chore(deps): update dependencies (#696)

* chore(deps): update dependencies

Bump runtime and dev dependencies to their latest compatible versions and
refresh the affected snapshots and generated types.

Notable follow-on changes:

- `cssnano` >= 8.0.3 and `@changesets/get-github-info` v1 are exports-only,
  which neither `moduleResolution: "node"` nor the `import` plugin's node
  resolver can read, so their import sites are annotated.
- the `import` plugin cannot parse `copy-webpack-plugin` v14's dist bundle.
- refresh the vendored `serialize-javascript` copy for v7.1.0.
- resolve transitive `fast-uri`, `brace-expansion`, `js-yaml` and
  `shell-quote` advisories; `npm audit` is now clean.

Two packages raised their own Node requirements, so the rows that can no
longer run them skip the affected tests, as the matrix already does for
`@swc/*`, `html-minifier-terser` and `esbuild`:

- `cssnano@8` declares `engines.node` as `^22.11.0 || ^24.11.0 || >=26.0`
  and calls `Array.prototype.difference`, which only lands in V8 13.x, so
  Node 18 and 20 throw `trustedFunctions.difference is not a function` at
  minify time. The `RUN_CSS_TESTS` gate in `jest.config.js` moves from
  Node 18 to Node 22.
- `copy-webpack-plugin@14` declares `engines.node` as `>= 20.9.0` and
  calls `Array.prototype.toSorted`, so Node 10-18 throw `toSorted is not
  a function`. Only `should work with ES modules` uses the plugin, so it
  is filtered by name through the workflow's existing `-t` pattern rather
  than skipping all of `TerserPlugin.test.js`, and an `18.x` case is added
  for the row that previously ran the suite unfiltered.

Held back deliberately:

- `@babel/*` v8 requires Node >= 20 and would fail `api.assertVersion(7)`,
  breaking the Node 10-18 CI legs.
- `typescript` v7 removes `moduleResolution: node10` and needs a tsconfig
  and source migration.
- `del` v7+ is ESM-only and drops its default export.
- `jest-worker` v30 requires Node >= 18.14, but this package supports
  Node >= 10.13.0.
- `prettier-2` is an intentional pin for testing against Prettier 2.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XzZ6pmcJEquRDbKy4gKA8R

* fix: load `copy-webpack-plugin` lazily so old Node can run the suite

`copy-webpack-plugin@14` reaches for `require("node:path")`, a specifier
Node 10 and 12 cannot resolve, so importing it at the top of the file threw
before any test ran and took all 58 tests in `TerserPlugin.test.js` with it.
Filtering the one test that uses the plugin out by name does not help: `-t`
skips test execution, not module loading.

Move the import into the body of `should work with ES modules`, the only
test that uses it, so the rows that filter that test never load the module.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XzZ6pmcJEquRDbKy4gKA8R

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: alexander-akait

.changeset/changelog-generator.mjs

@@ -1,3 +1,6 @@
+// `@changesets/get-github-info` is exports-only, which the `import` plugin's
+// node resolver does not read
+// eslint-disable-next-line import/no-unresolved
 import { getInfo, getInfoFromPullRequest } from "@changesets/get-github-info";
 
 /** @typedef {import("@changesets/types").ChangelogFunctions} ChangelogFunctions */

.github/workflows/nodejs.yml

@@ -167,19 +167,28 @@ jobs:
         # aren't available on Node 10/12; `htmlMinifierTerser` requires Node
         # 14.13+; `esbuildMinify`/`esbuildMinifyCss` require Node 18+.
         #
+        # `should work with ES modules` drives `copy-webpack-plugin`, which
+        # declares `engines.node` as `>= 20.9.0` from v14 on and calls
+        # `Array.prototype.toSorted`, so it throws `toSorted is not a
+        # function` on anything older. Only that one test uses the plugin, so
+        # it is filtered by name rather than skipping the whole file.
+        #
         # `-u` is passed alongside the filter so Jest doesn't fail the CI run
         # over the snapshots whose owning tests are skipped by `-t` (Jest
         # treats them as obsolete when stdin isn't a TTY). The change is local
         # to the runner and never committed, so strict snapshot validation
-        # still happens on the Node 18+ rows that run the full suite.
+        # still happens on the Node 20+ rows that run the full suite.
         shell: bash
         run: |
           case "${{ matrix.node-version }}" in
             10.x|12.x)
-              npm run test:coverage -- --ci -u -t '^(?!.*(swcMinify|esbuildMinify|htmlMinifierTerser)).*$'
+              npm run test:coverage -- --ci -u -t '^(?!.*(swcMinify|esbuildMinify|htmlMinifierTerser|should work with ES modules)).*$'
               ;;
             14.x|16.x)
-              npm run test:coverage -- --ci -u -t '^(?!.*esbuildMinify).*$'
+              npm run test:coverage -- --ci -u -t '^(?!.*(esbuildMinify|should work with ES modules)).*$'
+              ;;
+            18.x)
+              npm run test:coverage -- --ci -u -t '^(?!.*should work with ES modules).*$'
               ;;
             *)
               npm run test:coverage -- --ci

README.md

@@ -298,10 +298,7 @@ type minifyFn = (
           | undefined;
         filename?: string | ((fileData: any) => string) | undefined;
         banner?:
-          | string
-          | boolean
-          | ((commentsFile: string) => string)
-          | undefined;
+          string | boolean | ((commentsFile: string) => string) | undefined;
       }
     | undefined,
 ) => Promise<{
@@ -368,9 +365,7 @@ const minify = (input, sourceMap, minimizerOptions, extractsComments) => {
 
   // Custom logic for extract comments
   const { map, code } = require("uglify-module") // Or require('./path/to/uglify-module')
-    .minify(input, {
-      /* Your options for minification */
-    });
+    .minify(input, {/* Your options for minification */});
 
   return { map, code, warnings: [], errors: [], extractedComments: [] };
 };
@@ -580,10 +575,7 @@ type extractComments =
         | undefined;
       filename?: string | ((fileData: any) => string) | undefined;
       banner?:
-        | string
-        | boolean
-        | ((commentsFile: string) => string)
-        | undefined;
+        string | boolean | ((commentsFile: string) => string) | undefined;
     };
 ```
 
@@ -1399,9 +1391,7 @@ module.exports = {
       new MinimizerPlugin({
         minify: (file, sourceMap) => {
           // https://github.com/mishoo/UglifyJS2#minify-options
-          const uglifyJsOptions = {
-            /* your `uglify-js` package options */
-          };
+          const uglifyJsOptions = {/* your `uglify-js` package options */};
 
           if (sourceMap) {
             uglifyJsOptions.sourceMap = {

jest.config.js

@@ -1,12 +1,16 @@
-// The bundled CSS minimizers (`cssnano@7`, `@swc/css`, `lightningcss`,
-// `esbuild@0.27`) require modern Node and don't reliably install on the
+// The bundled CSS minimizers (`cssnano@8`, `@swc/css`, `lightningcss`,
+// `esbuild@0.28`) require modern Node and don't reliably install on the
 // Windows agents. Skip the dedicated CSS test file outright on rows that
-// can't run them so we don't end up with stale or missing snapshots. The
-// `@swc/html` minimizers require Node >= 14, so the dedicated swc-html file
-// is skipped on older Node for the same reason.
+// can't run them so we don't end up with stale or missing snapshots.
+// `cssnano@8` declares `engines.node` as `^22.11.0 || ^24.11.0 || >=26.0`
+// and reaches for `Array.prototype.difference`, which only lands in V8 13.x,
+// so anything older throws `trustedFunctions.difference is not a function`
+// at minify time rather than failing to install. The `@swc/html` minimizers
+// require Node >= 14, so the dedicated swc-html file is skipped on older
+// Node for the same reason.
 const NODE_MAJOR = Number(process.versions.node.split(".")[0]);
 const IS_WINDOWS = process.platform === "win32";
-const RUN_CSS_TESTS = NODE_MAJOR >= 18 && !IS_WINDOWS;
+const RUN_CSS_TESTS = NODE_MAJOR >= 22 && !IS_WINDOWS;
 const RUN_SWC_HTML_TESTS = NODE_MAJOR >= 14;
 // `renderEmbeddedSource` and the `collectEmbeddedSource` / `embeddedSources`
 // passes landed in webpack 5.110; the plugin degrades to doing nothing without