@depup/webpack 5.110.3-depup.0 → 5.111.1-depup.0

package/lib/hmr/LazyCompilationPlugin.js

@@ -335,11 +335,9 @@ class LazyCompilationProxyModule extends Module {
 			block.addDependency(dep);
 			this.addBlock(block);
 		} else if (hasClosureLibrary(compilation.options.output)) {
-			// Reserve statically-declared externals as dependencies of the inactive
-			// proxy so the initial entry chunk's library wrapper already exposes
-			// their closure identifiers (e.g. `__WEBPACK_EXTERNAL_MODULE_react__`).
-			// Once the proxy activates and the lazily-built module references those
-			// externals, the identifiers resolve normally instead of throwing.
+			// Reserve the statically declared externals on the inactive proxy, so the
+			// entry chunk's library wrapper already exposes their closure identifiers
+			// and they resolve rather than throw once the proxy activates.
 			const requests = collectStaticExternalRequests(
 				options.externals,
 				this.layer

package/lib/html/HtmlGenerator.js

@@ -9,6 +9,7 @@ const ConcatenationScope = require("../ConcatenationScope");
 const Generator = require("../Generator");
 const {
 	HTML_TYPE,
+	HTML_TYPES,
 	JAVASCRIPT_TYPE,
 	JAVASCRIPT_TYPES
 } = require("../ModuleSourceTypeConstants");
@@ -225,12 +226,9 @@ const CHUNK_URL_SENTINEL_REGEXP =
 const HTML_PAGE_URL_SENTINEL_REGEXP =
 	/__WEBPACK_HTML_PAGE_URL__([0-9a-f]+)__END__/g;
 
-// Sentinel for a URL-referenced asset (font/image/…) emitted into a resource-hint
-// `<link>` tag by `HtmlEntryDependency`; resolved to the asset's real emitted
-// URL from its codegen data during `HtmlModulesPlugin` render. Deferred because
-// HtmlEntry deps run *while* the HTML module is being codegen'd — the asset
-// module's own codegen might not have completed yet. Keyed by the asset
-// module's identifier, hex-encoded so any character in it is safe in a URL.
+// Sentinel for a URL-referenced asset in a resource-hint `<link>`, resolved at
+// `HtmlModulesPlugin` render because HtmlEntry deps run while the HTML module
+// is codegen'd, before the asset's own. Keyed by hex-encoded identifier.
 const ASSET_URL_SENTINEL_REGEXP =
 	/__WEBPACK_HTML_ASSET_URL__([0-9a-f]+)__END__/g;
 
@@ -239,11 +237,9 @@ const ASSET_URL_SENTINEL_REGEXP =
 /** @type {WeakSet<Compilation>} */
 const integritySentinelCompilations = new WeakSet();
 
-// Matches the whole ` integrity="<sentinel>"` so the attribute can be dropped
-// entirely when the per-asset `integrity` function returns `false`. Minification
-// runs first and may have unquoted the value (§13.1.2.3), so the quote is
-// optional and back-referenced to keep the pair matched; the replacement always
-// re-quotes, since an SRI list carries spaces and `=` padding.
+// Matches the whole ` integrity="<sentinel>"`, so the attribute can be dropped
+// when the per-asset `integrity` returns `false`. Minification runs first and
+// may have unquoted it, hence the optional back-referenced quote.
 const INTEGRITY_SENTINEL_REGEXP =
 	/ integrity=(["']?)__WEBPACK_HTML_INTEGRITY__([0-9a-f]+)__([a-z]+)__END__\1/g;
 
@@ -252,10 +248,9 @@ const INTEGRITY_SENTINEL_REGEXP =
 const INTEGRITY_SENTINEL_STRIP_REGEXP =
 	/ integrity=(\\?["']|)__WEBPACK_HTML_INTEGRITY__[0-9a-f]+__[a-z]+__END__\1/g;
 
-// The trailing `(?:__<hash>)?` is the inlined chunk's content hash, embedded by
-// `embedInlineChunkHashes` so the host HTML's bytes (and its `[contenthash]`,
-// incl. RealContentHashPlugin's recompute) change with the inlined content; the
-// resolver ignores it.
+// The trailing `(?:__<hash>)?` is the inlined chunk's content hash, embedded so
+// the host page's bytes and `[contenthash]` change with the inlined content.
+// The resolver ignores it.
 const INLINE_SENTINEL_REGEXP =
 	/__WEBPACK_HTML_INLINE__([0-9a-f]+)__([a-z]+)(?:__[0-9a-f]+)?__END__/g;
 
@@ -448,12 +443,9 @@ class HtmlGenerator extends Generator {
 			const url =
 				/** @type {Record<string, string | undefined> | undefined} */
 				(data.get("url"));
-			// Prefer the `asset-url` channel — it's the actual URL string
-			// (publicPath + filename). Also handled: assets reached only from JS
-			// have no `asset-url` channel (their only URL is the JS expression
-			// `__webpack_require__.p + "…"`); for those we reconstruct the URL
-			// from the emitted `filename` + `PUBLIC_PATH_AUTO` so the same
-			// undo-path substitution runs at asset render.
+			// Prefer the `asset-url` channel, which is the real URL string. An asset
+			// reached only from JS has none — its URL is a JS expression — so rebuild
+			// one from `filename` and let the undo-path substitution run.
 			if (url && url["asset-url"]) return url["asset-url"];
 			const filename = /** @type {string | undefined} */ (data.get("filename"));
 			if (filename) return `${PUBLIC_PATH_AUTO}${filename}`;
@@ -692,10 +684,9 @@ class HtmlGenerator extends Generator {
 							bodyDepth++;
 						}
 					},
-					// Collected on exit: an element's `end` is only final once it
-					// closes, and the streamed walk enters it while it is still open.
-					// `script` / `style` / `link` / `meta` never nest in each other, so
-					// exiting keeps them in source order.
+					// Collected on exit, since an element's `end` is final only once it
+					// closes. `script`, `style`, `link` and `meta` never nest in each
+					// other, so exiting keeps them in source order.
 					exit: (path) => {
 						const name = path.tagName();
 						if (name === "head") {
@@ -1047,19 +1038,19 @@ class HtmlGenerator extends Generator {
 	 * Creates an instance of HtmlGenerator.
 	 * @param {HtmlGeneratorOptions=} options generator options
 	 * @param {ModuleGraph=} moduleGraph the module graph; used to detect when an HTML module is reached as a compilation entry so `extract` can default to `true` for it
+	 * @param {((module: NormalModule) => boolean)=} isPageOnly tells whether the module's only output is its emitted page, so it exposes no JavaScript
 	 */
-	constructor(options, moduleGraph) {
+	constructor(options, moduleGraph, isPageOnly) {
 		super();
 		/** @type {HtmlGeneratorOptions} */
 		this.options = options || {};
 		/** @type {ModuleGraph | undefined} */
 		this._moduleGraph = moduleGraph;
-		// Raw dependency-template render (before `[webpack/auto]` resolution),
-		// shared between the JS and HTML type passes of a single
-		// `codeGeneration()` call. Keyed by that call's `runtimeRequirements`
-		// Set — created once per call and passed to every type's `generate()`,
-		// so it uniquely scopes the cache to one module's one code generation
-		// and releases with it. The two passes differ only in `undoPath`.
+		/** @type {((module: NormalModule) => boolean) | undefined} */
+		this._isPageOnly = isPageOnly;
+		// Raw render shared between the JS and HTML passes of one `codeGeneration()`
+		// call, which differ only in `undoPath`. Keyed by that call's
+		// `runtimeRequirements` Set, so the entry is scoped to it and releases with it.
 		/** @type {WeakMap<RuntimeRequirements, string>} */
 		this._rawRenderCache = new WeakMap();
 	}
@@ -1071,11 +1062,9 @@ class HtmlGenerator extends Generator {
 	 * @returns {string | undefined} reason why this module can't be concatenated, undefined when it can be concatenated
 	 */
 	getConcatenationBailoutReason(module, context) {
-		// The HMR shim references the per-module `module.hot` object — when an
-		// HTML module is concatenated, that scope is gone (the merged file
-		// shares a single `module`), so the self-accept / DOM-patch wiring
-		// would target the wrong module id. Bail out of concatenation so the
-		// HMR-aware HTML module keeps its own module scope.
+		// The HMR shim references the per-module `module.hot`, and a concatenated
+		// file shares one `module`, so the self-accept wiring would target the wrong
+		// id. Bail out, keeping the module's own scope.
 		if (module.hot) {
 			return "HTML module needs its own module scope for HMR";
 		}
@@ -1134,6 +1123,9 @@ class HtmlGenerator extends Generator {
 	 */
 	getTypes(module) {
 		if (this._shouldExposeHtmlType(module)) {
+			// A page nothing else reads has no JavaScript side: that chunk would
+			// only re-export the markup already emitted as the `.html` asset.
+			if (this._isPageOnly && this._isPageOnly(module)) return HTML_TYPES;
 			return JAVASCRIPT_AND_HTML_TYPES;
 		}
 		return JAVASCRIPT_TYPES;
@@ -1143,10 +1135,9 @@ class HtmlGenerator extends Generator {
 	 * @returns {boolean} whether getTypes() depends on the module's incoming connections
 	 */
 	getTypesDependOnIncomingConnections() {
-		// A fixed extract (`true` / `false` / `"inline"`) gives a stable type set;
-		// only the unset default reads `_isEntryModule` (incoming connections).
-		const { extract } = this.options;
-		return extract !== true && extract !== false && extract !== "inline";
+		// Every page that can expose the html type reads incoming connections —
+		// for the `extract` default, and for the page-only JavaScript drop.
+		return this.options.extract !== false;
 	}
 
 	/**
@@ -1272,10 +1263,9 @@ class HtmlGenerator extends Generator {
 	 * @returns {string} the rewritten HTML
 	 */
 	_renderHtml(module, generateContext, undoPath) {
-		// The dependency-template pass is identical for both type passes (no
-		// template branches on `type` or writes `runtimeRequirements`), so
-		// compute the raw render once per `codeGeneration()` and reuse it; the
-		// passes diverge only in the `[webpack/auto]` substitution below.
+		// No dependency template branches on `type` or writes
+		// `runtimeRequirements`, so the raw render is computed once per
+		// `codeGeneration()`; the passes diverge only in the substitution below.
 		const cacheKey = generateContext.runtimeRequirements;
 		let rawContent = this._rawRenderCache.get(cacheKey);
 		if (rawContent === undefined) {
@@ -1339,11 +1329,9 @@ class HtmlGenerator extends Generator {
 
 		/** @type {string} */
 		let sourceContent;
-		// `module.hot` is set by `HotModuleReplacementPlugin` on every module
-		// when HMR is enabled. When set, we cannot use the concatenation path
-		// (it merges into a parent's module scope, where `module.hot.accept`
-		// would target the wrong id) — `getConcatenationBailoutReason` keeps
-		// us out of concatenation in that case.
+		// `module.hot` marks HMR being enabled, and concatenation merges into a
+		// parent's scope where `module.hot.accept` would target the wrong id.
+		// `getConcatenationBailoutReason` keeps such a module out of it.
 		if (generateContext.concatenationScope && !module.hot) {
 			generateContext.concatenationScope.registerNamespaceExport(
 				ConcatenationScope.NAMESPACE_OBJECT_EXPORT
@@ -1417,15 +1405,11 @@ class HtmlGenerator extends Generator {
 		const acceptBlock = extracting
 			? [
 					"module.hot.accept();",
-					// Mask `<!-- … -->` comments — replace their characters
-					// with spaces, preserving length — before any tag regex
-					// runs. Masking (rather than deleting) keeps string offsets
-					// stable, so the body/title content can be sliced back out
-					// of the original HTML with comments intact, while a
-					// `<body>`/`</body>`/`<title>` inside a comment can no
-					// longer fool the tag regexes (the non-greedy `*?` would
-					// otherwise stop at the FIRST `</body>` it sees, even one
-					// inside a comment).
+					// WHY: a `</body>` inside a comment stops the non-greedy `*?` at the
+					// wrong place, so comments are masked before any tag regex runs.
+					// Masking rather than deleting keeps offsets stable, so the body and
+					// title can still be sliced out of the original HTML with their
+					// comments intact.
 					`${declare} __webpack_mask_comments__ = ${runtimeTemplate.returningFunction(
 						`h.replace(/<!--[\\s\\S]*?-->/g, ${runtimeTemplate.returningFunction(
 							'c.replace(/[^\\n]/g, " ")',
@@ -1469,9 +1453,8 @@ class HtmlGenerator extends Generator {
 						]
 					)};`,
 					// A `<script>` parsed out of a string carries the already-started flag,
-					// so appending that element would never run it. A fresh one with the
-					// same attributes and body does — which is what the reload this
-					// replaces would have done.
+					// so appending it would never run. A fresh one with the same attributes
+					// and body does, as the reload this replaces would have.
 					`${declare} __webpack_revive_script__ = ${runtimeTemplate.basicFunction(
 						"node",
 						[
@@ -1487,11 +1470,9 @@ class HtmlGenerator extends Generator {
 							"return script;"
 						]
 					)};`,
-					// Apply only the difference between the two authored heads, keyed on
-					// serialized markup: the runtime's own injected `<script>` / `<link>`
-					// are in neither string, so replacing `document.head` wholesale would
-					// tear them down while a delta never touches them. Reports whether it
-					// could — the caller reloads when it could not.
+					// Apply only the difference between the two authored heads: the
+					// runtime's own injected tags are in neither string, so replacing
+					// `document.head` wholesale would tear them down where a delta cannot.
 					`${declare} __webpack_patch_head__ = ${runtimeTemplate.basicFunction(
 						"oldHtml, newHtml",
 						[
@@ -1527,14 +1508,12 @@ class HtmlGenerator extends Generator {
 							`${declare} removed = surplus(oldChildren, newChildren);`,
 							`${declare} added = surplus(newChildren, oldChildren);`,
 							"if (removed.length === 0 && added.length === 0) return true;",
-							// A script that has run cannot be un-run, so dropping one is the
-							// one edit still worth a reload — but only a script that ran. A
-							// `type` that is neither a JavaScript MIME type nor `module` /
-							// `importmap` / `speculationrules` makes the element a data block
-							// (`application/ld+json`, `text/template`, …) the browser never
-							// executed, so removing it is as safe as removing a `<meta>`.
-							// Every JavaScript MIME essence ends in `script`, and a type
-							// nothing here recognizes falls back to the reload.
+							// WHY: a script that has run cannot be un-run, so dropping one is the
+							// single edit still worth a reload — but only a script that ran. A
+							// `type` that is neither a JavaScript MIME essence, all of which end
+							// in `script`, nor `module`, `importmap` or `speculationrules` is a
+							// data block the browser never executed, as safe to remove as a
+							// `<meta>`. An unrecognized type falls back to the reload.
 							`if (removed.some(${runtimeTemplate.basicFunction("node", [
 								'if (node.nodeName !== "SCRIPT") return false;',
 								`${declare} type = (node.getAttribute("type") || "").trim().toLowerCase();`,
@@ -1558,11 +1537,9 @@ class HtmlGenerator extends Generator {
 							]),
 							"}",
 							`for (${mutable} i = 0; i < live.length; i++) document.head.removeChild(live[i]);`,
-							// Pair each retained element with its live node, scanning only
-							// forward: an authored element that has moved relative to the
-							// others finds no match from there on, and a reorder the delta
-							// cannot express falls back to the reload. Injected nodes simply
-							// never match, so they neither anchor nor block anything.
+							// Pair each retained element with its live node, scanning forward
+							// only: a moved element then finds no match and falls back to the
+							// reload, while an injected node never matches either way.
 							`${declare} liveByNew = [];`,
 							`${mutable} searchFrom = 0;`,
 							`for (${mutable} i = 0; i < newChildren.length; i++) {`,
@@ -1642,13 +1619,22 @@ class HtmlGenerator extends Generator {
 	 */
 	generateError(error, module, generateContext) {
 		if (generateContext.type === HTML_TYPE) {
-			// Strip `<`, `>`, `--` runs from `error.message` so it can't escape the comment.
-			const safe = String(error.message)
+			// Strip `<`, `>`, `--` runs from the message so it can't escape the comment.
+			const safe = Generator.buildErrorMessage(
+				error,
+				generateContext.runtimeTemplate.requestShortener
+			)
 				.replace(/[<>]/g, "")
 				.replace(/-{2,}/g, (m) => `${"-".repeat(m.length - 1)} `);
 			return new RawSource(`<!-- webpack error: ${safe} -->`);
 		}
-		return new RawSource(Generator.throwBuildErrorCode(error));
+		return new RawSource(
+			Generator.throwBuildErrorCode(
+				error,
+				undefined,
+				generateContext.runtimeTemplate.requestShortener
+			)
+		);
 	}
 
 	/**
@@ -1658,10 +1644,9 @@ class HtmlGenerator extends Generator {
 	 */
 	updateHash(hash, updateHashContext) {
 		hash.update("html");
-		// Source-type set changes when html-type exposure flips; the HMR shim's
-		// `extracting` branch changes when the emit decision flips. They differ
-		// only for `"inline"` (exposes html, but does not emit), so hash both.
-		// One `_shouldExtract` walk covers both checks (expose = extract ∪ inline).
+		// The source-type set turns on html-type exposure and the HMR shim's
+		// `extracting` branch on the emit decision. They differ only for
+		// `"inline"`, which exposes html without emitting, so hash both.
 		const extract = this._shouldExtract(updateHashContext.module);
 		if (extract || this.options.extract === "inline") {
 			hash.update("html-type");