Skip to content

chore(deps): update dependencies, rechoir v1 and ejs v7; harden stderr assertions - #4873

Merged
alexander-akait merged 4 commits into
mainfrom
chore/update-deps-stable-tests
Oct 16, 2026
Merged

alexander-akait merged 4 commits into
mainfrom
chore/update-deps-stable-tests

Conversation

@alexander-akait

@alexander-akait alexander-akait commented Oct 16, 2026 •

Copy link
Copy Markdown
Member

Summary

Supersedes #4870, #4869 and #4859.

Dependencies: every direct dependency goes to the newest release in its current major: @babel/*, @swc/core, @types/node, cspell, eslint, eslint-config-webpack, jest, js-yaml, lint-staged, pkg-pr-new, prettier, readable-stream, sass, tsx, webpack 5.112, webpack-bundle-analyzer 5.4 and @inquirer/*. The lockfile refresh also brings in webpack-dev-middleware 8.3.0 and source-map-js 1.2.2.

Two major updates (each with a changeset):

  • rechoir 0.8 → 1.0 (webpack-cli)
    • The only code change replaces the resolve package with Node's require.resolve(id, { paths }), so loader packages now resolve through their exports maps. The API is unchanged.
    • It declares node >= 22.15.0, but nothing in the code needs it: the config-format and create-webpack-app/init suites pass on Node 20.20 as well.
    • Users on Node 20 will get an EBADENGINE warning from npm. Strict engine checks (Yarn 1, engine-strict) would refuse the install. Node 20 has been EOL since April 2026.
  • ejs 6 → 7 (create-webpack-app)
    • v7 stops reading render options out of the data object.
    • generate-files.ts passes its options as the third argument to ejs.render, so it is unaffected.

Type fix (webpack 5.112): MultiConfiguration is now typed as ReadonlyArray<Configuration> & MultiCompilerOptions. That means Array.isArray no longer narrows it, and the union no longer matches a single webpack() overload. The code now narrows with the existing isMultipleConfiguration guard and calls webpack() once per shape. Runtime behaviour is unchanged.

Test hardening: #4870 went red because webpack-bundle-analyzer 5.4 now logs <i> [webpack-bundle-analyzer] ... to stderr. This is the same kind of break #4837 had to patch for Node's experimental warnings. Changes:

  • Added a cleanStderr helper in test/utils/test-utils.js. It replaces withoutExperimentalWarnings and removes three kinds of third-party noise:

    • Node.js experimental warnings, including warnings whose message spans several lines
    • Node.js core deprecations (DEP0xxx) raised inside dependencies
    • webpack infrastructure logs at info level (<i> ...)

    It keeps webpack's own deprecations (DEP_WEBPACK_*) and <w>/<e> logs, so tests still catch the CLI misusing webpack. test/api/clean-stderr.test.js has unit tests for the helper.

  • Every expect(stderr).toBeFalsy() now goes through cleanStderr.

  • The analyze tests look for the analyzer's message on both stdout and stderr.

  • The "not writable path" init test skips when the directory is writable anyway. Root in containers ignores permission bits.

CI: dropped Node.js 25 from the test matrix. It is an odd-numbered release that never becomes LTS. The matrix is now 20.x (holds the declared minimum), 22.x, 24.x and 26.x (promoted to LTS in late October 2026).

Still held back (major updates)

Package Current Latest
commander 14.0.3 15.0.0
typescript 6.0.3 7.0.2
execa 9.6.1 10.1.1 (see #4845)
del-cli 7.0.0 8.0.1

Test plan

  • npm run build, npm run lint, npm run fmt:check
  • Full npm run test:base -- --ci locally on Node 22: 154/154 suites, 804 passed, 1 skipped
  • After the rechoir/ejs bump:
    • config-format, config-lookup and create-webpack-app suites: 122/122 on Node 22
    • config-format and create-webpack-app/init suites: 98 passed, 2 skipped on Node 20.20

🤖 Generated with Claude Code

https://claude.ai/code/session_01KbymRVCYb4Cyn9e5vCaU8n

Summary by CodeRabbit

  • Bug Fixes
    • Improved handling of single and multiple webpack configurations when loading configuration files.
    • Updated configuration resolution for compatibility with current Node.js resolver behavior.
  • Chores
    • Updated tooling and packages used by the app generator.
  • Tests
    • Improved command-line checks to distinguish routine runtime and webpack informational output from warnings and errors.
    • Made initialization checks more reliable across environments with different file permissions.

