[Snyk] Upgrade webpack from 5.24.4 to 5.28.0 #3
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade webpack from 5.24.4 to 5.28.0. See this package in npm: https://www.npmjs.com/package/webpack See this project in Snyk: https://app.snyk.io/org/j-vin-b8w/project/eb18f4cc-28bc-4690-a5bc-9f8c1462d7ef?utm_source=github&utm_medium=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade webpack from 5.24.4 to 5.28.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version fixes:
SNYK-JS-LODASH-1040724
Why? Proof of Concept exploit, CVSS 7.2
SNYK-JS-NODENOTIFIER-1035794
Why? Proof of Concept exploit, CVSS 7.2
SNYK-JS-LODASH-1018905
Why? Proof of Concept exploit, CVSS 7.2
SNYK-JS-HOSTEDGITINFO-1088355
Why? Proof of Concept exploit, CVSS 7.2
SNYK-JS-GLOBPARENT-1016905
Why? Proof of Concept exploit, CVSS 7.2
SNYK-JS-GLOBPARENT-1016905
Why? Proof of Concept exploit, CVSS 7.2
(*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: webpack
-
5.28.0 - 2021-03-24
- add
- fixes a watch mode caching problem which was introduced in 5.26.0 when using the unsafe cache
- improve serialization performance
-
5.27.2 - 2021-03-22
- fix error reporting when errors happen in
- avoid crash when
- fix lazy compilation opt-out when HMR accept/decline is used on an
- fix
-
5.27.1 - 2021-03-20
- allow invalidation after first watch run in MultiCompilers
-
5.27.0 - 2021-03-19
- add
- fix caching bug when split chunks of an entrypoint change and modules of the entrypoint stay equal
- fix
- fix incorrect id assignment of record ids plugin
- this causes ids changing unnecessary during watch mode
- fix library exports when using onChunks in entry
- This prevented using libraries with web target when using splitChunks for the initial chunks
-
5.26.3 - 2021-03-17
- fix race condition in MultiCompiler queueing
-
5.26.2 - 2021-03-16
- fix problem with new line after comment
- fix assign libraries with runtime chunk
-
5.26.1 - 2021-03-16
- avoid using strict mode runtime for assign libraries to allow assigning not existing variables
- avoid collision with
- allow filenames starting with
-
5.26.0 - 2021-03-15
- handle cache version automatically for DefinePlugin
- Values no longer need to be defined as build dependencies
- add more options for
- fix a memory leak which happens in watch mode with caching when modules are removed from the compilation
- fix usage of some arrow functions when es5 target is selected
- chunk loading in workers now uses publicPath instead of relative paths
- fixes a problem when worker file is in a child directory
-
5.25.1 - 2021-03-14
- fix startup logic when non-js chunks are in the entrypoint
- remove
-
5.25.0 - 2021-03-12
- Refactor the startup logic to improve library support
- add
- improve error handling for HMR
- add second argument to self accept error handler to pass new module and module id
- add error handler argument to dependency accept, passing error and module ids
- add
- used by default when HMR is enabled
- when ignoring a module used by
- add
- fix problem when library options apply to a non-runtime chunk
- fix crash in
- fix sub-optimal splitting of
- fix a memory leak in AssetGenerator
- fix usage of runtime globals in SharedPlugin to support HMR updates
- deprecate
-
5.24.4 - 2021-03-08
from webpack GitHub release notesFeatures
module.generator.asset.publicPathto configure a different publicPath for assetsBugfixes
Performance
Bugfixes
beforeLoadershookexperiments.lazyCompilationis used (regression)import()new URL(new URLgenerated by worker handingBugfix
Features
utils: { contextify(context, absolutePath), absolutify(context, request) }to loader contextBugfixes
importsfield handlingBugfix
Bugfixes
Bugfixes
Set.addAllpolyfill../when generation the undo path for non-web targetsFeatures
DefinePlugin.runtimeValue(file/context/missing/buildDependencies, version)Bugfixes
Bugfixes
type: "module"for Workers when generating classic scriptsFeatures
__webpack_runtime_id__to access the current runtime idoutput.strictModuleErrorHandlingto opt into stricter evaluation error handling semantics according to ESM specnew URL()this will result in an url to a empty file ("data:,")module.generator.asset.emitoption to disable creating assets from asset modules (e. g. for SSR)Bugfixes
splitChunks.maxSizewhere negative indicies are accessedsplitChunks.maxSizein some cases when multiple size types are involvedDeprecations
output.strictModuleExceptionHandling(this is the CommonJS way of handling errors, and the name is weird)Commit messages
Package name: webpack
Compare
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
🧐 View latest project report
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs