@depup/webpack 5.110.1-depup.0 → 5.110.3-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/webpack
 
 | Field | Value |
 |-------|-------|
-| Original | [webpack](https://www.npmjs.com/package/webpack) @ 5.110.1 |
-| Processed | 2026-08-30 |
+| Original | [webpack](https://www.npmjs.com/package/webpack) @ 5.110.3 |
+| Processed | 2026-09-06 |
 | Smoke test | passed |
 | Deps updated | 9 |
 
@@ -24,12 +24,12 @@ npm install @depup/webpack
 |------------|------|-----|
 | @types/estree | ^1.0.8 | ^1.0.9 |
 | acorn | ^8.16.0 | ^8.18.0 |
-| browserslist | ^4.28.1 | ^4.28.8 |
+| browserslist | ^4.28.1 | ^4.28.9 |
 | chrome-trace-event | ^1.0.2 | ^1.0.4 |
 | enhanced-resolve | ^5.24.4 | ^5.24.5 |
 | es-module-lexer | ^2.1.0 | ^2.3.2 |
 | events | ^3.2.0 | ^3.3.0 |
-| minimizer-webpack-plugin | ^5.7.0 | ^5.8.0 |
+| minimizer-webpack-plugin | ^5.7.0 | ^5.9.0 |
 | tapable | ^2.3.0 | ^2.3.3 |
 
 ---

package/changes.json

@@ -10,7 +10,7 @@
     },
     "browserslist": {
       "from": "^4.28.1",
-      "to": "^4.28.8"
+      "to": "^4.28.9"
     },
     "chrome-trace-event": {
       "from": "^1.0.2",
@@ -30,13 +30,13 @@
     },
     "minimizer-webpack-plugin": {
       "from": "^5.7.0",
-      "to": "^5.8.0"
+      "to": "^5.9.0"
     },
     "tapable": {
       "from": "^2.3.0",
       "to": "^2.3.3"
     }
   },
-  "timestamp": "2026-08-30T01:01:13.635Z",
+  "timestamp": "2026-09-06T01:00:50.036Z",
   "totalUpdated": 9
 }

package/lib/ChunkGraph.js

@@ -1380,27 +1380,29 @@ class ChunkGraph {
 
 		for (const chunkGroup of chunk.groupsIterable) {
 			if (chunkGroup instanceof Entrypoint) {
+				if (entrypoints.has(chunkGroup)) continue;
+				entrypoints.add(chunkGroup);
+				// `entrypoints` doubles as the visited set: a diamond of `dependOn`
+				// edges would otherwise re-traverse the shared entrypoint per path
 				const queue = [chunkGroup];
-				while (queue.length > 0) {
-					const current = queue.shift();
-					if (current) {
-						entrypoints.add(current);
-
-						let hasChildrenEntrypoint = false;
-						for (const child of current.childrenIterable) {
-							if (child instanceof Entrypoint && child.dependOn(current)) {
-								hasChildrenEntrypoint = true;
-								queue.push(/** @type {Entrypoint} */ (child));
+				for (let i = 0; i < queue.length; i++) {
+					const current = queue[i];
+					let hasChildrenEntrypoint = false;
+					for (const child of current.childrenIterable) {
+						if (child instanceof Entrypoint && child.dependOn(current)) {
+							hasChildrenEntrypoint = true;
+							if (!entrypoints.has(child)) {
+								entrypoints.add(child);
+								queue.push(child);
 							}
 						}
-						// entryChunkB: hasChildrenEntrypoint = true
-						// entryChunkA: dependOn = entryChunkB
-						if (hasChildrenEntrypoint) {
-							const entrypointChunk = current.getEntrypointChunk();
-							if (entrypointChunk !== chunk && !entrypointChunk.hasRuntime()) {
-								// add entryChunkB to set
-								set.add(entrypointChunk);
-							}
+					}
+					// an entrypoint others depend on has to be loaded before them,
+					// unless it is the runtime chunk itself or carries its own runtime
+					if (hasChildrenEntrypoint) {
+						const entrypointChunk = current.getEntrypointChunk();
+						if (entrypointChunk !== chunk && !entrypointChunk.hasRuntime()) {
+							set.add(entrypointChunk);
 						}
 					}
 				}

package/lib/Compilation.js

@@ -4083,7 +4083,7 @@ Or do you want to use the entrypoints '${name}' and '${runtime}' independently o
 		const text = /** @type {string} */ (source.source());
 		// Everything the hook is handed is in the key: a tap answers per language
 		// pair, so identical text offered as two of them is two questions.
-		const key = `${info.type}${info.hostType}${text}`;
+		const key = `${info.type}\0${info.hostType}\0${text}`;
 		const resolved = this._embeddedSources.get(info.module);
 		if (resolved !== undefined) {
 			const hit = resolved.get(key);

package/lib/ConcatenationScope.js

@@ -19,9 +19,10 @@ const {
  * 	ExportName as Ids
  * } from "./optimize/ConcatenatedModule"
  */
-/** @import { Range } from "./javascript/JavascriptParser" */
 
-/** @typedef {{ start: number, end: number, name: string }} ModuleReferenceMatch */
+/** @typedef {{ start: number, end: number, name: string, leaked: boolean }} ModuleReferenceMatch */
+
+const MODULE_REFERENCE_TOKEN = "__WEBPACK_MODULE_REFERENCE__";
 
 const MODULE_REFERENCE_REGEXP =
 	/^__WEBPACK_MODULE_REFERENCE__(\d+)_([\da-f]+|ns)(_call)?(_directImport)?(_deferredImport)?(_mangleableNs)?(_moduleExportsAccess)?(?:_asiSafe(\d))?__$/;
@@ -33,6 +34,8 @@ const MODULE_REFERENCE_SCAN_REGEXP = new RegExp(
 	"g"
 );
 
+const IDENTIFIER_CHARACTER_REGEXP = /[\w$]/;
+
 /** @type {WeakMap<Source, ModuleReferenceMatch[]>} */
 const moduleReferencesCache = new WeakMap();
 
@@ -76,10 +79,6 @@ class ConcatenationScope {
 		this.usedNames = usedNames;
 		/** @type {Map<Module, ModuleInfo>} */
 		this._modulesMap = modulesMap;
-		// written and read by dependency templates within a single code
-		// generation pass, never across passes
-		/** @type {Range[] | undefined} */
-		this._replacedRequireRanges = undefined;
 	}
 
 	/**
@@ -121,33 +120,6 @@ class ConcatenationScope {
 		return this._currentModule.wrapped;
 	}
 
-	/**
-	 * Records a `require(...)` call that was replaced as a whole by a
-	 * concatenation reference, so nothing else rewrites a range inside it.
-	 * @param {Range} range source range of the replaced call
-	 */
-	registerReplacedRequire(range) {
-		if (this._replacedRequireRanges === undefined) {
-			this._replacedRequireRanges = [];
-		}
-		this._replacedRequireRanges.push(range);
-	}
-
-	/**
-	 * Checks whether an offset sits inside an already-replaced `require(...)` call.
-	 * Containment, not exact match: `new require(...)` is replaced from `new`.
-	 * @param {number} start start offset to test
-	 * @returns {boolean} true, when the offset was replaced already
-	 */
-	isInsideReplacedRequire(start) {
-		const ranges = this._replacedRequireRanges;
-		if (ranges === undefined) return false;
-		for (const [rangeStart, rangeEnd] of ranges) {
-			if (start >= rangeStart && start < rangeEnd) return true;
-		}
-		return false;
-	}
-
 	/**
 	 * Records the symbol that should be used when the current module exports a
 	 * named binding.
@@ -263,7 +235,22 @@ class ConcatenationScope {
 	}
 
 	/**
-	 * Finds all encoded module references in a generated source.
+	 * Checks whether an identifier buries a reference token without being one,
+	 * which nothing can resolve: it would reach the output as an undeclared global.
+	 * @param {string} name the identifier
+	 * @returns {boolean} true, when a reference token is buried in the identifier
+	 */
+	static isLeakedModuleReference(name) {
+		return (
+			name.includes(MODULE_REFERENCE_TOKEN) &&
+			!MODULE_REFERENCE_REGEXP.test(name)
+		);
+	}
+
+	/**
+	 * Finds all encoded module references in a generated source. A match that
+	 * continues an identifier is reported as `leaked`: it is a token a wider
+	 * replacement swallowed, so substituting it would rewrite the middle of a name.
 	 * @param {Source} source generated source
 	 * @returns {ModuleReferenceMatch[]} reference token positions (end is exclusive, excludes the appended "._")
 	 */
@@ -279,7 +266,10 @@ class ConcatenationScope {
 			result.push({
 				start: match.index,
 				end: match.index + match[0].length,
-				name: match[0]
+				name: match[0],
+				leaked:
+					match.index > 0 &&
+					IDENTIFIER_CHARACTER_REGEXP.test(code[match.index - 1])
 			});
 			match = MODULE_REFERENCE_SCAN_REGEXP.exec(code);
 		}

package/lib/DotenvPlugin.js

@@ -6,6 +6,7 @@
 "use strict";
 
 const FileSystemInfo = require("./FileSystemInfo");
+const DotenvFileError = require("./errors/DotenvFileError");
 const { join } = require("./util/fs");
 
 /** @import { DotenvPluginOptions } from "../declarations/WebpackOptions" */
@@ -155,8 +156,8 @@ function expandValue(value, processEnv, runningParsed) {
 		const opMatch = expression.match(opRegex);
 		const splitter = opMatch ? opMatch[0] : null;
 
-		const r = expression.split(/** @type {string} */ (splitter));
-		// const r = splitter ? expression.split(splitter) : [expression];
+		// `split(null)` splits on the string "null", cutting up names containing it
+		const r = splitter ? expression.split(splitter) : [expression];
 
 		/** @type {string} */
 		let defaultValue;
@@ -235,16 +236,21 @@ function expand(options) {
 /**
  * Format environment variables as DefinePlugin definitions
  * @param {Env} env environment variables
- * @returns {Record<string, string>} formatted definitions
+ * @returns {Record<string, string | Env>} formatted definitions
  */
 const envToDefinitions = (env) => {
-	const definitions = /** @type {Record<string, string>} */ ({});
+	const definitions = /** @type {Record<string, string | Env>} */ ({});
+	// one nested definition rather than a `import.meta.env.<key>` per key: a
+	// dotted key would otherwise read back as a nested object, not as the key
+	const importMetaEnv = /** @type {Env} */ (Object.create(null));
 
 	for (const [key, value] of Object.entries(env)) {
 		const defValue = JSON.stringify(value);
+		// `process.env` stays flat — it must not shadow the real one at runtime
 		definitions[`process.env.${key}`] = defValue;
-		definitions[`import.meta.env.${key}`] = defValue;
+		importMetaEnv[key] = defValue;
 	}
+	definitions["import.meta.env"] = importMetaEnv;
 
 	return definitions;
 };
@@ -296,6 +302,8 @@ class DotenvPlugin {
 
 		/** @type {undefined | InstanceType<Snapshot>} */
 		let snapshot;
+		/** @type {undefined | DotenvFileError} */
+		let loadError;
 
 		const cache = compiler.getCache(PLUGIN_NAME);
 		const identifier = JSON.stringify(
@@ -304,16 +312,31 @@ class DotenvPlugin {
 		const itemCache = cache.getItemCache(identifier, null);
 
 		compiler.hooks.beforeCompile.tapPromise(PLUGIN_NAME, async () => {
-			const { parsed, snapshot: newSnapshot } = dir
-				? await this._loadEnv(compiler, itemCache, dir)
-				: { parsed: {} };
-			const env = this._getEnv(prefixes, parsed);
-
-			definePlugin.definitions = envToDefinitions(env || {});
-			snapshot = newSnapshot;
+			loadError = undefined;
+			try {
+				const { parsed, snapshot: newSnapshot } = dir
+					? await this._loadEnv(compiler, itemCache, dir)
+					: { parsed: {} };
+				const env = this._getEnv(prefixes, parsed);
+
+				definePlugin.definitions = envToDefinitions(env || {});
+				snapshot = newSnapshot;
+			} catch (err) {
+				// reported on the compilation so watch mode recovers when it is fixed
+				if (!(err instanceof DotenvFileError)) throw err;
+				loadError = err;
+				definePlugin.definitions = envToDefinitions({});
+				snapshot = undefined;
+			}
 		});
 
 		compiler.hooks.compilation.tap(PLUGIN_NAME, (compilation) => {
+			if (loadError) {
+				compilation.errors.push(loadError);
+				compilation.fileDependencies.add(
+					/** @type {string} */ (loadError.file)
+				);
+			}
 			if (snapshot) {
 				compilation.fileDependencies.addAll(snapshot.getFileIterable());
 				compilation.missingDependencies.addAll(snapshot.getMissingIterable());
@@ -369,7 +392,12 @@ class DotenvPlugin {
 						fileDependencies.push(filePath);
 						return content;
 					},
-					() => {
+					(err) => {
+						const code = /** @type {NodeJS.ErrnoException} */ (err).code;
+						// only an absent file is normal; anything else is a real fault
+						if (code !== "ENOENT" && code !== "ENOTDIR") {
+							throw new DotenvFileError(filePath, err);
+						}
 						// File doesn't exist, add to missingDependencies (this is normal)
 						missingDependencies.push(filePath);
 						return "";

package/lib/ExportsInfo.js

@@ -1747,6 +1747,16 @@ class ExportInfo {
 		return result;
 	}
 
+	/**
+	 * Returns whether resolving the target leads back to this export, which
+	 * `getTarget` cannot express as it reports a cycle as "no target".
+	 * @param {ModuleGraph} moduleGraph the module graph
+	 * @returns {boolean} true, when the reexport chain is circular
+	 */
+	hasCircularTarget(moduleGraph) {
+		return this._getTarget(moduleGraph, RETURNS_TRUE, undefined) === CIRCULAR;
+	}
+
 	/**
 	 * Returns the target.
 	 * @param {ModuleGraph} moduleGraph the module graph

package/lib/FlagDependencyUsagePlugin.js

@@ -345,10 +345,16 @@ class FlagDependencyUsagePlugin {
 											if (oldItem === undefined || Array.isArray(oldItem)) {
 												exportsMap.set(key, item);
 											} else {
+												// An unset flag means "allowed", so merge on `!== false`:
+												// `undefined && false` reads back as allowed.
 												exportsMap.set(key, {
 													name: item.name,
-													canMangle: item.canMangle && oldItem.canMangle,
-													canInline: item.canInline && oldItem.canInline
+													canMangle:
+														item.canMangle !== false &&
+														oldItem.canMangle !== false,
+													canInline:
+														item.canInline !== false &&
+														oldItem.canInline !== false
 												});
 											}
 										}

package/lib/NormalModule.js

@@ -109,7 +109,6 @@ const getModuleBuildError = memoize(() => require("./errors/ModuleBuildError"));
  * 	BuildMeta,
  * 	CodeGenerationContext,
  * 	CodeGenerationResult,
- * 	CodeGenerationResultData,
  * 	ConcatenationBailoutReasonContext,
  * 	KnownBuildInfo,
  * 	LibIdentOptions,
@@ -119,7 +118,6 @@ const getModuleBuildError = memoize(() => require("./errors/ModuleBuildError"));
  * 	NeedBuildCallback,
  * 	BuildCallback,
  * 	RuntimeRequirements,
- * 	Sources,
  * 	SourceType,
  * 	SourceTypes
  * } from "./Module"
@@ -728,11 +726,6 @@ class NormalModule extends Module {
 		this._sideEffectsStateGraph = undefined;
 		/** @type {ConnectionState | undefined} */
 		this._sideEffectsStateValue = undefined;
-		/**
-		 * @private
-		 * @type {CodeGenerationResultData}
-		 */
-		this._codeGeneratorData = new Map();
 	}
 
 	/**
@@ -1892,10 +1885,19 @@ class NormalModule extends Module {
 			runtimeRequirements.add(RuntimeGlobals.thisAsExports);
 		}
 
-		const getData = () => this._codeGeneratorData;
+		/** @type {CodeGenerationResult} */
+		const resultEntry = {
+			sources: new Map(),
+			runtimeRequirements,
+			data: undefined,
+			hash: undefined
+		};
+
+		const getData = () => {
+			if (resultEntry.data === undefined) resultEntry.data = new Map();
+			return resultEntry.data;
+		};
 
-		/** @type {Sources} */
-		const sources = new Map();
 		for (const type of sourceTypes || chunkGraph.getModuleSourceTypes(this)) {
 			// TODO webpack@6 make generateError required
 			const generator =
@@ -1930,17 +1932,10 @@ class NormalModule extends Module {
 					});
 
 			if (source) {
-				sources.set(type, new CachedSource(source));
+				resultEntry.sources.set(type, new CachedSource(source));
 			}
 		}
 
-		/** @type {CodeGenerationResult} */
-		const resultEntry = {
-			sources,
-			runtimeRequirements,
-			data: this._codeGeneratorData,
-			hash: undefined
-		};
 		return resultEntry;
 	}
 
@@ -2116,7 +2111,6 @@ class NormalModule extends Module {
 		write(this.error);
 		write(this._lastSuccessfulBuildMeta);
 		write(this._forceBuild);
-		write(this._codeGeneratorData);
 		write(this.hot);
 		super.serialize(context);
 	}
@@ -2160,7 +2154,6 @@ class NormalModule extends Module {
 		this.error = read();
 		this._lastSuccessfulBuildMeta = read();
 		this._forceBuild = read();
-		this._codeGeneratorData = read();
 		this.hot = read();
 		super.deserialize(context);
 	}

package/lib/RuntimePlugin.js

@@ -189,6 +189,9 @@ const TREE_DEPENDENCIES = {
 		RuntimeGlobals.makeNamespaceObject,
 		RuntimeGlobals.require
 	],
+	[RuntimeGlobals.deferredModuleAsyncTransitiveDependencies]: [
+		RuntimeGlobals.asyncModule
+	],
 	[RuntimeGlobals.makeOptimizedDeferredNamespaceObject]: [
 		RuntimeGlobals.require
 	],