Refresh every direct dependency to the newest version in its current major
(supersedes #4870, #4869 and #4859): @babel/*, @swc/core, @types/node, cspell,
eslint, eslint-config-webpack, jest, js-yaml, lint-staged, pkg-pr-new,
prettier, readable-stream, sass, tsx, webpack, webpack-bundle-analyzer and
@inquirer/*, plus transitive updates such as webpack-dev-middleware 8.3.0 and
source-map-js 1.2.2.

webpack 5.112 types `MultiConfiguration` as a readonly array with
multi-compiler options, so `Array.isArray` no longer narrows it and the union
no longer fits a single `webpack()` overload. Narrow with the existing
`isMultipleConfiguration` guard and call `webpack()` per shape.

Make tests resilient to third-party output: a single `cleanStderr` helper
drops Node.js experimental warnings, Node.js core deprecations raised inside
dependencies and webpack infrastructure info logs (`<i> ...`), while keeping
webpack deprecations, warnings and errors. Every "stderr is empty" assertion
goes through it. The analyze tests look for webpack-bundle-analyzer's message
on both streams, since 5.4 moved it to stderr. The non-writable-path init
test now skips when the directory is writable anyway (root in containers).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbymRVCYb4Cyn9e5vCaU8n
@changeset-bot

changeset-bot Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 9cadf5d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
Name Type
create-webpack-app Patch
webpack-cli Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@linux-foundation-easycla

linux-foundation-easycla Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

CLA Not Signed

One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via:

Co-authored-by: name <email>

Supported Co-authored-by: formats include:

  1. Anything <id+login@users.noreply.github.com> - it will locate your GitHub user by id part.
  2. Anything <login@users.noreply.github.com> - it will locate your GitHub user by login part.
  3. Anything <public-email> - it will locate your GitHub user by public-email part. Note that this email must be made public on Github.
  4. Anything <other-email> - it will locate your GitHub user by other-email part but only if that email was used before for any other CLA as a main commit author.
  5. login <any-valid-email> - it will locate your GitHub user by login part, note that login part must be at least 3 characters long.

Alternatively, if the co-author should not be included, remove the Co-authored-by: line from the commit message.

Please update your commit message(s) by doing git commit --amend and then git push [--force] and then request re-running CLA check via commenting on this pull request:

/easycla

@github-actions

github-actions Bot commented Oct 16, 2026 •

Copy link
Copy Markdown
Contributor

This PR is packaged and the instant preview is available (9def039).

Install it locally:

  • npm
npm i -D create-webpack-app@https://pkg.pr.new/create-webpack-app@9def039 webpack-cli@https://pkg.pr.new/webpack-cli@9def039
  • yarn
yarn add -D create-webpack-app@https://pkg.pr.new/create-webpack-app@9def039 webpack-cli@https://pkg.pr.new/webpack-cli@9def039
  • pnpm
pnpm add -D create-webpack-app@https://pkg.pr.new/create-webpack-app@9def039 webpack-cli@https://pkg.pr.new/webpack-cli@9def039

@codecov

codecov Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.85%. Comparing base (3af13e1) to head (9cadf5d).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #4873      +/-   ##
==========================================
- Coverage   94.86%   94.85%   -0.01%     
==========================================
  Files          14       14              
  Lines        5626     5637      +11     
  Branches      841      846       +5     
==========================================
+ Hits         5337     5347      +10     
- Misses        288      289       +1     
  Partials        1        1              
Files with missing lines Coverage Δ
packages/webpack-cli/src/webpack-cli.ts 96.73% <100.00%> (-0.02%) ⬇️

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3af13e1...9cadf5d. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@coderabbitai

coderabbitai Bot commented Oct 16, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 48250b7a-8924-453b-ad52-c171d8aab951
📥 Commits

Reviewing files that changed from the base of the PR and between 321ed2a and 9cadf5d.

📒 Files selected for processing: 1
  • .github/workflows/nodejs.yml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Walkthrough

The CLI now uses isMultipleConfiguration to identify multiple configurations and selects a webpack() overload based on configuration shape and callback presence. Test utilities add cleanStderr, and CLI tests use it to filter selected Node.js warnings and webpack infrastructure info lines before checking stderr. Analyzer tests search both output streams for the report message. Dependency versions change, and the initialization test checks directory writability before asserting permission failure.

Priority: ➖ Normal

Merge Risk: 🔵 Low · up to 9cadf

Most installs are not shown to be affected, but Node 20 users enforcing dependency engine requirements may be blocked from installing webpack-cli. The Node 25 matrix change is intentional; address or accept the bounded installation risk.

Pre-merge checks: Passed 5
Check name Status Explanation
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 5…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely summarizes the dependency updates, rechoir and ejs major-version changes, and hardened stderr assertions.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 52 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 1
🛠️ Fix failing CI checks: 💡
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments: 1
packages/webpack-cli/src/webpack-cli.ts: 1

3655-3674: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Optional: Reduce the duplicated branches in createCompiler.

The two webpack() calls in each branch are identical in shape. The only difference is the type of config.options. The nested ternary is hard to read. The wrapper keeps the validation-error reporting and exit code 2, so runtime behavior is preserved.

A small helper or an if/else block with an early assignment would be easier to read. This is optional, because the current code is correct and type-safe.


ℹ️ Review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 63eeb9e3-0326-4244-9705-62c67db8486a
📥 Commits

Reviewing files that changed from the base of the PR and between 3af13e1 and cb662f9.

⛔ Files ignored due to path filters: 1
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing: 110
  • package.json
  • packages/create-webpack-app/package.json
  • packages/webpack-cli/src/webpack-cli.ts
  • test/build/analyze/analyze-flag.test.js
  • test/build/bail/bail.test.js
  • test/build/basic/basic.test.js
  • test/build/build-errors/errors.test.js
  • test/build/build-variable/build-variable.test.js
  • test/build/build-warnings/warnings.test.js
  • test/build/bundle-variable/bundle-variable.test.js
  • test/build/colors/colors.test.js
  • test/build/config-format/auto/auto.test.mjs
  • test/build/config-format/babel-commonjs/babel-esm.test.js
  • test/build/config-format/coffee/coffee.test.js
  • test/build/config-format/commonjs-default/commonjs-default.test.js
  • test/build/config-format/commonjs/commonjs.test.js
  • test/build/config-format/disable-interpret/disable-interpret.test.js
  • test/build/config-format/esm-top-level-await/index.test.js
  • test/build/config-format/esm/mjs.test.js
  • test/build/config-format/json/json.test.js
  • test/build/config-format/json5/json5.test.js
  • test/build/config-format/typescript-auto/typescript.test.mjs
  • test/build/config-format/typescript-cjs/typescript.test.mjs
  • test/build/config-format/typescript-mjs/typescript.test.mjs
  • test/build/config-format/typescript-tsx/typescript.test.mjs
  • test/build/config-format/yaml/yaml.test.js
  • test/build/config-lookup/custom-name/custom-name.test.js
  • test/build/config-lookup/dotfolder-array/dotfolder-array.test.js
  • test/build/config-lookup/dotfolder-single/dotfolder-single.test.js
  • test/build/config-lookup/relative/basic-config.test.js
  • test/build/config-name/config-name.test.js
  • test/build/config-node-env/config-node-env.test.js
  • test/build/config/basic/basic-config.test.js
  • test/build/config/defaults/basic-config/default-js-config.test.js
  • test/build/config/defaults/cjs-config/default-cjs-config.test.js
  • test/build/config/defaults/dot-webpack-directory-webpackfile/dot-webpack-webpackfile.test.js
  • test/build/config/defaults/dot-webpack-directory/dot-webpack-config.test.js
  • test/build/config/defaults/mjs-config/default-mjs-config.test.js
  • test/build/config/defaults/with-mode/default-config-with-mode.test.js
  • test/build/config/empty-array/empty-array.test.js
  • test/build/config/empty-function/empty-function.test.js
  • test/build/config/empty-promise/empty-promise.test.js
  • test/build/config/empty/empty.test.js
  • test/build/config/function/functional-config.test.js
  • test/build/config/multi-compiler-options/multi-compiler-options.test.js
  • test/build/config/multi-compiler/multi-compiler.test.js
  • test/build/config/multiple-with-one-compilation/multiple-with-one-compilation.test.js
  • test/build/config/multiple/multiple-config.test.js
  • test/build/config/no-code/no-code.test.js
  • test/build/config/no-config-array/no-config-array.test.js
  • test/build/config/no-config-object/no-config-object.test.js
  • test/build/config/object-freeze-partial/index.test.js
  • test/build/config/object-freeze/index.test.js
  • test/build/config/type/array-function-with-argv/function-with-argv.test.js
  • test/build/config/type/array-function-with-env/array-function-with-env.test.js
  • test/build/config/type/array-functions/array-functions.test.js
  • test/build/config/type/array-promises/array-promises.test.js
  • test/build/config/type/array/array.test.js
  • test/build/config/type/function-array/function-array.test.js
  • test/build/config/type/function-async/function-async.test.js
  • test/build/config/type/function-promise/function-promise.test.js
  • test/build/config/type/function-with-argv/function-with-argv.test.js
  • test/build/config/type/function-with-env/function-with-env.test.js
  • test/build/config/type/function/function.test.js
  • test/build/config/type/promise-array/promise-array.test.js
  • test/build/config/type/promise-function/promise-function.test.js
  • test/build/config/type/promise/promise.test.js
  • test/build/core-flags/core-flags.test.js
  • test/build/custom-webpack/custom-webpack.test.js
  • test/build/defaults/output-defaults.test.js
  • test/build/devtool/array/source-map-array.test.js
  • test/build/devtool/object/source-map-object.test.js
  • test/build/entry/config-entry/entry-with-config/entry-with-config.test.js
  • test/build/entry/config-entry/entry-with-index/entry-with-config.test.js
  • test/build/entry/defaults-empty/entry-single-arg.test.js
  • test/build/entry/defaults-index/entry-multi-args.test.js
  • test/build/entry/flag-entry/entry-with-flag.test.js
  • test/build/entry/multiple-entries/multi-entries.test.js
  • test/build/env/array/array-env.test.js
  • test/build/env/object/object-env.test.js
  • test/build/extends/extends.test.js
  • test/build/import-local/import-local.test.js
  • test/build/json/json.test.js
  • test/build/merge/config/merge-config.test.js
  • test/build/mode/mode-single-arg/mode-single-arg.test.js
  • test/build/mode/mode-with-config/mode-with-config.test.js
  • test/build/multi-compiler-options/multi-compiler-options.test.js
  • test/build/name/name.test.js
  • test/build/node/node.test.js
  • test/build/output/output-named-bundles.test.js
  • test/build/stats/config-no/no-stats-with-config.test.js
  • test/build/stats/config/stats.test.js
  • test/build/stats/flags/stats.test.js
  • test/build/target/flag-test/target-flag.test.js
  • test/build/zero-config/entry-absent/zero-config.test.js
  • test/build/zero-config/entry-present/zero-config.test.js
  • test/complete/complete.test.js
  • test/create-webpack-app/init/init.test.js
  • test/external-command/external-command.test.js
  • test/info/additional-package.test.js
  • test/info/basic.test.js
  • test/info/output.test.js
  • test/utils/cli-plugin-test/plugin.test.js
  • test/utils/test-utils.js
  • test/version/basic.test.js
  • test/version/output.test.js
  • test/watch/analyze/analyze-flag.test.js
  • test/watch/bail/bail.test.js
  • test/watch/basic/basic.test.js
  • test/watch/stats/stats-and-watch.test.js

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Comment thread test/utils/test-utils.js Outdated
rechoir 1.0 replaces the `resolve` package with Node.js's own
`require.resolve(id, { paths })`, so loader packages are now resolved
through their `exports` maps; its API is unchanged. It declares
`node >= 22.15.0`, but the code runs on the Node.js 20 baseline (the
config-format suites pass on Node.js 20.20).

ejs 7 stops reading render options out of the data object.
create-webpack-app passes its options as the third argument to
`ejs.render`, so it is unaffected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbymRVCYb4Cyn9e5vCaU8n
@alexander-akait alexander-akait changed the title chore(deps): update dependencies within their current majors and harden stderr assertions chore(deps): update dependencies, rechoir v1 and ejs v7; harden stderr assertions Oct 16, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1


ℹ️ Review info
⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 0ab2b299-b6ec-4458-a36c-462a9ec29257
📥 Commits

Reviewing files that changed from the base of the PR and between cb662f9 and de6bd2f.

⛔ Files ignored due to path filters: 1
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing: 5
  • .changeset/update-ejs-v7.md
  • .changeset/update-rechoir-v1.md
  • packages/create-webpack-app/package.json
  • packages/webpack-cli/package.json
  • packages/webpack-cli/src/webpack-cli.ts
🚧 Files skipped from review as they are similar to previous changes: 1
  • packages/webpack-cli/src/webpack-cli.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Comment thread packages/webpack-cli/package.json
A warning message can span several lines, and only its first line was
removed. Drop continuation lines up to the `(Use node --trace-...)` hint,
without crossing a line that starts another record, so CLI output is never
swallowed. Cover the helper with unit tests.

Also replace the nested ternary in `createCompiler` with if/else.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbymRVCYb4Cyn9e5vCaU8n
Node.js 25 is an odd-numbered release that never becomes LTS and is EOL.
Test on the Node.js 20 line, which holds the declared minimum, and on the
LTS lines 22, 24 and 26 (promoted to LTS in October 2026).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KbymRVCYb4Cyn9e5vCaU8n
@alexander-akait
alexander-akait merged commit 9def039 into main Oct 16, 2026
34 of 35 checks passed
@alexander-akait
alexander-akait deleted the chore/update-deps-stable-tests branch October 16, 2026 15:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants