[Snyk] Upgrade webpack from 5.82.1 to 5.97.1 #141
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade webpack from 5.82.1 to 5.97.1. See this package in npm: webpack See this project in Snyk: https://app.snyk.io/org/sammytezzy/project/801c3797-5f02-4e73-9d0b-aff26283dffb?utm_source=github&utm_medium=referral&page=upgrade-pr
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
|
|
Reviewer's Guide by SourceryThis pull request upgrades webpack from version 5.82.1 to 5.97.1. This upgrade fixes two medium-severity Cross-site Scripting (XSS) vulnerabilities, SNYK-JS-SERIALIZEJAVASCRIPT-6147607 and SNYK-JS-WEBPACK-7840298. The upgrade includes numerous bug fixes, new features, and performance improvements across multiple versions. State diagram of webpack version upgrade changesstateDiagram-v2
state "webpack 5.82.1" as old
state "webpack 5.97.1" as new
[*] --> old
old --> new
state new {
[*] --> SecurityFixes
state SecurityFixes {
XSS1_Fixed
XSS2_Fixed
}
state Features {
CSS_Improvements
Universal_Loading
Debug_IDs
}
state BugFixes {
Performance_Fixes
CSS_Module_Fixes
WebAssembly_Fixes
}
}
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade webpack from 5.82.1 to 5.97.1.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 26 versions ahead of your current version.
The recommended version was released 21 days ago.
Issues fixed by the recommended upgrade:
SNYK-JS-SERIALIZEJAVASCRIPT-6147607
SNYK-JS-WEBPACK-7840298
Release notes
Package name: webpack
-
5.97.1 - 2024-12-05
- Performance regression
- Sub define key should't be renamed when it's a defined variable
-
5.97.0 - 2024-12-03
- Don't crash with filesystem cache and unknown scheme
- Generate a valid code when
- Fixed conflict variable name with concatenate modules and runtime code
- Merge duplicate chunks before
- Collisions in ESM library
- Use recursive search for versions of shared dependencies
- [WASM] Don't crash WebAssembly with Reference Types (sync and async)
- [WASM] Fixed wasm loading for sync and async webassembly
- [CSS] Don't add
- [CSS] Parsing strings on Windows
- [CSS] Fixed CSS local escaping
- Added support for injecting debug IDs
- Export the
- Added universal loading for JS chunks and JS worker chunks (only ES modules)
- [WASM] Added universal loading for WebAssembly chunks (only for async WebAssembly)
- [CSS] Allow initial CSS chunks to be placed anywhere - the
- [CSS] Added universal loading for CSS chunks
- [CSS] Parse ICSS
- [CSS] Parse ICSS
- [CSS] Added the
- [CSS] Allow to import custom properties in CSS modules
- Faster Queue implementation, also fixed queue iterator state in dequeue method to ensure correct behavior after item removal
-
5.96.1 - 2024-11-01
- [Types] Add
- [Types] Fixed regression in
-
5.96.0 - 2024-10-31
- Fixed Module Federation should track all referenced chunks
- Handle Data URI without base64 word
- HotUpdateChunk have correct runtime when modified with new runtime
- Order of chunks ids in generated chunk code
- No extra Javascript chunks when using asset module as an entrypoint
- Use optimistically logic for
- Collision with global variables for
- Avoid through variables in inlined module
- Allow chunk template strings in
- No extra runtime for get javascript/css chunk filename
- No extra runtime for prefetch and preload in JS runtime when it was unsed in CSS
- Avoid cache invalidation using ProgressPlugin
- Increase parallelism when using
- Correctly parsing string in
- Typescript types
- [CSS]
- [CSS] Always interpolate classes even if they are not involved in export
- [CSS] No extra runtime in Javascript runtime chunks for asset modules used in CSS
- [CSS] No extra runtime in Javascript runtime chunks for external asset modules used in CSS
- [CSS] No extra runtime for the
- [CSS] Fixed
- [CSS] Fixed - emit a warning on broken :local and :global
- Export CSS and ESM runtime modules
- Single Runtime Chunk and Federation eager module hoisting
- [CSS] Support
- [CSS] Support
- [CSS] CSS nesting in CSS modules
-
5.95.0 - 2024-09-25
- Fixed hanging when attempting to read a symlink-like file that it can't read
- Handle
- Merge duplicate chunks call after split chunks
- Generate correctly code for dynamically importing the same file twice and destructuring
- Use content hash as [base] and [name] for extracted DataURI's
- Distinguish
- [Types] Make
- [Types] Typescript 5.6 compatibility
- Add new
- Pass output.hash* options to loader context
- Avoid unneeded re-visit in build chunk graph
-
5.94.0 - 2024-08-22
- Added runtime condition for harmony reexport checked
- Handle properly
- Make
- Move @ types/eslint-scope to dev deps
- Related in asset stats is now always an array when no related found
- Handle ASI for export declarations
- Mangle destruction incorrect with export named default properly
- Fixed unexpected asi generation with sequence expression
- Fixed a lot of types
- Added new external type "module-import"
- Support
- [CSS]
- Fixed DOM clobbering in auto public path
-
5.93.0 - 2024-07-11
- Generate correct relative path to runtime chunks
- Makes
- Fixed mangle destructuring default in namespace import
- Fixed consumption of eager shared modules for module federation
- Strip slash for pretty regexp
- Calculate correct contenthash for CSS generator options
- Added the
- Added the
- Added the
-
5.92.1 - 2024-06-19
- Doesn't crash with an error when the css experiment is enabled and contenthash is used
-
5.92.0 - 2024-06-11
- Correct tidle range's comutation for module federation
- Consider runtime for pure expression dependency update hash
- Return value in the
- Fixed failed to resolve promise when eager import a dynamic cjs
- Avoid generation extra code for external modules when remapping is not required
- The
- Avoid hashing for
- Fixed mangle with destructuring for JSON modules
- The
- Fixed
- Correct behavior of
- Changed to the correct plugin name for the
- Set the
- Fixed when runtimeChunk has no exports when
- [CSS] Fixed parsing minimized CSS import
- [CSS] URLs in CSS files now have correct public path
- [CSS] The
- [Types] Improved context module types
- Added platform target properties to compiler
- Improved multi compiler cache location and validating it
- Support
- Support
- Support prefetch/preload for module chunk format
- Support "..." in the
- Root module is less prone to be wrapped in IIFE
- Export
- Export
- Export
- [CSS] Support the
- [CSS] Support CSS when chunk format is module
-
5.91.0 - 2024-03-20
- Deserializer for ignored modules doesn't crash
- Allow the
- Normalize the
- Fixed
- Fixed resolve's plugins types
- Fixed wrongly calculate postOrderIndex
- Fixed watching types
- Output import attrbiutes/import assertions for external JS imports
- Throw an error when DllPlugin needs to generate multiple manifest files, but the path is the same
- [CSS] Output
- Allow to customize the stage of BannerPlugin
- [CSS] Support CSS exports convention
- [CSS] support CSS local ident name
- [CSS] Support
- [CSS] Support
- [CSS] Allow to use LZW to compress css head meta (enabled in the
- [CSS] Support prefetch/preload for CSS chunks
-
5.90.3 - 2024-02-19
-
5.90.2 - 2024-02-15
-
5.90.1 - 2024-02-01
-
5.90.0 - 2024-01-24
-
5.89.0 - 2023-10-13
-
5.88.2 - 2023-07-18
-
5.88.1 - 2023-06-28
-
5.88.0 - 2023-06-21
-
5.87.0 - 2023-06-14
-
5.86.0 - 2023-06-07
-
5.85.1 - 2023-06-05
-
5.85.0 - 2023-05-31
-
5.84.1 - 2023-05-25
-
5.84.0 - 2023-05-24
-
5.83.1 - 2023-05-17
-
5.83.0 - 2023-05-17
-
5.82.1 - 2023-05-10
from webpack GitHub release notesBug Fixes
Bug Fixes
output.iifeistrueand output.library.type isumd[uniqueName]tolocalIdentNamewhen it is emptyNew Features
MergeDuplicateChunkspluginoutput.cssHeadDataCompressionoption was deleted@ valueat-rules in CSS modules:importrules in CSS modulesurlandimportoptions for CSSPerformance
Bug Fixes
@ types/eslint-scopeto dependencieSvalidateBug Fixes
output.environment.dynamicImportto determine chunk format when no browserslist or targetoptimization.avoidEntryIifeoutput.devtoolNamespaceimportModuleon the execution stageexportandimportcss/autoconsiders a module depending on its filename ascss(pure CSS) orcss/local, before it wascss/globalandcss/localnodetargeturl()s and@ importparsingNew Features
/* webpackIgnore: true */for CSS filessrc()supportBug Fixes
defaultfor import context element dependencymoduleandimportinmodule-importfor externalsimport'sEnvironmentPlugindefault values types less strictNew Features
optimization.avoidEntryIifeoption (trueby default for theproductionmode)Performance
Bug Fixes
data/http/httpsprotocols in source mapsbigintoptimistic when browserslist not foundNew Features
webpackIgnorefornew URL()construction@ importpathinfo supportSecurity
Bug Fixes
DefinePluginquieter under default log levelNew Features
binarygenerator option for asset modules to explicitly keep source maps produced by loadersmodern-modulelibrary value for tree shakable outputoverrideStrictoption to override strict or non-strict mode for javascript modulesBug Fixes
Bug Fixes
subtractRuntimefunction for runtime logiccss/globaltype now handles the exports name@ keyframeand@ propertyat-rules incss/globaltypestats.hasWarnings()method now respects theignoreWarningsoptionArrayQueueiterator__webpack_exports_info__.a.b.canMangleCommonJsChunkFormatPluginpluginchunkLoadingoption to theimportwhen environment is unknown and output is modulemodulechunkFormat usedcssmodule type should not allow parser to switch modeNew Features
import attributesspec (withkeyword)node:prefix for Node.js core modules in runtime codeimportsFieldsoption for resolverInitFragmentclass for pluginscompileBooleanMatcherutil for pluginsInputFileSystemandOutputFileSystemtypesesModulegenerator option for CSS modulesBug Fixes
unsafeCacheoption to be a proxy objectsnapshot.unmanagedPathsoptionfstypeslayer/supports/mediafor external CSS importsNew Features
__webpack_nonce__for CSS chunksfetchPriorityfor CSS chunksproductionmode by default)Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
Summary by Sourcery
Upgrade webpack from 5.82.1 to 5.97.1 to address two medium-severity Cross-site Scripting (XSS) vulnerabilities.
Bug Fixes:
Enhancements: