Skip to content

fix(html): skip script tags for shared chunks without JavaScript - #22779

Merged
alexander-akait merged 1 commit into
mainfrom
fix/html-shared-chunks
Oct 19, 2026
Merged

alexander-akait merged 1 commit into
mainfrom
fix/html-shared-chunks

Conversation

@bjohansebas

@bjohansebas bjohansebas commented Oct 18, 2026 •

Copy link
Copy Markdown
Member

Summary

When splitChunks extracts only Module Federation shared consumers, the chunk emits no JavaScript, but native HTML still adds a script URL for it. Require chunkHasJs() before injecting that script.

Before #21002, HTML generation cloned the entry's script tag for every initial sibling chunk. That fix added CSS links but kept hasJs || !hasCss to preserve the old behavior for chunks without JavaScript or CSS. This removes that fallback; chunkHasJs() already includes runtime chunks, and their load order stays unchanged.

The regression fixture uses eager shared modules and output.html.integrity: true:

Output Before After
Files emitted by virtual-shared 0 0
Script tags in virtual.html 3, including the nonexistent shared file 2: runtime and entry
Script tags in mixed.html 3 3, with valid integrity hashes

What kind of change does this PR introduce?

fix

Did you add tests for your changes?

Yes: test/configCases/html/shared-module-chunks/ checks virtual and mixed chunks, script execution order, and integrity hashes. The regression failed before the fix. All 162 targeted tests pass across the normal and persistent-cache suites; yarn lint passes.

Does this PR introduce a breaking change?

No.

If relevant, what needs to be documented once your changes are merged or what have you already documented?

n/a

Use of AI

Codex assisted with the reproduction, fix, regression tests, and PR description.

Summary by CodeRabbit

  • Bug Fixes
    • HTML pages no longer include script tags for shared chunks that contain no JavaScript.

@changeset-bot

changeset-bot Bot commented Oct 18, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: a7f5722

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
webpack Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: webpack/webpack/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: ecf3d90e-2e9f-419e-9cf2-d96b30de3079
📥 Commits

Reviewing files that changed from the base of the PR and between 8cbe6b5 and a7f5722.

📒 Files selected for processing: 9
  • .changeset/080-html-shared-chunks.md
  • lib/dependencies/html/HtmlEntryDependency.js
  • test/configCases/html/shared-module-chunks/entry.js
  • test/configCases/html/shared-module-chunks/first.js
  • test/configCases/html/shared-module-chunks/second.js
  • test/configCases/html/shared-module-chunks/test.config.js
  • test/configCases/html/shared-module-chunks/test.js
  • test/configCases/html/shared-module-chunks/vendor.js
  • test/configCases/html/shared-module-chunks/webpack.config.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The HTML JS sibling list now excludes chunks that do not emit JavaScript. A new configuration test covers virtual and mixed shared chunks, including their HTML script references and execution.

Changes: HTML Shared Chunk Script Filtering

Layer / File(s) Summary
Filter HTML JS siblings
lib/dependencies/html/HtmlEntryDependency.js, .changeset/080-html-shared-chunks.md
The JS sibling list now includes only chunks that emit JavaScript. The changeset records this behavior.
Test virtual and mixed shared chunks
test/configCases/html/shared-module-chunks/*
The test configuration defines virtual and mixed shared chunks. The test checks emitted files, script references, SHA-384 integrity values, and execution results. The fixture modules provide the expected shared values.

Priority: ➖ Normal

Change: Bug fix

Merge Risk: ⚪ Minimal · up to a7f57

The change skips script tags for chunks without JavaScript while retaining the runtime script. No issue identified here prevents merging after normal checks.

Pre-merge checks: Passed 3 · Inconclusive 1

Failed Failed checks: 1 inconclusive

Check name Status Explanation Resolution
Title check Inconclusive The title uses the required Conventional Commit format, uses the allowed type fix, and accurately describes the HTML change. The branch prefix is not provided, so the required type-prefix match cann… Provide the branch name or confirm that its prefix is fix. If confirmed, this check passes.
Passed Passed checks: 3 passed
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Title check

Explanation

The title uses the required Conventional Commit format, uses the allowed type fix, and accurately describes the HTML change. The branch prefix is not provided, so the required type-prefix match cannot be verified.

Resolution

Provide the branch name or confirm that its prefix is fix. If confirmed, this check passes.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

This PR is packaged and the instant preview is available (7455053).

Install it locally:

  • npm
npm i -D webpack@https://pkg.pr.new/webpack@7455053
  • yarn
yarn add -D webpack@https://pkg.pr.new/webpack@7455053
  • pnpm
pnpm add -D webpack@https://pkg.pr.new/webpack@7455053

@github-actions github-actions Bot added the area: parser JavaScript parsing and dependency analysis (lib/javascript, lib/dependencies) label Oct 18, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Types Coverage

Coverage after merging fix/html-shared-chunks into main will be
99.24%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
bin
   webpack.js98.86%100%100%98.86%113
declarations
   WebpackOptions.ts99.94%100%100%99.94%4240
examples
   build-common.js100%100%100%100%
   buildAll.js100%100%100%100%
   examples.js100%100%100%100%
   template-common.js98.21%100%100%98.21%72
examples/custom-javascript-parser
   test.filter.js100%100%100%100%
examples/custom-javascript-parser/internals
   acorn-parse.js100%100%100%100%
   meriyah-parse.js100%100%100%100%
   oxc-parse.js100%100%100%100%
examples/markdown
   webpack.config.mjs100%100%100%100%
examples/module-federation
   test.filter.js100%100%100%100%
examples/reexport-components
   test.filter.js100%100%100%100%
examples/ssr
   test.filter.js100%100%100%100%
examples/typescript
   test.filter.js100%100%100%100%
examples/typescript-non-erasable
   test.filter.js50%100%100%50%5
examples/virtual-modules
   test.filter.js100%100%100%100%
examples/wasm-bindgen-esm
   test.filter.js100%100%100%100%
examples/wasm-complex
   test.filter.js100%100%100%100%
examples/wasm-emscripten
   test.filter.js100%100%100%100%
examples/wasm-simple
   test.filter.js100%100%100%100%
examples/wasm-simple-source-phase
   test.filter.js100%100%100%100%
lib
   Chunk.js100%100%100%100%
   Compilation.js98.71%100%100%98.71%1779, 2092, 2099, 2107, 2129, 2132, 3116, 3667, 3710, 4299, 4303, 4430, 4451, 4576, 4613, 4620, 4673–4674, 4678, 4683, 4699–4700, 4714–4715, 4720–4721, 5245, 5271, 6101, 6118, 6136, 6152, 6167, 6192, 6195, 6563, 6566–6567, 6572, 6587, 6670, 6694, 851–852
   Compiler.js98.81%100%100%98.81%1116, 1153, 1156, 1336–1337, 1345, 848, 934, 975
   Dependency.js100%100%100%100%
   DependencyTemplate.js100%100%100%100%
   EntryPlugin.js100%100%100%100%
   Entrypoint.js100%100%100%100%
   ExternalsPlugin.js100%100%100%100%
   FileSystemInfo.js100%100%100%100%
   InitFragment.js100%100%100%100%
   LibraryTemplatePlugin.js100%100%100%100%
   ModuleFilenameHelpers.js100%100%100%100%
   ModuleNotFoundError.js100%100%100%100%
   MultiCompiler.js98.91%100%100%98.91%489, 561, 748, 813
   NormalModule.js100%100%100%100%
   NullFactory.js100%100%100%100%
   ProgressPlugin.js100%100%100%100%
   RawModule.js100%100%100%100%
   RequestShortener.js100%100%100%100%
   SingleEntryPlugin.js100%100%100%100%
   WebpackError.js100%100%100%100%
   index.js100%100%100%100%
   webpack.js98.59%100%100%98.59%306, 308
lib/asset
   AssetBytesGenerator.js100%100%100%100%
   AssetBytesParser.js91.67%100%100%91.67%27
   AssetGenerator.js100%100%100%100%
   AssetModule.js100%100%100%100%
   AssetModulesPlugin.js98.45%100%100%98.45%334, 360, 363, 493, 58
   AssetParser.js96.15%100%100%96.15%47
   AssetSourceGenerator.js100%100%100%100%
   AssetSourceParser.js91.67%100%100%91.67%27
   RawDataUrlModule.js100%100%100%100%
   WebManifestGenerator.js100%100%100%100%
   WebManifestParser.js100%100%100%100%
lib/async-modules
   AsyncModuleHelpers.js100%100%100%100%
   AwaitDependenciesInitFragment.js100%100%100%100%
   InferAsyncModulesPlugin.js100%100%100%100%
   isGeneratorLowered.js100%100%100%100%
lib/bun
   BunTargetPlugin.js100%100%100%100%
lib/cache
   AddBuildDependenciesPlugin.js100%100%100%100%
   AddManagedPathsPlugin.js100%100%100%100%
   Cache.js98.25%100%100%98.25%104
   CacheFacade.js100%100%100%100%
   IdleFileCachePlugin.js97.92%100%100%97.92%75, 87, 95
   MemoryCachePlugin.js92%100%100%92%33, 42
   MemoryWithGcCachePlugin.js93.42%100%100%93.42%106, 120–121, 130, 88
   PackFileCacheStrategy.js96.54%100%100%96.54%1306, 1406, 1410, 1472, 1718, 1802, 1825, 1855, 684, 703, 713–715, 717, 733–734, 739, 742, 744, 749, 754, 779, 785, 819, 825, 831, 836, 847, 856, 861–862, 864, 881, 887–888, 890
   ResolverCachePlugin.js100%100%100%100%
   getLazyHashedEtag.js100%100%100%100%
   mergeEtags.js100%100%100%100%
lib/config
   OptionsApply.js100%100%100%100%
   PlatformPlugin.js100%100%100%100%
   WebpackOptionsApply.js100%100%100%100%
   WebpackOptionsDefaulter.js100%100%100%100%
   browserslistTargetHandler.js100%100%100%100%
   cli.js98.89%100%100%98.89%114, 550, 582, 632
   defaults.js99.59%100%100%99.59%1633–1635, 1643, 288, 548
   defineConfig.js100%100%100%100%
   getClaimedAssetTypes.js100%100%100%100%
   normalization.js99.14%100%100%99.14%285–286, 356, 371
   target.js100%100%100%100%
   validateSchema.js94.67%100%100%94.67%100, 87, 89, 98
lib/container
   ContainerEntryDependency.js100%100%100%100%
   ContainerEntryModule.js100%100%100%100%
   ContainerEntryModuleFactory.js100%100%100%100%
   ContainerExposedDependency.js100%100%100%100%
   ContainerPlugin.js100%100%100%100%
   ContainerReferencePlugin.js100%100%100%100%
   FallbackDependency.js100%100%100%100%
   FallbackItemDependency.js100%100%100%100%
   FallbackModule.js100%100%100%100%
   FallbackModuleFactory.js100%100%100%100%
   HoistContainerReferencesPlugin.js100%100%100%100%
   ModuleFederationPlugin.js100%100%100%100%
   RemoteModule.js100%100%100%100%
   RemoteRuntimeModule.js100%100%100%100%
   RemoteToExternalDependency.js100%100%100%100%
   declaredRemotes.js100%100%100%100%
   moduleFederationHooks.js100%100%100%100%
   options.js100%100%100%100%
lib/context
   ContextExclusionPlugin.js100%100%100%100%
   ContextModule.js99.88%100%100%99.88%1495
   ContextModuleFactory.js95.70%100%100%95.70%230, 257, 276, 280–281, 289, 466, 487, 492, 534, 543, 545, 549, 552, 558–559
   ContextReplacementPlugin.js100%100%100%100%
lib/css
   CssGenerator.js99.29%100%100%99.29%1094, 129, 305, 847
   CssInjectStyleRuntimeModule.js100%100%100%100%
   CssLoadingRuntimeModule.js100%100%100%100%
   CssModule.js100%100%100%100%
   CssModulesPlugin.js98.72%100%100%98.72%217, 418, 432, 445, 458, 481, 494, 507, 520
   CssParser.js99.76%100%100%99.76%1090, 2425, 3072, 3075, 3081, 3514, 943
   CssServerStylesRuntimeModule.js100%100%100%100%
   conventions.js98.65%100%100%98.65%93
   cssMinify.js100%100%100%100%
   data.js99.84%100%100%99.84%229, 5601
   syntax-parser.js99.69%100%100%99.69%10798–10799, 11351–11352, 11389, 11599, 11648, 13966, 14027–14030, 14135–14136, 14234–14235, 14983, 15280, 15282, 15802, 16168, 18311, 2619, 3326, 3328, 3333, 3352, 4101, 4107
   syntax-printer.js99.33%100%100%99.33%2603–2604, 2606–2607, 2609–2610, 2615, 2885–2888, 2981, 353, 3666, 4091, 4227, 4927, 5238, 6026, 727
   syntax.js100%100%100%100%
   topologicalSort.js100%100%100%100%
lib/debug
   ProfilingPlugin.js97.35%100%100%97.35%582, 589, 598, 602, 611, 616, 622, 627
lib/define
   DefinePlugin.js99.42%100%100%99.42%1488, 936, 938, 943, 967
   DotenvPlugin.js97.62%100%100%97.62%276, 395, 443, 456–457
   EnvironmentPlugin.js100%100%100%100%
lib/deno
   DenoTargetPlugin.js100%100%100%100%
lib/dependencies
   ConstDependency.js100%100%100%100%
   ContextElementDependency.js100%100%100%100%
   NullDependency.js100%100%100%100%
lib/dependencies/amd
   AMDDefineDependency.js100%100%100%100%
   AMDDefineDependencyParserPlugin.js100%100%100%100%
   AMDPlugin.js99.31%100%100%99.31%54
   AMDRequireArrayDependency.js100%100%100%100%
   AMDRequireContextDependency.js100%100%100%100%
   AMDRequireDependenciesBlock.js100%100%100%100%
   AMDRequireDependenciesBlockParserPlugin.js100%100%100%100%
   AMDRequireDependency.js100%100%100%100%
   AMDRequireItemDependency.js100%100%100%100%
   AMDRuntimeModules.js95.45%100%100%95.45%65
   LocalModule.js100%100%100%100%
   LocalModuleDependency.js100%100%100%100%
   LocalModulesHelpers.js100%100%100%100%
   RequireJsStuffPlugin.js100%100%100%100%
   UnsupportedDependency.js100%100%100%100%
lib/dependencies/commonjs
   

for (const name of ["virtual", "mixed"]) {
it(`should load ${name} shared chunks with valid integrity and no missing scripts`, () => {
const html = fs.readFileSync(path.join(__dirname, `${name}.html`), "utf8");
const tags = html.match(/<script\b[^>]*>/g) || [];
@github-actions

Copy link
Copy Markdown
Contributor

Generated code size

Comparing base (8cbe6b5) to head (a7f5722). Merging this pull request adds 9 new asset(s).

What moved Tests Assets Gzip Raw Test edit
Changed, test untouched 0 0 — — —
Changed, test edited 0 0 — — —
New 1 9 ⚪ added +11.30 KiB ⚪ added +41.04 KiB —
Deleted 0 0 — — —
Unchanged — 9021 — — —

Read Changed, test untouched first: the test is byte-identical on both sides, so webpack generated the difference. Changed, test edited moved partly because the test did — Test edit is how many bytes the test gained, and a bundle that grew by less is not a regression. New and Deleted are whole files, not deltas — a new asset was created, not grown, so it reads gray (⚪ added) — and adding tests cannot bury a real change. Gzip decides, because that is what users download; raw is the tiebreak, and brotli and zstd are per asset below.

No asset that both runs emit changed size — everything below is new or deleted.

9 asset(s) this pull request adds
Asset Raw Gzip (9) Brotli (11) Zstd (19)
⚪ added html/shared-module-chunks 0/virtual-runtime.[hash].js 16.97 KiB 4.02 KiB 3.61 KiB 3.90 KiB
⚪ added html/shared-module-chunks 1/mixed-runtime.[hash].js 16.95 KiB 4.01 KiB 3.61 KiB 3.90 KiB
⚪ added html/shared-module-chunks 0/virtual.[hash].js 1.83 KiB 653 B 568 B 635 B
⚪ added html/shared-module-chunks 1/mixed.[hash].js 1.77 KiB 645 B 558 B 628 B
⚪ added html/shared-module-chunks 1/test.js 1.22 KiB 631 B 540 B 645 B
⚪ added html/shared-module-chunks 0/test.js 1.22 KiB 631 B 540 B 645 B
⚪ added html/shared-module-chunks 1/mixed.html 570 B 366 B 307 B 364 B
⚪ added html/shared-module-chunks 0/virtual.html 400 B 290 B 230 B 288 B
⚪ added html/shared-module-chunks 1/mixed-shared.[hash].js 131 B 122 B 124 B 112 B

No runtime that both runs build changed which runtime modules it carries.

2 runtime(s) this pull request adds or no longer builds
Runtime Modules
➕ html/shared-module-chunks 0/virtual-runtime 7
➕ html/shared-module-chunks 1/mixed-runtime 7

Built test/configCases with the defaults a user gets: 2260 test(s), 9030 asset(s), 101 emitted nothing.

