chore(deps): bump the npm-minor group across 1 directory with 3 updates

[dependabot]

Bumps the npm-minor group with 3 updates in the / directory: @fortawesome/fontawesome-free, webpack and webpack-cli.

Updates @fortawesome/fontawesome-free from 7.2.0 to 7.3.0

Release notes

Sourced from @​fortawesome/fontawesome-free's releases.

Release 7.3.0

Change log available at https://fontawesome.com/docs/changelog/

Commits

• 70fb2dd Release 7.3.0 (#21612)
• See full diff in compare view

Updates webpack from 5.107.2 to 5.108.3

Release notes

Sourced from webpack's releases.

v5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

v5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

v5.108.1

Patch Changes

• Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #21280)

• Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #21269)

v5.108.0

Minor Changes

• Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @​alexander-akait in #21218)

• Add a bun target that emits ESM and externalizes bun:* and node.js built-in modules. (by @​alexander-akait in #21248)

• Support CommonJS reexports via Object.defineProperty value and getter descriptors. (by @​alexander-akait in #21129)

• Support JSON Schema const when generating CLI flags from a schema. (by @​alexander-akait in #21087)

• Support JSON Schema if/then/else when generating CLI flags from a schema. (by @​alexander-akait in #21087)

• Skip import specifiers, require() and import() calls in dead conditional branches gated by inlined imported constants (isDEV ? A : B), evaluated via getCondition. (by @​hai-x in #21136)

• CSS localIdentName [hash] now resolves to the local ident hash (matching css-loader); use [modulehash] for the module hash. (by @​alexander-akait in #21259)

• Add CSS parser as option and resolve url() inside HTML style attributes. (by @​alexander-akait in #21157)

• Add dedicated module classes for all built-in module types. (by @​alexander-akait in #21164)

• Support .html/.css for the default ./src entry under the html/css experiments. (by @​alexander-akait in #21039)

• Add defineConfig helper for typed configuration files. (by @​alexander-akait in #21169)

• Add a deno target (with versions, e.g. deno, deno2, deno1.40) that emits ESM, resolves node.js built-ins via the required node: specifier, and keeps Deno's own import protocols (npm:, jsr:, node:, http(s)://) external. (by @​alexander-akait in #21247)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

5.108.1

Patch Changes

• Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #21280)

• Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #21269)

5.108.0

Minor Changes

• Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @​alexander-akait in #21218)

• Add a bun target that emits ESM and externalizes bun:* and node.js built-in modules. (by @​alexander-akait in #21248)

• Support CommonJS reexports via Object.defineProperty value and getter descriptors. (by @​alexander-akait in #21129)

• Support JSON Schema const when generating CLI flags from a schema. (by @​alexander-akait in #21087)

• Support JSON Schema if/then/else when generating CLI flags from a schema. (by @​alexander-akait in #21087)

• Skip import specifiers, require() and import() calls in dead conditional branches gated by inlined imported constants (isDEV ? A : B), evaluated via getCondition. (by @​hai-x in #21136)

• CSS localIdentName [hash] now resolves to the local ident hash (matching css-loader); use [modulehash] for the module hash. (by @​alexander-akait in #21259)

• Add CSS parser as option and resolve url() inside HTML style attributes. (by @​alexander-akait in #21157)

• Add dedicated module classes for all built-in module types. (by @​alexander-akait in #21164)

• Support .html/.css for the default ./src entry under the html/css experiments. (by @​alexander-akait in #21039)

... (truncated)

Commits

• 6844305 chore(release): new release (#21304)
• 99286e2 fix: match harmony accept dependencies by module reference (#21303)
• 0abec4d fix: guard HarmonyAcceptDependency against unresolved module ids (#21302)
• 606712d perf(css): struct-of-arrays AST for the streaming CSS parser (#21285)
• cf9c04e docs: update examples (#21293)
• 4dfe770 chore(release): new release (#21287)
• 7534a5e test: add defer import case for #19219 (#21292)
• 9857fc7 fix: lazy barrel for import with side effects (#21291)
• 54fa902 Respect the node: prefix for node.js core modules used as externals (#21286)
• 5e7db5d refactor: extract createHooksRegistry to deduplicate getCompilationHooks patt...
• Additional commits viewable in compare view

Updates webpack-cli from 7.0.3 to 7.1.0

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.1.0

Minor Changes

• feat(cli): refresh the --help output using commander's configureHelp API — branded headers, section dividers, colorized terms and a clearer footer. Colors and chrome collapse to plain text when output is piped or --no-color is used, so scripts keep working. (by @​alexander-akait in #4779)

• feat: support .json5, .yaml/.yml and .toml configuration files by parsing them directly, with the parser package (json5, js-yaml, toml) installed on demand by the user and declared as optional peerDependencies so the parsers resolve correctly under Yarn PnP (by @​alexander-akait in #4777)

Changelog

Sourced from webpack-cli's changelog.

7.1.0

Minor Changes

• feat(cli): refresh the --help output using commander's configureHelp API — branded headers, section dividers, colorized terms and a clearer footer. Colors and chrome collapse to plain text when output is piped or --no-color is used, so scripts keep working. (by @​alexander-akait in #4779)

• feat: support .json5, .yaml/.yml and .toml configuration files by parsing them directly, with the parser package (json5, js-yaml, toml) installed on demand by the user and declared as optional peerDependencies so the parsers resolve correctly under Yarn PnP (by @​alexander-akait in #4777)

Commits

• 3cd7423 chore(release): new release (#4778)
• b42d1f4 fix(webpack-cli): declare json5/js-yaml/toml as optional peerDependencies (#4...
• 3471103 refactor(cli): hierarchical indentation for styled CLI output (#4786)
• 772330c build(deps): update dependencies (except commander) (#4785)
• a7380e1 feat(cli): refresh CLI output via commander's help API + shared status icons ...
• 721d8fd chore(deps): bump the dependencies group with 2 updates (#4780)
• 65aa86c chore(deps-dev): bump the dependencies group with 3 updates (#4781)
• 134e62d feat(webpack-cli): support json5/yaml/toml configs via direct parsing (no int...
• 0b22f77 fix(cli): make config loading errors more verbose (#4776)
• a5af401 chore(deps): bump launch-editor from 2.13.1 to 2.14.1 (#4774)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@fortawesome/fontawesome-free	7.3.0	🟢 4	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 4 Found 9/22 approved changesets -- score normalized to 4 Maintained 🟢 10 1 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow ⚠️ -1 no workflows found CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ -1 No tokens found Security-Policy ⚠️ 0 security policy file not detected License 🟢 9 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies ⚠️ -1 no dependencies found Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed
npm/enhanced-resolve	5.24.1	🟢 5.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 1/11 approved changesets -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/minimizer-webpack-plugin	5.6.1	Unknown	Unknown
npm/watchpack	2.5.2	🟢 5.9	Details Check Score Reason Code-Review 🟢 3 Found 1/3 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/webpack	5.108.3	🟢 5.7	Details Check Score Reason Code-Review 🟢 3 Found 7/22 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 2 badge detected: InProgress License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected Pinned-Dependencies 🟢 10 all dependencies are pinned Binary-Artifacts ⚠️ 0 binaries present in source code SAST 🟢 10 SAST tool is run on all commits Fuzzing ⚠️ 0 project is not fuzzed
npm/webpack-cli	7.1.0	🟢 5.7	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 1 Found 1/10 approved changesets -- score normalized to 1 Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• yarn.lock