[dependabot]

Bumps the tooling group with 6 updates in the / directory:

Package	From	To
esbuild-plugin-react-virtualized	1.0.6	1.0.7
eslint-plugin-prettier	5.5.6	5.5.7
eslint-plugin-sonarjs	4.2.1	4.2.2
prettier	3.9.8	3.9.10
vite-plugin-compression2	2.5.3	2.5.4
webpack	5.111.0	5.112.2

Updates esbuild-plugin-react-virtualized from 1.0.6 to 1.0.7

Release notes

Sourced from esbuild-plugin-react-virtualized's releases.

v1.0.7

1.0.7 (2026-11-02)

Miscellaneous Chores

• modernise dev tooling (#385) (ce0b28a)

Changelog

Sourced from esbuild-plugin-react-virtualized's changelog.

1.0.7 (2026-11-02)

Miscellaneous Chores

• modernise dev tooling (#385) (ce0b28a)

Commits

• 45c44a3 chore(master): release 1.0.7 (#386)
• a053d2d ci(dependabot): group actions updates and remove auto-merge (#388)
• 901d868 chore(deps-dev): bump the dev-dependencies group across 1 directory with 2 up...
• ce0b28a chore: modernise dev tooling (#385)
• 7a5c854 chore(deps-dev): bump the dev-dependencies group with 5 updates (#383)
• b9391c6 chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 (#382)
• b568074 chore(deps-dev): bump the dev-dependencies group with 3 updates (#381)
• 630ede0 chore(deps): bump actions/setup-node from 6 to 7 (#379)
• 035e50d chore(deps-dev): bump the dev-dependencies group with 5 updates (#380)
• 9820bf7 chore(deps-dev): bump prettier from 3.9.0 to 3.9.4 in the dev-dependencies gr...
• Additional commits viewable in compare view

Updates eslint-plugin-prettier from 5.5.6 to 5.5.7

Release notes

Sourced from eslint-plugin-prettier's releases.

v5.5.7

Patch Changes

• #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

• #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

New Contributors

• @​truongbo17 made their first contribution in prettier/eslint-plugin-prettier#798
• @​OskarEichler made their first contribution in prettier/eslint-plugin-prettier#796

Full Changelog: prettier/eslint-plugin-prettier@v5.5.6...v5.5.7

Changelog

Sourced from eslint-plugin-prettier's changelog.

5.5.7

Patch Changes

• #796 7e53ecd Thanks @​OskarEichler! - Fix fallback diagnostic locations for all supported line endings.

• #805 1b7c433 Thanks @​JounQin! - Report a clear error when the sync worker fails to load, so a missing prettier dependency now fails fast with Cannot find package 'prettier' instead of hanging ESLint indefinitely.

Commits

• e6dd27a chore: keep packageManager when cleaning package.json for release (#808)
• 7544956 chore: release eslint-plugin-prettier (#799)
• e3e5238 ci: enable npm publish provenance for changesets v3 (#807)
• 7c923c4 build(deps): Bump http-cache-semantics from 4.2.0 to 4.3.0 (#806)
• 1b7c433 fix: bump synckit to surface worker failures instead of hanging (#805)
• a6b3feb docs: explain line endings and endOfLine behavior (#804)
• 2f6ba1d ci: exercise the getLocFromIndex ponyfill on ESLint 9 (#803)
• cf1d2c5 chore(deps): update (#802)
• 9f14a55 chore(deps): update all dependencies (#788)
• 7e53ecd fix: map fallback source locations to actual line starts (#796)
• Additional commits viewable in compare view

Updates eslint-plugin-sonarjs from 4.2.1 to 4.2.2

Commits

• See full diff in compare view

Updates prettier from 3.9.8 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• See full diff in compare view

Updates vite-plugin-compression2 from 2.5.3 to 2.5.4

Release notes

Sourced from vite-plugin-compression2's releases.

v2.5.4

• Fix generateBundle

Changelog

Sourced from vite-plugin-compression2's changelog.

2.5.4

• Fix generateBundle

Commits

• ecf4e99 ci: use trusted publishing
• 70e1243 chore: release v2.5.4
• 5f187c7 workflow: rewrite generate logic
• 3b4d48d workflow: migrate to vite8
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite-plugin-compression2 since your current version.

Updates webpack from 5.111.0 to 5.112.2

Release notes

Sourced from webpack's releases.

v5.112.2

Patch Changes

• Reduce repeated scans when concatenating imported modules. (by @​xiaoxiaojx in #22865)

• Avoid allocating CSS module sets for single-group chunks. (by @​xiaoxiaojx in #22866)

• Return the value of every module type loaded with importModule(). (by @​alexander-akait in #22869)

v5.112.1

Patch Changes

• Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @​aryanraj45 in #22699)

• Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @​aryanraj45 in #22749)

• Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @​alexander-akait in #22791)

• Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @​lazerg in #22833)

• Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @​codeXsidd in #22846)

• Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @​alexander-akait in #22794)

• Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @​alexander-akait in #22804)

• Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @​dependabot in #22811)

• Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @​alexander-akait in #22733)

• Await asynchronous modules that ProvidePlugin injects into ES modules. (by @​alexander-akait in #22728)

• Keep a resolve that ends after the compiler closed from throwing. (by @​alexander-akait in #22795)

• Preserve string names passed to SharedWorker constructors. (by @​bjohansebas in #22770)

• Preserve string contents when extracting source map comments. (by @​bjohansebas in #22768)

• Scope strict-mode, async and generator block function declarations to their block. (by @​alexander-akait in #22800)

• Preserve raw dotenv values when reusing cached environment files. (by @​Eshiv-Pandey in #22787)

• Preserve assigned or patched built-ins, conversions and pattern targets. (by @​aryanraj45 in #22761)

• Keep globals a globalThis write replaces, and slice on a patched array. (by @​alexander-akait in #22862)

• Skip HTML script tags for shared chunks that emit no JavaScript. (by @​bjohansebas in #22779)

• Keep the digits Firefox lays out a minified CSS percentage with. (by @​alexander-akait in #22718)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.112.2

Patch Changes

• Reduce repeated scans when concatenating imported modules. (by @​xiaoxiaojx in #22865)

• Avoid allocating CSS module sets for single-group chunks. (by @​xiaoxiaojx in #22866)

• Return the value of every module type loaded with importModule(). (by @​alexander-akait in #22869)

5.112.1

Patch Changes

• Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @​aryanraj45 in #22699)

• Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @​aryanraj45 in #22749)

• Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @​alexander-akait in #22791)

• Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @​lazerg in #22833)

• Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @​codeXsidd in #22846)

• Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @​alexander-akait in #22794)

• Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @​alexander-akait in #22804)

• Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @​dependabot in #22811)

• Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @​alexander-akait in #22733)

• Await asynchronous modules that ProvidePlugin injects into ES modules. (by @​alexander-akait in #22728)

• Keep a resolve that ends after the compiler closed from throwing. (by @​alexander-akait in #22795)

• Preserve string names passed to SharedWorker constructors. (by @​bjohansebas in #22770)

• Preserve string contents when extracting source map comments. (by @​bjohansebas in #22768)

• Scope strict-mode, async and generator block function declarations to their block. (by @​alexander-akait in #22800)

• Preserve raw dotenv values when reusing cached environment files. (by @​Eshiv-Pandey in #22787)

• Preserve assigned or patched built-ins, conversions and pattern targets. (by @​aryanraj45 in #22761)

• Keep globals a globalThis write replaces, and slice on a patched array. (by @​alexander-akait in #22862)

• Skip HTML script tags for shared chunks that emit no JavaScript. (by @​bjohansebas in #22779)

... (truncated)

Commits

• e95a7f2 chore(release): new release (#22867)
• 6e43fc2 fix: return the value of every module type from importModule() (#22869)
• 4ffac8d ci: rename the parser job to spec and run CSS, HTML and XML in one leg (#22870)
• 0c02242 test: split the syntax unit tests into tokenizer, parser and printer (#22825)
• 660608c perf(css): cut CPU and allocation in the CSS minifier (#22868)
• 8c3cbd3 perf: avoid allocating unused CSS module sets (#22866)
• a1e5f6a perf: avoid duplicate scans in module concatenation (#22865)
• 759b539 chore(release): new release (#22720)
• 539f8de fix(minify): keep globals a globalThis write replaces, and slice on a pat...
• 9668155 ci: run the deep-imports check in the lint job (#22859)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Low Risk
Dev-only dependency patch bumps; validate with a normal lint, build:prod/build:ui, and Storybook if those paths matter for your workflow.

Overview
This PR bumps six dev tooling dependencies in package.json and refreshes package-lock.json, with no application source changes.

Lint/format: prettier moves to 3.9.10 (Markdown parsing fixes), and eslint-plugin-prettier to 5.5.7 (clearer errors when the Prettier worker fails; better diagnostic locations). eslint-plugin-sonarjs is patched to 4.2.2.

Build: webpack is updated to 5.112.2, pulling in newer enhanced-resolve, minimizer-webpack-plugin, schema-utils, watchpack, and webpack-sources in the lockfile. esbuild-plugin-react-virtualized goes to 1.0.7 (used in Storybook’s Vite config). vite-plugin-compression2 is bumped to 2.5.4 (generateBundle fix) even though the UI Vite config currently has that plugin commented out.

^{Reviewed by Cursor Bugbot for commit a0360bc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T00:08:02.309750Z	a0360bc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.