@codspeed

codspeed Bot commented Oct 18, 2026

Copy link
Copy Markdown

Merging this PR will improve performance by 61.73%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 411 untouched benchmarks
⏩ 209 skipped benchmarks1

Performance Changes

Mode Benchmark BASE HEAD Efficiency
⚡ Memory unit benchmark "html-parser-document-unit", parseHtml 527 KB 325.9 KB +61.73%

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.


Comparing fix/html-shared-chunks (a7f5722) with main (8cbe6b5)

Open in CodSpeed

Footnotes

  1. 209 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@codecov

codecov Bot commented Oct 19, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.49%. Comparing base (8cbe6b5) to head (a7f5722).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main   #22779   +/-   ##
=======================================
  Coverage   96.48%   96.49%           
=======================================
  Files         778      778           
  Lines      137417   137417           
  Branches    46599    46599           
=======================================
+ Hits       132586   132598   +12     
+ Misses       4831     4819   -12     
Flag Coverage Δ
css-parsing 24.77% <ø> (ø)
html5lib 26.56% <0.00%> (ø)
integration 81.27% <100.00%> (+<0.01%) ⬆️
minify-corpora 90.86% <ø> (ø)
syntax-equivalence 78.79% <ø> (ø)
test262 55.77% <ø> (+2.81%) ⬆️
test262-parser 79.42% <ø> (ø)
unit 76.60% <0.00%> (ø)
xmlconf 27.51% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@alexander-akait
alexander-akait merged commit 7455053 into main Oct 19, 2026
69 of 71 checks passed
@alexander-akait
alexander-akait deleted the fix/html-shared-chunks branch October 19, 2026 01:55
markharding pushed a commit to futo-org/Harbor that referenced this pull request Oct 27, 2026
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [webpack](https://github.com/webpack/webpack) | [`5.112.0` → `5.112.2`](https://renovatebot.com/diffs/npm/webpack/5.112.0/5.112.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/webpack/5.112.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/webpack/5.112.0/5.112.2?slim=true) |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/99) for more information.

---

### Release Notes

<details>
<summary>webpack/webpack (webpack)</summary>

### [`v5.112.2`](https://github.com/webpack/webpack/blob/HEAD/CHANGELOG.md#51122)

[Compare Source](webpack/webpack@v5.112.1...v5.112.2)

##### Patch Changes

- Reduce repeated scans when concatenating imported modules. (by [@&#8203;xiaoxiaojx](https://github.com/xiaoxiaojx) in [#&#8203;22865](webpack/webpack#22865))

- Avoid allocating CSS module sets for single-group chunks. (by [@&#8203;xiaoxiaojx](https://github.com/xiaoxiaojx) in [#&#8203;22866](webpack/webpack#22866))

- Return the value of every module type loaded with `importModule()`. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22869](webpack/webpack#22869))

### [`v5.112.1`](https://github.com/webpack/webpack/blob/HEAD/CHANGELOG.md#51121)

[Compare Source](webpack/webpack@v5.112.0...v5.112.1)

##### Patch Changes

- Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by [@&#8203;aryanraj45](https://github.com/aryanraj45) in [#&#8203;22699](webpack/webpack#22699))

- Rebuild under `cacheUnaffected` a module whose re-export target goes or returns. (by [@&#8203;aryanraj45](https://github.com/aryanraj45) in [#&#8203;22749](webpack/webpack#22749))

- Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22791](webpack/webpack#22791))

- Fix `exportType: "style"` CSS modules throwing outside the runtime chunk. (by [@&#8203;lazerg](https://github.com/lazerg) in [#&#8203;22833](webpack/webpack#22833))

- Fix crash when a CSS module with `exportType: "style"` imports an ignored stylesheet. (by [@&#8203;codeXsidd](https://github.com/codeXsidd) in [#&#8203;22846](webpack/webpack#22846))

- Keep empty process environment variables that `.env` files don't define in `DotenvPlugin`. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22794](webpack/webpack#22794))

- Rehash an ESM entry chunk when a chunk it imports by file name changes. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22804](webpack/webpack#22804))

- Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by [@&#8203;dependabot](https://github.com/apps/dependabot) in [#&#8203;22811](webpack/webpack#22811))

- Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22733](webpack/webpack#22733))

- Await asynchronous modules that `ProvidePlugin` injects into ES modules. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22728](webpack/webpack#22728))

- Keep a resolve that ends after the compiler closed from throwing. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22795](webpack/webpack#22795))

- Preserve string names passed to SharedWorker constructors. (by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;22770](webpack/webpack#22770))

- Preserve string contents when extracting source map comments. (by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;22768](webpack/webpack#22768))

- Scope strict-mode, async and generator block function declarations to their block. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22800](webpack/webpack#22800))

- Preserve raw dotenv values when reusing cached environment files. (by [@&#8203;Eshiv-Pandey](https://github.com/Eshiv-Pandey) in [#&#8203;22787](webpack/webpack#22787))

- Preserve assigned or patched built-ins, conversions and pattern targets. (by [@&#8203;aryanraj45](https://github.com/aryanraj45) in [#&#8203;22761](webpack/webpack#22761))

- Keep globals a `globalThis` write replaces, and `slice` on a patched array. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22862](webpack/webpack#22862))

- Skip HTML script tags for shared chunks that emit no JavaScript. (by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;22779](webpack/webpack#22779))

- Keep the digits Firefox lays out a minified CSS percentage with. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22718](webpack/webpack#22718))

- Reject a second `srcset` descriptor after a `0x` density descriptor. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22741](webpack/webpack#22741))

- Minify JavaScript faster, folding string methods on constants and `x -= 1`. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22823](webpack/webpack#22823))

- Shorten minified JavaScript, and keep it running like its source. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22717](webpack/webpack#22717))

- Drop more unused functions, arguments, calls, global reads and variable copies when minifying JavaScript. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22789](webpack/webpack#22789))

- Minify JavaScript smaller where swc does, and fold a function's `length` right. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22826](webpack/webpack#22826))

- Reduce JavaScript output size where oxc or swc produce smaller output. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22829](webpack/webpack#22829))

- Update watchpack to 2.6.3 and rebuild on a `node_modules` created mid-build. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22743](webpack/webpack#22743))

- Support `concatenateModules` with `cacheUnaffected`. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22746](webpack/webpack#22746))

- Update schema-utils to 4.8.1. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22774](webpack/webpack#22774))

- Keep CSS fallbacks, vendor overrides, `oklch()` hues and HTML elements. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22753](webpack/webpack#22753))

- Validate `CleanPlugin` and `DotenvPlugin` options with a precompiled check, so valid options no longer compile their schema at startup. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22758](webpack/webpack#22758))

- Speed up startup and CSS minification, sharing the compile cache with workers. (by [@&#8203;xiaoxiaojx](https://github.com/xiaoxiaojx) in [#&#8203;22706](webpack/webpack#22706))

- Use precise, generic types for modules, parsers, generators, stats and loaders. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22731](webpack/webpack#22731))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "before 9am on tuesday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE3NS4xIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSJdfQ==-->

Reviewed-on: https://code.futo.org/harbor/harbor/pulls/2035
markharding pushed a commit to futo-org/Harbor that referenced this pull request Oct 29, 2026
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [webpack](https://github.com/webpack/webpack) | [`5.112.0` → `5.112.2`](https://renovatebot.com/diffs/npm/webpack/5.112.0/5.112.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/webpack/5.112.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/webpack/5.112.0/5.112.2?slim=true) |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/99) for more information.

---

### Release Notes

<details>
<summary>webpack/webpack (webpack)</summary>

### [`v5.112.2`](https://github.com/webpack/webpack/blob/HEAD/CHANGELOG.md#51122)

[Compare Source](webpack/webpack@v5.112.1...v5.112.2)

##### Patch Changes

- Reduce repeated scans when concatenating imported modules. (by [@&#8203;xiaoxiaojx](https://github.com/xiaoxiaojx) in [#&#8203;22865](webpack/webpack#22865))

- Avoid allocating CSS module sets for single-group chunks. (by [@&#8203;xiaoxiaojx](https://github.com/xiaoxiaojx) in [#&#8203;22866](webpack/webpack#22866))

- Return the value of every module type loaded with `importModule()`. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22869](webpack/webpack#22869))

### [`v5.112.1`](https://github.com/webpack/webpack/blob/HEAD/CHANGELOG.md#51121)

[Compare Source](webpack/webpack@v5.112.0...v5.112.1)

##### Patch Changes

- Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by [@&#8203;aryanraj45](https://github.com/aryanraj45) in [#&#8203;22699](webpack/webpack#22699))

- Rebuild under `cacheUnaffected` a module whose re-export target goes or returns. (by [@&#8203;aryanraj45](https://github.com/aryanraj45) in [#&#8203;22749](webpack/webpack#22749))

- Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22791](webpack/webpack#22791))

- Fix `exportType: "style"` CSS modules throwing outside the runtime chunk. (by [@&#8203;lazerg](https://github.com/lazerg) in [#&#8203;22833](webpack/webpack#22833))

- Fix crash when a CSS module with `exportType: "style"` imports an ignored stylesheet. (by [@&#8203;codeXsidd](https://github.com/codeXsidd) in [#&#8203;22846](webpack/webpack#22846))

- Keep empty process environment variables that `.env` files don't define in `DotenvPlugin`. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22794](webpack/webpack#22794))

- Rehash an ESM entry chunk when a chunk it imports by file name changes. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22804](webpack/webpack#22804))

- Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by [@&#8203;dependabot](https://github.com/apps/dependabot) in [#&#8203;22811](webpack/webpack#22811))

- Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22733](webpack/webpack#22733))

- Await asynchronous modules that `ProvidePlugin` injects into ES modules. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22728](webpack/webpack#22728))

- Keep a resolve that ends after the compiler closed from throwing. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22795](webpack/webpack#22795))

- Preserve string names passed to SharedWorker constructors. (by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;22770](webpack/webpack#22770))

- Preserve string contents when extracting source map comments. (by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;22768](webpack/webpack#22768))

- Scope strict-mode, async and generator block function declarations to their block. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22800](webpack/webpack#22800))

- Preserve raw dotenv values when reusing cached environment files. (by [@&#8203;Eshiv-Pandey](https://github.com/Eshiv-Pandey) in [#&#8203;22787](webpack/webpack#22787))

- Preserve assigned or patched built-ins, conversions and pattern targets. (by [@&#8203;aryanraj45](https://github.com/aryanraj45) in [#&#8203;22761](webpack/webpack#22761))

- Keep globals a `globalThis` write replaces, and `slice` on a patched array. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22862](webpack/webpack#22862))

- Skip HTML script tags for shared chunks that emit no JavaScript. (by [@&#8203;bjohansebas](https://github.com/bjohansebas) in [#&#8203;22779](webpack/webpack#22779))

- Keep the digits Firefox lays out a minified CSS percentage with. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22718](webpack/webpack#22718))

- Reject a second `srcset` descriptor after a `0x` density descriptor. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22741](webpack/webpack#22741))

- Minify JavaScript faster, folding string methods on constants and `x -= 1`. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22823](webpack/webpack#22823))

- Shorten minified JavaScript, and keep it running like its source. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22717](webpack/webpack#22717))

- Drop more unused functions, arguments, calls, global reads and variable copies when minifying JavaScript. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22789](webpack/webpack#22789))

- Minify JavaScript smaller where swc does, and fold a function's `length` right. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22826](webpack/webpack#22826))

- Reduce JavaScript output size where oxc or swc produce smaller output. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22829](webpack/webpack#22829))

- Update watchpack to 2.6.3 and rebuild on a `node_modules` created mid-build. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22743](webpack/webpack#22743))

- Support `concatenateModules` with `cacheUnaffected`. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22746](webpack/webpack#22746))

- Update schema-utils to 4.8.1. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22774](webpack/webpack#22774))

- Keep CSS fallbacks, vendor overrides, `oklch()` hues and HTML elements. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22753](webpack/webpack#22753))

- Validate `CleanPlugin` and `DotenvPlugin` options with a precompiled check, so valid options no longer compile their schema at startup. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22758](webpack/webpack#22758))

- Speed up startup and CSS minification, sharing the compile cache with workers. (by [@&#8203;xiaoxiaojx](https://github.com/xiaoxiaojx) in [#&#8203;22706](webpack/webpack#22706))

- Use precise, generic types for modules, parsers, generators, stats and loaders. (by [@&#8203;alexander-akait](https://github.com/alexander-akait) in [#&#8203;22731](webpack/webpack#22731))

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - "before 9am on tuesday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNzUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjE3NS4xIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSJdfQ==-->

Reviewed-on: https://code.futo.org/harbor/harbor/pulls/2035
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: parser JavaScript parsing and dependency analysis (lib/javascript, lib/dependencies)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants