chore(deps-dev): bump webpack from 5.85.0 to 5.85.1 (#3837)
• a7ec146 chore(deps-dev): bump @​typescript-eslint/eslint-plugin (#3838)
• 9464635 chore(deps-dev): bump eslint from 8.41.0 to 8.42.0 (#3835)
• cf1796f docs: update changelog
• 7899c39 chore(release): publish new version
• bb4f8eb fix: regression for custom configurations (#3834)
• 14b9c18 docs: update changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying radio-t-site with    Cloudflare Pages

Latest commit:	b6f671c
Status:	✅  Deploy successful!
Preview URL:	https://1ed3db3d.radio-t-site.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-hugo-0jk6.radio-t-site.pages.dev

View logs

[paskal]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with master! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[github-actions]

size-limit report 📦

Path	Size
static/build/app.js	19.14 KB (+15.96% 🔺)
static/build/manifest.js	845 B (+16.4% 🔺)
static/build/vendor.js	126.08 KB (-3.89% 🔽)
static/build/app.css	7.24 KB (-1.38% 🔽)
static/build/app-dark.css	7.29 KB (-1.38% 🔽)
static/build/vendor.css	5.97 KB (-6.89% 🔽)
static/build/vendor-dark.css	6.01 KB (-7.86% 🔽)

[github-actions]

Site Build Comparison

Build completed at: 2024-11-03 11:26:11 UTC

Changed files:

- Modified: `build/vendor.js`
- Modified: `build/app.css`
- New: `build/vendor.js.LICENSE.txt`
- New: `build/app.js.LICENSE.txt`
- Modified: `build/vendor.css`
- Modified: `build/manifest.js`
- Modified: `build/app-dark.css`
- Modified: `build/app.js`
- Modified: `build/vendor-dark.css`

View full changes diff

[paskal]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[paskal]

CSS diff is just different sorting of properties, overall should be good. Testing manually side-by-side with the radiot.com now.

[paskal]

Checked side by side interface and comments and multiple pages look and playback functionality, all works the same. Merging.