chore(deps): update all non-major dependencies

5.103.0 -> 5.105.1

v5.105.1

Compare Source

Patch Changes

• Fix VirtualUrlPlugin Windows compatibility by sanitizing cache keys and filenames. Cache keys now use toSafePath to replace colons (:) with double underscores (__) and sanitize other invalid characters, ensuring compatibility with Windows filesystem restrictions. (by [xiaoxiaojx](https://github.com/xiaoxiaojx) in #20424)

• Revert part of the createRequire generation behavior for require("node:...") to keep compatibility with those modules exports, e.g. const EventEmitter = require("node:events");. (by [hai-x](https://github.com/hai-x) in #20433)

• Skip guard collection when exports-presence mode is disabled to improve parsing performance. (by [hai-x](https://github.com/hai-x) in #20433)

Released by github-actions[bot] on 2/10/2026

v5.105.0

Compare Source

Minor Changes

• Allow resolving worker module by export condition name when using new Worker() (by [hai-x](https://github.com/hai-x) in #20353)

• Detect conditional imports to avoid compile-time linking errors for non-existent exports. (by [hai-x](https://github.com/hai-x) in #20320)

• Added the tsconfig option for the resolver options (replacement for tsconfig-paths-webpack-plugin). Can be false (disabled), true (use the default tsconfig.json file to search for it), a string path to tsconfig.json, or an object with configFile and references options. (by [alexander-akait](https://github.com/alexander-akait) in #20400)

• Support import.defer() for context modules. (by [ahabhgk](https...

[View full release notes]

Released by github-actions[bot] on 2/3/2026

v5.104.1

Compare Source

5.104.1

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

Released by alexander-akait on 12/18/2025

0.9.12 -> 0.9.13

v0.9.13

Compare Source

Released by github-actions[bot] on 2/10/2026

v0.9.9

Compare Source

Released by github-actions[bot] on 10/15/2025

v0.9.8

Compare Source

Released by github-actions[bot] on 10/7/2025

0.27.0 -> 0.27.3

v0.27.3

Compare Source

• Preserve URL fragments in data URLs (#4370)

  Consider the following HTML, CSS, and SVG:

  • index.html:

    <!DOCTYPE html>
    <html>
      <head><link rel="stylesheet" href="icons.css"></head>
      <body><div class="triangle"></div></body>
    </html>

  • icons.css:

    .triangle {
      width: 10px;
      height: 10px;
      background: currentColor;
      clip-path: url(./triangle.svg#x);
    }

  • triangle.svg:

    <svg xmlns="http://www.w3.org/2000/svg">
      <defs>
        <clipPath id="x">
          <path d="M0 0H10V10Z"/>
        </clipPath>
      </defs>
    </svg>

  The CSS uses a URL fragment (the #x) to reference the clipPath element in the SVG file. Previously esbuild's CSS bundler didn't preserve the URL fragment when bundling the SVG using...

[View full release notes]

Released by github-actions[bot] on 2/5/2026

v0.27.2

Compare Source

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by [hybrist](https://github.com/hybrist).

• Automatically add the -webkit-mask prefix (#4357, #4358)

  This release automatically adds the -webkit- vendor prefix for the [mask](https://de...

[View full release notes]

Released by github-actions[bot] on 12/17/2025

v0.27.1

Compare Source

• Fix bundler bug with var nested inside if (#4348)

  This release fixes a bug with the bundler that happens when importing an ES module using require (which causes it to be wrapped) and there's a top-level var inside an if statement without being wrapped in a { ... } block (and a few other conditions). The bundling transform needed to hoist these var declarations outside of the lazy ES module wrapper for correctness. See the issue for details.

• Fix minifier bug with for inside try inside label (#4351)

  This fixes an old regression from version v0.21.4. Some code was introduced to move the label inside the try statement to address a problem with transforming labeled for await loops to avoid the await (the transformation involves converting the for await loop into a for loop and wrapping it in a try st...

[View full release notes]

Released by github-actions[bot] on 12/3/2025

v2 → v2.1.2

Visit oven-sh/setup-bun for release notes.

v6 → v6.0.2

Visit actions/checkout for release notes.