Update dependency babel-preset-minify to v0.5.2#576
Update dependency babel-preset-minify to v0.5.2#576renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: experiments/guess-static-sites/package-lock.json |
d96459a to
de1db15
Compare
de1db15 to
22b6334
Compare
22b6334 to
26ed0cb
Compare
26ed0cb to
deea591
Compare
JiwaniZakir
left a comment
There was a problem hiding this comment.
The package.json now has babel-minify pinned at 0.5.1 while babel-preset-minify is bumped to 0.5.2 — since babel-minify bundles babel-preset-minify internally, this creates a subtle version split where the two packages are no longer in sync. It's worth verifying whether babel-minify@0.5.1 vendors its own copy of the preset or defers to the one resolved in node_modules, as the behavior could differ between the two versions. The lodash bump from 4.17.15 to 4.17.23 in both the babel-plugin-minify-dead-code-elimination and babel-preset-minify dependency trees is a welcome side effect, picking up security fixes for prototype pollution vulnerabilities. However, given that the lock file now introduces new nested entries for babel-plugin-minify-mangle-names@0.5.1 and babel-plugin-transform-merge-sibling-variables@6.9.5, it would be prudent to run the existing test suite against the updated build output to confirm the minification behavior hasn't changed in any observable way for the static-sites experiment.
deea591 to
a41d720
Compare
This PR contains the following updates:
0.5.1→0.5.2Release Notes
babel/minify (babel-preset-minify)
v0.5.2Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.