chore(deps): update dependency webpack to v5.104.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
webpack	5.102.1 → 5.104.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

webpack/webpack (webpack)

v5.104.1

Compare Source

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

Compare Source

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Compare Source

Features

• Added DotenvPlugin and top level dotenv option to enable this plugin
• Added WebpackManifestPlugin
• Added support the ignoreList option in devtool plugins
• Allow to use custom javascript parse function
• Added import.meta.env support for environment variables
• Added support for import.meta.dirname and import.meta.filename
• Added support import.defer() for statistical path
• Handle import.meta.main
• Added suport to setup named exports for JSON modules and disable usage named export for import file from "./file.json" with { type: "json" }
• Added support __dirname/__filename/import.meta.dirname/import.meta.filename for universal target
• [CSS] Added the exportType option with link (by default), "text" and css-style-sheet values
• [CSS] Added support for composes properties

Fixes

• The dependOn chunk must be loaded before the common chunk
• Return to namespace import when the external request includes a specific export
• No runtime extra runtime code for module libraries
• Delay HMR accept dependencies to preserve import attributes
• Properly handle external presets for universal target
• Fixed incorrect identifier of import binding for module externals
• Fixed when defer import and dynamic default export mixed
• Reduce generated output when globalThis supported
• Fixed loading async modules in defer import
• Reexport module for default import when no used exports for systemjs library
• Rename HarmonyExportDependencyParserPlugin exported id to CompatibilityPlugin tagged id
• Handle __dirname and __filename for ES modules
• Rename single nested __webpack_export__ and __webpack_require__ in already bundled code
• [Types] webpack function type
• [Types] NormalModule type
• [Types] Multi compiler configuration type
• [Types] Fixed regression in custom hashDigest type
• [CSS] No extra runtime for initial chunk
• [CSS] Fixed a lot of CSS modules bugs

---

Configuration

📅 Schedule: Branch creation - "before 8am on wednesday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for rspack ready!

Name	Link
🔨 Latest commit	365b98b
🔍 Latest deploy log	https://app.netlify.com/projects/rspack/deploys/696e8f74c44f5d00087591f3
😎 Deploy Preview	https://deploy-preview-12482--rspack.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

📦 Binary Size-limit

Comparing 365b98b to fix: sort css by sourceorder, esm import comes first (#12778) by Fy

🙈 Size remains the same at 47.99MB

[github-actions]

Rsdoctor Bundle Diff Analysis

Found 5 projects in monorepo, 5 projects with changes.

📊 Quick Summary

Project	Total Size	Change
react-10k	5.7 MB	-
react-1k	825.4 KB	-
react-5k	2.7 MB	-
rome	984.2 KB	-
ui-components	2.1 MB	-

📋 Detailed Reports (Click to expand)

📁 react-10k

Path: ../build-tools-performance/cases/react-10k/dist/rsdoctor-data.json

⚠️ No baseline data found - Unable to perform comparison analysis

Metric	Current	Baseline	Change
📊 Total Size	5.7 MB	-	-
📄 JavaScript	5.7 MB	-	-
🎨 CSS	21.0 B	-	-
🌐 HTML	0 B	-	-
📁 Other Assets	0 B	-	-

📁 react-1k

Path: ../build-tools-performance/cases/react-1k/dist/rsdoctor-data.json

⚠️ No baseline data found - Unable to perform comparison analysis

Metric	Current	Baseline	Change
📊 Total Size	825.4 KB	-	-
📄 JavaScript	825.4 KB	-	-
🎨 CSS	0 B	-	-
🌐 HTML	0 B	-	-
📁 Other Assets	0 B	-	-

📁 react-5k

Path: ../build-tools-performance/cases/react-5k/dist/rsdoctor-data.json

⚠️ No baseline data found - Unable to perform comparison analysis

Metric	Current	Baseline	Change
📊 Total Size	2.7 MB	-	-
📄 JavaScript	2.7 MB	-	-
🎨 CSS	21.0 B	-	-
🌐 HTML	0 B	-	-
📁 Other Assets	0 B	-	-

📁 rome

Path: ../build-tools-performance/cases/rome/dist/rsdoctor-data.json

⚠️ No baseline data found - Unable to perform comparison analysis

Metric	Current	Baseline	Change
📊 Total Size	984.2 KB	-	-
📄 JavaScript	984.2 KB	-	-
🎨 CSS	0 B	-	-
🌐 HTML	0 B	-	-
📁 Other Assets	0 B	-	-

📁 ui-components

Path: ../build-tools-performance/cases/ui-components/dist/rsdoctor-data.json

⚠️ No baseline data found - Unable to perform comparison analysis

Metric	Current	Baseline	Change
📊 Total Size	2.1 MB	-	-
📄 JavaScript	2.0 MB	-	-
🎨 CSS	83.0 KB	-	-
🌐 HTML	0 B	-	-
📁 Other Assets	0 B	-	-

Generated by Rsdoctor GitHub Action

[codspeed-hq]

CodSpeed Performance Report

Merging this PR will not alter performance

_{Comparing renovate/webpack-5.x (365b98b) with main (6991b7b)}

Summary

✅ 16 untouched benchmarks
⏩ 1 skipped benchmark¹

Footnotes

1. 1 benchmark was skipped, so the baseline result was used instead. If it was deleted from the codebase, click here and archive it to remove it from the performance reports. ↩