Skip to content

chore(deps-dev): bump webpack from 5.108.4 to 5.109.0 in /webapp - #1004

Merged
mergify[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/webapp/webpack-5.109.0
Jul 27, 2026
Merged

chore(deps-dev): bump webpack from 5.108.4 to 5.109.0 in /webapp#1004
mergify[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/webapp/webpack-5.109.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor

Bumps webpack from 5.108.4 to 5.109.0.

Release notes

Sourced from webpack's releases.

v5.109.0

Minor Changes

  • Default experiments.typescript to "auto", enabling built-in TypeScript support on Node.js >= 22.6 when no TypeScript loader is registered. (by @​alexander-akait in #21477)

  • Default experiments.css, experiments.html and experiments.asyncWebAssembly to "auto", enabling built-in support unless a loader is registered for those files; modules with inline or hook-injected loaders (e.g. html-webpack-plugin templates) keep being parsed as JavaScript. (by @​alexander-akait in #21477)

  • Add output.resourceHints to emit resource hints (preload/prefetch/modulepreload/preconnect), on by default for ESM output, plus module.parser.<type>.urlHints, css.fontPreload and javascript.dynamicImportCssPreload. (by @​alexander-akait in #21477)

  • Add built-in build progress via infrastructureLogging.progress, plus estimatedTime, phaseTimings, progress bar width and progressBar: "auto" on ProgressPlugin. (by @​alexander-akait in #21477)

  • Concatenate CommonJS modules with statically analyzable exports; opt out via optimization.concatenateModules: { commonjs: false }. (by @​alexander-akait in #21477)

  • Wrap "weird" CommonJS modules into module concatenation instead of bailing out. (by @​alexander-akait in #21477)

  • Add output.html.inline (true | "script" | "style") and the webpackInline magic comment to inline chunk content into HTML. (by @​alexander-akait in #21477)

  • Add output.html.inject to control where chunk tags are injected. (by @​alexander-akait in #21477)

  • Add output.html.title, output.html.meta and output.html.base options for head generation. (by @​alexander-akait in #21477)

  • Support per-icon link attributes (sizes, media, color, type, crossorigin) and arrays in output.html.favicon. (by @​alexander-akait in #21487)

  • Add output.html.manifest to generate and link a web app manifest with hashed icons. (by @​alexander-akait in #21487)

  • Add output.html.csp to inject a Content-Security-Policy meta with inline-content hashes and an optional nonce. (by @​alexander-akait in #21487)

  • Add the output.html injectTags compilation hook to inject tags (script/link/meta/â€Ķ) with injectTo placement. (by @​alexander-akait in #21487)

  • Add the output.html transformTags compilation hook to mutate, remove, or move (between <head> and <body>) a page's existing <script>/<link>/<style>/<meta> tags. (by @​alexander-akait in #21487)

  • Extend the HTML pipeline with html link sources (bundled as their own emitted page) and rel="preload"/"prefetch" links bundled as chunks. (by @​alexander-akait in #21477)

  • Recognize more asset-bearing HTML sources: the twitter:player:stream meta, legacy SVG references, and Web App Manifest icons/screenshots/shortcuts URLs. (by @​alexander-akait in #21477)

  • Add module.parser.html.as to parse HTML as a document or an element fragment. (by @​alexander-akait in #21477)

  • Allow disabling a built-in HTML parser source via type: false in sources. (by @​alexander-akait in #21477)

  • Export webpack.html.HtmlModulesPlugin with transformHtml/htmlEmitted compilation hooks. (by @​alexander-akait in #21477)

  • Resolve @custom-media (including media-type values) and @custom-selector in native CSS. (by @​alexander-akait in #21477)

  • Scope view-transition-name/-group/-class names and ::view-transition-*() pseudo references in CSS modules under customIdents. (by @​alexander-akait in #21486)

  • Add import.meta.glob support, with a caseSensitive option and consistent hidden/node_modules matching. (by @​alexander-akait in #21477)

  • Resolve import.meta.resolve("./asset") to the emitted asset URL via the importMeta.resolve parser option. (by @​alexander-akait in #21477)

  • Add import.meta.env defaults: MODE, DEV, PROD, SSR and BASE_URL. (by @​alexander-akait in #21477)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.109.0

Minor Changes

  • Default experiments.typescript to "auto", enabling built-in TypeScript support on Node.js >= 22.6 when no TypeScript loader is registered. (by @​alexander-akait in #21477)

  • Default experiments.css, experiments.html and experiments.asyncWebAssembly to "auto", enabling built-in support unless a loader is registered for those files; modules with inline or hook-injected loaders (e.g. html-webpack-plugin templates) keep being parsed as JavaScript. (by @​alexander-akait in #21477)

  • Add output.resourceHints to emit resource hints (preload/prefetch/modulepreload/preconnect), on by default for ESM output, plus module.parser.<type>.urlHints, css.fontPreload and javascript.dynamicImportCssPreload. (by @​alexander-akait in #21477)

  • Add built-in build progress via infrastructureLogging.progress, plus estimatedTime, phaseTimings, progress bar width and progressBar: "auto" on ProgressPlugin. (by @​alexander-akait in #21477)

  • Concatenate CommonJS modules with statically analyzable exports; opt out via optimization.concatenateModules: { commonjs: false }. (by @​alexander-akait in #21477)

  • Wrap "weird" CommonJS modules into module concatenation instead of bailing out. (by @​alexander-akait in #21477)

  • Add output.html.inline (true | "script" | "style") and the webpackInline magic comment to inline chunk content into HTML. (by @​alexander-akait in #21477)

  • Add output.html.inject to control where chunk tags are injected. (by @​alexander-akait in #21477)

  • Add output.html.title, output.html.meta and output.html.base options for head generation. (by @​alexander-akait in #21477)

  • Support per-icon link attributes (sizes, media, color, type, crossorigin) and arrays in output.html.favicon. (by @​alexander-akait in #21487)

  • Add output.html.manifest to generate and link a web app manifest with hashed icons. (by @​alexander-akait in #21487)

  • Add output.html.csp to inject a Content-Security-Policy meta with inline-content hashes and an optional nonce. (by @​alexander-akait in #21487)

  • Add the output.html injectTags compilation hook to inject tags (script/link/meta/â€Ķ) with injectTo placement. (by @​alexander-akait in #21487)

  • Add the output.html transformTags compilation hook to mutate, remove, or move (between <head> and <body>) a page's existing <script>/<link>/<style>/<meta> tags. (by @​alexander-akait in #21487)

  • Extend the HTML pipeline with html link sources (bundled as their own emitted page) and rel="preload"/"prefetch" links bundled as chunks. (by @​alexander-akait in #21477)

  • Recognize more asset-bearing HTML sources: the twitter:player:stream meta, legacy SVG references, and Web App Manifest icons/screenshots/shortcuts URLs. (by @​alexander-akait in #21477)

  • Add module.parser.html.as to parse HTML as a document or an element fragment. (by @​alexander-akait in #21477)

  • Allow disabling a built-in HTML parser source via type: false in sources. (by @​alexander-akait in #21477)

  • Export webpack.html.HtmlModulesPlugin with transformHtml/htmlEmitted compilation hooks. (by @​alexander-akait in #21477)

  • Resolve @custom-media (including media-type values) and @custom-selector in native CSS. (by @​alexander-akait in #21477)

  • Scope view-transition-name/-group/-class names and ::view-transition-*() pseudo references in CSS modules under customIdents. (by @​alexander-akait in #21486)

  • Add import.meta.glob support, with a caseSensitive option and consistent hidden/node_modules matching. (by @​alexander-akait in #21477)

  • Resolve import.meta.resolve("./asset") to the emitted asset URL via the importMeta.resolve parser option. (by @​alexander-akait in #21477)

... (truncated)

Commits
  • 21cd11a chore(release): new release (#21337)
  • 7121604 feat: native HTML output features (favicon attributes, manifest, CSP, tag inj...
  • 828a65c feat: scope view-transition names in CSS modules (#21486)
  • 27dfadb fix: keep loader results as JavaScript when css/html support is implicitly en...
  • 8565f1a fix: context hash crash on unsupported directory entries (#21484)
  • d933655 chore(deps): bump test/test262-cases in the dependencies group (#21479)
  • 5df3269 chore(deps): bump the dependencies group with 11 updates (#21480)
  • 06e8dbf chore(deps): bump actions/checkout in the dependencies group (#21478)
  • c07ba06 docs: simplify, union and importance-order pending changelog entries (#21477)
  • 6fcbd52 build: verify internalSerializables in lint:special (#21476)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps-dev): bump webpack from 5.108.4 to 5.109.0 in /webapp
0d59a39 
Bumps [webpack](https://github.com/webpack/webpack) from 5.108.4 to 5.109.0.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.108.4...v5.109.0)

---
updated-dependencies:
- dependency-name: webpack
  dependency-version: 5.109.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 26, 2026
@mergify

mergify Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

@codacy-production

codacy-production Bot commented Jul 26, 2026

Copy link
Copy Markdown

Up to standards ✅

ðŸŸĒ Issues 0 issues

Results:
0 new issues

View in Codacy

ðŸŸĒ Metrics 0 complexity

Metric Results
Complexity 0

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@mergify
mergify Bot merged commit a602158 into main Jul 27, 2026
12 of 15 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/webapp/webpack-5.109.0 branch July 27, 2026 08:42
mergify Bot added a commit that referenced this pull request Sep 6, 2026
@mergify
chore(deps): bump org.openrewrite.recipe:rewrite-static-analysis fromâ€Ķ
4017b7a 
â€Ķ 2.41.0 to 2.41.1 [skip ci]

Bumps [org.openrewrite.recipe:rewrite-static-analysis](https://github.com/openrewrite/rewrite-static-analysis) from 2.41.0 to 2.41.1.
Release notes

*Sourced from [org.openrewrite.recipe:rewrite-static-analysis's releases](https://github.com/openrewrite/rewrite-static-analysis/releases).*

> 2.41.1
> ------
>
> What's Changed
> --------------
>
> * Add `RemoveDuplicateAnnotations` by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-static-analysis#1000](https://redirect.github.com/openrewrite/rewrite-static-analysis/pull/1000)
> * Revert "Skip the JavaScript RPC tests when their npm package is unavailable" by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-static-analysis#1001](https://redirect.github.com/openrewrite/rewrite-static-analysis/pull/1001)
> * Do not remove `catch (Exception e)` covering a checked exception by [`@​timtebeek`](https://github.com/timtebeek) in [openrewrite/rewrite-static-analysis#1003](https://redirect.github.com/openrewrite/rewrite-static-analysis/pull/1003)
> * UnnecessaryExplicitTypeArguments: retain witness when enclosing method has dependent type parameters by [`@​Niloyyy`](https://github.com/Niloyyy) in [openrewrite/rewrite-static-analysis#998](https://redirect.github.com/openrewrite/rewrite-static-analysis/pull/998)
> * Add recipe optimizing map iteration by [`@​sambsnyd`](https://github.com/sambsnyd) in [openrewrite/rewrite-static-analysis#1004](https://redirect.github.com/openrewrite/rewrite-static-analysis/pull/1004)
> * WhileInsteadOfFor not to run for Go code by [`@​greg-at-moderne`](https://github.com/greg-at-moderne) in [openrewrite/rewrite-static-analysis#999](https://redirect.github.com/openrewrite/rewrite-static-analysis/pull/999)
> * Keep annotated and `strictfp` overrides that only call super by [`@​martinfrancois`](https://github.com/martinfrancois) in [openrewrite/rewrite-static-analysis#988](https://redirect.github.com/openrewrite/rewrite-static-analysis/pull/988)
>
> New Contributors
> ----------------
>
> * [`@​Niloyyy`](https://github.com/Niloyyy) made their first contribution in [openrewrite/rewrite-static-analysis#998](https://redirect.github.com/openrewrite/rewrite-static-analysis/pull/998)
>
> **Full Changelog**: <openrewrite/rewrite-static-analysis@v2.41.0...v2.41.1>


Commits

* [`0555ec6`](openrewrite/rewrite-static-analysis@0555ec6) OpenRewrite recipe best practices
* [`bee07a4`](openrewrite/rewrite-static-analysis@bee07a4) Keep annotated and `strictfp` overrides that only call super ([#988](https://redirect.github.com/openrewrite/rewrite-static-analysis/issues/988))
* [`f7337c8`](openrewrite/rewrite-static-analysis@f7337c8) WhileInsteadOfFor not to run for Go code ([#999](https://redirect.github.com/openrewrite/rewrite-static-analysis/issues/999))
* [`33284b2`](openrewrite/rewrite-static-analysis@33284b2) Add recipe to optimize map set iteration ([#1004](https://redirect.github.com/openrewrite/rewrite-static-analysis/issues/1004))
* [`8720917`](openrewrite/rewrite-static-analysis@8720917) UnnecessaryExplicitTypeArguments: retain witness when enclosing method has de...
* [`a127799`](openrewrite/rewrite-static-analysis@a127799) Do not remove `catch (Exception e)` covering a checked exception ([#1003](https://redirect.github.com/openrewrite/rewrite-static-analysis/issues/1003))
* [`dbd8871`](openrewrite/rewrite-static-analysis@dbd8871) OpenRewrite recipe best practices
* [`27392cc`](openrewrite/rewrite-static-analysis@27392cc) Revert "Skip the JavaScript RPC tests when their npm package is unavailable" ...
* [`1b39dcc`](openrewrite/rewrite-static-analysis@1b39dcc) Add `RemoveDuplicateAnnotations` ([#1000](https://redirect.github.com/openrewrite/rewrite-static-analysis/issues/1000))
* [`eb731c9`](openrewrite/rewrite-static-analysis@eb731c9) Do not assert non-null when removing an emptied javadoc comment
* Additional commits viewable in [compare view](openrewrite/rewrite-static-analysis@v2.41.0...v2.41.1)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=org.openrewrite.recipe:rewrite-static-analysis&package-manager=maven&previous-version=2.41.0&new-version=2.41.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@robfrank robfrank robfrank approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file dependency_approved javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@robfrank