Skip to content

Conversation

@renovate-sh-app
Copy link
Contributor

@renovate-sh-app renovate-sh-app bot commented Dec 18, 2025

This PR contains the following updates:

Package Change Age Confidence
webpack ^5.95.0^5.102.1 age confidence

Release Notes

webpack/webpack (webpack)

v5.104.1

Compare Source

Patch Changes
  • 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
  • c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

Compare Source

Minor Changes
  • d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
  • d3dd841: Enhance import.meta.env to support object access.
  • 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
  • 04cd530: Handle more at-rules for CSS modules.
  • cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
  • d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
  • 5983843: Provide a stable runtime function variable __webpack_global__.
  • d3dd841: Improved localIdentName hashing for CSS.
Patch Changes
  • 22c48fb: Added module existence check for informative error message in development mode.
  • 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
  • d3dd841: Support universal lazy compilation.
  • d3dd841: Fixed module library export definitions when multiple runtimes.
  • d3dd841: Fixed CSS nesting and CSS custom properties parsing.
  • d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
  • aab1da9: Fixed bugs for css/global type.
  • d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
  • d3dd841: Handle nested __webpack_require__.
  • 728ddb7: The speed of identifier parsing has been improved.
  • 0f8b31b: Improve types.
  • d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
  • 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
  • d3dd841: Serialize HookWebpackError.
  • d3dd841: Added ability to use built-in properties in dotenv and define plugin.
  • 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
  • d3dd841: Reduce collision for local indent name in CSS.
  • d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Compare Source

Features
  • Added DotenvPlugin and top level dotenv option to enable this plugin
  • Added WebpackManifestPlugin
  • Added support the ignoreList option in devtool plugins
  • Allow to use custom javascript parse function
  • Added import.meta.env support for environment variables
  • Added support for import.meta.dirname and import.meta.filename
  • Added support import.defer() for statistical path
  • Handle import.meta.main
  • Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
  • Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
  • [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
  • [CSS] Added support for composes properties
Fixes
  • The dependOn chunk must be loaded before the common chunk
  • Return to namespace import when the external request includes a specific export
  • No runtime extra runtime code for module libraries
  • Delay HMR accept dependencies to preserve import attributes
  • Properly handle external presets for universal target
  • Fixed incorrect identifier of import binding for module externals
  • Fixed when defer import and dynamic default export mixed
  • Reduce generated output when globalThis supported
  • Fixed loading async modules in defer import
  • Reexport module for default import when no used exports for systemjs library
  • Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
  • Handle __dirname and __filename for ES modules
  • Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
  • [Types] webpack function type
  • [Types] NormalModule type
  • [Types] Multi compiler configuration type
  • [Types] Fixed regression in custom hashDigest type
  • [CSS] No extra runtime for initial chunk
  • [CSS] Fixed a lot of CSS modules bugs

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

@renovate-sh-app renovate-sh-app bot requested a review from a team as a code owner December 18, 2025 21:15
@renovate-sh-app renovate-sh-app bot force-pushed the renovate/webpack-5.x branch from d1d8bce to ed9a92b Compare December 19, 2025 15:12
@renovate-sh-app renovate-sh-app bot changed the title chore(deps): update dependency webpack to ^5.103.0 chore(deps): update dependency webpack to ^5.104.0 Dec 19, 2025
| datasource | package | from    | to      |
| ---------- | ------- | ------- | ------- |
| npm        | webpack | 5.102.1 | 5.104.1 |


Signed-off-by: renovate-sh-app[bot] <219655108+renovate-sh-app[bot]@users.noreply.github.com>
@renovate-sh-app renovate-sh-app bot force-pushed the renovate/webpack-5.x branch from ed9a92b to 22e081b Compare December 21, 2025 15:17
@renovate-sh-app renovate-sh-app bot changed the title chore(deps): update dependency webpack to ^5.104.0 chore(deps): update dependency webpack to ^5.102.1 Dec 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Incoming

Development

Successfully merging this pull request may close these issues.

0 participants