Update webapp build tooling

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@nx/webpack (source)	22.7.8 → 22.7.9
postcss (source)	8.5.26 → 8.5.28
webpack	5.110.2 → 5.110.3
webpack-dev-middleware	7.4.5 → 7.4.6

---

Release Notes

nrwl/nx (@​nx/webpack)

v22.7.9

Compare Source

22.7.9 (2026-09-01)

🩹 Fixes

• core: restrict daemon and plugin worker socket access to the owning user (#​36370, #​36586, #​36463)
• core: compare daemon workspace roots case-insensitively on Windows (#​36835, #​36722)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#​36280)
• core: port quoteShellArg helper for no-shell spawn fixes (#​36215, #​36626, #​35954)
• maven: stop running maven and gradle graph analysis through a shell (#​36626, #​36215)

❤️ Thank You

• AgentEnder @​AgentEnder
• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz
• Jelle Bruisten @​JelleBruisten
• Leosvel Pérez Espinosa @​leosvelperez

postcss/postcss (postcss)

v8.5.28

Compare Source

• Fixes types regression.

v8.5.27

Compare Source

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

webpack/webpack (webpack)

v5.110.3

Compare Source

Patch Changes

• Fix import() options, circular reexport severity and namespace writes. (by @​alexander-akait in #​21867)

• Skip ESM interop when require() targets a module outside the concatenation. (by @​hai-x in #​21884)

• Fix concatenated require() in a require.ensure callback or a computed request. (by @​hai-x in #​21907)

• Keep optimization.minimize a boolean; its options move to minimizeOptions. (by @​alexander-akait in #​21886)

• Fix mangled exports read through require() and a leaked internal reference. (by @​alexander-akait in #​21905)

• Fix new on a default import of a wrapped CommonJS module. (by @​alexander-akait in #​21876)

• Throw when a deferred namespace of an async module is forced while it evaluates. (by @​alexander-akait in #​21871)

• Do not report a missing export for a name a side-effect-free barrel defers. (by @​alexander-akait in #​21874)

• Fix queue, URL scheme, dotenv, HTTP module and persistent cache edge cases. (by @​alexander-akait in #​21901)

• Evaluate a deferred import's async dependencies where the import sits. (by @​alexander-akait in #​21902)

• Omit ambiguous export * names from the module namespace. (by @​alexander-akait in #​21878)

webpack/webpack-dev-middleware (webpack-dev-middleware)

v7.4.6

Compare Source

7.4.6 (2026-09-03)

Bug Fixes

• reject requests that resolve outside the output directory

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

First appeared in

Environment	Release
Beta	2026-09-07.1-beta.1
Production	Not yet deployed