chore: Bump @lavamoat/webpack from 1.5.0 to 1.5.2 (#3706)

Bumps
[@lavamoat/webpack](https://github.com/LavaMoat/lavamoat/tree/HEAD/packages/webpack)
from 1.5.0 to 1.5.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/LavaMoat/lavamoat/releases"><code>@​lavamoat/webpack</code>'s
releases</a>.</em></p>
<blockquote>
<h2>webpack: v1.5.2</h2>
<h2><a
href="https://github.com/LavaMoat/LavaMoat/compare/webpack-v1.5.1...webpack-v1.5.2">1.5.2</a>
(2025-10-27)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>webpack:</strong> adapt scuttling config for runtime
regardless of where it comes from (<a
href="https://redirect.github.com/LavaMoat/LavaMoat/issues/1839">#1839</a>)
(<a
href="https://github.com/LavaMoat/LavaMoat/commit/b1ad321cb8b3e36a44fa661a7d2f5899f7a08fdc">b1ad321</a>)</li>
<li><strong>webpack:</strong> add j to the list of harmless fields on
<strong>webpack_require</strong> (<a
href="https://redirect.github.com/LavaMoat/LavaMoat/issues/1838">#1838</a>)
(<a
href="https://github.com/LavaMoat/LavaMoat/commit/7035a404627d038e9ff7b4d5fd2e7b7ed8928194">7035a40</a>)</li>
</ul>
<h2>webpack: v1.5.1</h2>
<h2><a
href="https://github.com/LavaMoat/LavaMoat/compare/webpack-v1.5.0...webpack-v1.5.1">1.5.1</a>
(2025-10-09)</h2>
<h3>Dependencies</h3>
<ul>
<li>The following workspace dependencies were updated
<ul>
<li>dependencies
<ul>
<li>lavamoat-core bumped from ^16.7.1 to ^17.0.0</li>
</ul>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/LavaMoat/LavaMoat/blob/main/packages/webpack/CHANGELOG.md"><code>@​lavamoat/webpack</code>'s
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/LavaMoat/LavaMoat/compare/webpack-v1.5.1...webpack-v1.5.2">1.5.2</a>
(2025-10-27)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>webpack:</strong> adapt scuttling config for runtime
regardless of where it comes from (<a
href="https://redirect.github.com/LavaMoat/LavaMoat/issues/1839">#1839</a>)
(<a
href="https://github.com/LavaMoat/LavaMoat/commit/b1ad321cb8b3e36a44fa661a7d2f5899f7a08fdc">b1ad321</a>)</li>
<li><strong>webpack:</strong> add j to the list of harmless fields on
<strong>webpack_require</strong> (<a
href="https://redirect.github.com/LavaMoat/LavaMoat/issues/1838">#1838</a>)
(<a
href="https://github.com/LavaMoat/LavaMoat/commit/7035a404627d038e9ff7b4d5fd2e7b7ed8928194">7035a40</a>)</li>
</ul>
<h2><a
href="https://github.com/LavaMoat/LavaMoat/compare/webpack-v1.5.0...webpack-v1.5.1">1.5.1</a>
(2025-10-09)</h2>
<h3>Dependencies</h3>
<ul>
<li>The following workspace dependencies were updated
<ul>
<li>dependencies
<ul>
<li>lavamoat-core bumped from ^16.7.1 to ^17.0.0</li>
</ul>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/LavaMoat/LavaMoat/commit/cf32a71880a1ae4d0c9ad5912a5f2d54112bd877"><code>cf32a71</code></a>
chore: release main (<a
href="https://github.com/LavaMoat/lavamoat/tree/HEAD/packages/webpack/issues/1842">#1842</a>)</li>
<li><a
href="https://github.com/LavaMoat/LavaMoat/commit/b1ad321cb8b3e36a44fa661a7d2f5899f7a08fdc"><code>b1ad321</code></a>
fix(webpack): adapt scuttling config for runtime regardless of where it
comes...</li>
<li><a
href="https://github.com/LavaMoat/LavaMoat/commit/7035a404627d038e9ff7b4d5fd2e7b7ed8928194"><code>7035a40</code></a>
fix(webpack): add j to the list of harmless fields on
<strong>webpack_require</strong> (<a
href="https://github.com/LavaMoat/lavamoat/tree/HEAD/packages/webpack/issues/1">#1</a>...</li>
<li><a
href="https://github.com/LavaMoat/LavaMoat/commit/b1de5886dd8afc45dfc3d6c871f501bf5aea7e76"><code>b1de588</code></a>
chore(deps): update dependency webpack to v5.102.1 (<a
href="https://github.com/LavaMoat/lavamoat/tree/HEAD/packages/webpack/issues/1436">#1436</a>)</li>
<li><a
href="https://github.com/LavaMoat/LavaMoat/commit/aad7145bb2e5bc772c1b445d60f37cf818ef63ff"><code>aad7145</code></a>
chore: release main (<a
href="https://github.com/LavaMoat/lavamoat/tree/HEAD/packages/webpack/issues/1836">#1836</a>)</li>
<li>See full diff in <a
href="https://github.com/LavaMoat/lavamoat/commits/webpack-v1.5.2/packages/webpack">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@lavamoat/webpack&package-manager=npm_and_yarn&previous-version=1.5.0&new-version=1.5.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Bumps `@lavamoat/webpack` to `1.5.2` and updates LavaMoat policy
references and lockfile (transitively bumping `lavamoat-core` to `^17`).
> 
> - **Dependencies**:
> - Upgrade `@lavamoat/webpack` devDependency from `^1.5.0` to `^1.5.2`.
> - Refresh `yarn.lock`, updating transitive `lavamoat-core` to
`^17.0.0`.
> - **Build/Policy** (`lavamoat/build-system/policy.json`):
> - Update package path references from `lavamoat>lavamoat-core` and
`lavamoat>lavamoat-tofu` to `@lavamoat/webpack>lavamoat-core` and
`@lavamoat/webpack>lavamoat-core>lavamoat-tofu`.
> - Adjust `@lavamoat/webpack` package map to reference
`@lavamoat/webpack>lavamoat-core` (remove `lavamoat>lavamoat-core`).
> - Remove `node:fs/promises.writeFile` from the `lavamoat-core`
resource; keep other builtins/globals unchanged.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
6882738. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MetaMask Bot <[email protected]>

Author: dependabot[bot]

packages/snaps-execution-environments/lavamoat/build-system/policy.json

@@ -133,7 +133,7 @@
         "depcheck>@babel/parser": true,
         "lavamoat>@lavamoat/aa": true,
         "@lavamoat/webpack>browser-resolve": true,
-        "lavamoat>lavamoat-core": true,
+        "@lavamoat/webpack>lavamoat-core": true,
         "webpack": true
       }
     },
@@ -738,11 +738,10 @@
         "lavamoat>lavamoat-core>merge-deep>kind-of>is-buffer": true
       }
     },
-    "lavamoat>lavamoat-core": {
+    "@lavamoat/webpack>lavamoat-core": {
       "builtin": {
         "node:events": true,
         "node:fs.readFileSync": true,
-        "node:fs/promises.writeFile": true,
         "node:path.extname": true,
         "node:path.join": true
       },
@@ -754,16 +753,16 @@
       },
       "packages": {
         "@lavamoat/webpack>json-stable-stringify": true,
-        "lavamoat>lavamoat-tofu": true,
+        "@lavamoat/webpack>lavamoat-core>lavamoat-tofu": true,
         "lavamoat>lavamoat-core>merge-deep": true
       }
     },
-    "lavamoat>lavamoat-tofu": {
+    "@lavamoat/webpack>lavamoat-core>lavamoat-tofu": {
       "globals": {
         "console.log": true
       },
       "packages": {
-        "lavamoat>lavamoat-tofu>@babel/parser": true,
+        "@lavamoat/webpack>lavamoat-core>lavamoat-tofu>@babel/parser": true,
         "depcheck>@babel/traverse": true
       }
     },

packages/snaps-execution-environments/package.json

@@ -82,7 +82,7 @@
     "@esbuild-plugins/node-modules-polyfill": "^0.2.2",
     "@lavamoat/allow-scripts": "^3.4.0",
     "@lavamoat/lavatube": "^1.0.0",
-    "@lavamoat/webpack": "^1.5.0",
+    "@lavamoat/webpack": "^1.5.2",
     "@metamask/auto-changelog": "^5.0.2",
     "@swc/core": "1.11.31",
     "@swc/jest": "^0.2.38",

yarn.lock

@@ -2770,20 +2770,20 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@lavamoat/webpack@npm:^1.5.0":
-  version: 1.5.0
-  resolution: "@lavamoat/webpack@npm:1.5.0"
+"@lavamoat/webpack@npm:^1.5.2":
+  version: 1.5.2
+  resolution: "@lavamoat/webpack@npm:1.5.2"
   dependencies:
     "@babel/parser": "npm:7.28.3"
     "@lavamoat/aa": "npm:^4.3.4"
     "@lavamoat/types": "npm:^0.1.0"
     browser-resolve: "npm:2.0.0"
     json-stable-stringify: "npm:1.3.0"
-    lavamoat-core: "npm:^16.7.1"
+    lavamoat-core: "npm:^17.0.0"
     ses: "npm:1.14.0"
   peerDependencies:
     webpack: ^5.80.2
-  checksum: 10/aaa44ce8aebd13f2d399e4240caf6dfb44bf01630cd66a7f82853f5b881e5421496c3648302e41639b9b0c0cdd1c0e750b318b6ff1fc0a61648a553c866af141
+  checksum: 10/65cff12c32b99dbe79840818c0b8695704b481d8ed71e13ae71bf7596ab08a26c065583e29b6c6e5a8c49f3de853836013497e2d2ce819a4392100e47c28dbb6
   languageName: node
   linkType: hard
 
@@ -4335,7 +4335,7 @@ __metadata:
     "@esbuild-plugins/node-modules-polyfill": "npm:^0.2.2"
     "@lavamoat/allow-scripts": "npm:^3.4.0"
     "@lavamoat/lavatube": "npm:^1.0.0"
-    "@lavamoat/webpack": "npm:^1.5.0"
+    "@lavamoat/webpack": "npm:^1.5.2"
     "@metamask/auto-changelog": "npm:^5.0.2"
     "@metamask/json-rpc-engine": "npm:^10.1.0"
     "@metamask/object-multiplex": "npm:^2.1.0"
@@ -13672,7 +13672,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lavamoat-core@npm:^16.5.0, lavamoat-core@npm:^16.7.1":
+"lavamoat-core@npm:^16.5.0":
   version: 16.7.1
   resolution: "lavamoat-core@npm:16.7.1"
   dependencies:
@@ -13688,6 +13688,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"lavamoat-core@npm:^17.0.0":
+  version: 17.0.0
+  resolution: "lavamoat-core@npm:17.0.0"
+  dependencies:
+    "@babel/types": "npm:7.27.3"
+    "@lavamoat/types": "npm:^0.1.0"
+    json-stable-stringify: "npm:1.3.0"
+    lavamoat-tofu: "npm:^8.0.11"
+    merge-deep: "npm:3.0.3"
+    ses: "npm:1.14.0"
+  bin:
+    lavamoat-sort-policy: src/policy-sort-cli.js
+  checksum: 10/6442eb31ed938e1c25805266f447755359e051716b70a62d46d44f1d3036ebc2ed54f62b0eece1ca2f02d4117ed88b5e60ca100905be2d134cef1bcfee015076
+  languageName: node
+  linkType: hard
+
 "lavamoat-tofu@npm:^8.0.11, lavamoat-tofu@npm:^8.0.8":
   version: 8.0.11
   resolution: "lavamoat-tofu@npm:8.0.11"