Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 4, 2025

This PR contains the following updates:

Package Change Age Confidence
webpack 5.101.35.104.1 age confidence

Release Notes

webpack/webpack (webpack)

v5.104.1

Compare Source

Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

Compare Source

Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Compare Source

Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs

v5.102.1

Compare Source

Fixes
  • Supported extends with env for browserslist
  • Supported JSONP fragment format for web workers.
  • Fixed dynamic import support in workers using browserslist.
  • Fixed default defer import mangling.
  • Fixed default import of commonjs externals for SystemJS format.
  • Fixed context modules to the same file with different import attributes.
  • Fixed typescript types.
  • Improved import.meta warning messages to be more clear when used directly.
  • [CSS] Fixed CC_UPPER_U parsing (E -> U) in tokenizer.

v5.102.0

Compare Source

Features
  • Added static analyze for dynamic imports
  • Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)
  • Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)
  • Added the snapshot.contextModule to configure snapshots options for context modules
  • Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)
  • The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)
  • The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)
  • Added function matcher support in rule options
Fixes
  • Fixed conflicts caused by multiple concatenate modules
  • Ignore import failure during HMR update with ES modules output
  • Keep render module order consistent
  • Prevent inlining modules that have this exports
  • Removed unused timeout attribute of script tag
  • Supported UMD chunk format to work in web workers
  • Improved CommonJs bundle to ES module library
  • Use es-lexer for mjs files for build dependencies
  • Fixed support __non_webpack_require__ for ES modules
  • Properly handle external modules for CSS
  • AssetsByChunkName included assets from chunk.auxiliaryFiles
  • Use createRequire only when output is ES module and target is node
  • Typescript types
Performance Improvements
  • Avoid extra calls for snapshot
  • A avoid extra jobs for build dependencies
  • Move import attributes to own dependencies

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot enabled auto-merge (squash) October 4, 2025 20:25
@renovate renovate bot added the renovate label Oct 4, 2025
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from a5b3998 to f338674 Compare October 12, 2025 17:53
@renovate renovate bot changed the title chore(deps): update dependency webpack to v5.102.0 chore(deps): update dependency webpack to v5.102.1 Oct 12, 2025
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch 2 times, most recently from dfe1d58 to 5b3411f Compare October 21, 2025 16:57
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from 5b3411f to 779ea4c Compare October 28, 2025 05:15
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from 779ea4c to 904dd2c Compare November 10, 2025 21:11
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch 2 times, most recently from cf40e7d to 7e67dc9 Compare November 23, 2025 12:59
@renovate renovate bot changed the title chore(deps): update dependency webpack to v5.102.1 chore(deps): update dependency webpack to v5.103.0 Nov 23, 2025
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from 7e67dc9 to 1d215fc Compare November 25, 2025 20:50
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from 1d215fc to 4c4be7f Compare December 3, 2025 19:14
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from 4c4be7f to a610a49 Compare December 21, 2025 13:42
@renovate renovate bot changed the title chore(deps): update dependency webpack to v5.103.0 chore(deps): update dependency webpack to v5.104.0 Dec 21, 2025
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from a610a49 to fec2adf Compare December 23, 2025 17:44
@renovate renovate bot changed the title chore(deps): update dependency webpack to v5.104.0 chore(deps): update dependency webpack to v5.104.1 Dec 23, 2025
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from fec2adf to a400c3f Compare December 31, 2025 17:42
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from a400c3f to 00f26bf Compare January 8, 2026 17:40
@renovate renovate bot force-pushed the renovate/webpack-5.x-lockfile branch from 00f26bf to 6e703d5 Compare January 19, 2026 14:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant