npm / webpack
webpack
What changed in webpack 5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
17 breaking5 security4 deprecations141 new APIs and options37 performance68 behavior and defaults12 tooling214 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initwebpack 5498 changes
Breaking changes 17
Minification now parses JavaScript with webpack's own parser rather than terser's and refuses early errors.
Writes to imported bindings now throw without preventing module concatenation.
A non-optional read past an undefined DefinePlugin member now throws.
Remove experiments.outputModule; set output.module to emit ESM instead.
Minification now handles embedded bodies and style attributes through their embedded paths, decodes script types, and bases attribute minification on decoded values.
Accept output.module to emit ESM in place of experiments.outputModule.
Throws when a deferred namespace of an async module is forced while the module evaluates.
Throws SyntaxError or WebAssembly.CompileError when a module cannot be parsed.
Reports an error when an object external has no entry for the externals type being used.
Supports parsers without location APIs by deriving locations from node offsets; AST nodes no longer carry loc.
[hash] now resolves to the local ident hash, matching css-loader; use [modulehash] for the module hash.
Rejects new import.defer(...) and new import.source(...) with member access as a SyntaxError.
Rejects new import.source(...) with member access as a SyntaxError.
new import.defer(...) and new import.source(...) now fail with a parse-time SyntaxError; parenthesized forms remain valid and throw TypeError at runtime.
Emits an error when a proxy server returns a non-200 status code instead of failing silently.
Accessing a non-existent import.meta.env property now returns an empty object instead of the full object at runtime.
Re-validates redirects against allowedUris, restricts them to http(s), and limits redirect count to prevent SSRF and untrusted content inclusion; rejected redirects are not cached or written to the lockfile.
Security 5
Injects a Content-Security-Policy meta tag with inline-content hashes and an optional nonce.
Rejects __proto__, constructor, and prototype path segments to prevent prototype pollution.
Fixed a user information bypass vulnerability in the plugin.
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Deprecations 4
Harmony* names are renamed to ESM* names and the old spellings are deprecated.
Deprecated in favor of importMeta.webpackContext.
ModuleNotFoundError is re-exported from webpack/lib/ModuleNotFoundError for compatibility with older plugins; the re-export will be removed in webpack 6.
All deprecated methods and options are now marked with @deprecated in types.
New APIs and options 141
Adds customMedia and customSelectors minimization options and resolves chained names.
Adds a JavaScript SyntaxTree read like the CSS one, along with toEstreeObject.
Set to "all" to expose the exports of every entry module.
Adds an HTML parser chunk-name option and a
webpackChunkNamecomment for tags.Adds a parser option for classic-script
thissemantics.Adds a CSS charset option; false drops
@charsetfor UTF-8 CSS.Adds a CSS minimization option for converting approximate colors.
Drops a declaration that a later one overrides when no target is named.
Adds JSON minimization, enabled by default with futureDefaults.
Adds an option to discover chunk intersections.
Adds an ignore hook and keeps unfollowed
fromsymlinks.Shared modules now accept include and exclude version and request filters.
Adds SSRManifestPlugin and fixes server-rendered CSS collection and adoption.
Exposed under its scope and now accepts several requests, with the current one first.
Adds XML parsing and SVG/XML minification with data URLs and attribute sorting.
Export cssMinify on css.syntax.
Export htmlMinify on html.syntax.
Add lowerUnsupported while dropping information already stated or readable only by a gone engine.
Add mergeScripts, along with boolean and token switches.
Add an option for spec namespace objects.
Add normalizeUrlAttributes, mergeScripts, and boolean and token switches.
Add an option to join CSS rules across a gap.
Add output.copy to copy files and directories into the output directory.
Add output.environment.topLevelAwait and await every async ESM entry.
Export webpack's renderEmbeddedSource for minifying inline CSS and JSON through the embedded-source path.
Keeps optimization.minimize boolean; its options move to optimization.minimizeOptions.
Add a placeholder used for the file name of asset and HTML modules with futureDefaults.
Add a placeholder used for the path of asset and HTML modules with futureDefaults.
Support printing CSS and HTML in beautified as well as minified form.
Accept an object for an entry's html option to override output.html per option.
Mark externals as side-effect-free with a
sideEffectsflag.Externalize installed packages with the nodeModules preset and its allowlist option, replacing the webpack-node-externals plugin.
Add a module rule condition based on the description file's relative path.
Add an aggregated shutdown hook to MultiCompiler.
Configure HTML minification options, including whitespace, comments, empty attributes and elements, implied tags, and attribute sorting.
Configure or exclude the minifier for each asset type.
Configure an AMD-style loader branch in UMD output.
Skip prefetch links for chunks that are already preloaded or prefetched.
Enable performance hints for checks not set individually, including duplicate packages, circular dependencies, large modules, and unused configuration.
Set to
"stats"to report performance hints in stats only.Add renderEmbeddedSource and minify its output out of the box.
Read CSS collected while rendering without a DOM; collected CSS remains in the order styles were applied.
Adds an externals type that loads AMD externals without an AMD library wrapper.
Adds ?raw, ?url, ?inline, and ?no-inline asset query suffixes under experiments.futureDefaults.
Supports zstd compression for the filesystem cache.
Controls case sensitivity for import.meta.glob matching.
Exposes the original DOM event as error.event.
Adds a CSS option for font preloading.
Adds fine-grained parser options for import.meta.
Adds MODE, DEV, PROD, SSR, and BASE_URL defaults.
Adds glob imports with a caseSensitive option and consistent hidden-file and node_modules matching.
Can resolve an asset specifier to its emitted asset URL through the importMeta.resolve parser option.
Provides the replacement parser option for importMetaContext.
Enables built-in build progress through infrastructure logging.
Compilation hook for injecting script, link, meta, and other tags with injectTo placement.
Adds a JavaScript option for CSS preloading from dynamic imports.
Adds parser configuration for URL resource hints.
Selects whether HTML is parsed as a document or an element fragment.
Bundles Worklet addModule() entries.
Exposes the active MultiWatching instance.
Adds an interop hint of "default" or "esModule" to control default-export interop.
CommonJS modules with statically analyzable exports can be concatenated; set commonjs: false to opt out.
Configures the base element during HTML head generation.
Supports arrays and per-icon link attributes: sizes, media, color, type, and crossorigin.
Controls where chunk tags are injected into HTML.
Controls inlining chunk content into HTML with true, "script", or "style".
Generates and links a web app manifest with hashed icons.
Configures meta tags during HTML head generation.
Configures the HTML document title during head generation.
Emits preload, prefetch, modulepreload, and preconnect resource hints; it is on by default for ESM output.
Adds a WebAssembly fallback for responses with an incorrect MIME type.
Adds estimated-time reporting to the progress bar.
Adds phase timings to progress reporting.
Adds progressBar: "auto".
Adds a configurable progress bar width.
Exposes the original DOM event as error.event.
Setting type: false disables a built-in HTML parser source.
Configures warnings for strict-mode-only syntax and semantic hazards in ES module output.
Compilation hook for mutating, removing, or moving existing script, link, style, and meta tags.
Exports the HTML modules plugin with transformHtml and htmlEmitted compilation hooks.
Magic comment for inlining chunk content into HTML.
Adds dedicated module classes for all built-in module types.
Adds a target that emits ESM and externalizes bun:* and Node.js built-in modules.
Adds a universal boolean for universal targets, including universal and web-plus-node targets.
Supports CSS in Node for universal targets and collects styles for SSR.
Adds an HTML source type that extracts url() references from CSS-valued attributes.
Adds a helper for typed configuration files.
Adds Deno targets that emit ESM, resolve Node.js built-ins with node:, and leave Deno import protocols external.
Adds worker entry configuration for worker chunk filenames.
Supports inline digests in hash path placeholders, such as [contenthash:base64:8].
Adds the CSS parser as option and resolves url() inside HTML style attributes.
Disables or customizes URL-attribute extraction for HTML modules, including source types for custom attributes.
Transforms HTML module source before parsing.
Marks top-level names as side-effect-free for tree shaking.
Adds support for inlineExports to improve tree-shaking.
Adds an environment capability that enables Object.hasOwn in generated runtime code where supported.
Adds an environment capability option and emits let or const instead of var in generated runtime code where safe.
Enables emitting ||= in runtime code when the target supports logical assignment operators.
Adds an environment capability that enables spread syntax in generated runtime code where supported.
Adds an environment capability for using an unguarded Symbol in generated runtime code where supported.
Emits an HTML file per entrypoint and injects its JS and CSS chunks, including dependOn shared chunks.
Gates the runtime MODULE_NOT_FOUND guard.
Adds a worker-specific chunk filename option.
Supports [uniqueName] and its [uniquename] alias in template paths.
Adds a target preset for browser, web worker, Node.js, Electron, and NW.js that always outputs ECMAScript modules.
The HTML generator option type is now HtmlGeneratorOptions, making the extract option available in createGenerator and generator hook types.
The experimental HTML tokenizer exposes parse errors through a callback, distinguishing recoverable warnings from errors caused by incomplete offset ranges.
Reserves the html module type for first-class HTML entry-point support.
Enables experimental TypeScript transformation using Node.js module.stripTypeScriptTypes; supports erasable TypeScript in .ts, .cts, .mts, and TypeScript data URLs, but not TSX or non-erasable syntax.
The function form for CSS modules accepts string[] as well as string.
Adds a CssLoadingRuntimeModule compilation hook so plugins can control where stylesheet <link> elements are inserted.
Enables emitting parsed, URL-rewritten HTML as a standalone .html file alongside the module's JavaScript export.
Controls whether webpack sets .name to "default" for anonymous default export functions and classes; defaults to true for applications and false for libraries with output.library.
The pure parser option for css/module and css/auto requires every selector to contain a local class or id, otherwise webpack emits a build error.
Supports the annotation to mark functions as pure for better tree-shaking.
Adds the orderModules hook to CssModulesPlugin compilation hooks.
CSS modules support exportType: "style" to inject styles into the DOM via HTMLStyleElement, similar to style-loader.
Adds an option to configure the hash function used for hashing.
Adds an option to enable or disable validation in webpack plugins and loaders, with an API for using it inside plugins.
Adds a context option for virtual modules, allowing a custom context path to resolve relative imports; it defaults to auto-derived context.
Adds a method to distinguish basic source types and clarify how modules with non-basic source types like remote still produce JavaScript output.
ECMA modules now support
createRequire.Context modules now support import.defer().
Adds a resolver option that can be disabled, use the default tsconfig.json, specify a tsconfig path, or accept configFile and references options.
Adds options to control the renaming of at-rules and various identifiers in CSS modules.
Adds the base64url, base62, base58, base52, base49, base36, base32, and base25 digests.
Adds support for universal lazy compilation.
Provides a stable runtime function variable.
Adds support for composes properties in CSS.
Allows using a custom JavaScript parse function.
Adds a top-level option to enable DotenvPlugin.
Adds DotenvPlugin for enabling dotenv support.
Adds the CSS exportType option with link, text, and css-style-sheet values; link is the default.
Adds support for the ignoreList option in devtool plugins.
Adds support for import.defer() for a static path.
Adds support for import.meta.dirname.
Adds support for accessing environment variables through import.meta.env.
Adds support for import.meta.filename.
Adds handling for import.meta.main.
Adds support for named exports and for disabling named exports when importing JSON with a type attribute.
Adds WebpackManifestPlugin.
Performance 37
Uses module paths so parallel minification can load built-in minimizers directly in workers instead of serializing function sources.
Speeds up comment lookup, tokenization, and grammar parsing.
Module concatenation is skipped when providedExports is disabled.
Performs in one pass minification previously completed by a second pass.
Drops dead CSS left by a cut and joins more blocks that print alike.
Completes joins, drops, and collapses in one pass instead of requiring a second.
Speeds parsing by stepping over dropped selector preludes in bytes.
Stops emitting the CSS chunk loading runtime when every CSS chunk is initial.
Minifies more HTML and CSS shorthands.
Cuts two costs off printing.
Speeds up cache writes.
Speed up builds and reduce memory use through faster parsing, minification, dependency processing, and shared watching for MultiCompiler children.
Speeds up CSS parsing and reduces memory use across experimental and non-modules parsing paths.
Improves parser speed and reduces peak memory use.
Speeds up stats generation and reduces its peak memory use.
Enables the Node.js compile cache in the webpack CLI entry point.
HTML parsing uses less CPU and memory by skipping unused AST nodes.
Parsing is faster by avoiding unused selector AST nodes and value tokens.
CSS parsing is faster and uses less memory for CSS AST nodes.
Inlines export default values when the exported value is a primitive constant.
Defers building unused re-export targets of side-effect-free barrel modules.
The hook is invoked once per directory with all matched files in one batch, reducing per-file overhead in context resolution.
Per-child code-generation results are released in MultiCompiler and when the compiler closes, reducing memory retention.
Watch-mode rebuilds avoid purging the stat cache for every file under an explicitly watched context directory.
Multi-module chunks no longer include unnecessary
__webpack_require__runtime helpers.The side-effects connection-state walk uses an allocation-light iterative loop, restoring rebuild performance while keeping deep import chains stack-safe.
Watch-mode rebuilds reuse warm stat caches for watched context directories instead of discarding stats for every file under the directory.
Peak memory usage is reduced on large builds.
Drops unused __webpack_require__, __webpack_require__.d, and __webpack_require__.o helpers from module library bundles when their on-demand exports source is dropped.
CSS bundles omit the runtime when all imported CSS modules are concatenated into the same scope.
Guard collection is skipped when exports-presence mode is disabled, improving parsing performance.
JavaScript modules are no longer generated for unused CSS exports, reducing unnecessary output and bundle size.
Destructuring assignments reuse cached stringified environment definitions.
Improves the speed of identifier parsing.
Avoids extra runtime for the initial CSS chunk.
Reduces generated output when globalThis is supported.
Avoids generating extra runtime code for module libraries.
Behavior and default changes 68
JavaScript is minified with webpack's printer under futureDefaults and with terser otherwise.
More path, module, and file filter options now accept glob patterns.
A run of inline script tags can be bundled into one chunk that the page can inline.
Source maps now emit the scopes field so debuggers can resolve imported ESM bindings by name.
Drops fallback declarations when every target in browserslist reads past them.
Bases HTML value minification on what a value means rather than its spelling.
Folds more enumerated attribute values and drops values that name no keyword.
Lower CSS nesting, :dir(), and custom at-rules; case folding and escapes are gated.
Absolute-path inputs accept file URLs in any spelling that Node reads.
Filesystem cache build dependencies may be optional.
With futureDefaults enabled, output.module is enabled by default on ESM-capable targets and for module and modern-module library types.
processResult is async, and a tap can rename the asset it rewrote.
Tree shake CommonJS object literal exports, destructured require bindings, unused method requires, and unused side-effect-free require calls and reexports.
Wrap concatenated modules in lazy accessors and inline require calls while preserving wrapped-body names and side effects.
Warn on cross-kind CSS module export conflicts and let the class win.
Patch the HTML head in place on hot update instead of forcing a full reload, including when removing a script that never executed.
Minify HTML while preserving the parsed document, including attribute grammars and tree structure.
Do not emit development source maps for module libraries or when futureDefaults is enabled.
Module rules support OS-independent glob matching.
Report which compilers changed on the MultiCompiler done hook.
When enabled, safely minify CSS and HTML assets with source maps unless a minimizer is already configured for them; each rewrite can be disabled by its named option.
CSS sources in source maps are named by their resource path, without the
cssprefix.The filesystem cache removes unreferenced files after storing, ages files by recorded time so restored caches are cleaned too, and collects all fully expired packs in one store.
Compiles async modules to generators for targets without async/await.
“Weird” CommonJS modules are wrapped into module concatenation instead of causing concatenation to bail out.
Emits analyzable new URL, worker/worklet URL, and import() references with literal specifiers.
Defaults to "auto", enabling built-in WebAssembly support unless a loader is registered for those files.
Defaults to "auto", enabling built-in CSS support unless a loader is registered for those files.
Defaults to "auto", enabling built-in HTML support unless a loader is registered for those files.
Defaults to "auto", enabling built-in TypeScript support on Node.js >= 22.6 when no TypeScript loader is registered.
Recognizes twitter:player:stream metadata, legacy SVG references, and Web App Manifest icons, screenshots, and shortcuts URLs as asset-bearing sources.
HTML link sources are bundled as their own emitted page, while rel="preload" and rel="prefetch" links are bundled as chunks.
The default is now
globalThisfor universal targets.Supports CommonJS reexports using Object.defineProperty value and getter descriptors.
Supports inline hash digests and lengths in CSS module localIdentName placeholders.
Import specifiers and require() or import() calls in dead branches gated by inlined imported constants are skipped.
Under the html/css experiments, the default ./src entry supports .html and .css.
Uses module-import for electron externals when the target supports ESM.
Extracts more source URLs from SVG and legacy or obsolete attributes.
Schema-generated CLI flags now support JSON Schema const.
Keeps export mangling enabled when a namespace object is used as a whole value by materializing a decoupled object with original export names.
Universal node-plus-web targets resolve the Worker constructor from worker_threads when no global Worker exists.
Allows tree-shaking unused calls to NO_SIDE_EFFECTS-annotated exports across module boundaries.
Top-level await and import.meta are treated as ES module markers, matching Node.js syntax detection so no explicit module type is needed.
Static member reads from a const binding created with require(LITERAL) are tracked as referenced exports, allowing unused CommonJS exports to be removed when usedExports is enabled.
With experiments.html and experiments.css, CSS chunks reachable from a script entry are emitted as stylesheet links in import order, with nonce, crossorigin, and referrerpolicy copied from the originating tag.
Resolver defaults now include module-sync to align with Node.js's synchronously-loadable ESM condition.
Module concatenation is supported for CSS modules with text, css-style-sheet, style, and link export types.
@value identifiers can be used as @import URLs and inside url() functions.
Inline CSS source maps are embedded for text, style, and css-style-sheet export types; imported CSS is merged for text and css-style-sheet, and generated class exports map back to original selectors.
The experimental TypeScript support requires Node.js >= 22.6 with the stable mode: "strip" API.
Conflicting order warnings for CSS now include fragment groups.
Destructuring assignment with require in CommonJS is supported, allowing tree shaking.
The localIdentName option now accepts a function.
External modules can now be placed in async chunks when outputting ECMA modules.
Async WASM modules now support source.
Asset modules are marked side-effect-free only when this option is enabled, preventing asset-copying imports from breaking otherwise.
Asset modules are now considered side-effect free.
The devtool option now supports array values.
Unknown import.meta properties are determined at runtime rather than statically analyzed at compile time.
Generated source maps include the ignoreList property only when it has content, avoiding empty arrays.
Worker modules can now be resolved by export condition name when using new Worker().
Adds the ability to use built-in properties in dotenv and DefinePlugin.
Uses the fully qualified class name or export name for the placeholder in CSS modules.
Supports object access.
Adds a module existence check to provide a more informative error message in development mode.
Adds support for __dirname with the universal target.
Adds support for __filename with the universal target.
Tooling 12
Can profile hook map taps, including resolver and parser hooks.
Report inner-graph, AMD, and bare module bailouts.
Improves module parse errors with a babel-style code frame and the module type.
Shows why a module was marked as not cacheable.
Adds HMR support with body and title DOM patching on update.
Schema-generated CLI flags now support JSON Schema if/then/else.
NormalModuleCreateData is generic over module type, narrowing parser, parserOptions, generator, and generatorOptions to the types for that module.
NormalModuleFactory parser and generator methods are generic over module type and return specific parser or generator classes for known types.
Callback types are narrowed by context: chunk filename callbacks require pathData.chunk, and module filename callbacks require pathData.module.
Experimental options are now marked as such in the types.
The schema's deprecate flag improves TypeScript support by identifying options already deprecated by the configuration.
Resolution supports new features for tsconfig.json.
Fixes and other changes 214
Loader output for
.wasmis parsed as JavaScript when async wasm is auto-enabled.Scopes and exports a CSS Modules @value consistently whether it is local or imported.
Supports deferred imports introduced by hot updates.
An async runtimeValue is now resolved over an async beforeParse hook.
Awaits every async entry before resolving an ESM library import.
Minified CSS and HTML are stable on a second pass, including for truncated input.
Keeps the last HMR update when output.clean is used and stops rechecking removed files.
Plugins set on a multi-configuration array are now applied to the MultiCompiler.
Reads errors through the processErrors hook via getErrors, matching hasWarnings, so filtered errors do not contradict the result.
Watch mode rebuilds when a file is deleted while a build is running.
Preserves regular expression flags when rebuilding context request matchers.
Preserves the spread of shadows and canonicalizes merged selector lists.
Gathers a CSS layer across a rule that writes only a different layer.
Omits implied tags and merges adjacent runs on the first pass.
Preserves the
initialkeyword where an engine treats it distinctly.Joins adjacent CSS rules after cuts and preserves values that escapes previously consumed.
Joins rules made adjacent by a top-level
@layergather.Preserves the page's closing html tag spelling regardless of how the element was opened.
Looks up attributes using decoded values rather than their source spelling.
Tree construction now follows HTML template form and frameset rules.
Preserves an attribute's delimiter and value spelling when quoting is frozen.
Rewrites attribute values whose source uses character references.
Unquotes HTML attribute values containing a vertical tab.
Orders attributes by their output and reads values after decoding.
Fixes module library exports lost under cache or missing behind a re-export.
Each switch now governs only its own CSS rewrite.
A fulfilled async cycle member is rejected with the cycle's evaluation error.
Settle a CSS chunk load when there is no DOM and its stylesheet cannot be read.
Preserve colors when rounding would change read-back channels, and lower CSS color functions and related syntax more accurately.
Lower CSS spellings a target cannot read and write a color fallback before an unsupported color spelling.
Await an evaluating-async dependency of a deferred import.
Fix generated ESM external reexports to escape requests, use configured requests, preserve live bindings and import attributes, and avoid stack overflows in star-reexport cycles.
Fix import.meta and require.main, and scope-hoist import.meta.main.
Honor resolve.fileSystem; the notes also identify where module.exprContextCritical moved.
Fixes circular reexport severity.
Fixes using new on a default import of a wrapped CommonJS module.
Evaluates a deferred import's async dependencies where the import occurs.
Omits ambiguous export * names from the module namespace.
Fixes handling of import() options.
Fixes namespace writes.
Skips ESM interop when require() targets a module outside the concatenation.
Fixes concatenated require() in a require.ensure callback or with a computed request.
Fixes reads of mangled exports through require() and a leaked internal reference.
Avoids reporting a missing export for a name deferred by a side-effect-free barrel.
Fixes analyzable ESM baking around cycles, mixed-served wasm and style url maps.
Strips a BOM added by a loader to a string and shifts a source map that counted it.
Fixes ESM circular reexports and cyclic const TDZ, and defers evaluation order.
Reports a named import that is never read when it names a missing export.
Stops output.html from emitting an unused JS chunk for each generated page.
Accepts the optimization.minimize: true shorthand when a plugin sets it in apply().
Fixes handling of a RegExp without capture groups in snapshot.managedPaths.
Resolve absolute symlink targets and treat an unreadable context as missing.
Avoid emitting a dead module and a failing require for an asset-url external.
Treat top-level this as the global scope in a classic worker entry.
Emit a CommonJS entry's default as export default in module library output.
Release compilation and file system caches retained after compiler.close().
Fix optional chains that read an undefined object member.
Derive import defer behavior from the target.
Derive import source behavior from the target and fix the source phase.
An etag mismatch in the memory cache falls through to the file cache instead of reporting a miss.
Fix tree shaking for a namespace reexported as default and prevent reading undefined from its member.
Fix common outputPath calculation, reruns after dependency validation failures, and watch-mode recovery after fatal child errors.
Keep the runtime out of strict mode when output.globalObject reads this.
Respect strictThisContextOnImports for require member calls.
Fix top-level using and await using declarations in modules.
Support UNC paths in module and context replacement plugins.
Skips
require().propin dead branches gated by inlined imported constants.Aliases pointing at package directories whose names end with .js are resolved again.
The loader context target is reported as
universalfor the universal target.Tracks dependencies by parsing sources when require.cache children are unavailable, such as on Bun.
Names the failing key when evaluation of a
typeofvalue fails, making the error easier to diagnose.Fixes a stray semicolon emitted before an imported call following a parenthesized sequence element.
Ignores ERR_SERVER_NOT_RUNNING during backend disposal so compiler.close() succeeds on Bun.
Returns a real ArrayBuffer so WebAssembly.instantiate accepts the loader result.
Makes re-export analysis independent of module processing order.
Guards setNoDelay and force-closes connections during lazy-compilation backend disposal to improve Deno compatibility.
Fixes inlined non-binary assets with encoding: false emitting "undefined" instead of their content.
Changes an HTML page's content hash when its inlined chunk content changes.
Escapes ? and # so source map names are not truncated.
Prevents unused CSS module exports from leaking into the JavaScript wrapper.
CSS modules scope view-transition names and pseudo references under customIdents.
Decodes non-base64 data URIs as UTF-8 to preserve multi-byte characters.
Skips anonymous default export name fix-up when name is non-configurable, avoiding an exception on pre-ES2015 engines.
Fixes deferred import error rethrows, evaluation guards, namespace identity, and lazy evaluation of initial-chunk context imports.
Merges object-form and dotted definitions so import.meta.env and process.env are consistent for direct, whole-object, and destructured access.
Resolves directory requests to their index module in scoped DllReferencePlugin.
Evaluates and validates the second argument to dynamic import(specifier, options).
Preserves live bindings for a module library's entry exports, including when the runtime is emitted as a separate chunk.
Renders sizes of 1 TiB or larger instead of displaying "undefined".
Prevents a dangling stylesheet link for a JavaScript-only chunk in an HTML entry.
Fixes escaping, head detection, duplicate meta tags, resource-hint and entry-tag retention with inject: false, and stylesheet placement.
Ignores a base element inside an inert template when resolving HTML URLs.
Prevents reuse of an already-used numbered suffix that could produce duplicate module or chunk ids.
Native CSS resolves @custom-media, including media-type values, and @custom-selector.
Fixes broken HMR with output.module and non-import chunk loading by emitting a plain-JSON hot-update manifest.
Recognizes modern RegExp flags d, s, u, and v when statically evaluating new RegExp(...).
Keeps required JSON data intact when prototype methods such as arr.includes() are called on it.
Fixes undersized modules being merged into the wrong result group.
Prevents a malformed HTML magic comment from leaking a pending inline directive onto the next element.
HTML asset URLs are resolved against the document's <base href>.
Directory references in
new URL(...)are passed through instead of being resolved.The cache is keyed on a lazy barrel's still-lazy re-export targets.
Fixes an HMR code generation crash when harmony accept has unresolved imports.
Matches dependencies by module reference so HMR code generation handles imports without a module or chunk id.
Fixes deferral of ungrouped side-effect imports in lazy barrels.
Respects the node: prefix for Node.js core modules used as externals.
Fixes invalid property access for escaped namespace imports with multi-character mangled export names.
Adds frames to the ProfilingPlugin event so its trace loads in Chrome DevTools.
Keeps all CommonJS exports when an exported function accesses them through this.
Keeps the full exports object when a require() binding is re-exported.
No longer drops exports accessed before a deferred require binding.
Access to an undefined object member now resolves as undefined.
Recognizes forward-slash Windows absolute paths such as C:/dir consistently.
Resolves and rewrites asset URLs inside iframe srcdoc in HTML modules.
Re-encodes inline hash digests from the full content hash for full entropy, realContentHash compatibility, and dynamically loaded chunk filenames; preserves leading zero bytes in base-N digests.
Fixes module-sharing hostname validation.
On the node target, resolves a global Worker constructor to worker_threads.
Allows the filesystem root as output.path by treating EISDIR like EEXIST in mkdirp.
Improves commonjs, node-commonjs, and global externals for universal targets.
Chunk-hash placeholders in chunk URLs embedded in extracted HTML are now resolved.
HTML content hashes now account for changes to referenced assets and inline-style URLs.
Missing entry options are filled in when an async block joins an existing entrypoint.
Fixes a first-activation
ReferenceErrorfor lazy-compiled modules in closure-wrappedumd,umd2,amd,amd-require, andsystemlibrary bundles with statically enumerable externals.External runtime conditions are included in concatenated-module hash updates, so changes invalidate persistent caches.
CreateData now represents the fully populated value passed to module creation hooks, while ResolveData.createData is Partial<CreateData>.
Decodes all WHATWG named character references, including legacy bare forms and multi-code-point entities, with longest-prefix backtracking.
Imported bindings inside inline AMD define callbacks in ES modules are rewritten to imported references, avoiding runtime ReferenceError; inner graph usage analysis is also fixed for a related function pattern.
Hash placeholders with length suffixes, such as [fullhash:N] and [hash:N], are now interpolated at runtime instead of remaining as XXXX.
Traversal is iterative, preventing stack overflows on long linear chains of side-effect-free imports.
Multiple SourceMapDevToolPlugin instances can coexist with devtool on the same asset; additional related.sourceMap entries are appended instead of overwritten.
WebAssembly async and sync generator hooks now use EmptyGeneratorOptions instead of EmptyParserOptions.
Prefetch orders are resolved per import() call site instead of leaking across imports that share a webpackChunkName.
Preload orders are resolved per import() call site instead of leaking across imports that share a webpackChunkName.
Supports no-expression template literals in computed member access, such as import.meta[
url].Recomputes CSS chunk content hashes and rendered bytes when an asset referenced from CSS changes its hashed filename.
Preserves the @charset at-rule when CSS modules use exportType: "text".
Fixes HMR for concatenated CSS modules with style exportType using stable per-module style element identifiers and inner module IDs in HMR records.
Fixes self-composition duplicate module instances, per-class local() and global() tracking, and composed-file ordering.
A .module.<ext> file imported directly and via icss composes or :import becomes a single module instance.
Fixes @value resolution when the same local name is imported from multiple modules.
Cyclic star re-exports now detect per-name cycles and fall through to a non-cyclic source instead of producing a recursive getter chain.
External dependencies in ESM output preserve defer and source import phase keywords, as import attributes do.
Fixes typeof and instanceof for deferred default-only and default-with-named external modules under optimization.concatenateModules.
Assignment to a deferred namespace no longer evaluates the module; deferred namespaces are distinct from eager namespaces and shared across defer-import call sites for the same module.
A side-effect-free SequenceExpression argument with a static specifier is resolved like a direct static import() specifier.
Tree-shaking purity analysis handles more expression types and PURE comments in template interpolations, while preventing comments from leaking across object properties.
Resolves [hash] and [fullhash] placeholders when generating url() references for experiments.css.
Escapes # in a request's directory portion when it also contains a query string, allowing projects in such paths to resolve correctly.
Attaches a no-op rejection handler to best-effort prefetch so chunk loading failures do not cause unhandled rejections.
When an ES module exports the literal name "module.exports", CommonJS require() returns that export's value instead of the namespace object, matching Node.js behavior.
Preserves using declaration initializers when inner graph optimization is enabled.
Fixes spec deviations in the deferred namespace object returned by this runtime helper.
Asset modules are available in JS context when referenced from both CSS and a lazily compiled JS chunk.
CSS modules now handle
@charsetat-rules.CSS @import inherits the parent module's exportType, so a file configured as text correctly creates a style tag when imported by a style parent.
The
entriesandentrypointsoptions no longer have user-provided falsy values overridden by||default handling.Missing generator options are included in the hash, ensuring persistent cache invalidation when configuration changes.
The
modulesoption no longer has its user-provided falsy value overridden by||default handling.Generated fix-up code now references the real assignment target and uses Object.defineProperty and Object.getOwnPropertyDescriptor, avoiding ReferenceError and supporting pre-ES2015 runtimes.
Local ident hashing now uses compiler context instead of module context, avoiding hash collisions for same-named files in different directories.
CSS modules no longer rename !important as a local identifier.
Entry chunks are hashed after runtime chunks to prevent stale content-hash references in watch mode.
Corrects url() path resolution and preserves source maps for non-link CSS export types, including style, text, and css-style-sheet.
Fixes resolving in CSS modules.
Anonymous default-exported functions and classes now receive the name "default", per the ES specification.
As a standalone expression, import.meta now returns a complete object with known properties and stable identity; preserve-unknown ESM output merges runtime properties.
When outputting an ECMA module library, webpack no longer renders an unused top-level __webpack_exports__ declaration.
Absolute-path virtual module IDs now use their context directly instead of concatenating it with compiler.context.
Handles createRequire when it appears in expressions.
Narrows detection to explicit existence checks on namespace imports, such as "x" in ns.
Fixes the types for multi stats.
Removes empty, needless JavaScript output for normal CSS modules.
The
bytesimport attribute now produces immutable bytes to match the TC39 specification.Context modules now handle rejections correctly.
Empty JavaScript files are no longer generated for CSS-only entry points.
CSS modules with
@importnow work during HMR whenexportTypeis notlink, without special HMR handling.Missing-module errors are thrown after the interception handler, allowing interception to customize the module factory.
Webpack no longer crashes when a referenced chunk is not a runtime chunk.
The missing declaration is added in certain bundles that combine a JavaScript entry with non-JavaScript entries.
Fixed a type regression affecting WebpackPluginInstance.
Part of createRequire generation behavior for require calls with node: specifiers was reverted to preserve compatibility with those modules' exports.
Cache keys and filenames are sanitized for Windows filesystem compatibility, replacing colons with double underscores and sanitizing other invalid characters.
Conditional imports are detected to avoid compile-time linking errors for non-existent exports.
Rendering of Node.js built-in modules is improved for ECMA module output.
Star exports for dependencies are preserved in ECMA module output.
Fixes ESM default export handling for .mjs files in Module Federation.
Fixes missing export generation when concatenated modules in different chunks share the same runtime.
Declaring a module variable in module scope no longer conflicts with the default moduleArgument.
Fixes an unused export name when a self-referencing dependency is imported inside a web worker.
Stats output now respects the stats.errorStack option.
Sets resourceData.context so subsequent module resolution uses a valid filesystem path instead of the virtual scheme path.
Supports multiple URL patterns for Worker self-imports and deduplicates Workers that resolve to the same module.
Reuses the same async entrypoint for the same Worker URL within a module to avoid circular dependency warnings.
Avoids accessing the WEBPACK_IMPORT_KEY declaration with var during reexports runtime calculation.
Fixes bugs for the
css/globaltype.Removes CSS link tags when CSS imports are removed.
Handles more at-rules for CSS modules.
Fixes parsing of CSS nesting and CSS custom properties.
Prevents
debugIdinjection from being corrupted when usinghidden-source-map.Adds serialization support for
HookWebpackError.Makes
import.meta.filenameandimport.meta.dirnamecompatible withevaldevtools.Improves hashing and reduces collisions for CSS local identifiers.
Doesn't write the URL fragment to the filename and instead applies it to the module URL.
Renames single nested __webpack_export__ and __webpack_require__ identifiers in already bundled code.
Fixes cases where defer imports and dynamic default exports are mixed.
Fixes loading of async modules in defer imports.
Chunks declared with dependOn are loaded before the common chunk.
Handles __dirname for ES modules.
Returns to a namespace import when an external request includes a specific export.
Handles __filename for ES modules.
Delays HMR accept dependencies to preserve import attributes.
Fixes the identifier used for import bindings of module externals.
Reexports a module for default imports when no exports are used.
Properly handles external presets for the universal target.