Bump webpack from 5.107.2 to 5.108.3

[dependabot]

Bumps webpack from 5.107.2 to 5.108.3.

Release notes

Sourced from webpack's releases.

v5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

v5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

v5.108.1

Patch Changes

• Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #21280)

• Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #21269)

v5.108.0

Minor Changes

• Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @​alexander-akait in #21218)

• Add a bun target that emits ESM and externalizes bun:* and node.js built-in modules. (by @​alexander-akait in #21248)

• Support CommonJS reexports via Object.defineProperty value and getter descriptors. (by @​alexander-akait in #21129)

• Support JSON Schema const when generating CLI flags from a schema. (by @​alexander-akait in #21087)

• Support JSON Schema if/then/else when generating CLI flags from a schema. (by @​alexander-akait in #21087)

• Skip import specifiers, require() and import() calls in dead conditional branches gated by inlined imported constants (isDEV ? A : B), evaluated via getCondition. (by @​hai-x in #21136)

• CSS localIdentName [hash] now resolves to the local ident hash (matching css-loader); use [modulehash] for the module hash. (by @​alexander-akait in #21259)

• Add CSS parser as option and resolve url() inside HTML style attributes. (by @​alexander-akait in #21157)

• Add dedicated module classes for all built-in module types. (by @​alexander-akait in #21164)

• Support .html/.css for the default ./src entry under the html/css experiments. (by @​alexander-akait in #21039)

• Add defineConfig helper for typed configuration files. (by @​alexander-akait in #21169)

• Add a deno target (with versions, e.g. deno, deno2, deno1.40) that emits ESM, resolves node.js built-ins via the required node: specifier, and keeps Deno's own import protocols (npm:, jsr:, node:, http(s)://) external. (by @​alexander-akait in #21247)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

5.108.1

Patch Changes

• Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #21280)

• Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #21269)

5.108.0

Minor Changes

• Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @​alexander-akait in #21218)

• Add a bun target that emits ESM and externalizes bun:* and node.js built-in modules. (by @​alexander-akait in #21248)

• Support CommonJS reexports via Object.defineProperty value and getter descriptors. (by @​alexander-akait in #21129)

• Support JSON Schema const when generating CLI flags from a schema. (by @​alexander-akait in #21087)

• Support JSON Schema if/then/else when generating CLI flags from a schema. (by @​alexander-akait in #21087)

• Skip import specifiers, require() and import() calls in dead conditional branches gated by inlined imported constants (isDEV ? A : B), evaluated via getCondition. (by @​hai-x in #21136)

• CSS localIdentName [hash] now resolves to the local ident hash (matching css-loader); use [modulehash] for the module hash. (by @​alexander-akait in #21259)

• Add CSS parser as option and resolve url() inside HTML style attributes. (by @​alexander-akait in #21157)

• Add dedicated module classes for all built-in module types. (by @​alexander-akait in #21164)

• Support .html/.css for the default ./src entry under the html/css experiments. (by @​alexander-akait in #21039)

... (truncated)

Commits

• 6844305 chore(release): new release (#21304)
• 99286e2 fix: match harmony accept dependencies by module reference (#21303)
• 0abec4d fix: guard HarmonyAcceptDependency against unresolved module ids (#21302)
• 606712d perf(css): struct-of-arrays AST for the streaming CSS parser (#21285)
• cf9c04e docs: update examples (#21293)
• 4dfe770 chore(release): new release (#21287)
• 7534a5e test: add defer import case for #19219 (#21292)
• 9857fc7 fix: lazy barrel for import with side effects (#21291)
• 54fa902 Respect the node: prefix for node.js core modules used as externals (#21286)
• 5e7db5d refactor: extract createHooksRegistry to deduplicate getCompilationHooks patt...
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​webpack@​5.107.2 ⏵ 5.108.3	-1			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/[email protected] ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected]. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[ikuwow]

@dependabot rebase