build(deps-dev): bump webpack from 5.87.0 to 5.102.0 #1213

dependabot · 2025-10-06T09:06:10Z

Bumps webpack from 5.87.0 to 5.102.0.

Release notes

v5.102.0

Features

Added static analyze for dynamic imports

Added support for import file from "./file.ext" with { type: "bytes" } to get the content as Uint8Array (look at example)

Added support for import file from "./file.ext" with { type: "text" } to get the content as text (look at example)

Added the snapshot.contextModule to configure snapshots options for context modules

Added the extractSourceMap option to implement the capabilities of loading source maps by comment, you don't need source-map-loader (look at example)

The topLevelAwait experiment is now stable (you can remove experiments.topLevelAwait from your webpack.config.js)

The layers experiment is now stable (you can remove experiments.layers from your webpack.config.js)

Added function matcher support in rule options

Fixes

Fixed conflicts caused by multiple concatenate modules

Ignore import failure during HMR update with ES modules output

Keep render module order consistent

Prevent inlining modules that have this exports

Removed unused timeout attribute of script tag

Supported UMD chunk format to work in web workers

Improved CommonJs bundle to ES module library

Use es-lexer for mjs files for build dependencies

Fixed support __non_webpack_require__ for ES modules

Properly handle external modules for CSS

AssetsByChunkName included assets from chunk.auxiliaryFiles

Use createRequire only when output is ES module and target is node

Typescript types

Performance Improvements

Avoid extra calls for snapshot

A avoid extra jobs for build dependencies

Move import attributes to own dependencies

v5.101.3

Fixes

Fixed resolve execution order issue from extra await in async modules

Avoid empty block for unused statement

Collect only specific expressions for destructuring assignment

v5.101.2

Fixes

Fixed syntax error when comment is on the last line

Handle var declaration for createRequire

Distinguish free variable and tagged variable

v5.101.1

Fixes

... (truncated)

Commits

14c813a chore(release): 5.102.0
761b153 feat: support function matcher in rule options (#19952)
8c0fa9e feat: tree shaking nested exports for destructuring assignment (#19955)
0a58530 chore(deps): bump actions/dependency-review-action from 4.7.3 to 4.8.0 (#19958)
042bf86 fix: integrity in http-url test (#19954)
d9121b3 docs: use markdown instead html (#19938)
3f00777 docs: remove unused files (#19937)
3cf0d95 chore: add lfx badge (#19934)
84e5c12 fix: should analyze correct variable for dynamic import (#19936)
44cf16f docs: Revise security policy and reporting guidelines (#19886)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [webpack](https://github.com/webpack/webpack) from 5.87.0 to 5.102.0. - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.87.0...v5.102.0) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.102.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

bolt-new-by-stackblitz · 2025-10-06T09:06:14Z

Run & review this pull request in StackBlitz Codeflow.

coderabbitai · 2025-10-06T09:06:28Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Note

Free review on us!

CodeRabbit is offering free reviews until Wed Oct 08 2025 to showcase some of the refinements we've made.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

socket-security · 2025-10-06T09:06:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	next@12.1.6
	@esbuild/linux-loong64@0.14.54
	esbuild-android-arm64@0.14.54
	esbuild-darwin-64@0.14.54
	esbuild-darwin-arm64@0.14.54
	esbuild-freebsd-64@0.14.54
	esbuild-freebsd-arm64@0.14.54
	esbuild-linux-32@0.14.54
	esbuild-linux-64@0.14.54
	esbuild-linux-arm@0.14.54
	esbuild-linux-arm64@0.14.54
	esbuild-linux-mips64le@0.14.54
	esbuild-linux-ppc64le@0.14.54
	esbuild-linux-riscv64@0.14.54
	esbuild-linux-s390x@0.14.54
	esbuild-openbsd-64@0.14.54
	esbuild-sunos-64@0.14.54
	esbuild-windows-32@0.14.54
	esbuild-windows-64@0.14.54
	esbuild-windows-arm64@0.14.54
	@next/swc-android-arm-eabi@12.1.6
	@next/swc-android-arm64@12.1.6
	@next/swc-darwin-arm64@12.1.6
	@next/swc-darwin-x64@12.1.6
	@next/swc-linux-arm-gnueabihf@12.1.6
	@next/swc-linux-arm64-gnu@12.1.6
	@next/swc-linux-arm64-musl@12.1.6
	@next/swc-linux-x64-gnu@12.1.6
	@next/swc-linux-x64-musl@12.1.6
	@next/swc-win32-arm64-msvc@12.1.6
	@next/swc-win32-ia32-msvc@12.1.6
	@next/swc-win32-x64-msvc@12.1.6
	esbuild-netbsd-64@0.14.54
See 179 more rows in the dashboard

View full report

socket-security · 2025-10-06T09:06:39Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		`next@12.1.6` has a Critical CVE. CVE: GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware (CRITICAL) Affected versions: >= 13.0.0 < 13.5.9; >= 14.0.0 < 14.2.25; >= 15.0.0 < 15.2.3; >= 11.1.4 < 12.3.5 Patched version: 12.3.5 From: example/nextjs/package.json → `npm/next@12.1.6` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@12.1.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

sonarqubecloud · 2025-10-06T09:06:42Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 6, 2025

dependabot bot mentioned this pull request Oct 6, 2025

build(deps-dev): bump webpack from 5.87.0 to 5.101.3 #1201

Closed

pull-request-size bot added the size/XS label Oct 6, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps-dev): bump webpack from 5.87.0 to 5.102.0 #1213

build(deps-dev): bump webpack from 5.87.0 to 5.102.0 #1213

Uh oh!

dependabot bot commented on behalf of github Oct 6, 2025

Uh oh!

bolt-new-by-stackblitz bot commented Oct 6, 2025

Uh oh!

coderabbitai bot commented Oct 6, 2025

Review skipped

Free review on us!

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

sonarqubecloud bot commented Oct 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

build(deps-dev): bump webpack from 5.87.0 to 5.102.0 #1213

Are you sure you want to change the base?

build(deps-dev): bump webpack from 5.87.0 to 5.102.0 #1213

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 6, 2025

v5.102.0

Features

Fixes

Performance Improvements

v5.101.3

Fixes

v5.101.2

Fixes

v5.101.1

Fixes

Uh oh!

bolt-new-by-stackblitz bot commented Oct 6, 2025

Uh oh!

coderabbitai bot commented Oct 6, 2025

Review skipped

Free review on us!

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

sonarqubecloud bot commented Oct 6, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants