Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Oct 9, 2025

Bumps the npm_and_yarn group with 2 updates in the /apps/extension directory: webpack and webpack-dev-server.
Bumps the npm_and_yarn group with 1 update in the /apps/mobile directory: react-native-mmkv.
Bumps the npm_and_yarn group with 3 updates in the /apps/web directory: webpack, graphql and hono.
Bumps the npm_and_yarn group with 1 update in the /packages/api directory: graphql.
Bumps the npm_and_yarn group with 2 updates in the /packages/uniswap directory: react-native-mmkv and graphql.
Bumps the npm_and_yarn group with 1 update in the /packages/utilities directory: graphql.
Bumps the npm_and_yarn group with 1 update in the /packages/wallet directory: graphql.

Updates webpack from 5.90.0 to 5.94.0

Release notes

Sourced from webpack's releases.

v5.94.0

Bug Fixes

  • Added runtime condition for harmony reexport checked
  • Handle properly data/http/https protocols in source maps
  • Make bigint optimistic when browserslist not found
  • Move @​types/eslint-scope to dev deps
  • Related in asset stats is now always an array when no related found
  • Handle ASI for export declarations
  • Mangle destruction incorrect with export named default properly
  • Fixed unexpected asi generation with sequence expression
  • Fixed a lot of types

New Features

  • Added new external type "module-import"
  • Support webpackIgnore for new URL() construction
  • [CSS] @import pathinfo support

Security

  • Fixed DOM clobbering in auto public path

v5.93.0

Bug Fixes

  • Generate correct relative path to runtime chunks
  • Makes DefinePlugin quieter under default log level
  • Fixed mangle destructuring default in namespace import
  • Fixed consumption of eager shared modules for module federation
  • Strip slash for pretty regexp
  • Calculate correct contenthash for CSS generator options

New Features

  • Added the binary generator option for asset modules to explicitly keep source maps produced by loaders
  • Added the modern-module library value for tree shakable output
  • Added the overrideStrict option to override strict or non-strict mode for javascript modules

v5.92.1

Bug Fixes

  • Doesn't crash with an error when the css experiment is enabled and contenthash is used

v5.92.0

Bug Fixes

  • Correct tidle range's comutation for module federation
  • Consider runtime for pure expression dependency update hash
  • Return value in the subtractRuntime function for runtime logic

... (truncated)

Commits
  • eabf85d chore(release): 5.94.0
  • 955e057 security: fix DOM clobbering in auto public path
  • 9822387 test: fix
  • cbb86ed test: fix
  • 5ac3d7f fix: unexpected asi generation with sequence expression
  • 2411661 security: fix DOM clobbering in auto public path
  • b8c03d4 fix: unexpected asi generation with sequence expression
  • f46a03c revert: do not use heuristic fallback for "module-import"
  • 60f1898 fix: do not use heuristic fallback for "module-import"
  • 66306aa Revert "fix: module-import get fallback from externalsPresets"
  • Additional commits viewable in compare view

Updates webpack-dev-server from 4.15.1 to 5.2.1

Release notes

Sourced from webpack-dev-server's releases.

v5.2.1

5.2.1 (2025-03-26)

Security

  • cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
  • requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

  • prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
  • take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

v5.2.0

5.2.0 (2024-12-11)

Features

  • added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

  • speed up initial client bundling (145b5d0)

v5.1.0

5.1.0 (2024-09-03)

Features

  • add visual progress indicators (a8f40b7)
  • added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
  • allow the server option to be Function (#5275) (02a1c6d)
  • http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

v5.0.4

5.0.4 (2024-03-19)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.1 (2025-03-26)

Security

  • cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
  • requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

  • prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
  • take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

5.2.0 (2024-12-11)

Features

  • added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

  • speed up initial client bundling (145b5d0)

5.1.0 (2024-09-03)

Features

  • add visual progress indicators (a8f40b7)
  • added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
  • allow the server option to be Function (#5275) (02a1c6d)
  • http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

5.0.4 (2024-03-19)

Bug Fixes

... (truncated)

Commits
  • 0d22a08 chore(release): 5.2.1
  • 6045b1e chore(deps): update (#5444)
  • ffd0b86 fix: take the first network found instead of the last one, this restores the ...
  • 9ea7b08 ci: update dependency-review-action (#5442)
  • 5c9378b Merge commit from fork
  • d2575ad Merge commit from fork
  • 8c1abc9 fix: prevent overlay for errors caught by React error boundaries (#5431)
  • 5a39c70 ci: update codecov/codecov-action to v5 (#5406)
  • 55220a8 chore(deps-dev): bump the dependencies group across 1 directory with 4 update...
  • 09f6f8e chore(deps): bump the dependencies group across 1 directory with 2 updates (#...
  • Additional commits viewable in compare view

Updates react-native-mmkv from 2.10.1 to 2.11.0

Release notes

Sourced from react-native-mmkv's releases.

Release 2.11.0

2.11.0 (2023-11-10)

📚 Documentation

✨ Features

🐛 Bug Fixes

  • Don't leak encryption key in logs (a8995cc)
  • Fix "Failed to create MMKV instance" reload/fast refresh JSI error on Expo (#602) (1c58a78)
  • Fix correct behavior of function setState parameter (#598) (f391f9b)
  • Include banner in npm package (6327d85)

Release 2.10.2

2.10.2 (2023-08-25)

🐛 Bug Fixes

  • revert change AndroidManifest to support RN < 0.71 (#561) (40b71fe)
Commits
  • de2bde2 chore: release 2.11.0
  • 1c58a78 fix: Fix "Failed to create MMKV instance" reload/fast refresh JSI error on Ex...
  • 7683a65 feat: add basic test suite for hooks (#600)
  • f391f9b fix: Fix correct behavior of function setState parameter (#598)
  • 6327d85 fix: Include banner in npm package
  • 01b2bb2 feat: Add support for AGP>=8 (#589)
  • a7e5e90 docs: New banner
  • a8995cc fix: Don't leak encryption key in logs
  • f564552 Add community discord
  • d097084 feat: Add clang-format to lint the C++ codebase (#578)
  • Additional commits viewable in compare view

Updates webpack from 5.90.0 to 5.94.0

Release notes

Sourced from webpack's releases.

v5.94.0

Bug Fixes

  • Added runtime condition for harmony reexport checked
  • Handle properly data/http/https protocols in source maps
  • Make bigint optimistic when browserslist not found
  • Move @​types/eslint-scope to dev deps
  • Related in asset stats is now always an array when no related found
  • Handle ASI for export declarations
  • Mangle destruction incorrect with export named default properly
  • Fixed unexpected asi generation with sequence expression
  • Fixed a lot of types

New Features

  • Added new external type "module-import"
  • Support webpackIgnore for new URL() construction
  • [CSS] @import pathinfo support

Security

  • Fixed DOM clobbering in auto public path

v5.93.0

Bug Fixes

  • Generate correct relative path to runtime chunks
  • Makes DefinePlugin quieter under default log level
  • Fixed mangle destructuring default in namespace import
  • Fixed consumption of eager shared modules for module federation
  • Strip slash for pretty regexp
  • Calculate correct contenthash for CSS generator options

New Features

  • Added the binary generator option for asset modules to explicitly keep source maps produced by loaders
  • Added the modern-module library value for tree shakable output
  • Added the overrideStrict option to override strict or non-strict mode for javascript modules

v5.92.1

Bug Fixes

  • Doesn't crash with an error when the css experiment is enabled and contenthash is used

v5.92.0

Bug Fixes

  • Correct tidle range's comutation for module federation
  • Consider runtime for pure expression dependency update hash
  • Return value in the subtractRuntime function for runtime logic

... (truncated)

Commits
  • eabf85d chore(release): 5.94.0
  • 955e057 security: fix DOM clobbering in auto public path
  • 9822387 test: fix
  • cbb86ed test: fix
  • 5ac3d7f fix: unexpected asi generation with sequence expression
  • 2411661 security: fix DOM clobbering in auto public path
  • b8c03d4 fix: unexpected asi generation with sequence expression
  • f46a03c revert: do not use heuristic fallback for "module-import"
  • 60f1898 fix: do not use heuristic fallback for "module-import"
  • 66306aa Revert "fix: module-import get fallback from externalsPresets"
  • Additional commits viewable in compare view

Updates graphql from 16.6.0 to 16.8.1

Release notes

Sourced from graphql's releases.

v16.8.1 (2023-09-19)

Bug Fix 🐞

Committers: 1

v16.8.0 (2023-08-14)

New Feature 🚀

Committers: 1

v16.7.1 (2023-06-22)

📢 Big shout out to @​phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞

Committers: 1

v16.7.0 (2023-06-21)

New Feature 🚀

Bug Fix 🐞

Committers: 3

Commits

Updates hono from 4.8.4 to 4.9.7

Release notes

Sourced from hono's releases.

v4.9.7

Security

  • Fixed an issue in the bodyLimit middleware where the body size limit could be bypassed when both Content-Length and Transfer-Encoding headers were present. If you are using this middleware, please update immediately. Security Advisory

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.6...v4.9.7

v4.9.6

Security

Fixed a bug in URL path parsing (getPath) that could cause path confusion under malformed requests.

If you rely on reverse proxies (e.g. Nginx) for ACLs or restrict access to endpoints like /admin, please update immediately.

See advisory for details: GHSA-9hp6-4448-45g2

What's Changed

Full Changelog: honojs/hono@v4.9.5...v4.9.6

v4.9.5

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.9.4...v4.9.5

v4.9.4

What's Changed

... (truncated)

Commits

Updates graphql from 16.6.0 to 16.8.1

Release notes

Sourced from graphql's releases.

v16.8.1 (2023-09-19)

Bug Fix 🐞

Committers: 1

v16.8.0 (2023-08-14)

New Feature 🚀

Committers: 1

v16.7.1 (2023-06-22)

📢 Big shout out to @​phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞

Committers: 1

v16.7.0 (2023-06-21)

New Feature 🚀

Bug Fix 🐞

Committers: 3

Commits

Updates react-native-mmkv from 2.10.1 to 2.11.0

Release notes

Sourced from react-native-mmkv's releases.

Release 2.11.0

2.11.0 (2023-11-10)

📚 Documentation

✨ Features

🐛 Bug Fixes

  • Don't leak encryption key in logs (a8995cc)
  • Fix "Failed to create MMKV instance" reload/fast refresh JSI error on Expo (#602) (1c58a78)
  • Fix correct behavior of function setState parameter (#598) (f391f9b)
  • Include banner in npm package (6327d85)

Release 2.10.2

2.10.2 (2023-08-25)

🐛 Bug Fixes

  • revert change AndroidManifest to support RN < 0.71 (#561) (40b71fe)
Commits
  • de2bde2 chore: release 2.11.0
  • 1c58a78 fix: Fix "Failed to create MMKV instance" reload/fast refresh JSI error on Ex...
  • 7683a65 feat: add basic test suite for hooks (#600)
  • f391f9b fix: Fix correct behavior of function setState parameter (#598)
  • 6327d85 fix: Include banner in npm package
  • 01b2bb2 feat: Add support for AGP>=8 (#589)
  • a7e5e90 docs: New banner
  • a8995cc fix: Don't leak encryption key in logs
  • f564552 Add community discord
  • d097084 feat: Add clang-format to lint the C++ codebase (#578)
  • Additional commits viewable in compare view

Updates graphql from 16.6.0 to 16.8.1

Release notes

Sourced from graphql's releases.

v16.8.1 (2023-09-19)

Bug Fix 🐞

Committers: 1

v16.8.0 (2023-08-14)

New Feature 🚀

Committers: 1

v16.7.1 (2023-06-22)

📢 Big shout out to @​phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞

Committers: 1

v16.7.0 (2023-06-21)

New Feature 🚀

Bug Fix 🐞

Committers: 3

Commits

Updates graphql from 16.6.0 to 16.8.1

Release notes

Sourced from graphql's releases.

v16.8.1 (2023-09-19)

Bug Fix 🐞

Committers: 1

v16.8.0 (2023-08-14)

New Feature 🚀

Committers: 1

v16.7.1 (2023-06-22)

📢 Big shout out to @​phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞

Committers: 1

v16.7.0 (2023-06-21)

New Feature 🚀

Bug Fix 🐞

Committers: 3

Commits

Updates graphql from 16.6.0 to 16.8.1

Release notes

Sourced from graphql's releases.

v16.8.1 (2023-09-19)

Bug Fix 🐞

Committers: 1

v16.8.0 (2023-08-14)

New Feature 🚀

Committers: 1

v16.7.1 (2023-06-22)

📢 Big shout out to @​phryneas, who managed to reproduce this issue and come up with this fix.

Bug Fix 🐞

Committers: 1

v16.7.0 (2023-06-21)

New Feature 🚀

Bug Fix 🐞

Committers: 3

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR...

Description has been truncated

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 9, 2025
@codesandbox
Copy link

codesandbox bot commented Oct 9, 2025

Review or Edit in CodeSandbox

Open the branch in Web EditorVS CodeInsiders

Open Preview

@vercel
Copy link

vercel bot commented Oct 9, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
interface-web Error Error Oct 9, 2025 6:51pm

@snyk-io
Copy link

snyk-io bot commented Oct 9, 2025

⚠️ Snyk checks are incomplete.

Status Scanner Critical High Medium Low Total (0)
⚠️ Open Source Security 0 0 0 0 See details

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Oct 9, 2025

Deploying uniswap with  Cloudflare Pages  Cloudflare Pages

Latest commit: 607cdb7
Status: ✅  Deploy successful!
Preview URL: https://4b601924.uniswap-omj.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-apps-ydv4.uniswap-omj.pages.dev

View logs

…updates

Bumps the npm_and_yarn group with 2 updates in the /apps/extension directory: [webpack](https://github.com/webpack/webpack) and [webpack-dev-server](https://github.com/webpack/webpack-dev-server).
Bumps the npm_and_yarn group with 1 update in the /apps/mobile directory: [react-native-mmkv](https://github.com/mrousavy/react-native-mmkv).
Bumps the npm_and_yarn group with 3 updates in the /apps/web directory: [webpack](https://github.com/webpack/webpack), [graphql](https://github.com/graphql/graphql-js) and [hono](https://github.com/honojs/hono).
Bumps the npm_and_yarn group with 1 update in the /packages/api directory: [graphql](https://github.com/graphql/graphql-js).
Bumps the npm_and_yarn group with 2 updates in the /packages/uniswap directory: [react-native-mmkv](https://github.com/mrousavy/react-native-mmkv) and [graphql](https://github.com/graphql/graphql-js).
Bumps the npm_and_yarn group with 1 update in the /packages/utilities directory: [graphql](https://github.com/graphql/graphql-js).
Bumps the npm_and_yarn group with 1 update in the /packages/wallet directory: [graphql](https://github.com/graphql/graphql-js).


Updates `webpack` from 5.90.0 to 5.94.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](webpack/webpack@v5.90.0...v5.94.0)

Updates `webpack-dev-server` from 4.15.1 to 5.2.1
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v4.15.1...v5.2.1)

Updates `react-native-mmkv` from 2.10.1 to 2.11.0
- [Release notes](https://github.com/mrousavy/react-native-mmkv/releases)
- [Commits](mrousavy/react-native-mmkv@v2.10.1...v2.11.0)

Updates `webpack` from 5.90.0 to 5.94.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](webpack/webpack@v5.90.0...v5.94.0)

Updates `graphql` from 16.6.0 to 16.8.1
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.6.0...v16.8.1)

Updates `hono` from 4.8.4 to 4.9.7
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.8.4...v4.9.7)

Updates `graphql` from 16.6.0 to 16.8.1
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.6.0...v16.8.1)

Updates `react-native-mmkv` from 2.10.1 to 2.11.0
- [Release notes](https://github.com/mrousavy/react-native-mmkv/releases)
- [Commits](mrousavy/react-native-mmkv@v2.10.1...v2.11.0)

Updates `graphql` from 16.6.0 to 16.8.1
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.6.0...v16.8.1)

Updates `graphql` from 16.6.0 to 16.8.1
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.6.0...v16.8.1)

Updates `graphql` from 16.6.0 to 16.8.1
- [Release notes](https://github.com/graphql/graphql-js/releases)
- [Commits](graphql/graphql-js@v16.6.0...v16.8.1)

---
updated-dependencies:
- dependency-name: webpack
  dependency-version: 5.94.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 5.2.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: react-native-mmkv
  dependency-version: 2.11.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: webpack
  dependency-version: 5.94.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: graphql
  dependency-version: 16.8.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.9.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: graphql
  dependency-version: 16.8.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: react-native-mmkv
  dependency-version: 2.11.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: graphql
  dependency-version: 16.8.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: graphql
  dependency-version: 16.8.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: graphql
  dependency-version: 16.8.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@Dargon789 Dargon789 force-pushed the dependabot/npm_and_yarn/apps/extension/npm_and_yarn-7dca2986f8 branch from 5630bdd to 607cdb7 Compare October 9, 2025 18:46
@Dargon789 Dargon789 merged commit 1cbe82b into main Oct 9, 2025
13 of 16 checks passed
@Dargon789 Dargon789 deleted the dependabot/npm_and_yarn/apps/extension/npm_and_yarn-7dca2986f8 branch October 9, 2025 18:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant