You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade webpack from 5.82.1 to 5.96.1.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 24 versions ahead of your current version.
The recommended version was released 2 months ago.
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR upgrades webpack from version 5.82.1 to 5.96.1. This upgrade fixes two medium-severity Cross-site Scripting (XSS) vulnerabilities, SNYK-JS-SERIALIZEJAVASCRIPT-6147607 and SNYK-JS-WEBPACK-7840298.
No diagrams generated as the changes look simple and do not need a visual representation.
File-Level Changes
Change
Details
Files
Upgrade webpack dependency
Updated the webpack dependency version from 5.82.1 to 5.96.1 in package.json.
Updated package-lock.json to reflect the changes in package.json.
package.json package-lock.json
Tips and commands
Interacting with Sourcery
Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time. You can also use
this command to specify where the summary should be inserted.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Snyk has created this PR to upgrade webpack from 5.82.1 to 5.96.1.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 24 versions ahead of your current version.
The recommended version was released 2 months ago.
Issues fixed by the recommended upgrade:
SNYK-JS-SERIALIZEJAVASCRIPT-6147607
SNYK-JS-WEBPACK-7840298
Release notes
Package name: webpack
-
5.96.1 - 2024-11-01
- [Types] Add
- [Types] Fixed regression in
-
5.96.0 - 2024-10-31
- Fixed Module Federation should track all referenced chunks
- Handle Data URI without base64 word
- HotUpdateChunk have correct runtime when modified with new runtime
- Order of chunks ids in generated chunk code
- No extra Javascript chunks when using asset module as an entrypoint
- Use optimistically logic for
- Collision with global variables for
- Avoid through variables in inlined module
- Allow chunk template strings in
- No extra runtime for get javascript/css chunk filename
- No extra runtime for prefetch and preload in JS runtime when it was unsed in CSS
- Avoid cache invalidation using ProgressPlugin
- Increase parallelism when using
- Correctly parsing string in
- Typescript types
- [CSS]
- [CSS] Always interpolate classes even if they are not involved in export
- [CSS] No extra runtime in Javascript runtime chunks for asset modules used in CSS
- [CSS] No extra runtime in Javascript runtime chunks for external asset modules used in CSS
- [CSS] No extra runtime for the
- [CSS] Fixed
- [CSS] Fixed - emit a warning on broken :local and :global
- Export CSS and ESM runtime modules
- Single Runtime Chunk and Federation eager module hoisting
- [CSS] Support
- [CSS] Support
- [CSS] CSS nesting in CSS modules
-
5.95.0 - 2024-09-25
- Fixed hanging when attempting to read a symlink-like file that it can't read
- Handle
- Merge duplicate chunks call after split chunks
- Generate correctly code for dynamically importing the same file twice and destructuring
- Use content hash as [base] and [name] for extracted DataURI's
- Distinguish
- [Types] Make
- [Types] Typescript 5.6 compatibility
- Add new
- Pass output.hash* options to loader context
- Avoid unneeded re-visit in build chunk graph
-
5.94.0 - 2024-08-22
- Added runtime condition for harmony reexport checked
- Handle properly
- Make
- Move @ types/eslint-scope to dev deps
- Related in asset stats is now always an array when no related found
- Handle ASI for export declarations
- Mangle destruction incorrect with export named default properly
- Fixed unexpected asi generation with sequence expression
- Fixed a lot of types
- Added new external type "module-import"
- Support
- [CSS]
- Fixed DOM clobbering in auto public path
-
5.93.0 - 2024-07-11
- Generate correct relative path to runtime chunks
- Makes
- Fixed mangle destructuring default in namespace import
- Fixed consumption of eager shared modules for module federation
- Strip slash for pretty regexp
- Calculate correct contenthash for CSS generator options
- Added the
- Added the
- Added the
-
5.92.1 - 2024-06-19
- Doesn't crash with an error when the css experiment is enabled and contenthash is used
-
5.92.0 - 2024-06-11
- Correct tidle range's comutation for module federation
- Consider runtime for pure expression dependency update hash
- Return value in the
- Fixed failed to resolve promise when eager import a dynamic cjs
- Avoid generation extra code for external modules when remapping is not required
- The
- Avoid hashing for
- Fixed mangle with destructuring for JSON modules
- The
- Fixed
- Correct behavior of
- Changed to the correct plugin name for the
- Set the
- Fixed when runtimeChunk has no exports when
- [CSS] Fixed parsing minimized CSS import
- [CSS] URLs in CSS files now have correct public path
- [CSS] The
- [Types] Improved context module types
- Added platform target properties to compiler
- Improved multi compiler cache location and validating it
- Support
- Support
- Support prefetch/preload for module chunk format
- Support "..." in the
- Root module is less prone to be wrapped in IIFE
- Export
- Export
- Export
- [CSS] Support the
- [CSS] Support CSS when chunk format is module
-
5.91.0 - 2024-03-20
- Deserializer for ignored modules doesn't crash
- Allow the
- Normalize the
- Fixed
- Fixed resolve's plugins types
- Fixed wrongly calculate postOrderIndex
- Fixed watching types
- Output import attrbiutes/import assertions for external JS imports
- Throw an error when DllPlugin needs to generate multiple manifest files, but the path is the same
- [CSS] Output
- Allow to customize the stage of BannerPlugin
- [CSS] Support CSS exports convention
- [CSS] support CSS local ident name
- [CSS] Support
- [CSS] Support
- [CSS] Allow to use LZW to compress css head meta (enabled in the
- [CSS] Support prefetch/preload for CSS chunks
-
5.90.3 - 2024-02-19
- don't mangle when destructuring a reexport
- types for
- many internal types
- [CSS] clean up export css local vars
- simplify and optimize chunk graph creation
-
5.90.2 - 2024-02-15
- use
- the
- mangle export with destructuring
- use new runtime to reconsider skipped connections
- make dynamic import optional in
- improve auto publicPath detection
- improve CI setup and include Node.js@21
-
5.90.1 - 2024-02-01
-
5.90.0 - 2024-01-24
-
5.89.0 - 2023-10-13
-
5.88.2 - 2023-07-18
-
5.88.1 - 2023-06-28
-
5.88.0 - 2023-06-21
-
5.87.0 - 2023-06-14
-
5.86.0 - 2023-06-07
-
5.85.1 - 2023-06-05
-
5.85.0 - 2023-05-31
-
5.84.1 - 2023-05-25
-
5.84.0 - 2023-05-24
-
5.83.1 - 2023-05-17
-
5.83.0 - 2023-05-17
-
5.82.1 - 2023-05-10
from webpack GitHub release notesBug Fixes
@ types/eslint-scopeto dependencieSvalidateBug Fixes
output.environment.dynamicImportto determine chunk format when no browserslist or targetoptimization.avoidEntryIifeoutput.devtoolNamespaceimportModuleon the execution stageexportandimportcss/autoconsiders a module depending on its filename ascss(pure CSS) orcss/local, before it wascss/globalandcss/localnodetargeturl()s and@ importparsingNew Features
/* webpackIgnore: true */for CSS filessrc()supportBug Fixes
defaultfor import context element dependencymoduleandimportinmodule-importfor externalsimport'sEnvironmentPlugindefault values types less strictNew Features
optimization.avoidEntryIifeoption (trueby default for theproductionmode)Performance
Bug Fixes
data/http/httpsprotocols in source mapsbigintoptimistic when browserslist not foundNew Features
webpackIgnorefornew URL()construction@ importpathinfo supportSecurity
Bug Fixes
DefinePluginquieter under default log levelNew Features
binarygenerator option for asset modules to explicitly keep source maps produced by loadersmodern-modulelibrary value for tree shakable outputoverrideStrictoption to override strict or non-strict mode for javascript modulesBug Fixes
Bug Fixes
subtractRuntimefunction for runtime logiccss/globaltype now handles the exports name@ keyframeand@ propertyat-rules incss/globaltypestats.hasWarnings()method now respects theignoreWarningsoptionArrayQueueiterator__webpack_exports_info__.a.b.canMangleCommonJsChunkFormatPluginpluginchunkLoadingoption to theimportwhen environment is unknown and output is modulemodulechunkFormat usedcssmodule type should not allow parser to switch modeNew Features
import attributesspec (withkeyword)node:prefix for Node.js core modules in runtime codeimportsFieldsoption for resolverInitFragmentclass for pluginscompileBooleanMatcherutil for pluginsInputFileSystemandOutputFileSystemtypesesModulegenerator option for CSS modulesBug Fixes
unsafeCacheoption to be a proxy objectsnapshot.unmanagedPathsoptionfstypeslayer/supports/mediafor external CSS importsNew Features
__webpack_nonce__for CSS chunksfetchPriorityfor CSS chunksproductionmode by default)Bug Fixes
Stats.toJson()andStats.toString()Perf
Bug Fixes
Math.imulinfnv1a32to avoid loss of precision, directly hash UTF16 valuessetStatus()of the HMR module should not return an array, which may cause infinite recursion__webpack_exports_info__.xxx.canMangleshouldn't always same as defaultactiveStatetry/catchDependencies & Maintenance
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
Summary by Sourcery
Upgrade webpack to version 5.96.1 to address security vulnerabilities.
Bug Fixes:
Enhancements: