Skip to content

chore(deps): update dependency webpack to v5.109.0#1452

Merged
renovate[bot] merged 1 commit into
masterfrom
renovate/dev-deps
Jul 24, 2026
Merged

chore(deps): update dependency webpack to v5.109.0#1452
renovate[bot] merged 1 commit into
masterfrom
renovate/dev-deps

Conversation

@renovate

@renovate renovate Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
webpack 5.108.45.109.0 age adoption passing confidence

Release Notes

webpack/webpack (webpack)

v5.109.0

Compare Source

Minor Changes
  • Default experiments.typescript to "auto", enabling built-in TypeScript support on Node.js >= 22.6 when no TypeScript loader is registered. (by @​alexander-akait in #​21477)

  • Default experiments.css, experiments.html and experiments.asyncWebAssembly to "auto", enabling built-in support unless a loader is registered for those files; modules with inline or hook-injected loaders (e.g. html-webpack-plugin templates) keep being parsed as JavaScript. (by @​alexander-akait in #​21477)

  • Add output.resourceHints to emit resource hints (preload/prefetch/modulepreload/preconnect), on by default for ESM output, plus module.parser.<type>.urlHints, css.fontPreload and javascript.dynamicImportCssPreload. (by @​alexander-akait in #​21477)

  • Add built-in build progress via infrastructureLogging.progress, plus estimatedTime, phaseTimings, progress bar width and progressBar: "auto" on ProgressPlugin. (by @​alexander-akait in #​21477)

  • Concatenate CommonJS modules with statically analyzable exports; opt out via optimization.concatenateModules: { commonjs: false }. (by @​alexander-akait in #​21477)

  • Wrap "weird" CommonJS modules into module concatenation instead of bailing out. (by @​alexander-akait in #​21477)

  • Add output.html.inline (true | "script" | "style") and the webpackInline magic comment to inline chunk content into HTML. (by @​alexander-akait in #​21477)

  • Add output.html.inject to control where chunk tags are injected. (by @​alexander-akait in #​21477)

  • Add output.html.title, output.html.meta and output.html.base options for head generation. (by @​alexander-akait in #​21477)

  • Support per-icon link attributes (sizes, media, color, type, crossorigin) and arrays in output.html.favicon. (by @​alexander-akait in #​21487)

  • Add output.html.manifest to generate and link a web app manifest with hashed icons. (by @​alexander-akait in #​21487)

  • Add output.html.csp to inject a Content-Security-Policy meta with inline-content hashes and an optional nonce. (by @​alexander-akait in #​21487)

  • Add the output.html injectTags compilation hook to inject tags (script/link/meta/…) with injectTo placement. (by @​alexander-akait in #​21487)

  • Add the output.html transformTags compilation hook to mutate, remove, or move (between <head> and <body>) a page's existing <script>/<link>/<style>/<meta> tags. (by @​alexander-akait in #​21487)

  • Extend the HTML pipeline with html link sources (bundled as their own emitted page) and rel="preload"/"prefetch" links bundled as chunks. (by @​alexander-akait in #​21477)

  • Recognize more asset-bearing HTML sources: the twitter:player:stream meta, legacy SVG references, and Web App Manifest icons/screenshots/shortcuts URLs. (by @​alexander-akait in #​21477)

  • Add module.parser.html.as to parse HTML as a document or an element fragment. (by @​alexander-akait in #​21477)

  • Allow disabling a built-in HTML parser source via type: false in sources. (by @​alexander-akait in #​21477)

  • Export webpack.html.HtmlModulesPlugin with transformHtml/htmlEmitted compilation hooks. (by @​alexander-akait in #​21477)

  • Resolve @custom-media (including media-type values) and @custom-selector in native CSS. (by @​alexander-akait in #​21477)

  • Scope view-transition-name/-group/-class names and ::view-transition-*() pseudo references in CSS modules under customIdents. (by @​alexander-akait in #​21486)

  • Add import.meta.glob support, with a caseSensitive option and consistent hidden/node_modules matching. (by @​alexander-akait in #​21477)

  • Resolve import.meta.resolve("./asset") to the emitted asset URL via the importMeta.resolve parser option. (by @​alexander-akait in #​21477)

  • Add import.meta.env defaults: MODE, DEV, PROD, SSR and BASE_URL. (by @​alexander-akait in #​21477)

  • Add fine-grained import.meta parser options. (by @​alexander-akait in #​21477)

  • Deprecate the importMetaContext parser option in favor of importMeta.webpackContext. (by @​alexander-akait in #​21477)

  • Emit analyzable new URL(…, import.meta.url), worker/worklet URL and import() references with literal specifiers for ESM module output. (by @​alexander-akait in #​21477)

  • Compile async modules to generators for targets without async/await. (by @​alexander-akait in #​21477)

  • Evaluate and validate the second argument of dynamic import(specifier, options). (by @​alexander-akait in #​21477)

  • Add module.parser.javascript.worklet to bundle Worklet addModule() entries. (by @​alexander-akait in #​21477)

  • Add ?raw, ?url, ?inline and ?no-inline asset query suffixes under experiments.futureDefaults. (by @​alexander-akait in #​21477)

  • Add an interop ("default" | "esModule") hint for object externals to control default-export interop. (by @​alexander-akait in #​21477)

  • Add an amd-async externals type that loads AMD externals without an AMD library wrapper. (by @​alexander-akait in #​21477)

  • Support cache.compression: "zstd" for the filesystem cache. (by @​alexander-akait in #​21477)

  • Warn on strict-mode-only syntax and semantic hazards in ES module output, configurable via the strictModeViolations parser option. (by @​alexander-akait in #​21477)

  • Support parsers without location APIs: locations derive from node offsets and AST nodes no longer carry loc. (by @​alexander-akait in #​21477)

  • Attach the original DOM event to ChunkLoadError and ScriptExternalLoadError as error.event. (by @​alexander-akait in #​21477)

  • Add output.wasmStreamingFallback for wasm fallback on a wrong MIME type. (by @​alexander-akait in #​21477)

  • Show why a module was marked as not cacheable in stats output. (by @​alexander-akait in #​21477)

  • Expose the active MultiWatching on MultiCompiler.watching. (by @​alexander-akait in #​21477)

  • Resolve git merge conflicts when parsing the build-http lockfile. (by @​alexander-akait in #​21477)

Patch Changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file dev-dependencies labels Jul 23, 2026
@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/webpack 5.109.0 🟢 5.6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 2Found 6/25 approved changesets -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 2badge detected: InProgress
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Pinned-Dependencies🟢 10all dependencies are pinned
Binary-Artifacts⚠️ 0binaries present in source code
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
Fuzzing⚠️ 0project is not fuzzed

Scanned Files

  • package-lock.json

@renovate
renovate Bot merged commit 9d48f99 into master Jul 24, 2026
11 checks passed
@renovate
renovate Bot deleted the renovate/dev-deps branch July 24, 2026 02:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file dev-dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants