Bump the server-dependencies group across 1 directory with 12 updates

[dependabot]

Bumps the server-dependencies group with 12 updates in the / directory:

Package	From	To
@ethereumjs/common	10.1.2	10.1.3
@ethereumjs/tx	10.1.2	10.1.3
@types/node	26.1.2	26.2.0
jose	6.2.4	6.2.9
mysql2	3.23.2	3.23.4
uuid	14.0.1	14.0.2
ws	8.21.1	8.21.3
@types/better-sqlite3	7.6.13	9.6.0
mocha	11.7.6	11.8.0
mysql-memory-server	1.14.1	1.16.0
webpack	5.109.0	5.109.2
webpack-cli	7.2.1	7.2.2

Updates @ethereumjs/common from 10.1.2 to 10.1.3

Release notes

Sourced from @​ethereumjs/common's releases.

@​ethereumjs/common v10.1.3

Release round overview

Welcome to 10.1.3 — a coordinated release across all active @ethereumjs/* libraries on the 10.1.x line. If you have been experimenting with the upcoming Amsterdam hardfork, this is our close-to-ready preview: the full 14-EIP Hardfork.Amsterdam bundle is implemented and aligned with tests-glamsterdam-devnet@v8.1.0 and glamsterdam-devnet-8. Public APIs and spec alignment are largely stable — a good time to try BAL builder/validator flows, two-dimensional block gas, builder requests, and the rest of the Amsterdam surface — but Amsterdam remains experimental and must not be used in production; spec or API shifts can still happen in later 10.1.x patches.

The sections below cover this package only; for the full EIP list, examples, and release ↔ spec tracking, see the @​ethereumjs/vm Amsterdam overview. On Osaka or earlier hardforks? Nothing changes unless you explicitly select Hardfork.Amsterdam.

@ethereumjs/common

@ethereumjs/common is the fork and parameter engine. Within the 10.1.3 round, Hardfork.Amsterdam expands from nine to fourteen EIPs and picks up the revised glamsterdam-devnet gas schedule — the single switch every downstream package inherits when you set hardfork: Hardfork.Amsterdam.

At a glance

• Hardfork.Amsterdam now activates EIPs 2780, 7708, 7843, 7778, 7928, 7954, 7976, 7981, 7997, 8024, 8037, 8038, 8246, and 8282.
• Revised gasPrices / gasConfig / vm params for glamsterdam-devnet v8.1.0 (EIP-8038 state-access costs, EIP-2780 intrinsic constants, …).
• Spec snapshot: tests-glamsterdam-devnet@v8.1.0.

Amsterdam (experimental)

Behaviour may still change in subsequent 10.1.x patch releases. Spec snapshot: tests-glamsterdam-devnet@v8.1.0 · Testnet: glamsterdam-devnet-8 Execution details: Amsterdam hardfork (experimental)

import { Common, Hardfork, Mainnet } from '@ethereumjs/common'
const common = new Common({ chain: Mainnet, hardfork: Hardfork.Amsterdam })
common.isActivatedEIP(8282) // true — builder deposit/exit requests
common.isActivatedEIP(8038) // true — state-access gas schedule
common.isActivatedEIP(2780) // true — revised intrinsic gas base

Changes

• Expand Amsterdam to the full 14-EIP bundle (2780, 7997, 8038, 8246, 8282, …), see PR #4361, #4362, #4364
• Align Amsterdam gas schedule with glamsterdam-devnet v8.1.0, see PR #4337, #4364

Commits

• 29f404f Release v10.1.3 — close-to-ready Amsterdam preview (glamsterdam-devnet v8.1.0...
• ff3354c DEVELOPER.md Rework / Better AI Release Instructions (#4375)
• ec47d61 Api Docs + Main README Overhaul (#4374)
• 513028f Amsterdam Examples + API Additions/Enhancements (#4372)
• f4a6a6d Examples / Code Conventions (#4371)
• 8b3f292 Test Coverage (#4370)
• c4f93a3 Security Stuff (#4369)
• f3a7f5e BAL ordering fix (#4368)
• e9263e1 fix(util): incorrect storage key ordering (#4341)
• c3d0a7e fix(evm): snapshot step event memory (#4354)
• Additional commits viewable in compare view

Updates @ethereumjs/tx from 10.1.2 to 10.1.3

Release notes

Sourced from @​ethereumjs/tx's releases.

@​ethereumjs/tx v10.1.3

Release round overview

Welcome to 10.1.3 — a coordinated release across all active @ethereumjs/* libraries on the 10.1.x line. If you have been experimenting with the upcoming Amsterdam hardfork, this is our close-to-ready preview: the full 14-EIP Hardfork.Amsterdam bundle is implemented and aligned with tests-glamsterdam-devnet@v8.1.0 and glamsterdam-devnet-8. Public APIs and spec alignment are largely stable — a good time to try BAL builder/validator flows, two-dimensional block gas, builder requests, and the rest of the Amsterdam surface — but Amsterdam remains experimental and must not be used in production; spec or API shifts can still happen in later 10.1.x patches.

The sections below cover this package only; for the full EIP list, examples, and release ↔ spec tracking, see the @​ethereumjs/vm Amsterdam overview. On Osaka or earlier hardforks? Nothing changes unless you explicitly select Hardfork.Amsterdam.

@ethereumjs/tx

@ethereumjs/tx defines typed transactions and pre-execution validation. Within the 10.1.3 round Amsterdam tx semantics are complete for glamsterdam-devnet v8.1.0: EIP-2780 revises the intrinsic gas base, EIP-8038 prices access-list bytes under the new schedule, and getMinimumGasLimit() on every tx type returns the max of intrinsic and floor gas — the value integrators should use when sizing gasLimit for Amsterdam fixtures.

At a glance

• EIP-2780 — intrinsic gas includes recipient/value extras; calldata floor anchored on that base.
• EIP-8038 — access-list and authority-list byte costs under the glamsterdam schedule.
• getMinimumGasLimit() on legacy, 2930, 1559, 4844, and 7702 txs.
• Access/authority list entries restored in JSON cache serialization, see PR #4350.
• Spec snapshot: tests-glamsterdam-devnet@v8.1.0.

Amsterdam (experimental)

Behaviour may still change in subsequent 10.1.x patch releases. Spec snapshot: tests-glamsterdam-devnet@v8.1.0 · Testnet: glamsterdam-devnet-8 Fork overview: Amsterdam hardfork (experimental)

import { Common, Hardfork, Mainnet } from '@ethereumjs/common'
import { createLegacyTx } from '@ethereumjs/tx'
const common = new Common({ chain: Mainnet, hardfork: Hardfork.Amsterdam })
const tx = createLegacyTx({ gasLimit: 100_000n, gasPrice: 10n, data: new Uint8Array(100) }, { common })
tx.getMinimumGasLimit() // max(intrinsic, calldata floor, access-list floor, …)
tx.getValidationErrors() // [] when gasLimit is sufficient

See packages/tx/examples/calldataFloorGas.ts and the Amsterdam validation README section.

Changes

• EIP-2780 intrinsic gas and EIP-8038 access-list pricing, see PR #4361, #4364
• Amsterdam gas schedule alignment, see PR #4337
• getMinimumGasLimit() on all active tx types, see PR #4372
• Access/authority list JSON cache items, see PR #4350

Commits

• 29f404f Release v10.1.3 — close-to-ready Amsterdam preview (glamsterdam-devnet v8.1.0...
• ff3354c DEVELOPER.md Rework / Better AI Release Instructions (#4375)
• ec47d61 Api Docs + Main README Overhaul (#4374)
• 513028f Amsterdam Examples + API Additions/Enhancements (#4372)
• f4a6a6d Examples / Code Conventions (#4371)
• 8b3f292 Test Coverage (#4370)
• c4f93a3 Security Stuff (#4369)
• f3a7f5e BAL ordering fix (#4368)
• e9263e1 fix(util): incorrect storage key ordering (#4341)
• c3d0a7e fix(evm): snapshot step event memory (#4354)
• Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

• See full diff in compare view

Updates jose from 6.2.4 to 6.2.9

Release notes

Sourced from jose's releases.

v6.2.9

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

v6.2.8

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

v6.2.7

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

v6.2.6

Fixes

• types: accept host CryptoKey declarations (b48a15b)

v6.2.5

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)
• types: correct key resolver and JWT header types (e95f8c4)
• validate the clockTolerance and currentDate options are finite (ab2f18d)

Documentation

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.9 (2026-08-15)

Fixes

• reject a JWE whose generated Key Management Parameters collide (6ed19a6)
• types: undeprecate PBES2 p2c parameter (33bf832)

6.2.8 (2026-08-03)

Fixes

• enforce a single recipient when decrypting dir and ECDH-ES (505c383)
• reject a non-string "alg" in EmbeddedJWK (714f870)

Refactor

• index the JWS and JWE registries without a wrapper (925f3bb)
• name the "alg" source in unsupported algorithm failures (1500459)

6.2.7 (2026-08-01)

Fixes

• require own JOSE properties for presence checks (90ab09c)

Refactor

• reduce bundle size (767d7f1)

6.2.6 (2026-07-31)

Fixes

• types: accept host CryptoKey declarations (b48a15b)

6.2.5 (2026-07-29)

Fixes

• compare claim values for falsy validation options (eb86956)
• forward key management parameters for a single JWE recipient (2d4f801)
• handle a zero-length JWE additional authenticated data (16ca398)
• reject a generateKeyPair crv option the algorithm does not imply (76364e9)
• reject an unencoded payload in the JWS Compact Serialization (01d053f)
• reject characters outside the Base64URL alphabet (0ebb971), references #879
• reject duplicate "crit" values when producing (31d60e1)
• reject invalid UTF-8 in JOSE Headers and JWT Claims Sets (5df3fed)
• reject truncated ASN.1 key data (7a16c66)
• surface non-ASCII token segments as JOSE errors (194fe11)
• types: correct JWK and CryptoKey types (62a196d)

... (truncated)

Commits

• f3a3c78 chore(release): 6.2.9
• 33bf832 fix(types): undeprecate PBES2 p2c parameter
• 6ed19a6 fix: reject a JWE whose generated Key Management Parameters collide
• 944840d ci: use shared release workflows
• 05bccf2 chore: bump packages
• f7392d1 test: account for workerd nodejs_compat flag default changes
• 4e944be ci: drop the wait-for-npm machinery
• 4285b6f chore(deps-dev): bump undici
• cb114ec chore: cleanup after release
• 8b768eb chore(release): 6.2.8
• Additional commits viewable in compare view

Updates mysql2 from 3.23.2 to 3.23.4

Release notes

Sourced from mysql2's releases.

v3.23.4

3.23.4 (2026-08-19)

Bug Fixes

• keep leading zeros in TIME fractional seconds (#4481) (3cccf4a)
• typings: align callback Pool and PoolConnection types with runtime (#4478) (8b1f829)

v3.23.3

3.23.3 (2026-08-10)

Bug Fixes

• honor query-level namedPlaceholders as false (#4460) (20f732b)
• keep connectTimeout active until the handshake completes (#4458) (508a731)
• pool: give each pooled connection its own config copy (#4473) (361d232)
• pool: propagate query dispatch errors instead of throwing (#4459) (7ce6943)
• replace denque with a local ring buffer queue (#4472) (88f3d9e)

Changelog

Sourced from mysql2's changelog.

3.23.4 (2026-08-19)

Bug Fixes

• keep leading zeros in TIME fractional seconds (#4481) (3cccf4a)
• typings: align callback Pool and PoolConnection types with runtime (#4478) (8b1f829)

3.23.3 (2026-08-10)

Bug Fixes

• honor query-level namedPlaceholders as false (#4460) (20f732b)
• keep connectTimeout active until the handshake completes (#4458) (508a731)
• pool: give each pooled connection its own config copy (#4473) (361d232)
• pool: propagate query dispatch errors instead of throwing (#4459) (7ce6943)
• replace denque with a local ring buffer queue (#4472) (88f3d9e)

Commits

• 4df6770 chore(master): release 3.23.4 (#4479)
• 3cccf4a fix: keep leading zeros in TIME fractional seconds (#4481)
• 5bf517a build(deps-dev): bump tsx from 4.23.11 to 4.23.12 (#4482)
• 8b1f829 fix(typings): align callback Pool and PoolConnection types with runtime (#4478)
• bc30155 chore(master): release 3.23.3 (#4462)
• 88f3d9e fix: replace denque with a local ring buffer queue (#4472)
• c9ed1ca ci: add tests to idle sweeper cleanup on pool end (#4477)
• 495c08f ci: add tests to handshake error greeting (#4476)
• 61bea50 ci: add tests to large packet write chunking (#4475)
• 361d232 fix(pool): give each pooled connection its own config copy (#4473)
• Additional commits viewable in compare view

Updates uuid from 14.0.1 to 14.0.2

Release notes

Sourced from uuid's releases.

v14.0.2

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Changelog

Sourced from uuid's changelog.

14.0.2 (2026-08-18)

Bug Fixes

• v1: carry nsecs overflow into the timestamp's high bits (#972) (6adcc1d)
• v1: set the multicast bit on v1Bytes's own randomly-generated node (#973) (b1da338)
• v7: align default seq formula in v7Bytes with updateV7State (#965) (a67db57)

Commits

• fd59f02 chore(main): release 14.0.2 (#967)
• f3c564e docs: point the Node support permalink at the CI version matrix (#974)
• b1da338 fix(v1): set the multicast bit on v1Bytes's own randomly-generated node (#973)
• 6adcc1d fix(v1): carry nsecs overflow into the timestamp's high bits (#972)
• ea83515 docs: cleanup API summary (#968)
• ac36860 chore: pin publint version in CI (#966)
• a67db57 fix(v7): align default seq formula in v7Bytes with updateV7State (#965)
• See full diff in compare view

Updates ws from 8.21.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• See full diff in compare view

Updates @types/better-sqlite3 from 7.6.13 to 9.6.0

Commits

• See full diff in compare view

Updates mocha from 11.7.6 to 11.8.0

Release notes

Sourced from mocha's releases.

v11.8.0

11.8.0 (2026-08-02)

🌟 Features

• add --fail-hook-affected-tests option to report skipped tests as failed (#5519) (#6052) (7830309)

🧹 Chores

• add modern Netlify to v11.x branch (#6082) (26deb23), closes #5696
• change site title to Mocha 11, update index note (#6086) (1f44d5f)
• CI: bump Node from 22 to 24 in publish action (#6206) (05aec43)

v11.7.7

11.7.7 (2026-06-13)

🩹 Fixes

• surface ts-node compile errors (#6045) (3477563)

Changelog

Sourced from mocha's changelog.

11.8.0 (2026-08-02)

🌟 Features

• add --fail-hook-affected-tests option to report skipped tests as failed (#5519) (#6052) (7830309)

🧹 Chores

• add modern Netlify to v11.x branch (#6082) (26deb23), closes #5696
• change site title to Mocha 11, update index note (#6086) (1f44d5f)
• CI: bump Node from 22 to 24 in publish action (#6206) (05aec43)

11.7.7 (2026-06-13)

🩹 Fixes

• surface ts-node compile errors (#6045) (3477563)

Commits

• 90c1bb3 chore(v11.x): release 11.8.0 (#6076)
• 05aec43 chore(CI): bump Node from 22 to 24 in publish action (#6206)
• 1f44d5f chore: change site title to Mocha 11, update index note (#6086)
• 26deb23 chore: add modern Netlify to v11.x branch (#6082)
• 7830309 feat: add --fail-hook-affected-tests option to report skipped tests as failed...
• 41f2b95 chore(v11.x): release 11.7.7 (#6068)
• 3477563 fix: surface ts-node compile errors (#6045)
• See full diff in compare view

Updates mysql-memory-server from 1.14.1 to 1.16.0

Release notes

Sourced from mysql-memory-server's releases.

v1.16.0

What's Changed

Features

• feat: Add support for MySQL 26.7.0 by @​Sebastian-Webster in Sebastian-Webster/mysql-memory-server-nodejs#279

Chores

• ci: Add tests for Ubuntu 26.04 (arm64 and x64), Fedora 44 (arm64 and x64), Alpine 3.20 - 3.24 (arm64 and x64), and macOS 26 (Intel) by @​Sebastian-Webster in Sebastian-Webster/mysql-memory-server-nodejs#283
• ci: Add tests for Node 26 by @​Sebastian-Webster in Sebastian-Webster/mysql-memory-server-nodejs#287

Full Changelog: Sebastian-Webster/mysql-memory-server-nodejs@v1.15.0...v1.16.0

v1.15.0

What's Changed

Features

• feat: Add support for MySQL 8.4.9 - 8.4.11 and 9.7.0 - 9.7.2 by @​Sebastian-Webster in Sebastian-Webster/mysql-memory-server-nodejs#275

Chores

• deps: Update adm-zip to latest (0.6.0) by @​Sebastian-Webster in Sebastian-Webster/mysql-memory-server-nodejs#270
• deps: Update semver to latest (7.8.5) by @​Sebastian-Webster in Sebastian-Webster/mysql-memory-server-nodejs#271
• deps: Update devDependencies to latest by @​Sebastian-Webster in Sebastian-Webster/mysql-memory-server-nodejs#267 and Sebastian-Webster/mysql-memory-server-nodejs#273
• chore: Log CLI invocation error as is without UnhandledPromiseException by @​Sebastian-Webster in Sebastian-Webster/mysql-memory-server-nodejs#277

Full Changelog: Sebastian-Webster/mysql-memory-server-nodejs@v1.14.1...v1.15.0

Commits

• 2f7dc0c Mention in README that MySQL 26.7.0 is supported
• cf15e8f build - v1.16.0
• cf79761 Update GitHub Actions steps to latest
• cba601e Add tests for Node 26
• 2093ac5 Update moveFiles to moveFolders
• 5a72249 tests: Stop DB even if error occurs from connection
• 711bcba Move folder for CI diagnose instead of copying then deleting folder
• b2e5189 Add tests for Ubuntu 26.04, Fedora 44, Alpine 3.20 - 3.24, and macOS 26 (Intel)
• 2cdfc3b Update CodeQL to v4
• 2e74394 Add support for MySQL 26.7.0 (#279)
• Additional commits viewable in compare view

Updates webpack from 5.109.0 to 5.109.2

Release notes

Sourced from webpack's releases.

v5.109.2

Patch Changes

• Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

• Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

• Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

• Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

• Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

• Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

v5.109.1

Patch Changes

• Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

• Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

• Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

• Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

• Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

• Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

• Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

• Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

• Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

• Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

• Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

• Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

• Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

• Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #21516)

• Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #21523)

• Encode the persistent cache with V8's value serializer. (by @​avivkeller in #21514)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.2

Patch Changes

• Resolve aliases pointing at a package directory whose name ends with .js again. (by @​alexander-akait in #21542)

• Name CSS sources in source maps by their resource path, without the css prefix. (by @​bjohansebas in #21536)

• Delete no longer referenced files from the filesystem cache directory after storing the cache, age them by recorded time so restored caches are cleaned too, and collect every fully expired pack in one store instead of one per build. (by @​bjohansebas in #21528)

• Report "universal" as the loader context target for the universal target. (by @​alexander-akait in #21540)

• Skip require().prop in dead branches gated by inlined imported constants. (by @​hai-x in #21517)

• Annotate configuration options and public hooks in the generated types with the @since JSDoc tag. (by @​bjohansebas in #21473)

5.109.1

Patch Changes

• Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #21533)

• Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #21521)

• Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #21521)

• Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #21503)

• Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #21524)

• Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #21492)

• Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #21531)

• Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #21500)

• Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #21498)

• Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #21504)

• Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #21511)

• Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #21506)

• Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #21520)

• Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by