Skip to content

build(deps): bump webpack from 5.89.0 to 5.109.0 in /example#92

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/example/webpack-5.109.0
Open

build(deps): bump webpack from 5.89.0 to 5.109.0 in /example#92
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/example/webpack-5.109.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps webpack from 5.89.0 to 5.109.0.

Release notes

Sourced from webpack's releases.

v5.109.0

Minor Changes

  • Default experiments.typescript to "auto", enabling built-in TypeScript support on Node.js >= 22.6 when no TypeScript loader is registered. (by @​alexander-akait in #21477)

  • Default experiments.css, experiments.html and experiments.asyncWebAssembly to "auto", enabling built-in support unless a loader is registered for those files; modules with inline or hook-injected loaders (e.g. html-webpack-plugin templates) keep being parsed as JavaScript. (by @​alexander-akait in #21477)

  • Add output.resourceHints to emit resource hints (preload/prefetch/modulepreload/preconnect), on by default for ESM output, plus module.parser.<type>.urlHints, css.fontPreload and javascript.dynamicImportCssPreload. (by @​alexander-akait in #21477)

  • Add built-in build progress via infrastructureLogging.progress, plus estimatedTime, phaseTimings, progress bar width and progressBar: "auto" on ProgressPlugin. (by @​alexander-akait in #21477)

  • Concatenate CommonJS modules with statically analyzable exports; opt out via optimization.concatenateModules: { commonjs: false }. (by @​alexander-akait in #21477)

  • Wrap "weird" CommonJS modules into module concatenation instead of bailing out. (by @​alexander-akait in #21477)

  • Add output.html.inline (true | "script" | "style") and the webpackInline magic comment to inline chunk content into HTML. (by @​alexander-akait in #21477)

  • Add output.html.inject to control where chunk tags are injected. (by @​alexander-akait in #21477)

  • Add output.html.title, output.html.meta and output.html.base options for head generation. (by @​alexander-akait in #21477)

  • Support per-icon link attributes (sizes, media, color, type, crossorigin) and arrays in output.html.favicon. (by @​alexander-akait in #21487)

  • Add output.html.manifest to generate and link a web app manifest with hashed icons. (by @​alexander-akait in #21487)

  • Add output.html.csp to inject a Content-Security-Policy meta with inline-content hashes and an optional nonce. (by @​alexander-akait in #21487)

  • Add the output.html injectTags compilation hook to inject tags (script/link/meta/…) with injectTo placement. (by @​alexander-akait in #21487)

  • Add the output.html transformTags compilation hook to mutate, remove, or move (between <head> and <body>) a page's existing <script>/<link>/<style>/<meta> tags. (by @​alexander-akait in #21487)

  • Extend the HTML pipeline with html link sources (bundled as their own emitted page) and rel="preload"/"prefetch" links bundled as chunks. (by @​alexander-akait in #21477)

  • Recognize more asset-bearing HTML sources: the twitter:player:stream meta, legacy SVG references, and Web App Manifest icons/screenshots/shortcuts URLs. (by @​alexander-akait in #21477)

  • Add module.parser.html.as to parse HTML as a document or an element fragment. (by @​alexander-akait in #21477)

  • Allow disabling a built-in HTML parser source via type: false in sources. (by @​alexander-akait in #21477)

  • Export webpack.html.HtmlModulesPlugin with transformHtml/htmlEmitted compilation hooks. (by @​alexander-akait in #21477)

  • Resolve @custom-media (including media-type values) and @custom-selector in native CSS. (by @​alexander-akait in #21477)

  • Scope view-transition-name/-group/-class names and ::view-transition-*() pseudo references in CSS modules under customIdents. (by @​alexander-akait in #21486)

  • Add import.meta.glob support, with a caseSensitive option and consistent hidden/node_modules matching. (by @​alexander-akait in #21477)

  • Resolve import.meta.resolve("./asset") to the emitted asset URL via the importMeta.resolve parser option. (by @​alexander-akait in #21477)

  • Add import.meta.env defaults: MODE, DEV, PROD, SSR and BASE_URL. (by @​alexander-akait in #21477)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.0

Minor Changes

  • Default experiments.typescript to "auto", enabling built-in TypeScript support on Node.js >= 22.6 when no TypeScript loader is registered. (by @​alexander-akait in #21477)

  • Default experiments.css, experiments.html and experiments.asyncWebAssembly to "auto", enabling built-in support unless a loader is registered for those files; modules with inline or hook-injected loaders (e.g. html-webpack-plugin templates) keep being parsed as JavaScript. (by @​alexander-akait in #21477)

  • Add output.resourceHints to emit resource hints (preload/prefetch/modulepreload/preconnect), on by default for ESM output, plus module.parser.<type>.urlHints, css.fontPreload and javascript.dynamicImportCssPreload. (by @​alexander-akait in #21477)

  • Add built-in build progress via infrastructureLogging.progress, plus estimatedTime, phaseTimings, progress bar width and progressBar: "auto" on ProgressPlugin. (by @​alexander-akait in #21477)

  • Concatenate CommonJS modules with statically analyzable exports; opt out via optimization.concatenateModules: { commonjs: false }. (by @​alexander-akait in #21477)

  • Wrap "weird" CommonJS modules into module concatenation instead of bailing out. (by @​alexander-akait in #21477)

  • Add output.html.inline (true | "script" | "style") and the webpackInline magic comment to inline chunk content into HTML. (by @​alexander-akait in #21477)

  • Add output.html.inject to control where chunk tags are injected. (by @​alexander-akait in #21477)

  • Add output.html.title, output.html.meta and output.html.base options for head generation. (by @​alexander-akait in #21477)

  • Support per-icon link attributes (sizes, media, color, type, crossorigin) and arrays in output.html.favicon. (by @​alexander-akait in #21487)

  • Add output.html.manifest to generate and link a web app manifest with hashed icons. (by @​alexander-akait in #21487)

  • Add output.html.csp to inject a Content-Security-Policy meta with inline-content hashes and an optional nonce. (by @​alexander-akait in #21487)

  • Add the output.html injectTags compilation hook to inject tags (script/link/meta/…) with injectTo placement. (by @​alexander-akait in #21487)

  • Add the output.html transformTags compilation hook to mutate, remove, or move (between <head> and <body>) a page's existing <script>/<link>/<style>/<meta> tags. (by @​alexander-akait in #21487)

  • Extend the HTML pipeline with html link sources (bundled as their own emitted page) and rel="preload"/"prefetch" links bundled as chunks. (by @​alexander-akait in #21477)

  • Recognize more asset-bearing HTML sources: the twitter:player:stream meta, legacy SVG references, and Web App Manifest icons/screenshots/shortcuts URLs. (by @​alexander-akait in #21477)

  • Add module.parser.html.as to parse HTML as a document or an element fragment. (by @​alexander-akait in #21477)

  • Allow disabling a built-in HTML parser source via type: false in sources. (by @​alexander-akait in #21477)

  • Export webpack.html.HtmlModulesPlugin with transformHtml/htmlEmitted compilation hooks. (by @​alexander-akait in #21477)

  • Resolve @custom-media (including media-type values) and @custom-selector in native CSS. (by @​alexander-akait in #21477)

  • Scope view-transition-name/-group/-class names and ::view-transition-*() pseudo references in CSS modules under customIdents. (by @​alexander-akait in #21486)

  • Add import.meta.glob support, with a caseSensitive option and consistent hidden/node_modules matching. (by @​alexander-akait in #21477)

  • Resolve import.meta.resolve("./asset") to the emitted asset URL via the importMeta.resolve parser option. (by @​alexander-akait in #21477)

... (truncated)

Commits
  • 21cd11a chore(release): new release (#21337)
  • 7121604 feat: native HTML output features (favicon attributes, manifest, CSP, tag inj...
  • 828a65c feat: scope view-transition names in CSS modules (#21486)
  • 27dfadb fix: keep loader results as JavaScript when css/html support is implicitly en...
  • 8565f1a fix: context hash crash on unsupported directory entries (#21484)
  • d933655 chore(deps): bump test/test262-cases in the dependencies group (#21479)
  • 5df3269 chore(deps): bump the dependencies group with 11 updates (#21480)
  • 06e8dbf chore(deps): bump actions/checkout in the dependencies group (#21478)
  • c07ba06 docs: simplify, union and importance-order pending changelog entries (#21477)
  • 6fcbd52 build: verify internalSerializables in lint:special (#21476)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Note

Medium Risk
Large webpack jump with new default "auto" experiments can change bundle/HTML behavior for Vue CLI builds; validate example build/serve after merge.

Overview
Updates example/yarn.lock so the Vue CLI example resolves webpack 5.109.0 (from 5.89.0). There is no package.json change; webpack remains a transitive dependency of @vue/cli-service and related plugins.

The lockfile refresh also realigns webpack’s dependency tree—for example @webassemblyjs 1.14.x, es-module-lexer 2.x, enhanced-resolve / watchpack / webpack-sources, schema-utils 4.x, minimizer-webpack-plugin (replacing webpack’s prior direct terser-webpack-plugin wiring), and removal of acorn-import-assertions.

Webpack 5.109 adds many opt-in or "auto" defaults (built-in TypeScript/CSS/HTML experiments, HTML output hooks, module concatenation tweaks). For this stack, html-webpack-plugin and existing loaders should still dominate parsing; worth a quick yarn build / yarn start smoke test after merge.

Reviewed by Cursor Bugbot for commit ba226d1. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 24, 2026 13:36
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 24, 2026
@dependabot
build(deps): bump webpack from 5.89.0 to 5.109.0 in /example
ba226d1 
Bumps [webpack](https://github.com/webpack/webpack) from 5.89.0 to 5.109.0.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.89.0...v5.109.0)

---
updated-dependencies:
- dependency-name: webpack
  dependency-version: 5.109.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/example/webpack-5.109.0 branch from 03a2a49 to ba226d1 Compare July 24, 2026 14:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants