@depup/webpack 5.110.3-depup.0 → 5.111.1-depup.0

package/README.md

@@ -13,23 +13,22 @@ npm install @depup/webpack
 
 | Field | Value |
 |-------|-------|
-| Original | [webpack](https://www.npmjs.com/package/webpack) @ 5.110.3 |
-| Processed | 2026-09-06 |
+| Original | [webpack](https://www.npmjs.com/package/webpack) @ 5.111.1 |
+| Processed | 2026-09-20 |
 | Smoke test | passed |
-| Deps updated | 9 |
+| Deps updated | 8 |
 
 ## Dependency Changes
 
 | Dependency | From | To |
 |------------|------|-----|
 | @types/estree | ^1.0.8 | ^1.0.9 |
-| acorn | ^8.16.0 | ^8.18.0 |
-| browserslist | ^4.28.1 | ^4.28.9 |
+| browserslist | ^4.28.1 | ^4.29.0 |
 | chrome-trace-event | ^1.0.2 | ^1.0.4 |
-| enhanced-resolve | ^5.24.4 | ^5.24.5 |
-| es-module-lexer | ^2.1.0 | ^2.3.2 |
+| enhanced-resolve | ^5.25.0 | ^5.25.1 |
+| es-module-lexer | ^2.1.0 | ^3.0.2 |
 | events | ^3.2.0 | ^3.3.0 |
-| minimizer-webpack-plugin | ^5.7.0 | ^5.9.0 |
+| minimizer-webpack-plugin | ^5.7.0 | ^5.11.0 |
 | tapable | ^2.3.0 | ^2.3.3 |
 
 ---

package/changes.json

@@ -4,25 +4,21 @@
       "from": "^1.0.8",
       "to": "^1.0.9"
     },
-    "acorn": {
-      "from": "^8.16.0",
-      "to": "^8.18.0"
-    },
     "browserslist": {
       "from": "^4.28.1",
-      "to": "^4.28.9"
+      "to": "^4.29.0"
     },
     "chrome-trace-event": {
       "from": "^1.0.2",
       "to": "^1.0.4"
     },
     "enhanced-resolve": {
-      "from": "^5.24.4",
-      "to": "^5.24.5"
+      "from": "^5.25.0",
+      "to": "^5.25.1"
     },
     "es-module-lexer": {
       "from": "^2.1.0",
-      "to": "^2.3.2"
+      "to": "^3.0.2"
     },
     "events": {
       "from": "^3.2.0",
@@ -30,13 +26,13 @@
     },
     "minimizer-webpack-plugin": {
       "from": "^5.7.0",
-      "to": "^5.9.0"
+      "to": "^5.11.0"
     },
     "tapable": {
       "from": "^2.3.0",
       "to": "^2.3.3"
     }
   },
-  "timestamp": "2026-09-06T01:00:50.036Z",
-  "totalUpdated": 9
+  "timestamp": "2026-09-20T01:00:33.211Z",
+  "totalUpdated": 8
 }

package/lib/APIPlugin.js

@@ -42,12 +42,12 @@ const getConcatenatedModule = memoize(() =>
  */
 /** @import Compilation from "./Compilation" */
 /** @import ChunkGraph from "./ChunkGraph" */
+/** @import { RuntimeSpec } from "./util/runtime" */
 /** @import JavascriptParser, { Range } from "./javascript/JavascriptParser" */
 
-// Modules that reassign `__webpack_public_path__` at runtime, by compilation. A baked
-// analyzable specifier can't reflect that, so those forms fall back. Also recorded per
-// module in `buildInfo`, because a module restored from the persistent cache is never
-// re-parsed and would otherwise lose the flag.
+// Modules reassigning `__webpack_public_path__` at runtime, per compilation, since
+// a baked specifier cannot reflect that. Also kept in `buildInfo`: a module
+// restored from the persistent cache is never re-parsed.
 /** @type {WeakMap<Compilation, Set<Module>>} */
 const runtimePublicPathOverride = new WeakMap();
 
@@ -79,17 +79,30 @@ const usesRuntimePublicPathOverride = (compilation) =>
 const overriddenRuntimes = new WeakMap();
 
 /**
- * Whether the public path is reassigned in any runtime `module` belongs to. Falls back
- * to the whole compilation when there is no chunk graph to place the module in.
+ * Whether the public path is reassigned in any runtime the reference belongs to,
+ * named either by the module emitting it or by `runtime` directly — a caller holding
+ * a chunk rather than a module has only the latter. Falls back to the whole
+ * compilation when neither can place it.
  * @param {Compilation} compilation compilation
  * @param {ChunkGraph=} chunkGraph the chunk graph
  * @param {Module=} module the module a reference is emitted into
- * @returns {boolean} true when a reassignment can reach this module's runtimes
+ * @param {RuntimeSpec=} runtime the runtime it is emitted for, where no module names it
+ * @returns {boolean} true when a reassignment can reach those runtimes
  */
-const runtimeUsesPublicPathOverride = (compilation, chunkGraph, module) => {
+const runtimeUsesPublicPathOverride = (
+	compilation,
+	chunkGraph,
+	module,
+	runtime
+) => {
 	const modules = runtimePublicPathOverride.get(compilation);
 	if (modules === undefined) return false;
-	if (chunkGraph === undefined || module === undefined) return true;
+	if (
+		chunkGraph === undefined ||
+		(module === undefined && runtime === undefined)
+	) {
+		return true;
+	}
 	// Keyed by the chunk graph, not the compilation: `executeModule` asks with a
 	// throw-away one whose answer must not outlive it.
 	let runtimes = overriddenRuntimes.get(chunkGraph);
@@ -115,8 +128,10 @@ const runtimeUsesPublicPathOverride = (compilation, chunkGraph, module) => {
 	if (overridden.size === 0) return false;
 	/** @type {Set<string>} */
 	const own = new Set();
-	for (const runtime of chunkGraph.getModuleRuntimes(module)) {
-		forEachRuntime(runtime, (key) => {
+	const reached =
+		module === undefined ? [runtime] : chunkGraph.getModuleRuntimes(module);
+	for (const each of reached) {
+		forEachRuntime(each, (key) => {
 			own.add(/** @type {string} */ (key));
 		});
 	}

package/lib/AutomaticPrefetchPlugin.js

@@ -5,9 +5,9 @@
 
 "use strict";
 
-const asyncLib = require("neo-async");
 const NormalModule = require("./NormalModule");
 const PrefetchDependency = require("./dependencies/PrefetchDependency");
+const asyncLib = require("./util/async");
 
 /** @import Compiler from "./Compiler" */
 

package/lib/Cache.js

@@ -70,8 +70,11 @@ class Cache {
 			get: new AsyncSeriesBailHook(["identifier", "etag", "gotHandlers"]),
 			/** @type {AsyncParallelHook<[string, Etag | null, Data]>} */
 			store: new AsyncParallelHook(["identifier", "etag", "data"]),
-			/** @type {AsyncParallelHook<[Iterable<string>]>} */
-			storeBuildDependencies: new AsyncParallelHook(["dependencies"]),
+			/** @type {AsyncParallelHook<[Iterable<string>, Iterable<string>]>} */
+			storeBuildDependencies: new AsyncParallelHook([
+				"dependencies",
+				"optionalDependencies"
+			]),
 			/** @type {SyncHook<[]>} */
 			beginIdle: new SyncHook([]),
 			/** @type {AsyncParallelHook<[]>} */
@@ -139,12 +142,14 @@ class Cache {
 	 * Persists the set of build dependencies required to determine whether the
 	 * cache can be restored in a future compilation.
 	 * @param {Iterable<string>} dependencies list of all build dependencies
+	 * @param {Iterable<string>} optionalDependencies list of optional build dependencies
 	 * @param {CallbackCache<void>} callback signals when the dependencies are stored
 	 * @returns {void}
 	 */
-	storeBuildDependencies(dependencies, callback) {
+	storeBuildDependencies(dependencies, optionalDependencies, callback) {
 		this.hooks.storeBuildDependencies.callAsync(
 			dependencies,
+			optionalDependencies,
 			makeWebpackErrorCallback(callback, "Cache.hooks.storeBuildDependencies")
 		);
 	}

package/lib/CacheFacade.js

@@ -6,9 +6,9 @@
 "use strict";
 
 const { forEachBail } = require("enhanced-resolve");
-const asyncLib = require("neo-async");
 const getLazyHashedEtag = require("./cache/getLazyHashedEtag");
 const mergeEtags = require("./cache/mergeEtags");
+const asyncLib = require("./util/async");
 
 /** @import Cache, { Etag } from "./Cache" */
 /** @import { HashableObject } from "./cache/getLazyHashedEtag" */

package/lib/CircularModulesPlugin.js

@@ -5,6 +5,8 @@
 
 "use strict";
 
+const HarmonyImportDependency = require("./dependencies/HarmonyImportDependency");
+const HarmonyImportSideEffectDependency = require("./dependencies/HarmonyImportSideEffectDependency");
 const CircularDependenciesWarning = require("./errors/CircularDependenciesWarning");
 const { compareModulesByIdentifier } = require("./util/comparators");
 
@@ -20,6 +22,22 @@ const PLUGIN_NAME = "CircularModulesPlugin";
 // Enough to name the worst tangles without printing the module graph.
 const MAX_REPORTED_CYCLES = 5;
 
+// After SideEffectsFlagPlugin / FlagDependencyUsagePlugin (stage 0).
+const STAGE_DETECT = 1;
+
+/**
+ * Bit flags for why a module is treated as circular.
+ * A module may carry both bits when it sits in a sync SCC and is a binding-read target.
+ * @enum {number}
+ */
+const CircularKind = {
+	None: 0,
+	/** ESM binding-observable target; blocks const export inlining (TDZ). */
+	Binding: 1 << 0,
+	/** Any synchronous SCC member; blocks value binding. */
+	Synchronous: 1 << 1
+};
+
 /**
  * The module a connection makes its origin evaluate before it can run, or
  * `null` when it does not: a weak reference never loads its target, and an
@@ -120,12 +138,26 @@ const formatShortestCycle = (members, moduleGraph, requestShortener) => {
 		.join(" -> ");
 };
 
+/**
+ * Whether a sync connection may observe the target's live export binding.
+ * Bare side-effect imports do not, so their cycles stay Binding-free.
+ * @param {ModuleGraphConnection} connection an outgoing connection
+ * @returns {boolean} true when the dependency can read a named/default binding
+ */
+const isBindingRead = (connection) => {
+	const dependency = connection.dependency;
+	return (
+		dependency instanceof HarmonyImportDependency &&
+		!(dependency instanceof HarmonyImportSideEffectDependency)
+	);
+};
+
 /**
  * Detects circular dependencies among synchronous module imports.
  *
- * Builds an adjacency layout from each module's synchronous outgoing
- * connections (skipping weak and async-block edges), then runs an iterative
- * SCC algorithm to find circular modules.
+ * One sync-edge SCC pass yields Synchronous members; Binding is derived from
+ * the same components for targets of binding-reads that share a component
+ * (or self-import), without a second Tarjan.
  *
  * Use the static `build()` method to create an instance. All intermediate data
  * (adjacency layout, index mappings) is local to `build()` and released on
@@ -133,12 +165,15 @@ const formatShortestCycle = (members, moduleGraph, requestShortener) => {
  */
 class CycleGraph {
 	/**
-	 * @param {Set<Module>} circularModules modules in a multi-module SCC or with a self-loop (for isCircular)
+	 * @param {Set<Module>} synchronousModules sync SCC members / self-loops
+	 * @param {Set<Module>} bindingModules binding-read targets sharing a sync SCC
 	 * @param {Module[][]} circularGroups multi-module SCC groups only (for reporting; self-loops omitted)
 	 */
-	constructor(circularModules, circularGroups) {
+	constructor(synchronousModules, bindingModules, circularGroups) {
 		/** @type {Set<Module>} */
-		this.circularModules = circularModules;
+		this.synchronousModules = synchronousModules;
+		/** @type {Set<Module>} */
+		this.bindingModules = bindingModules;
 		/** @type {Module[][]} */
 		this.circularGroups = circularGroups;
 	}
@@ -149,7 +184,7 @@ class CycleGraph {
 	 * @param {Iterable<Module>} modules the set of modules
 	 * @param {ModuleGraph} moduleGraph the module graph
 	 * @param {boolean=} collectGroups also group the modules of each cycle, which
-	 * only the hint reads — marking `isCircular` needs the set alone
+	 * only the hint reads — marking kinds needs the sets alone
 	 * @returns {CycleGraph} the result
 	 */
 	static build(modules, moduleGraph, collectGroups = false) {
@@ -163,12 +198,16 @@ class CycleGraph {
 		}
 
 		const size = moduleList.length;
-		if (size === 0) return new CycleGraph(new Set(), []);
+		if (size === 0) {
+			return new CycleGraph(new Set(), new Set(), []);
+		}
 
 		/** @type {number[][]} */
 		const edges = Array.from({ length: size });
 		/** @type {boolean[]} */
 		const selfLoops = Array.from({ length: size }, () => false);
+		/** @type {[number, number][]} */
+		const bindingReads = [];
 
 		for (let i = 0; i < size; i++) {
 			const module = moduleList[i];
@@ -177,13 +216,16 @@ class CycleGraph {
 			for (const connection of moduleGraph.getOutgoingConnections(module)) {
 				const target = getSynchronousTarget(connection, module, moduleGraph);
 				if (target === null) continue;
+				const binding = isBindingRead(connection);
 				if (target === module) {
 					selfLoops[i] = true;
+					if (binding) bindingReads.push([i, i]);
 					continue;
 				}
 				const targetIdx = moduleToIndex.get(target);
 				if (targetIdx !== undefined) {
 					deps.push(targetIdx);
+					if (binding) bindingReads.push([i, targetIdx]);
 				}
 			}
 			edges[i] = deps;
@@ -191,9 +233,12 @@ class CycleGraph {
 
 		// Iterative SCC algorithm
 		/** @type {Set<Module>} */
-		const circularModules = new Set();
+		const synchronousModules = new Set();
 		/** @type {Module[][]} */
 		const circularGroups = [];
+		/** @type {Int32Array} */
+		const componentOf = new Int32Array(size).fill(-1);
+		let nextComponent = 0;
 		let nextIndex = 0;
 		const nodeIndex = new Int32Array(size).fill(-1);
 		const nodeLowLink = new Int32Array(size);
@@ -246,16 +291,17 @@ class CycleGraph {
 							w = /** @type {number} */ (sccStack.pop());
 							nodeOnStack[w] = 0;
 							group.push(w);
+							componentOf[w] = nextComponent;
 						} while (w !== v);
+						nextComponent++;
 
 						if (group.length > 1 || selfLoops[v]) {
 							for (const idx of group) {
-								circularModules.add(moduleList[idx]);
+								synchronousModules.add(moduleList[idx]);
 							}
 						}
 
-						// A module that only references itself is no cycle, so it is
-						// circular for inlining but never a group to report.
+						// A self-loop is synchronous-circular but not a group to report.
 						if (collectGroups && group.length > 1) {
 							circularGroups.push(group.map((idx) => moduleList[idx]));
 						}
@@ -272,7 +318,18 @@ class CycleGraph {
 			}
 		}
 
-		return new CycleGraph(circularModules, circularGroups);
+		/** @type {Set<Module>} */
+		const bindingModules = new Set();
+		for (const [originIdx, targetIdx] of bindingReads) {
+			if (
+				originIdx === targetIdx ||
+				componentOf[originIdx] === componentOf[targetIdx]
+			) {
+				bindingModules.add(moduleList[targetIdx]);
+			}
+		}
+
+		return new CycleGraph(synchronousModules, bindingModules, circularGroups);
 	}
 }
 
@@ -282,7 +339,7 @@ class CycleGraph {
  */
 
 /**
- * One SCC scan: marks isCircular on every module, and reports groups when hints are set.
+ * One sync SCC scan: marks Synchronous and Binding kinds, reports groups when hints are set.
  */
 class CircularModulesPlugin {
 	/**
@@ -293,6 +350,32 @@ class CircularModulesPlugin {
 		this.hints = options && options.hints;
 	}
 
+	/**
+	 * The circular kind recorded on `module.buildInfo`, or `undefined` when this
+	 * plugin did not run for the compilation.
+	 * @param {Module} module the module
+	 * @returns {number | undefined} bit flags from CircularKind
+	 */
+	static getCircularKind(module) {
+		const buildInfo = /** @type {BuildInfo | undefined} */ (module.buildInfo);
+		if (!buildInfo || buildInfo.circularKind === undefined) return undefined;
+		return buildInfo.circularKind;
+	}
+
+	/**
+	 * Whether the module is circular. With `kind`, requires that bit to be set.
+	 * Without `kind`, any non-None kind counts. Missing kind (plugin off) is false.
+	 * @param {Module} module the module
+	 * @param {number=} kind CircularKind bit to test (e.g. CircularKind.Binding)
+	 * @returns {boolean} true when the module matches
+	 */
+	static isCircular(module, kind) {
+		const value = CircularModulesPlugin.getCircularKind(module);
+		if (value === undefined) return false;
+		if (kind === undefined) return value !== CircularKind.None;
+		return (value & kind) === kind;
+	}
+
 	/**
 	 * @param {Compiler} compiler the compiler instance
 	 * @returns {void}
@@ -304,48 +387,62 @@ class CircularModulesPlugin {
 			/** @type {CircularDependenciesWarning | undefined} */
 			let warning;
 
-			compilation.hooks.optimizeModules.tap(PLUGIN_NAME, (modules) => {
-				const { circularModules, circularGroups } = CycleGraph.build(
-					modules,
-					compilation.moduleGraph,
-					Boolean(hints)
-				);
-
-				// Must be an explicit boolean: ConstExportsPlugin checks `=== false`.
-				for (const m of modules) {
-					/** @type {BuildInfo} */
-					(m.buildInfo).isCircular = circularModules.has(m);
-				}
+			compilation.hooks.optimizeDependencies.tap(
+				{
+					name: PLUGIN_NAME,
+					stage: STAGE_DETECT
+				},
+				(modules) => {
+					const { synchronousModules, bindingModules, circularGroups } =
+						CycleGraph.build(modules, compilation.moduleGraph, Boolean(hints));
+
+					for (const m of modules) {
+						let kind = CircularKind.None;
+						if (synchronousModules.has(m)) {
+							kind |= CircularKind.Synchronous;
+						}
+						if (bindingModules.has(m)) {
+							kind |= CircularKind.Binding;
+						}
+						const buildInfo = /** @type {BuildInfo} */ (m.buildInfo);
+						buildInfo.circularKind = kind;
+						// Kept for existing tests / readers that still check the boolean.
+						buildInfo.isCircular = (kind & CircularKind.Synchronous) !== 0;
+					}
 
-				if (!hints) return;
-				if (circularGroups.length === 0) return;
-
-				const { moduleGraph, requestShortener } = compilation;
-
-				// Largest tangle first; ties break by name, as the order groups are
-				// discovered in is not stable.
-				circularGroups.sort(
-					(a, b) =>
-						b.length - a.length ||
-						compareModulesByIdentifier(
-							getCanonicalMember(a),
-							getCanonicalMember(b)
-						)
-				);
-
-				// The shortest cycle of a large group names two of its modules, so the
-				// size travels with it — otherwise the group reads as a pair.
-				const groups = circularGroups
-					.slice(0, MAX_REPORTED_CYCLES)
-					.map((members) => ({
-						size: members.length,
-						cycle: formatShortestCycle(members, moduleGraph, requestShortener)
-					}));
-				warning = new CircularDependenciesWarning(
-					groups,
-					circularGroups.length
-				);
-			});
+					if (!hints) return;
+					if (circularGroups.length === 0) {
+						warning = undefined;
+						return;
+					}
+
+					const { moduleGraph, requestShortener } = compilation;
+
+					// Largest tangle first; ties break by name, as the order groups are
+					// discovered in is not stable.
+					circularGroups.sort(
+						(a, b) =>
+							b.length - a.length ||
+							compareModulesByIdentifier(
+								getCanonicalMember(a),
+								getCanonicalMember(b)
+							)
+					);
+
+					// The shortest cycle of a large group names two of its modules, so the
+					// size travels with it — otherwise the group reads as a pair.
+					const groups = circularGroups
+						.slice(0, MAX_REPORTED_CYCLES)
+						.map((members) => ({
+							size: members.length,
+							cycle: formatShortestCycle(members, moduleGraph, requestShortener)
+						}));
+					warning = new CircularDependenciesWarning(
+						groups,
+						circularGroups.length
+					);
+				}
+			);
 
 			// Reported past the hash: `createHash` folds every message into it, so
 			// a hint pushed earlier would change the build's identity.
@@ -364,4 +461,9 @@ class CircularModulesPlugin {
 	}
 }
 
+/** @type {typeof CircularKind} */
+CircularModulesPlugin.CircularKind = CircularKind;
+/** @type {number} */
+CircularModulesPlugin.STAGE_DETECT = STAGE_DETECT;
+
 module.exports = CircularModulesPlugin;

package/lib/CleanPlugin.js

@@ -6,8 +6,8 @@
 "use strict";
 
 const path = require("path");
-const asyncLib = require("neo-async");
 const { SyncBailHook } = require("tapable");
+const asyncLib = require("./util/async");
 const createHooksRegistry = require("./util/createHooksRegistry");
 const { join } = require("./util/fs");
 const { ABSOLUTE_PATH_REGEXP } = require("./util/identifier");
@@ -98,7 +98,7 @@ const getDiffToFs = (fs, outputPath, currentAssets, callback) => {
 	const directories = getDirectories(currentAssets);
 	/** @type {Diff} */
 	const diff = new Set();
-	asyncLib.forEachLimit(
+	asyncLib.eachLimit(
 		directories,
 		10,
 		(directory, callback) => {

package/lib/CompatibilityPlugin.js

@@ -180,10 +180,9 @@ class CompatibilityPlugin {
 							});
 							return true;
 						});
-					// `const`/`let` are block-pre-walked, by which point the name is no
-					// longer free and `hooks.pattern` is not dispatched for it — tag
-					// them through the kind-specific declaration hooks instead.
-					// Returning nothing lets the variable be defined, keeping the tag.
+					// `const` and `let` are block-pre-walked, by which point the name is no
+					// longer free and `hooks.pattern` never fires, so they are tagged
+					// through the declaration hooks instead.
 					for (const hookMap of [
 						parser.hooks.varDeclarationConst,
 						parser.hooks.varDeclarationLet