Skip to content

chore(deps-dev): bump webpack from 5.109.0 to 5.110.1 - #1092

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/webpack-5.110.1
Open

chore(deps-dev): bump webpack from 5.109.0 to 5.110.1#1092
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/webpack-5.110.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps webpack from 5.109.0 to 5.110.1.

Release notes

Sourced from webpack's releases.

v5.110.1

Patch Changes

v5.110.0

Minor Changes

  • Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

  • Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

  • Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

  • Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

  • Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

  • Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

  • Give externals the original request of a context module element. (by @​alexander-akait in #21780)

  • Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

  • Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

  • Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

  • Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

  • Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

  • Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

  • Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

  • Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

  • Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

  • Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

  • Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

  • Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #21841)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.1

Patch Changes

5.110.0

Minor Changes

  • Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

  • Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

  • Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

  • Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

  • Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

  • Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

  • Give externals the original request of a context module element. (by @​alexander-akait in #21780)

  • Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

  • Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

  • Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

  • Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

  • Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

  • Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

  • Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

  • Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

  • Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

  • Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

  • Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

... (truncated)

Commits
  • 0b2952e chore(release): new release (#21846)
  • 2a1fda4 fix: throw a SyntaxError from a module that failed to parse (#21847)
  • 281efa6 test(css): cover a loader-added BOM in the css pipeline (#21848)
  • 36ded2c fix: accept the optimization.minimize true shorthand after normalization (#21...
  • c150225 fix(cache): accept a managedPaths RegExp without a capture group, and speed u...
  • 3a7c0e6 chore(release): new release (#21545)
  • 75891c8 chore(changesets): union same-subject entries (#21841)
  • 6b96de7 feat(config): emit no development source map for library builds (#21839)
  • ff0c832 feat(css,html): reach embedded source from cssMinify and htmlMinify (#21838)
  • 06bedfb chore(deps): bump test/wpt in the dependencies group (#21836)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps-dev): bump webpack from 5.109.0 to 5.110.1
53239e7 
Bumps [webpack](https://github.com/webpack/webpack) from 5.109.0 to 5.110.1.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.109.0...v5.110.1)

---
updated-dependencies:
- dependency-name: webpack
  dependency-version: 5.110.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 9, 2026
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 9, 2026
@dependabot dependabot Bot added the javascript Pull requests that update Javascript code label Sep 9, 2026
@chagong

Changyong Gong (chagong) commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Decision: NOT_MERGED

Dependabot PR Manager result

  • Repository: microsoft/vscode-java-dependency
  • Pull request: microsoft/vscode-java-dependency#1092 — chore(deps-dev): bump webpack from 5.109.0 to 5.110.1
  • Update: webpack 5.109.0 -> 5.110.1 (minor, direct development dependency).
  • Safety assessment: Dependabot-only verified history; standard dependency gate passes with only package.json and package-lock.json changed. Webpack remains necessary for compile, test, watch, and packaging. The update preserves its Node requirement and is low risk.
  • Final state: Head 53239e76ebc231018d6dbba388fcae47c4a0541c; open, mergeable, BEHIND, and approved. Live base f8cbde4b7fe08a11d1d54722660b6b16d173d905; branch is one commit behind. CI: 31/33 successful, 0 pending; all 4 required checks pass. E2E Windows (java-dep-autorefresh-targeted) is FLAKY_OR_TRANSIENT because the vsix-windows artifact was unavailable; E2E Summary is its derivative failure.
  • Actions taken: Exact-head npm ci, dependency-tree inspection, and compile passed. Approved the PR. Requested @dependabot rebase and then @dependabot recreate; Dependabot rejected both because the originating dependabot.yml entry was deleted. Head remained unchanged. No remediation, push, CI rerun, or merge was attempted.
  • Reason: Mandatory branch recovery is impossible through Dependabot because the configuration entry that created this PR no longer exists.
  • Next action: A maintainer must close this stale PR so Dependabot can create a replacement from the current configuration.
  • Workflow run: https://github.com/chagong/JavaForge/actions/runs/34745166209

@chagong

Changyong Gong (chagong) commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

Dependabot (@dependabot) rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor Author

The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@chagong

Changyong Gong (chagong) commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

Dependabot (@dependabot) recreate

@dependabot @github

dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor Author

The dependabot.yml entry that created this PR has been deleted so this PR can't be recreated. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

chagong
Changyong Gong (chagong) approved these changes Sep 13, 2026
View reviewed changes

@chagong Changyong Gong (chagong) left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved.

@chagong

Changyong Gong (chagong) commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

Dependabot (@dependabot) rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 13, 2026

Copy link
Copy Markdown
Contributor Author

The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@chagong

Changyong Gong (chagong) commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

Dependabot (@dependabot) recreate

@dependabot @github

dependabot Bot commented on behalf of github Sep 13, 2026

Copy link
Copy Markdown
Contributor Author

The dependabot.yml entry that created this PR has been deleted so this PR can't be recreated. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chagong Changyong Gong (chagong) chagong approved these changes
@testforstephen Jinbo Wang (testforstephen) Awaiting requested review from testforstephen testforstephen is a code owner
@wenytang-ms wenyt (wenytang-ms) Awaiting requested review from wenytang-ms wenytang-ms is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chagong