fix(deps): update dependency webpack to v5.105.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
webpack	5.94.0 → 5.105.0

---

Release Notes

webpack/webpack (webpack)

v5.105.0

Compare Source

Minor Changes

• Allow resolving worker module by export condition name when using new Worker() (by @​hai-x in #​20353)

• Detect conditional imports to avoid compile-time linking errors for non-existent exports. (by @​hai-x in #​20320)

• Added the tsconfig option for the resolver options (replacement for tsconfig-paths-webpack-plugin). Can be false (disabled), true (use the default tsconfig.json file to search for it), a string path to tsconfig.json, or an object with configFile and references options. (by @​alexander-akait in #​20400)

• Support import.defer() for context modules. (by @​ahabhgk in #​20399)

• Added support for array values ​​to the devtool option. (by @​hai-x in #​20191)

• Improve rendering node built-in modules for ECMA module output. (by @​hai-x in #​20255)

• Unknown import.meta properties are now determined at runtime instead of being statically analyzed at compile time. (by @​xiaoxiaojx in #​20312)

Patch Changes

• Fixed ESM default export handling for .mjs files in Module Federation (by @​y-okt in #​20189)

• Optimized import.meta.env handling in destructuring assignments by using cached stringified environment definitions. (by @​xiaoxiaojx in #​20313)

• Respect the stats.errorStack option in stats output. (by @​samarthsinh2660 in #​20258)

• Fixed a bug where declaring a module variable in module scope would conflict with the default moduleArgument. (by @​xiaoxiaojx in #​20265)

• Fix VirtualUrlPlugin to set resourceData.context for proper module resolution. Previously, when context was not set, it would fallback to the virtual scheme path (e.g., virtual:routes), which is not a valid filesystem path, causing subsequent resolve operations to fail. (by @​xiaoxiaojx in #​20390)

• Fixed Worker self-import handling to support various URL patterns (e.g., import.meta.url, new URL(import.meta.url), new URL(import.meta.url, import.meta.url), new URL("./index.js", import.meta.url)). Workers that resolve to the same module are now properly deduplicated, regardless of the URL syntax used. (by @​xiaoxiaojx in #​20381)

• Reuse the same async entrypoint for the same Worker URL within a module to avoid circular dependency warnings when multiple Workers reference the same resource. (by @​xiaoxiaojx in #​20345)

• Fixed a bug where a self-referencing dependency would have an unused export name when imported inside a web worker. (by @​samarthsinh2660 in #​20251)

• Fix missing export generation when concatenated modules in different chunks share the same runtime in module library bundles. (by @​hai-x in #​20346)

• Fixed import.meta.env.xxx behavior: when accessing a non-existent property, it now returns empty object instead of full object at runtime. (by @​xiaoxiaojx in #​20289)

• Improved parsing error reporting by adding a link to the loader documentation. (by @​gaurav10gg in #​20244)

• Fix typescript types. (by @​alexander-akait in #​20305)

• Add declaration for unused harmony import specifier. (by @​hai-x in #​20286)

• Fix compressibility of modules while retaining portability. (by @​dmichon-msft in #​20287)

• Optimize source map generation: only include ignoreList property when it has content, avoiding empty arrays in source maps. (by @​xiaoxiaojx in #​20319)

• Preserve star exports for dependencies in ECMA module output. (by @​hai-x in #​20293)

• Consider asset modulem to be side-effect free. (by @​hai-x in #​20352)

• Avoid generating JavaScript modules for CSS exports that are not used, reducing unnecessary output and bundle size. (by @​xiaoxiaojx in #​20337)

v5.104.1

Compare Source

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

Compare Source

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Compare Source

Features

• Added DotenvPlugin and top level dotenv option to enable this plugin
• Added WebpackManifestPlugin
• Added support the ignoreList option in devtool plugins
• Allow to use custom javascript parse function
• Added import.meta.env support for environment variables
• Added support for import.meta.dirname and import.meta.filename
• Added support import.defer() for statistical path
• Handle import.meta.main
• Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
• Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
• [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
• [CSS] Added support for composes properties

Fixes

• The dependOn chunk must be loaded before the common chunk
• Return to namespace import when the external request includes a specific export
• No runtime extra runtime code for module libraries
• Delay HMR accept dependencies to preserve import attributes
• Properly handle external presets for universal target
• Fixed incorrect identifier of import binding for module externals
• Fixed when defer import and dynamic default export mixed
• Reduce generated output when globalThis supported
• Fixed loading async modules in defer import
• Reexport module for default import when no used exports for systemjs library
• Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
• Handle __dirname and __filename for ES modules
• Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
• [Types] webpack function type
• [Types] NormalModule type
• [Types] Multi compiler configuration type
• [Types] Fixed regression in custom hashDigest type
• [CSS] No extra runtime for initial chunk
• [CSS] Fixed a lot of CSS modules bugs

v5.102.1

Compare Source

Fixes

• Supported extends with env for browserslist
• Supported JSONP fragment format for web workers.
• Fixed dynamic import support in workers using browserslist.
• Fixed default defer import mangling.
• Fixed default import of commonjs externals for SystemJS format.
• Fixed context modules to the same file with different import attributes.
• Fixed typescript types.
• Improved import.meta warning messages to be more clear when used directly.
• [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.

v5.102.0

Compare Source

Features

• Added static analyze for dynamic imports
• Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
• Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
• Added the snapshot.contextModule to configure snapshots options for context modules
• Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
• The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
• The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
• Added function matcher support in rule options

Fixes

• Fixed conflicts caused by multiple concatenate modules
• Ignore import failure during HMR update with ES modules output
• Keep render module order consistent
• Prevent inlining modules that have this exports
• Removed unused timeout attribute of script tag
• Supported UMD chunk format to work in web workers
• Improved CommonJs bundle to ES module library
• Use es-lexer for mjs files for build dependencies
• Fixed support __non_webpack_require__ for ES modules
• Properly handle external modules for CSS
• AssetsByChunkName included assets from chunk.auxiliaryFiles
• Use createRequire only when output is ES module and target is node
• Typescript types

Performance Improvements

• Avoid extra calls for snapshot
• A avoid extra jobs for build dependencies
• Move import attributes to own dependencies

v5.101.3

Compare Source

Fixes

• Fixed resolve execution order issue from extra await in async modules
• Avoid empty block for unused statement
• Collect only specific expressions for destructuring assignment

v5.101.2

Compare Source

Fixes

• Fixed syntax error when comment is on the last line
• Handle var declaration for createRequire
• Distinguish free variable and tagged variable

v5.101.1

Compare Source

Fixes

• Filter deleted assets in processAdditionalAssets hook
• HMR failure in defer module
• Emit assets even if invalidation occurs again
• Export types for serialization and deserialization in plugins and export the ModuleFactory class
• Fixed the failure export of internal function for ES module chunk format
• Fixed GetChunkFilename failure caused by dependOn entry
• Fixed the import of missing dependency chunks
• Fixed when entry chunk depends on the runtime chunk hash
• Fixed module.exports bundle to ESM library
• Adjusted the time of adding a group depending on the fragment of execution time
• Fixed circle dependencies when require RawModule and condition of isDeferred
• Tree-shakable module library should align preconditions of allowInlineStartup

v5.101.0

Compare Source

Fixes

• Fixed concatenate optimization for ESM that caused undefined export
• Respect the output.environment.nodePrefixForCoreModules option everywhere
• Respect the output.importMetaName option everywhere
• Fixed await async dependencies when accepting them during HMR
• Better typescript types

Features

• Added colors helpers for CLI
• Enable tree-shaking for ESM external modules with named imports
• Added the deferImport option to parser options

Performance Improvements

• Fixed a regression in module concatenation after implementing deferred import support
• Fixed a potential performance issue in CleanPlugin
• Avoid extra require in some places

v5.100.2

Compare Source

Fixes

• Keep consistent CSS order
• Dependency without the source order attribute must keep their original index
• Keep module traversal consistent across reexport scenarios

Performance Improvements

• Extend importPhasesPlugin only when enable deferImport (#​19689)

v5.100.1

Compare Source

Fixes

• Tree-shaking unused ignored modules
• [Types] Compatibility with old Node.js versions

v5.100.0

Compare Source

Fixes

• Fixed the case where an ES modules entry chunk depends on the runtime chunk hash
• Handle function exports in webpack module wrapper
• Ensure dependent chunks are imported before startup & fix duplicate export of 'default'
• Generate lose closing brace when exports are unprovided
• CleanPlugin doesn't unlink same file twice
• Fixed unexpected error codes from fs.unlink on Windows
• Typescript types

Features

• HMR support for ES modules output
• ES module output mode now fully supports splitChunks when external variables and runtimeChunk are not set.
• Added support using keyword
• Implemented tc39 Defer Module Evaluation (experiment)
• Support dynamic template literals expressions for new URL(...)
• Enable ES modules worker chunk loading for Node.js targets
• Improved support for destructing in DefinePlugin
• Added VirtualUrlPlugin to support virtual: scheme

Performance Improvements

• Remove useless startup entrypoint runtime for ES modules output
• Cache new URL(...) evaluate expression

v5.99.9

Compare Source

Fixes

• HMR might fail if there are new initial chunks
• Destructuring namespace import with default
• Destructuring namespace import with computed-property
• Generate valid code for es export generation for multiple module entries
• Fixed public path issue for ES modules
• Asset modules work when lazy compilation used
• Eliminate unused statements in certain scenarios
• Fixed regression with location and order of dependencies
• Fixed typescript types

v5.99.8

Compare Source

Fixes

• Fixed type error with latest @types/node
• Fixed typescript types

v5.99.7

Compare Source

Fixes

• Don't skip export generation for default reexport (#​19463)
• Fixed module library export generation for reexport (#​19459)
• Avoid module concatenation in child compilation for module library (#​19457)
• Ensure HMR recover gracefully when CSS module with error
• Respect cause of any errors and errors of AggregateError in stats output
• Added missing @types/json-schema in types

v5.99.6

Compare Source

Fixes

• Respect public path for ES modules
• Fixed generation of module for module library when mixing commonjs and esm modules
• Always apply FlagDependencyExportsPlugin for libraries where it required
• Faster logic for dead control flow
• Typescript types

v5.99.5

Compare Source

Fixes

• Control dead flow for labeled and blockless statements

v5.99.4

Compare Source

Fixes

• Fixed terminated state for if/else

v5.99.3

Compare Source

Fixes

• Fixed dead control flow with deep nested if/else

v5.99.2

Compare Source

Fixes

• Dead control flow for exotic cases

v5.99.1

Compare Source

Fixes

• Dead control flow for many cases

v5.99.0

Compare Source

Fixes

• Fixed a lot of types
• Fixed runtime error when using asset module as entrypoint and runtimeChunk
• JSON generator now preserves __proto__ property
• Fixed when entry module isn't executed when targeting webworker with a runtime chunk
• Do not duplicate modules with import attributes and reexport
• The module and module ESM libraries have been union and code generation has been improved
• Use a valid output path for errored asset modules
• Remove BOM from JavaScript and CSS files when loader was not used
• Create export for externals for module/modern-module library
• Export unprovided variables for commonjs-static library
• Forward semicolons from meta.webpackAST
• Use xxhash64 for cache.hashAlgorithm when experiments.futureDefaults enabled
• [CSS] Fixed profiling plugin for CSS
• [CSS] Avoid extra module.export output for CSS module

Features

• Add dead control flow check
• Handle new Worker(import.meta.url) and new Worker(new URL(import.meta.url)) syntax
• Added ability to generate custom error content for generators

Performance Improvements

• Fixed excessive calls of getAllReferences
• Optimize loc for monomorphic inline caching

Chores

• Switch on strict types for typescript

v5.98.0

Compare Source

Fixes

• Avoid the deprecation message #​19062 by @​alexander-akait
• Should not escape CSS local ident in JS #​19060 by @​JSerFeng
• MF parse range not compatible with Safari #​19083 by @​alexander-akait
• Preserve filenameTemplate in new split chunk #​19104 by @​henryqdineen
• Use module IDs for final render order #​19184 by @​dmichon-msft
• Strip blob: protocol when public path is auto #​19199 by @​alexander-akait
• Respect output.charset everywhere #​19202 by @​alexander-akait
• Node async WASM loader generation #​19210 by @​ashi009
• Correct BuildInfo and BuildMeta type definitions #​19200 by @​inottn

Performance Improvements

• Improve FlagDependencyExportsPlugin for large JSON by depth #​19058 by @​hai-x
• Optimize assign-depths #​19193 by @​dmichon-msft
• Use startsWith for matching instead of converting the string to a regex #​19207 by @​inottn

Chores

• Bump nanoid from 3.3.7 to 3.3.8 #​19063 by @​dependabot
• Fixed incorrect typecast in DefaultStatsFactoryPlugin #​19156 by @​Andarist
• Improved readme.md by adding video links for understanding webpack #​19101 by @​Vansh5632
• Typo fix #​19205 by @​hai-x
• Adopt the new webpack governance model #​18804 by @​ovflowd

Features

• Implement /* webpackIgnore: true */ for require.resolve #​19201 by @​alexander-akait

Continuous Integration

• CI fix #​19196 by @​alexander-akait

New Contributors

• @​Andarist made their first contribution in #​19156
• @​Vansh5632 made their first contribution in #​19101
• @​ashi009 made their first contribution in #​19210
• @​ovflowd made their first contribution in #​18804

Full Changelog: webpack/webpack@v5.97.1...v5.98.0

v5.97.1

Compare Source

Bug Fixes

• Performance regression
• Sub define key should't be renamed when it's a defined variable

v5.97.0

Compare Source

Bug Fixes

• Don't crash with filesystem cache and unknown scheme
• Generate a valid code when output.iife is true and output.library.type is umd
• Fixed conflict variable name with concatenate modules and runtime code
• Merge duplicate chunks before
• Collisions in ESM library
• Use recursive search for versions of shared dependencies
• [WASM] Don't crash WebAssembly with Reference Types (sync and async)
• [WASM] Fixed wasm loading for sync and async webassembly
• [CSS] Don't add [uniqueName] to localIdentName when it is empty
• [CSS] Parsing strings on Windows
• [CSS] Fixed CSS local escaping

New Features

• Added support for injecting debug IDs
• Export the MergeDuplicateChunks plugin
• Added universal loading for JS chunks and JS worker chunks (only ES modules)
• [WASM] Added universal loading for WebAssembly chunks (only for async WebAssembly)
• [CSS] Allow initial CSS chunks to be placed anywhere - the output.cssHeadDataCompression option was deleted
• [CSS] Added universal loading for CSS chunks
• [CSS] Parse ICSS @value at-rules in CSS modules
• [CSS] Parse ICSS :import rules in CSS modules
• [CSS] Added the url and import options for CSS
• [CSS] Allow to import custom properties in CSS modules

Performance

• Faster Queue implementation, also fixed queue iterator state in dequeue method to ensure correct behavior after item removal

v5.96.1

Compare Source

Bug Fixes

• [Types] Add @types/eslint-scope to dependencieS
• [Types] Fixed regression in validate

v5.96.0

Compare Source

Bug Fixes

• Fixed Module Federation should track all referenced chunks
• Handle Data URI without base64 word
• HotUpdateChunk have correct runtime when modified with new runtime
• Order of chunks ids in generated chunk code
• No extra Javascript chunks when using asset module as an entrypoint
• Use optimistically logic for output.environment.dynamicImport to determine chunk format when no browserslist or target
• Collision with global variables for optimization.avoidEntryIife
• Avoid through variables in inlined module
• Allow chunk template strings in output.devtoolNamespace
• No extra runtime for get javascript/css chunk filename
• No extra runtime for prefetch and preload in JS runtime when it was unsed in CSS
• Avoid cache invalidation using ProgressPlugin
• Increase parallelism when using importModule on the execution stage
• Correctly parsing string in export and import
• Typescript types
• [CSS] css/auto considers a module depending on its filename as css (pure CSS) or css/local, before it was css/global and css/local
• [CSS] Always interpolate classes even if they are not involved in export
• [CSS] No extra runtime in Javascript runtime chunks for asset modules used in CSS
• [CSS] No extra runtime in Javascript runtime chunks for external asset modules used in CSS
• [CSS] No extra runtime for the node target
• [CSS] Fixed url()s and @import parsing
• [CSS] Fixed - emit a warning on broken :local and :global

New Features

• Export CSS and ESM runtime modules
• Single Runtime Chunk and Federation eager module hoisting
• [CSS] Support /* webpackIgnore: true */ for CSS files
• [CSS] Support src() support
• [CSS] CSS nesting in CSS modules

v5.95.0

Compare Source

Bug Fixes

• Fixed hanging when attempting to read a symlink-like file that it can't read
• Handle default for import context element dependency
• Merge duplicate chunks call after split chunks
• Generate correctly code for dynamically importing the same file twice and destructuring
• Use content hash as [base] and [name] for extracted DataURI's
• Distinguish module and import in module-import for externals import's
• [Types] Make EnvironmentPlugin default values types less strict
• [Types] Typescript 5.6 compatibility

New Features

• Add new optimization.avoidEntryIife option (true by default for the production mode)
• Pass output.hash* options to loader context

Performance

• Avoid unneeded re-visit in build chunk graph

---

Configuration

📅 Schedule: Branch creation - "every weekday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.