You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
chore(deps): update dependency webpack to v5.76.0 [security]#37
Open
renovate[bot] wants to merge 1 commit intomasterhttps-quantumblockchainai-atlassian-net/karma-webpack:masterfrom
renovate/npm-webpack-vulnerabilityhttps-quantumblockchainai-atlassian-net/karma-webpack:renovate/npm-webpack-vulnerabilityCopy head branch name to clipboard
renovate[bot] wants to merge 1 commit intomasterhttps-quantumblockchainai-atlassian-net/karma-webpack:masterfrom
renovate/npm-webpack-vulnerabilityhttps-quantumblockchainai-atlassian-net/karma-webpack:renovate/npm-webpack-vulnerabilityCopy head branch name to clipboard
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
parser.javascript.reexportExportsPresence: false allows to disable warnings for non-existing exports during the migration from export ... from "..." to export type ... from "..." for type reexports in TypeScript
add experiments.backCompat: false to disable some expensive deprecations for better performance
Bugfixes
use ['catch'] instead of .catch for better ES3 support
fix removed parentheses when using new (require("...")).Something()
fix { require } object literals
splitChunks.chunks option is now correctly used for splitChunks.fallbackCacheGroup.maxSize too
fix schema of listen option, allow to omit port
add better support for Promises from different isolates
Developer Experience
add typings for the webpack API that is available within modules
use /// <reference types="webpack/module" /> to use the typings in typescript modules
correctly keep chunk loading state when the chunk loading logic is HMR updated
This fixes some edge cases that e. g. occur when using lazy compilation for entrypoints. It is now able to HMR update that instead of needing a manual reload. Also see fixes in webpack-dev-server@4.
track and resolve symlinks for filesystem snapshotting
This fixes some cases of circular yarn linking of dependencies.
It also fixes some problems when using package managers that use symlinks to deduplicate (e. g. cnpm or pnpm)
pass the resulting module in the callbacks of Compilation.addModuleChain and Compilation.addModuleTree
add experiments.buildHttp to build http(s):// imports instead of keeping them external
keeps a webpack.lock file with integrity and webpack.lock.data with cached content that should be committed
Automatically upgrades lockfile during development when remote resources change
(might be disabled with experiments.buildHttp.upgrade: false)
Lockfile is frozen during production builds and usually no network requests are made
(exception: Cache-Control: no-cache).
The webpack.lock.data persisting can be disabled with experiments.buildHttp.cacheLocation: false.
That will will introduce a availability risk.
(webpack cache will be used to cache network responses)
Bugfixes
fix HMR infinite loop (again)
fix rare non-determinism with splitChunks.maxSize introduces in the last release
optional modules no longer cause the module to fail when bail is set
fix typo in records format: chunkHashs -> chunkHashes
Performance
limit the number of parallel generated chunks for memory reasons
When using multiple configurations in watch mode and calling Watching.invalidate, dependencies and parallelism of the config array is now respected correctly
Fix a crash when accessing the stats after the next compilation has started
fix collecting changes when using Watching.suspend
fix schema of RuleCondition.not and allow passing a condition directly instead of only an array
Developer Experience
typings accept a ReadonlyArray of configurations now
improve memory usage when using the filesystem cache
When reading a file into a Buffer and picking smaller slices of the Buffer
the small slices still keep a reference to the large original Buffer.
The leads to increased memory usage. A fix would be to clone the slice into
a smaller Buffer when wasting too much memory, but this has a performance cost.
There is now a new option cache.allowCollectingMemory which controls that.
For one-off builds you probably want allowCollectingMemory: false and
for watch builds you probably want allowCollectingMemory: true.
It defaults to false in production mode and true in development mode.
add support for a pseudo extensions .webpack[type] (e. g. .webpack[javascript/auto]) to specify the default module type when no other module type is specified
to be used with !=! inline syntax
Bugfixes
fixes incorrect cache invalidation when new properties are added to the DefinePlugin
Experiments
add experiments.executeModule to allow build-time execution of modules of the module graph
add this.importModule(request, options, [callback]): Promise to the loader context
add compilation.executeModule(request, options, callback) for plugins
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
👍 No new dependency issues detected in pull request
Bot Commands
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all
renovatebot
changed the title
chore(deps): update dependency webpack to 5.76.0 [security]
chore(deps): update dependency webpack to v5.76.0 [security]
May 30, 2023
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
renovate
bot
changed the title
This PR contains the following updates:
5.10.0->5.76.0GitHub Vulnerability Alerts
CVE-2023-28154
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
Release Notes
webpack/webpack (webpack)
v5.76.0Compare Source
Bugfixes
generatedCodeinfo to fix bug in asset module cache restoration by @ryanwilsonperkin in https://github.com/webpack/webpack/pull/16703hashRegExplookup by @ryanwilsonperkin in https://github.com/webpack/webpack/pull/16759Features
targettoLoaderContexttype by @askoufis in https://github.com/webpack/webpack/pull/16781Security
Repo Changes
New Contributors
Full Changelog: webpack/webpack@v5.75.0...v5.76.0
v5.75.0Compare Source
Bugfixes
experiments.*normalize tofalsewhen opt-outNaN%windowbefore trying to access iteval-nosources-*actually exclude sourcesFeatures
@importto extenal CSS when using experimental CSS in nodei64support to the deprecated WASM implementationDeveloper Experience
EnableWasmLoadingPluginv5.74.0Compare Source
Features
resolve.extensionAliasoption which allows to alias extensions.jsextension to imports when the file really has a.tsextension (typescript +"type": "module")ProvidePluginBugfixes
shareScopeoption forModuleFederationPlugin"use-credentials"also for same origin scriptsPerformance
Extensibility
HarmonyImportDependencyfor pluginsv5.73.0Compare Source
Features
dynamicImportModeand prefetch and preloadimport { createRequire } from "module"in source codeBugfixes
return"field"in ModuleDeveloper Experience
PathDatain typingsv5.72.1Compare Source
Bugfixes
__webpack_nonce__with HMRinoperator in some casesthis.importModulev5.72.0Compare Source
Features
Bugfixes
inoperator with nested exportsv5.71.0Compare Source
Features
uniqueNamewhen using aoutput.librarywhich includes placeholdersinof a imported bindingBugfixes
chunkLoadingoption in module moduleevaluateExpressionreturnsnulllazy-onceContext modulesrunAsChildcallbackv5.70.0Compare Source
Features
baseUritoentryoptions to configure a static base uri (the base ofnew URL())__webpack_exports_info__.name.canMangleexperiments.buildHttpimport.meta.webpackContextas ESM alternative torequire.contextBugfixes
globalto a variableexperiments.outputModuleandloaderContext.importModulewith multiple chunksoutput.cleanwill keep HMR assets for at least 10s to allow HMR to access them even when compilation is faster then the browserPerformance
Developer Experience
Contributing
v5.69.1Compare Source
Revert
v5.69.0Compare Source
Features
resolve.aliasorresolve.modules) when creating an context moduleutil/typesto node.js built-in modules__webpack_exports_info__.<name>.canMangleapiBugfixes
stageoption when instrumenting plugins for the ProfilingPlugin#in paths of loadersexperiments.buildHttpContributing
Developer Experience
v5.68.0Compare Source
Features
__webpack_module__and__webpack_module__.idto the apiBugfixes
v5.67.0Compare Source
Features
experiments.cssSyncModuleIdsPluginto sync module ids between server and client compilationDeterministicModuleIdsPluginto allow to generate equal idsDeveloper Experience
nullto errors in callbacksBugfixes
experiments.css|webpack-hot-middleware/clientfrom lazy compilationContributing
v5.66.0Compare Source
Features
output.library.type: "commonjs-static"to emit a statically analyse-able commonjs module (for node.js esm interop support)experiments.css(very experimental)Bugfixes
experiments.lazyCompilation[absolute-resource-path]for SourceMap module namingPerformance
watchOptions.aggregateTimeoutto 20msv5.65.0Compare Source
Features
undefinednowBugfixes
singletonflag withoutrequiredVersionin Module Federationwatchpackfor context time info bugfixPerformance
Developer Experience
output.globalObjectcontains a non-trival expressionscripttype external with invalid syntaxResolver,StatsOptionsandResolvePluginInstancePreparations for the future
hashDigestLengthwill default to 16 in webpack 6 (experiments.futureDefaults)v5.64.4Compare Source
Bugfixes
Performance
Developer Experience
v5.64.3Compare Source
Performance
Infinityis used in configurationv5.64.2Compare Source
Bugfixes
v5.64.1Compare Source
Bugfixes
require(...).propertyinrequire.ensureoutput.clean: trueunsafeCachewithinmanagedPaths(node_modules)v5.64.0Compare Source
Features
asyncChunks: booleanoption to disable creation of async chunksBugfixes
experiments.backCompat: falsePerformance
v5.63.0Compare Source
Features
chunkLoading: falseto disable on-demand loadingBugfixes
import 'single-quote'in esm build dependenciesv5.62.2Compare Source
Bugfixes
__system_context__injection when using thelibraryoption on entrypointexportsPresence: "error"by default infutureDefaultsexportPresence->exportsPresencetypoexperiments.cacheUnaffectedv5.62.1Compare Source
Bugfix
;v5.62.0Compare Source
Features
parser.javascript.reexportExportsPresence: falseallows to disable warnings for non-existing exports during the migration fromexport ... from "..."toexport type ... from "..."for type reexports in TypeScriptexperiments.backCompat: falseto disable some expensive deprecations for better performanceBugfixes
['catch']instead of.catchfor better ES3 supportnew (require("...")).Something(){ require }object literalssplitChunks.chunksoption is now correctly used forsplitChunks.fallbackCacheGroup.maxSizetoolistenoption, allow to omitportDeveloper Experience
/// <reference types="webpack/module" />to use the typings in typescript modules"types": [..., "webpack/module"]in tsconfigv5.61.0Compare Source
Bugfixes
pathsubmodules in the node.js default externalsPerformance
Contribution
v5.60.0Compare Source
Features
experiments.lazyCompilation. e. g. port, https stuffBugfixes
output.hashFunctionused to persistent caching toobuildDependenciesSet correctly when loaders are added inbeforeLoadershookv5.59.1Compare Source
Bugfixes
experiments.buildHttpv5.59.0Compare Source
Features
/*#__PURE__*/forObject()in generated codemanaged/immutablePathsexperiments.buildHttpsplitChunks.minSizeReductionoptionBugfixes
waitForwhen modules are unsafe cachedv5.58.2Compare Source
Bugfixes
Performance
v5.58.1Compare Source
Bugfixes
.webpack[]suffix to not execute rulesv5.58.0Compare Source
Features
diagnostics_channelto node builtinsPerformance
v5.57.1Compare Source
Bugfix
v5.57.0Compare Source
Performance
Bugfixes
v5.56.1Compare Source
Bugfix
v5.56.0Compare Source
Performance
v5.55.1Compare Source
Bugfixes
experiments.cacheUnaffectedv5.55.0Compare Source
Performance
experiments.cacheUnaffectedmodule.unsafeCachev5.54.0Compare Source
Features
&&||and??output.hashFunctionevalis used in a moduleBugfixes
Performance
output.hashFunction: "xxhash64"for a super fast wasm based hash functionexperiments.cacheUnaffectedwhich caches computations for modules that are unchanged and reference only unchanged modulesv5.53.0Compare Source
Features
node.__dirname/__filename: "warn-mock"which warns on usage (will be enabled in webpack 6 by default)Bugfixes
stream/webto Node.js externalsExperiments
experiments.futureDefaultsto enable defaults for webpack 6v5.52.1Compare Source
Performance
v5.52.0Compare Source
Feature
experiments.executeModuleis enabled by default and the option is removedthis.importModuleBugfixes
__WEBPACK_EXTERNAL_MODULE_null__, which leads to merged externals.webpack[...]extension is not part of matching and module namev5.51.2Compare Source
Bugfixes
[contenthash]is undefined when usingnew Workerv5.51.1Compare Source
Bugfixes
library: "module"propages top-level-await correctlyv5.51.0Compare Source
Bugfixes
yarn linking of dependencies.Compilation.addModuleChainandCompilation.addModuleTreev5.50.0Compare Source
Features
#! ...) are now handled by webpackPerformance
v5.49.0Compare Source
Features
experiments.buildHttpto buildhttp(s)://imports instead of keeping them externalwebpack.lockfile with integrity andwebpack.lock.datawith cached content that should be committed(might be disabled with
experiments.buildHttp.upgrade: false)(exception:
Cache-Control: no-cache).webpack.lock.datapersisting can be disabled withexperiments.buildHttp.cacheLocation: false.That will will introduce a availability risk.
(webpack cache will be used to cache network responses)
Bugfixes
splitChunks.maxSizeintroduces in the last releasebailis setPerformance
v5.48.0Compare Source
Features
Bugfixes
v5.47.1Compare Source
Bugfixes
v5.47.0Compare Source
Performance
Bugfixes
"use strict"s in module modev5.46.0Compare Source
Features
stats.reasonsSpaceandstats.groupReasonsByOriginBugfixes
Performance
v5.45.1Compare Source
Bugfixes
assertin other placesimport(/* webpackPrefetch: true */ ...)no longer breaks library outputv5.45.0Compare Source
Features
Bugfixes
.cjsoutput filesPerformance
Contributing
v5.44.0Compare Source
Features
output.module+optimization.runtimeChunkBugfixes
v5.43.0Compare Source
Features
runtime: falsein entry description to disable runtime chunkruntimeoption in ModuleFederationPlugin and ContainerPluginBugfixes
"module"externals when concatenatedPerformance
v5.42.1Compare Source
Bugfixes
jsonDataordataUrlof undefinedv5.42.0Compare Source
Features
cache.compressionBugfixes
node-commonjsto schema forexternalsTypesystemexternalsPerformance
v5.41.1Compare Source
Bugfixes
Performance
v5.41.0Compare Source
Features
cache.idleTimeoutAfterLargeChangesto control thatBugfixes
Experiments
experiments.outputModule: true)output.library.type: "module": very basic support, no live bindings, unnecessary runtime codeoutput.chunkLoading: "import"output.chunkFormat: "module"externalsType: "module"generates nowimport * as X from "..."(in a module) orimport("...")(in a script)import { createRequire } from "module"in a modulenew Workeretc. sets `type: "module"v5.40.0Compare Source
Features
node:prefixed requests as node.js externalsinstanceof Promisein favor ofp && typeof p.then === "function"to allow mixing different Promise implementionsBugfixes
Performance
Developer Experience
Bufferinthis.emitFiletypings (loader context)resetcli argument descriptionv5.39.1Compare Source
Bugfixes
v5.39.0Compare Source
Features
import()context (import with expression)Bugfixes
cache.allowCollectingMemoryPerformance
Error.captureStackTracefrom webpack errorsv5.38.1Compare Source
Performance
v5.38.0Compare Source
Features
new URL("data:...", import.meta.url)is now supportedmodule.rules[].schemeas condition to match the request scheme (likedata,http, etc.)Bugfixes
Performance
v5.37.1Compare Source
Bugfixes
Watching.invalidate,dependenciesandparallelismof the config array is now respected correctlystatsafter the next compilation has startedWatching.suspendRuleCondition.notand allow passing a condition directly instead of only an arrayDeveloper Experience
Contributing
v5.37.0Compare Source
Features
output.trustedTypesBugfixes
dependOnnullin fs callbacksDeveloper Experiences
v5.36.2Compare Source
Bugfixes
output.cleanis against this assumptionv5.36.1Compare Source
Performance
cache.profile(type: "filesystem"only) flag for more info about (de)serialization timingsv5.36.0Compare Source
Features
Performance
v5.35.1Compare Source
Bugfixes
__webpack_exports__ is not definederror with some library typesperformance
v5.35.0Compare Source
Bugfixes
#in pathPerformance
v5.34.0Compare Source
Features
resolve.extensionsand handle them in this orderpnpapias builtin external when usingtarget: "node"Bugfixes
target: "node"Performance
Developer Experience
store: 'idle'from schema descriptionv5.33.2Compare Source
Bugfix
v5.33.1Compare Source
Bugfix
this.importModulev5.33.0Compare Source
Features
publicPathper entrypointentry.xxx.publicPathoptionBugfix
executeModulePerformance
export *and reexportsv5.32.0Compare Source
Features
.webpack[type](e. g..webpack[javascript/auto]) to specify the default module type when no other module type is specified!=!inline syntaxBugfixes
Experiments
experiments.executeModuleto allow build-time execution of modules of the module graphthis.importModule(request, options, [callback]): Promiseto the loader contextcompilation.executeModule(request, options, callback)for pluginsv5.31.2Compare Source
Bugfixes
v5.31.1Compare Source
Bugfixes
Memory
Performance
v5.31.0Compare Source
Features
infrastructureLogging.colors: Enables/Disables colorful output.infrastructureLogging.appendOnly: Only appends lines to the output. Avoids updating existing output e. g. for status messages.infrastructureLogging.stream: Stream used for logging output. Defaults to process.stderr.infrastructureLogging.console: Custom console used for logging.Bugfixes
exportsfield is usedv5.30.0Compare Source
Features
cache.maxGenerationswhencache.type: "memory"cache.type: "filesystem"andmode: "development"cache.maxMemoryGenerationswhencache.type: "filesystem"cache.maxAgecache.maxMemoryGenerations: 0Bugfixes
GC = Garbage Collection
v5.29.0Compare Source
Bugfixes
splitChunks.maxSizewhich cause too large chunks to be createdstats.groupModulesByTypeto the schemaDeveloper Experience
Module/Const/NullDependencyon the APIv5.28.0Compare Source
Features
module.generator.asset.publicPathto configure a different publicPath for assetsBugfixes
Performance
v5.27.2Compare Source
Bugfixes
beforeLoadershookexperiments.lazyCompilationis used (regression)import()new URL(new URLgenerated by worker handingv5.27.1Compare Source
Bugfix
v5.27.0Compare Source
Features
utils: { contextify(context, absolutePath), absolutify(context, request) }to loader contextBugfixes
importsfield handlingv5.26.3Compare Source
Bugfix
v5.26.2Compare Source
Bugfixes
v5.26.1Compare Source
Bugfixes
Set.addAllpolyfill../when generation the undo path for non-web targetsv5.26.0Compare Source
Features
DefinePlugin.runtimeValue(file/context/missing/buildDependencies, version)Bugfixes
v5.25.1Compare Source
Bugfixes
type: "module"for Workers when generating classic scriptsv5.25.0Compare Source
Features
__webpack_runtime_id__to access the current runtime idoutput.strictModuleErrorHandlingto opt into stricter evaluation error handling semantics according to ESM specnew URL()this will result in an url to a empty file ("data:,")module.generator.asset.emitoption to disable creating assets from asset modules (e. g. for SSR)Bugfixes
splitChunks.maxSizewhere negative indicies are accessedsplitChunks.maxSizein some cases when multiple size types are involvedDeprecations
output.strictModuleExceptionHandling(this is the CommonJS way of handling errors, and the name is weird)v5.24.4Compare Source
Bugfixes
externals"..."in array configuration options when it's not at the startv5.24.3Compare Source
Bugfixes
v5.24.2Compare Source
Bugfixes
modifiedFilesandremovedFileswere undefinedv5.24.1Compare Source
Performance
Developer Experience
v5.24.0Compare Source
Bugfixes
export *that point to the same exportexperiments.lazyCompilation: true. It now has an effect.Developer Experience
WatchingtypeContribution
Performance
v5.23.0Compare Source
Features
parserOptions.url: "relative"optionnew URL(e. g. for SSG/SSR)Bugfixes
Developer Experience
v5.22.0Compare Source
Features
'...'string instead of"..."(only affects output side when not minimized)dependenciesconfiguration option now works for watch builds toodependencieshas changedConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate. View repository job log here.