webpack 5.103.0 → 5.104.1

package/lib/schemes/HttpUriPlugin.js

@@ -34,6 +34,8 @@ const memoize = require("../util/memoize");
 const getHttp = memoize(() => require("http"));
 const getHttps = memoize(() => require("https"));
 
+const MAX_REDIRECTS = 5;
+
 /**
  * @param {typeof import("http") | typeof import("https")} request request
  * @param {string | URL | undefined} proxy proxy
@@ -200,6 +202,22 @@ const areLockfileEntriesEqual = (a, b) =>
 const entryToString = (entry) =>
 	`resolved: ${entry.resolved}, integrity: ${entry.integrity}, contentType: ${entry.contentType}`;
 
+/**
+ * Sanitize URL for inclusion in error messages
+ * @param {string} href URL string to sanitize
+ * @returns {string} sanitized URL text for logs/errors
+ */
+const sanitizeUrlForError = (href) => {
+	try {
+		const u = new URL(href);
+		return `${u.protocol}//${u.host}`;
+	} catch (_err) {
+		return String(href)
+			.slice(0, 200)
+			.replace(/[\r\n]/g, "");
+	}
+};
+
 class Lockfile {
 	constructor() {
 		this.version = 1;
@@ -317,7 +335,7 @@ const cachedWithoutKey = (fn) => {
  * @template R
  * @param {FnWithKey<T, R>} fn function
  * @param {FnWithKey<T, R>=} forceFn function for the second try
- * @returns {(FnWithKey<T, R>) & { force: FnWithKey<T, R> }} cached function
+ * @returns {FnWithKey<T, R> & { force: FnWithKey<T, R> }} cached function
  */
 const cachedWithKey = (fn, forceFn = fn) => {
 	/**
@@ -636,12 +654,47 @@ class HttpUriPlugin {
 				};
 
 				for (const { scheme, fetch } of schemes) {
+					/**
+					 * @param {string} location Location header value (relative or absolute)
+					 * @param {string} base current absolute URL
+					 * @returns {string} absolute, validated redirect target
+					 */
+					const validateRedirectLocation = (location, base) => {
+						let nextUrl;
+						try {
+							nextUrl = new URL(location, base);
+						} catch (err) {
+							throw new Error(
+								`Invalid redirect URL: ${sanitizeUrlForError(location)}`,
+								{ cause: err }
+							);
+						}
+						if (nextUrl.protocol !== "http:" && nextUrl.protocol !== "https:") {
+							throw new Error(
+								`Redirected URL uses disallowed protocol: ${sanitizeUrlForError(nextUrl.href)}`
+							);
+						}
+						if (!isAllowed(nextUrl.href)) {
+							throw new Error(
+								`${nextUrl.href} doesn't match the allowedUris policy after redirect. These URIs are allowed:\n${allowedUris
+									.map((uri) => ` - ${uri}`)
+									.join("\n")}`
+							);
+						}
+						return nextUrl.href;
+					};
 					/**
 					 * @param {string} url URL
 					 * @param {string | null} integrity integrity
 					 * @param {(err: Error | null, resolveContentResult?: ResolveContentResult) => void} callback callback
+					 * @param {number=} redirectCount number of followed redirects
 					 */
-					const resolveContent = (url, integrity, callback) => {
+					const resolveContent = (
+						url,
+						integrity,
+						callback,
+						redirectCount = 0
+					) => {
 						/**
 						 * @param {Error | null} err error
 						 * @param {FetchResult=} _result fetch result
@@ -653,8 +706,18 @@ class HttpUriPlugin {
 							const result = /** @type {FetchResult} */ (_result);
 
 							if ("location" in result) {
+								// Validate redirect target before following
+								let absolute;
+								try {
+									absolute = validateRedirectLocation(result.location, url);
+								} catch (err_) {
+									return callback(/** @type {Error} */ (err_));
+								}
+								if (redirectCount >= MAX_REDIRECTS) {
+									return callback(new Error("Too many redirects"));
+								}
 								return resolveContent(
-									result.location,
+									absolute,
 									integrity,
 									(err, innerResult) => {
 										if (err) return callback(err);
@@ -665,7 +728,8 @@ class HttpUriPlugin {
 											content,
 											storeLock: storeLock && result.storeLock
 										});
-									}
+									},
+									redirectCount + 1
 								);
 							}
 
@@ -781,9 +845,16 @@ class HttpUriPlugin {
 								res.statusCode >= 301 &&
 								res.statusCode <= 308
 							) {
-								const result = {
-									location: new URL(location, url).href
-								};
+								let absolute;
+								try {
+									absolute = validateRedirectLocation(location, url);
+								} catch (err) {
+									logger.log(
+										`GET ${url} [${res.statusCode}] -> ${String(location)} (rejected: ${/** @type {Error} */ (err).message})`
+									);
+									return callback(/** @type {Error} */ (err));
+								}
+								const result = { location: absolute };
 								if (
 									!cachedResult ||
 									!("location" in cachedResult) ||
@@ -882,12 +953,28 @@ class HttpUriPlugin {
 					 * @returns {boolean} true when allowed, otherwise false
 					 */
 					const isAllowed = (uri) => {
+						let parsedUri;
+						try {
+							// Parse the URI to prevent userinfo bypass attacks
+							// (e.g., http://allowed@malicious/path where @malicious is the actual host)
+							parsedUri = new URL(uri);
+						} catch (_err) {
+							return false;
+						}
 						for (const allowed of allowedUris) {
 							if (typeof allowed === "string") {
-								if (uri.startsWith(allowed)) return true;
+								let parsedAllowed;
+								try {
+									parsedAllowed = new URL(allowed);
+								} catch (_err) {
+									continue;
+								}
+								if (parsedUri.href.startsWith(parsedAllowed.href)) {
+									return true;
+								}
 							} else if (typeof allowed === "function") {
-								if (allowed(uri)) return true;
-							} else if (allowed.test(uri)) {
+								if (allowed(parsedUri.href)) return true;
+							} else if (allowed.test(parsedUri.href)) {
 								return true;
 							}
 						}

package/lib/serialization/AggregateErrorSerializer.js

@@ -7,7 +7,7 @@
 /** @typedef {import("./ObjectMiddleware").ObjectDeserializerContext} ObjectDeserializerContext */
 /** @typedef {import("./ObjectMiddleware").ObjectSerializerContext} ObjectSerializerContext */
 
-/** @typedef {Error & { cause: unknown, errors: EXPECTED_ANY[] }} AggregateError */
+/** @typedef {Error & { cause?: unknown, errors: EXPECTED_ANY[] }} AggregateError */
 
 class AggregateErrorSerializer {
 	/**
@@ -27,7 +27,6 @@ class AggregateErrorSerializer {
 	 */
 	deserialize(context) {
 		const errors = context.read();
-		// @ts-expect-error ES2018 doesn't `AggregateError`, but it can be used by developers
 		// eslint-disable-next-line n/no-unsupported-features/es-builtins, n/no-unsupported-features/es-syntax, unicorn/error-message
 		const err = new AggregateError(errors);
 

package/lib/serialization/ObjectMiddleware.js

@@ -157,11 +157,9 @@ jsTypes.set(ReferenceError, new ErrorObjectSerializer(ReferenceError));
 jsTypes.set(SyntaxError, new ErrorObjectSerializer(SyntaxError));
 jsTypes.set(TypeError, new ErrorObjectSerializer(TypeError));
 
-// @ts-expect-error ES2018 doesn't `AggregateError`, but it can be used by developers
 // eslint-disable-next-line n/no-unsupported-features/es-builtins, n/no-unsupported-features/es-syntax
 if (typeof AggregateError !== "undefined") {
 	jsTypes.set(
-		// @ts-expect-error ES2018 doesn't `AggregateError`, but it can be used by developers
 		// eslint-disable-next-line n/no-unsupported-features/es-builtins, n/no-unsupported-features/es-syntax
 		AggregateError,
 		new AggregateErrorSerializer()

package/lib/serialization/SingleItemMiddleware.js

@@ -8,7 +8,7 @@ const SerializerMiddleware = require("./SerializerMiddleware");
 
 /** @typedef {EXPECTED_ANY} DeserializedType */
 /** @typedef {EXPECTED_ANY[]} SerializedType */
-/** @typedef {{}} Context */
+/** @typedef {EXPECTED_OBJECT} Context */
 
 /**
  * @extends {SerializerMiddleware<DeserializedType, SerializedType, Context>}

package/lib/sharing/ConsumeSharedModule.js

@@ -8,7 +8,7 @@
 const { RawSource } = require("webpack-sources");
 const AsyncDependenciesBlock = require("../AsyncDependenciesBlock");
 const Module = require("../Module");
-const { CONSUME_SHARED_TYPES } = require("../ModuleSourceTypesConstants");
+const { CONSUME_SHARED_TYPES } = require("../ModuleSourceTypeConstants");
 const {
 	WEBPACK_MODULE_TYPE_CONSUME_SHARED_MODULE
 } = require("../ModuleTypeConstants");

package/lib/sharing/ConsumeSharedPlugin.js

@@ -119,11 +119,13 @@ class ConsumeSharedPlugin {
 					normalModuleFactory
 				);
 
-				/** @type {Map<string, ConsumeOptions>} */
+				/** @typedef {Map<string, ConsumeOptions>} Consumes */
+
+				/** @type {Consumes} */
 				let unresolvedConsumes;
-				/** @type {Map<string, ConsumeOptions>} */
+				/** @type {Consumes} */
 				let resolvedConsumes;
-				/** @type {Map<string, ConsumeOptions>} */
+				/** @type {Consumes} */
 				let prefixedConsumes;
 				const promise = resolveMatchedConfigs(compilation, this._consumes).then(
 					({ resolved, unresolved, prefixed }) => {

package/lib/sharing/ProvideSharedModule.js

@@ -7,7 +7,7 @@
 
 const AsyncDependenciesBlock = require("../AsyncDependenciesBlock");
 const Module = require("../Module");
-const { SHARED_INIT_TYPES } = require("../ModuleSourceTypesConstants");
+const { SHARED_INIT_TYPES } = require("../ModuleSourceTypeConstants");
 const { WEBPACK_MODULE_TYPE_PROVIDE } = require("../ModuleTypeConstants");
 const RuntimeGlobals = require("../RuntimeGlobals");
 const makeSerializable = require("../util/makeSerializable");

package/lib/sharing/resolveMatchedConfigs.js

@@ -10,14 +10,20 @@ const LazySet = require("../util/LazySet");
 
 /** @typedef {import("enhanced-resolve").ResolveContext} ResolveContext */
 /** @typedef {import("../Compilation")} Compilation */
+/** @typedef {import("../Compilation").FileSystemDependencies} FileSystemDependencies */
 /** @typedef {import("../ResolverFactory").ResolveOptionsWithDependencyType} ResolveOptionsWithDependencyType */
 
+/**
+ * @template T
+ * @typedef {Map<string, T>} MatchedConfigsItem
+ */
+
 /**
  * @template T
  * @typedef {object} MatchedConfigs
- * @property {Map<string, T>} resolved
- * @property {Map<string, T>} unresolved
- * @property {Map<string, T>} prefixed
+ * @property {MatchedConfigsItem<T>} resolved
+ * @property {MatchedConfigsItem<T>} unresolved
+ * @property {MatchedConfigsItem<T>} prefixed
  */
 
 /** @type {ResolveOptionsWithDependencyType} */
@@ -30,11 +36,11 @@ const RESOLVE_OPTIONS = { dependencyType: "esm" };
  * @returns {Promise<MatchedConfigs<T>>} resolved matchers
  */
 module.exports.resolveMatchedConfigs = (compilation, configs) => {
-	/** @type {Map<string, T>} */
+	/** @type {MatchedConfigsItem<T>} */
 	const resolved = new Map();
-	/** @type {Map<string, T>} */
+	/** @type {MatchedConfigsItem<T>} */
 	const unresolved = new Map();
-	/** @type {Map<string, T>} */
+	/** @type {MatchedConfigsItem<T>} */
 	const prefixed = new Map();
 	/** @type {ResolveContext} */
 	const resolveContext = {
@@ -84,15 +90,15 @@ module.exports.resolveMatchedConfigs = (compilation, configs) => {
 		})
 	).then(() => {
 		compilation.contextDependencies.addAll(
-			/** @type {LazySet<string>} */
+			/** @type {FileSystemDependencies} */
 			(resolveContext.contextDependencies)
 		);
 		compilation.fileDependencies.addAll(
-			/** @type {LazySet<string>} */
+			/** @type {FileSystemDependencies} */
 			(resolveContext.fileDependencies)
 		);
 		compilation.missingDependencies.addAll(
-			/** @type {LazySet<string>} */
+			/** @type {FileSystemDependencies} */
 			(resolveContext.missingDependencies)
 		);
 		return { resolved, unresolved, prefixed };

package/lib/sharing/utils.js

@@ -379,7 +379,7 @@ const getRequiredVersionFromDescriptionFile = (data, packageName) => {
 			packageName in dependency
 		) {
 			return normalizeVersion(
-				/** @type {Exclude<JsonPrimitive, null | boolean| number>} */ (
+				/** @type {Exclude<JsonPrimitive, null | boolean | number>} */ (
 					dependency[packageName]
 				)
 			);

package/lib/stats/DefaultStatsFactoryPlugin.js

@@ -49,6 +49,8 @@ const { makePathsRelative, parseResource } = require("../util/identifier");
 /** @typedef {import("../ModuleGraphConnection")} ModuleGraphConnection */
 /** @typedef {import("../ModuleProfile")} ModuleProfile */
 /** @typedef {import("../WebpackError")} WebpackError */
+/** @typedef {import("../serialization/AggregateErrorSerializer").AggregateError} AggregateError */
+/** @typedef {import("../serialization/ErrorObjectSerializer").ErrorWithCause} ErrorWithCause */
 /** @typedef {import("../ExportsInfo").ExportInfoName} ExportInfoName */
 
 /**
@@ -370,13 +372,17 @@ const uniqueArray = (items, selector) => {
 const uniqueOrderedArray = (items, selector, comparator) =>
 	uniqueArray(items, selector).sort(comparator);
 
-/** @template T @template R @typedef {{ [P in keyof T]: R }} MappedValues<T, R> */
+/**
+ * @template T
+ * @template R
+ * @typedef {{ [P in keyof T]: R }} MappedValues<T, R>
+ */
 
 /**
  * @template {object} T
  * @template {object} R
  * @param {T} obj object to be mapped
- * @param {function(T[keyof T], keyof T): R} fn mapping function
+ * @param {(value: T[keyof T], key: keyof T) => R} fn mapping function
  * @returns {MappedValues<T, R>} mapped object
  */
 const mapObject = (obj, fn) => {
@@ -406,9 +412,6 @@ const countWithChildren = (compilation, getItems) => {
 	return count;
 };
 
-/** @typedef {Error & { cause?: unknown }} ErrorWithCause */
-/** @typedef {Error & { errors: EXPECTED_ANY[] }} AggregateError */
-
 /** @type {ExtractorsByOption<string | ErrorWithCause | AggregateError | WebpackError, StatsError>} */
 const EXTRACT_ERROR = {
 	_: (object, error, context, { requestShortener }) => {

package/lib/stats/DefaultStatsPresetPlugin.js

@@ -30,7 +30,7 @@ const applyDefaults = (options, defaults) => {
 	}
 };
 
-/** @typedef {{ [Key in Exclude<StatsValue, boolean | object | "normal">]: StatsOptions }} NamedPresets */
+/** @typedef {{ [Key in Exclude<StatsValue, boolean | EXPECTED_OBJECT | "normal">]: StatsOptions }} NamedPresets */
 
 /** @type {NamedPresets} */
 const NAMED_PRESETS = {

package/lib/stats/DefaultStatsPrinterPlugin.js

@@ -76,7 +76,7 @@ const getResourceName = (resource) => {
 
 /**
  * @param {string} name module name
- * @returns {[string,string]} prefix and module name
+ * @returns {[string, string]} prefix and module name
  */
 const getModuleName = (name) => {
 	const [, prefix, resource] =

package/lib/util/StringXor.js

@@ -36,7 +36,7 @@
  */
 class StringXor {
 	constructor() {
-		/** @type {Buffer|undefined} */
+		/** @type {Buffer | undefined} */
 		this._value = undefined;
 	}
 

package/lib/util/URLAbsoluteSpecifier.js

@@ -5,7 +5,7 @@
 
 "use strict";
 
-/** @typedef {(error: Error|null, result?: Buffer) => void} ErrorFirstCallback */
+/** @typedef {(error: Error | null, result?: Buffer) => void} ErrorFirstCallback */
 
 const backSlashCharCode = "\\".charCodeAt(0);
 const slashCharCode = "/".charCodeAt(0);
@@ -25,7 +25,7 @@ const queryCharCode = "?".charCodeAt(0);
  * e.g. Absolute specifiers like 'file:///user/webpack/index.js'
  * https://tools.ietf.org/html/rfc3986#section-3.1
  * @param {string} specifier specifier
- * @returns {string|undefined} scheme if absolute URL specifier provided
+ * @returns {string | undefined} scheme if absolute URL specifier provided
  */
 function getScheme(specifier) {
 	const start = specifier.charCodeAt(0);

package/lib/util/binarySearchBounds.js

@@ -8,8 +8,8 @@
 /* cspell:disable-next-line */
 // Refactor: Peter Somogyvari @petermetz
 
-/** @typedef {">=" | "<=" | "<" | ">" | "-" } BinarySearchPredicate */
-/** @typedef {"GE" | "GT" | "LT" | "LE" | "EQ" } SearchPredicateSuffix */
+/** @typedef {">=" | "<=" | "<" | ">" | "-"} BinarySearchPredicate */
+/** @typedef {"GE" | "GT" | "LT" | "LE" | "EQ"} SearchPredicateSuffix */
 
 /**
  * Helper function for compiling binary search functions.

package/lib/util/comparators.js

@@ -57,7 +57,7 @@ const createCachedParameterizedComparator = (fn) => {
 		/**
 		 * @param {T} a first item
 		 * @param {T} b second item
-		 * @returns {-1|0|1} compare result
+		 * @returns {-1 | 0 | 1} compare result
 		 */
 		const result = fn.bind(null, arg);
 		map.set(/** @type {EXPECTED_OBJECT} */ (arg), result);
@@ -90,7 +90,7 @@ const compareIterables = (elementComparator) => {
 	/**
 	 * @param {Iterable<T>} a first value
 	 * @param {Iterable<T>} b second value
-	 * @returns {-1|0|1} compare result
+	 * @returns {-1 | 0 | 1} compare result
 	 */
 	const result = (a, b) => {
 		const aI = a[Symbol.iterator]();
@@ -115,7 +115,7 @@ const compareIterables = (elementComparator) => {
  * Compare two locations
  * @param {DependencyLocation} a A location node
  * @param {DependencyLocation} b A location node
- * @returns {-1|0|1} sorting comparator value
+ * @returns {-1 | 0 | 1} sorting comparator value
  */
 const compareLocations = (a, b) => {
 	const isObjectA = typeof a === "object" && a !== null;
@@ -178,7 +178,7 @@ const compareLocations = (a, b) => {
  * @param {ChunkGraph} chunkGraph the chunk graph
  * @param {Module} a module
  * @param {Module} b module
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 const compareModulesById = (chunkGraph, a, b) =>
 	compareIds(
@@ -189,7 +189,7 @@ const compareModulesById = (chunkGraph, a, b) =>
 /**
  * @param {number} a number
  * @param {number} b number
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 const compareNumbers = (a, b) => {
 	if (typeof a !== typeof b) {
@@ -203,7 +203,7 @@ const compareNumbers = (a, b) => {
 /**
  * @param {string} a string
  * @param {string} b string
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 const compareStringsNumeric = (a, b) => {
 	const aLength = a.length;
@@ -275,7 +275,7 @@ const compareStringsNumeric = (a, b) => {
  * @param {ModuleGraph} moduleGraph the module graph
  * @param {Module} a module
  * @param {Module} b module
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 const compareModulesByPostOrderIndexOrIdentifier = (moduleGraph, a, b) => {
 	const cmp = compareNumbers(
@@ -290,7 +290,7 @@ const compareModulesByPostOrderIndexOrIdentifier = (moduleGraph, a, b) => {
  * @param {ModuleGraph} moduleGraph the module graph
  * @param {Module} a module
  * @param {Module} b module
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 const compareModulesByPreOrderIndexOrIdentifier = (moduleGraph, a, b) => {
 	const cmp = compareNumbers(
@@ -305,7 +305,7 @@ const compareModulesByPreOrderIndexOrIdentifier = (moduleGraph, a, b) => {
  * @param {ChunkGraph} chunkGraph the chunk graph
  * @param {Module} a module
  * @param {Module} b module
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 const compareModulesByIdOrIdentifier = (chunkGraph, a, b) => {
 	const cmp = compareIds(
@@ -327,7 +327,7 @@ const compareChunks = (chunkGraph, a, b) => chunkGraph.compareChunks(a, b);
 /**
  * @param {string} a first string
  * @param {string} b second string
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 const compareStrings = (a, b) => {
 	if (a < b) return -1;
@@ -408,7 +408,7 @@ const concatComparators = (c1, c2, ...cRest) => {
 	/**
 	 * @param {T} a first value
 	 * @param {T} b second value
-	 * @returns {-1|0|1} compare result
+	 * @returns {-1 | 0 | 1} compare result
 	 */
 	const result = (a, b) => {
 		const res = c1(a, b);
@@ -440,7 +440,7 @@ const compareSelect = (getter, comparator) => {
 	/**
 	 * @param {T} a first value
 	 * @param {T} b second value
-	 * @returns {-1|0|1} compare result
+	 * @returns {-1 | 0 | 1} compare result
 	 */
 	const result = (a, b) => {
 		const aValue = getter(a);
@@ -511,47 +511,42 @@ const compareChunksNatural = (chunkGraph) => {
  * https://github.com/webpack/webpack/pull/19686
  * @param {Dependency[]} dependencies dependencies
  * @param {WeakMap<Dependency, DependencySourceOrder>} dependencySourceOrderMap dependency source order map
+ * @param {((dep: Dependency, index: number) => void)=} onDependencyReSort optional callback to set index for each dependency
  * @returns {void}
  */
-const sortWithSourceOrder = (dependencies, dependencySourceOrderMap) => {
-	/**
-	 * @param {Dependency} dep dependency
-	 * @returns {number} source order
-	 */
-	const getSourceOrder = (dep) => {
-		if (dependencySourceOrderMap.has(dep)) {
-			const { main } = /** @type {DependencySourceOrder} */ (
-				dependencySourceOrderMap.get(dep)
-			);
-			return main;
-		}
-		return /** @type {number} */ (
-			/** @type {ModuleDependency} */ (dep).sourceOrder
-		);
-	};
-
-	/**
-	 * If the sourceOrder is a number, it means the dependency needs to be sorted.
-	 * @param {number | undefined} sourceOrder sourceOrder
-	 * @returns {boolean} needReSort
-	 */
-	const needReSort = (sourceOrder) => {
-		if (typeof sourceOrder === "number") {
-			return true;
-		}
-		return false;
-	};
-
-	// Extract dependencies with sourceOrder and sort them
+const sortWithSourceOrder = (
+	dependencies,
+	dependencySourceOrderMap,
+	onDependencyReSort
+) => {
+	/** @type {{dep: Dependency, main: number, sub: number}[]} */
 	const withSourceOrder = [];
+	/** @type {number[]} */
+	const positions = [];
 
-	// First pass: collect dependencies with sourceOrder
 	for (let i = 0; i < dependencies.length; i++) {
 		const dep = dependencies[i];
-		const sourceOrder = getSourceOrder(dep);
-
-		if (needReSort(sourceOrder)) {
-			withSourceOrder.push({ dep, sourceOrder, originalIndex: i });
+		const cached = dependencySourceOrderMap.get(dep);
+
+		if (cached) {
+			positions.push(i);
+			withSourceOrder.push({
+				dep,
+				main: cached.main,
+				sub: cached.sub
+			});
+		} else {
+			const sourceOrder = /** @type {number | undefined} */ (
+				/** @type {ModuleDependency} */ (dep).sourceOrder
+			);
+			if (typeof sourceOrder === "number") {
+				positions.push(i);
+				withSourceOrder.push({
+					dep,
+					main: sourceOrder,
+					sub: 0
+				});
+			}
 		}
 	}
 
@@ -559,37 +554,19 @@ const sortWithSourceOrder = (dependencies, dependencySourceOrderMap) => {
 		return;
 	}
 
-	// Sort dependencies with sourceOrder
 	withSourceOrder.sort((a, b) => {
-		// Handle both dependencies in map case
-		if (
-			dependencySourceOrderMap.has(a.dep) &&
-			dependencySourceOrderMap.has(b.dep)
-		) {
-			const { main: mainA, sub: subA } = /** @type {DependencySourceOrder} */ (
-				dependencySourceOrderMap.get(a.dep)
-			);
-			const { main: mainB, sub: subB } = /** @type {DependencySourceOrder} */ (
-				dependencySourceOrderMap.get(b.dep)
-			);
-			if (mainA === mainB) {
-				return compareNumbers(subA, subB);
-			}
-			return compareNumbers(mainA, mainB);
+		if (a.main !== b.main) {
+			return compareNumbers(a.main, b.main);
 		}
-
-		return compareNumbers(a.sourceOrder, b.sourceOrder);
+		return compareNumbers(a.sub, b.sub);
 	});
 
-	// Second pass: build result array
-	let sortedIndex = 0;
-	for (let i = 0; i < dependencies.length; i++) {
-		const dep = dependencies[i];
-		const sourceOrder = getSourceOrder(dep);
-
-		if (needReSort(sourceOrder)) {
-			dependencies[i] = withSourceOrder[sortedIndex].dep;
-			sortedIndex++;
+	// Second pass: place sorted deps back to original positions
+	for (let i = 0; i < positions.length; i++) {
+		const depIndex = positions[i];
+		dependencies[depIndex] = withSourceOrder[i].dep;
+		if (onDependencyReSort) {
+			onDependencyReSort(dependencies[depIndex], depIndex);
 		}
 	}
 };
@@ -601,7 +578,7 @@ module.exports.compareChunks =
 /**
  * @param {Chunk} a chunk
  * @param {Chunk} b chunk
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 module.exports.compareChunksById = (a, b) =>
 	compareIds(/** @type {ChunkId} */ (a.id), /** @type {ChunkId} */ (b.id));
@@ -622,7 +599,7 @@ module.exports.compareModulesByIdOrIdentifier =
 /**
  * @param {Module} a module
  * @param {Module} b module
- * @returns {-1|0|1} compare result
+ * @returns {-1 | 0 | 1} compare result
  */
 module.exports.compareModulesByIdentifier = (a, b) =>
 	compareIds(a.identifier(), b.identifier());