webpack 5.106.2 → 5.107.1

package/lib/css/walkCssTokens.js

@@ -5,6 +5,8 @@
 
 "use strict";
 
+const { makeCacheable } = require("../util/identifier");
+
 /**
  * Defines the css token callbacks type used by this module.
  * @typedef {object} CssTokenCallbacks
@@ -161,6 +163,143 @@ const isIdentStartCodePoint = (cc) =>
 	cc === CC_LOW_LINE ||
 	cc >= 0x80;
 
+const REGEX_SINGLE_ESCAPE = /[ -,./:-@[\]^`{-~]/;
+const REGEX_EXCESSIVE_SPACES = /(^|\\+)?(\\[A-F0-9]{1,6}) (?![a-fA-F0-9 ])/g;
+const REGEX_CTRL_WHITESPACE = /[\t\n\f\r\v]/;
+const REGEX_LEADING_HYPHEN_DIGIT = /^-[-\d]/;
+const REGEX_DIGIT = /\d/;
+const CONTAINS_ESCAPE = /\\/;
+
+/**
+ * Returns escaped identifier.
+ * @param {string} str string
+ * @returns {string} escaped identifier
+ */
+const _escapeIdentifier = (str) => {
+	let output = "";
+	let counter = 0;
+
+	while (counter < str.length) {
+		const character = str.charAt(counter++);
+
+		/** @type {string} */
+		let value;
+
+		if (REGEX_CTRL_WHITESPACE.test(character)) {
+			const codePoint = character.charCodeAt(0);
+
+			value = `\\${codePoint.toString(16).toUpperCase()} `;
+		} else if (character === "\\" || REGEX_SINGLE_ESCAPE.test(character)) {
+			value = `\\${character}`;
+		} else {
+			value = character;
+		}
+
+		output += value;
+	}
+
+	const firstChar = str.charAt(0);
+
+	if (REGEX_LEADING_HYPHEN_DIGIT.test(output)) {
+		output = `\\-${output.slice(1)}`;
+	} else if (REGEX_DIGIT.test(firstChar)) {
+		output = `\\3${firstChar} ${output.slice(1)}`;
+	}
+
+	// Remove spaces after `\HEX` escapes that are not followed by a hex digit,
+	// since they’re redundant. Note that this is only possible if the escape
+	// sequence isn’t preceded by an odd number of backslashes.
+	output = output.replace(REGEX_EXCESSIVE_SPACES, ($0, $1, $2) => {
+		if ($1 && $1.length % 2) {
+			// It’s not safe to remove the space, so don’t.
+			return $0;
+		}
+
+		// Strip the space.
+		return ($1 || "") + $2;
+	});
+
+	return output;
+};
+
+/**
+ * Returns hex.
+ * @param {string} str string
+ * @returns {[string, number] | undefined} hex
+ */
+const gobbleHex = (str) => {
+	const lower = str.toLowerCase();
+	let hex = "";
+	let spaceTerminated = false;
+
+	for (let i = 0; i < 6 && lower[i] !== undefined; i++) {
+		const code = lower.charCodeAt(i);
+		// check to see if we are dealing with a valid hex char [a-f|0-9]
+		const valid = (code >= 97 && code <= 102) || (code >= 48 && code <= 57);
+		// https://drafts.csswg.org/css-syntax/#consume-escaped-code-point
+		spaceTerminated = code === 32;
+		if (!valid) break;
+		hex += lower[i];
+	}
+
+	if (hex.length === 0) return undefined;
+
+	const codePoint = Number.parseInt(hex, 16);
+	const isSurrogate = codePoint >= 0xd800 && codePoint <= 0xdfff;
+
+	// Add special case for
+	// "If this number is zero, or is for a surrogate, or is greater than the maximum allowed code point"
+	// https://drafts.csswg.org/css-syntax/#maximum-allowed-code-point
+	if (isSurrogate || codePoint === 0x0000 || codePoint > 0x10ffff) {
+		return ["�", hex.length + (spaceTerminated ? 1 : 0)];
+	}
+
+	return [
+		String.fromCodePoint(codePoint),
+		hex.length + (spaceTerminated ? 1 : 0)
+	];
+};
+
+/**
+ * Unescape identifier.
+ * @param {string} str string
+ * @returns {string} unescaped string
+ */
+const _unescapeIdentifier = (str) => {
+	const needToProcess = CONTAINS_ESCAPE.test(str);
+	if (!needToProcess) return str;
+	let ret = "";
+	for (let i = 0; i < str.length; i++) {
+		if (str[i] === "\\") {
+			const gobbled = gobbleHex(str.slice(i + 1, i + 7));
+			if (gobbled !== undefined) {
+				ret += gobbled[0];
+				i += gobbled[1];
+				continue;
+			}
+			// Retain a pair of \\ if double escaped `\\\\`
+			// https://github.com/postcss/postcss-selector-parser/commit/268c9a7656fb53f543dc620aa5b73a30ec3ff20e
+			if (str[i + 1] === "\\") {
+				ret += "\\";
+				i += 1;
+				continue;
+			}
+			// if \\ is at the end of the string retain it
+			// https://github.com/postcss/postcss-selector-parser/commit/01a6b346e3612ce1ab20219acc26abdc259ccefb
+			if (str.length === i + 1) {
+				ret += str[i];
+			}
+			continue;
+		}
+		ret += str[i];
+	}
+
+	return ret;
+};
+
+const escapeIdentifier = makeCacheable(_escapeIdentifier);
+const unescapeIdentifier = makeCacheable(_unescapeIdentifier);
+
 /** @type {CharHandler} */
 const consumeDelimToken = (input, pos, callbacks) => {
 	// Return a <delim-token> with its value set to the current input code point.
@@ -1632,11 +1771,11 @@ const eatImageSetStrings = (input, pos, cbs) => {
  * @param {string} input input
  * @param {number} pos position
  * @param {CssTokenCallbacks} cbs callbacks
- * @returns {[[number, number, number, number] | undefined, [number, number] | undefined, [number, number] | undefined, [number, number] | undefined]} positions of top level tokens
+ * @returns {[[number, number, number, number, boolean?] | undefined, [number, number] | undefined, [number, number] | undefined, [number, number] | undefined]} positions of top level tokens — the URL tuple's optional 5th element is `true` when the URL was given as an identifier (CSS Modules `@value` reference)
  */
 const eatImportTokens = (input, pos, cbs) => {
 	const result =
-		/** @type {[[number, number, number, number] | undefined, [number, number] | undefined, [number, number] | undefined, [number, number] | undefined]} */
+		/** @type {[[number, number, number, number, boolean?] | undefined, [number, number] | undefined, [number, number] | undefined, [number, number] | undefined]} */
 		(Array.from({ length: 4 }));
 
 	/** @type {0 | 1 | 2 | undefined} */
@@ -1740,6 +1879,11 @@ const eatImportTokens = (input, pos, cbs) => {
 				if (name === "layer") {
 					result[1] = [start, end];
 					scope = undefined;
+				} else if (result[0] === undefined) {
+					// Capture as URL identifier (e.g. `@import myValue;` where
+					// `myValue` is a CSS Modules `@value` definition).
+					result[0] = [start, end, start, end, true];
+					scope = undefined;
 				}
 			}
 
@@ -1868,7 +2012,9 @@ module.exports.eatUntil = eatUntil;
 module.exports.eatWhiteLine = eatWhiteLine;
 module.exports.eatWhitespace = eatWhitespace;
 module.exports.eatWhitespaceAndComments = eatWhitespaceAndComments;
+module.exports.escapeIdentifier = escapeIdentifier;
 module.exports.isIdentStartCodePoint = isIdentStartCodePoint;
 module.exports.isWhiteSpace = _isWhiteSpace;
 module.exports.skipCommentsAndEatIdentSequence =
 	skipCommentsAndEatIdentSequence;
+module.exports.unescapeIdentifier = unescapeIdentifier;

package/lib/dependencies/AMDRequireDependenciesBlockParserPlugin.js

@@ -6,7 +6,7 @@
 "use strict";
 
 const RuntimeGlobals = require("../RuntimeGlobals");
-const UnsupportedFeatureWarning = require("../UnsupportedFeatureWarning");
+const UnsupportedFeatureWarning = require("../errors/UnsupportedFeatureWarning");
 const AMDRequireArrayDependency = require("./AMDRequireArrayDependency");
 const AMDRequireContextDependency = require("./AMDRequireContextDependency");
 const AMDRequireDependenciesBlock = require("./AMDRequireDependenciesBlock");

package/lib/dependencies/CommonJsDependencyHelpers.js

@@ -6,11 +6,72 @@
 "use strict";
 
 const RuntimeGlobals = require("../RuntimeGlobals");
+const { propertyAccess } = require("../util/property");
 
 /** @typedef {import("../Module")} Module */
 /** @typedef {import("../Module").RuntimeRequirements} RuntimeRequirements */
+/** @typedef {import("../ModuleGraph")} ModuleGraph */
+/** @typedef {import("../util/runtime").RuntimeSpec} RuntimeSpec */
 /** @typedef {"exports" | "module.exports" | "this" | "Object.defineProperty(exports)" | "Object.defineProperty(module.exports)" | "Object.defineProperty(this)"} CommonJSDependencyBaseKeywords */
 
+/**
+ * The well-known name of the ESM named export that, when present, is unwrapped
+ * by CommonJS `require()` to match Node.js v23+ `require(esm)` semantics:
+ * https://nodejs.org/docs/latest/api/modules.html#loading-ecmascript-modules-using-require
+ */
+const ESM_MODULE_EXPORTS_NAME = "module.exports";
+
+/**
+ * Whether `require()` of `importedModule` would trigger Node.js's
+ * `require(esm)` `"module.exports"` named-export unwrap. This is the
+ * usage-independent eligibility check: it only looks at module type and
+ * whether the export is declared, so it can be safely used from
+ * `getReferencedExports` before usage info is finalized (otherwise the
+ * check would be circular — we'd need `"module.exports"` to already be
+ * marked used in order to ask whether to mark it used).
+ * @param {Module} importedModule the imported module
+ * @param {ModuleGraph} moduleGraph the module graph
+ * @returns {boolean} true if `require()` should unwrap `"module.exports"`
+ */
+const isRequireEsmModuleExportsModule = (importedModule, moduleGraph) => {
+	if (importedModule.getExportsType(moduleGraph, false) !== "namespace") {
+		return false;
+	}
+	const exportsInfo = moduleGraph.getExportsInfo(importedModule);
+	const exportInfo = exportsInfo.getReadOnlyExportInfo(ESM_MODULE_EXPORTS_NAME);
+	return exportInfo.provided === true;
+};
+
+/**
+ * When CommonJS `require()` resolves to an ES module that has a named export
+ * with the literal string name `"module.exports"`, Node.js returns the value of
+ * that export instead of the namespace object. Returns the property-access
+ * expression to apply to the require result for that unwrapping, or `null` if
+ * the imported module is not eligible (not strictly ESM, or no such export,
+ * or the export was tree-shaken away).
+ * @param {Module} importedModule the imported module
+ * @param {ModuleGraph} moduleGraph the module graph
+ * @param {RuntimeSpec} runtime the runtime for which the module is analysed
+ * @returns {string | null} property-access expression (e.g. `["module.exports"]`), or `null`
+ */
+const getRequireEsmModuleExportsAccess = (
+	importedModule,
+	moduleGraph,
+	runtime
+) => {
+	if (!isRequireEsmModuleExportsModule(importedModule, moduleGraph)) {
+		return null;
+	}
+	const exportsInfo = moduleGraph.getExportsInfo(importedModule);
+	const usedName = exportsInfo.getUsedName([ESM_MODULE_EXPORTS_NAME], runtime);
+	if (usedName === false) return null;
+	return propertyAccess(/** @type {readonly string[]} */ (usedName));
+};
+
+module.exports.ESM_MODULE_EXPORTS_NAME = ESM_MODULE_EXPORTS_NAME;
+module.exports.getRequireEsmModuleExportsAccess =
+	getRequireEsmModuleExportsAccess;
+
 /**
  * Returns type and base.
  * @param {CommonJSDependencyBaseKeywords} depBase commonjs dependency base
@@ -64,3 +125,5 @@ module.exports.handleDependencyBase = (
 
 	return [type, base];
 };
+module.exports.isRequireEsmModuleExportsModule =
+	isRequireEsmModuleExportsModule;

package/lib/dependencies/CommonJsExportRequireDependency.js

@@ -11,7 +11,12 @@ const Template = require("../Template");
 const { equals } = require("../util/ArrayHelpers");
 const makeSerializable = require("../util/makeSerializable");
 const { propertyAccess } = require("../util/property");
-const { handleDependencyBase } = require("./CommonJsDependencyHelpers");
+const {
+	ESM_MODULE_EXPORTS_NAME,
+	getRequireEsmModuleExportsAccess,
+	handleDependencyBase,
+	isRequireEsmModuleExportsModule
+} = require("./CommonJsDependencyHelpers");
 const ModuleDependency = require("./ModuleDependency");
 const processExportInfo = require("./processExportInfo");
 
@@ -107,6 +112,16 @@ class CommonJsExportRequireDependency extends ModuleDependency {
 	 */
 	getReferencedExports(moduleGraph, runtime) {
 		const ids = this.getIds(moduleGraph);
+		const importedModule = moduleGraph.getModule(this);
+		if (
+			importedModule &&
+			isRequireEsmModuleExportsModule(importedModule, moduleGraph)
+		) {
+			// `require(esm)` unwraps the "module.exports" named export; any
+			// further property access lands on that value (which webpack does
+			// not model), so only the "module.exports" export is observable.
+			return [[ESM_MODULE_EXPORTS_NAME]];
+		}
 		const getFullResult = () => {
 			if (ids.length === 0) {
 				return Dependency.EXPORTS_OBJECT_REFERENCED;
@@ -159,17 +174,26 @@ class CommonJsExportRequireDependency extends ModuleDependency {
 	 * @returns {ExportsSpec | undefined} export names
 	 */
 	getExports(moduleGraph) {
+		const importedModule = moduleGraph.getModule(this);
+		const esmUnwrap =
+			importedModule &&
+			isRequireEsmModuleExportsModule(importedModule, moduleGraph);
 		if (this.names.length === 1) {
 			const ids = this.getIds(moduleGraph);
 			const name = this.names[0];
 			const from = moduleGraph.getConnection(this);
 			if (!from) return;
+			const exportChain = esmUnwrap
+				? [ESM_MODULE_EXPORTS_NAME, ...ids]
+				: ids.length === 0
+					? null
+					: ids;
 			return {
 				exports: [
 					{
 						name,
 						from,
-						export: ids.length === 0 ? null : ids,
+						export: exportChain,
 						// we can't mangle names that are in an empty object
 						// because one could access the prototype property
 						// when export isn't set yet
@@ -195,6 +219,17 @@ class CommonJsExportRequireDependency extends ModuleDependency {
 		}
 		const from = moduleGraph.getConnection(this);
 		if (!from) return;
+		if (esmUnwrap) {
+			// Full re-export `module.exports = require("./esm")` of a module
+			// with a `"module.exports"` named export: the wrapping module's
+			// `module.exports` becomes the unwrapped value, whose own
+			// properties webpack cannot enumerate statically.
+			return {
+				exports: true,
+				canMangle: false,
+				dependencies: [from.module]
+			};
+		}
 		const reexportInfo = this.getStarReexports(
 			moduleGraph,
 			undefined,
@@ -393,14 +428,23 @@ CommonJsExportRequireDependency.Template = class CommonJsExportRequireDependency
 		});
 		if (importedModule) {
 			const ids = dep.getIds(moduleGraph);
-			const usedImported = moduleGraph
-				.getExportsInfo(importedModule)
-				.getUsedName(ids, runtime);
-			if (usedImported) {
-				const comment = equals(usedImported, ids)
-					? ""
-					: `${Template.toNormalComment(propertyAccess(ids))} `;
-				requireExpr += `${comment}${propertyAccess(usedImported)}`;
+			const esmRequireAccess = getRequireEsmModuleExportsAccess(
+				importedModule,
+				moduleGraph,
+				runtime
+			);
+			if (esmRequireAccess !== null) {
+				requireExpr += `${esmRequireAccess}${propertyAccess(ids)}`;
+			} else {
+				const usedImported = moduleGraph
+					.getExportsInfo(importedModule)
+					.getUsedName(ids, runtime);
+				if (usedImported) {
+					const comment = equals(usedImported, ids)
+						? ""
+						: `${Template.toNormalComment(propertyAccess(ids))} `;
+					requireExpr += `${comment}${propertyAccess(usedImported)}`;
+				}
 			}
 		}
 

package/lib/dependencies/CommonJsExportsParserPlugin.js

@@ -6,8 +6,8 @@
 "use strict";
 
 const RuntimeGlobals = require("../RuntimeGlobals");
-const formatLocation = require("../formatLocation");
 const { evaluateToString } = require("../javascript/JavascriptParserHelpers");
+const formatLocation = require("../util/formatLocation");
 const { propertyAccess } = require("../util/property");
 const CommonJsExportRequireDependency = require("./CommonJsExportRequireDependency");
 const CommonJsExportsDependency = require("./CommonJsExportsDependency");

package/lib/dependencies/CommonJsFullRequireDependency.js

@@ -10,6 +10,11 @@ const { equals } = require("../util/ArrayHelpers");
 const { getTrimmedIdsAndRange } = require("../util/chainedImports");
 const makeSerializable = require("../util/makeSerializable");
 const { propertyAccess } = require("../util/property");
+const {
+	ESM_MODULE_EXPORTS_NAME,
+	getRequireEsmModuleExportsAccess,
+	isRequireEsmModuleExportsModule
+} = require("./CommonJsDependencyHelpers");
 const ModuleDependency = require("./ModuleDependency");
 
 /** @typedef {import("webpack-sources").ReplaceSource} ReplaceSource */
@@ -55,14 +60,22 @@ class CommonJsFullRequireDependency extends ModuleDependency {
 	 * @returns {ReferencedExports} referenced exports
 	 */
 	getReferencedExports(moduleGraph, runtime) {
-		if (this.call) {
-			const importedModule = moduleGraph.getModule(this);
-			if (
-				!importedModule ||
-				importedModule.getExportsType(moduleGraph, false) !== "namespace"
-			) {
-				return [this.names.slice(0, -1)];
-			}
+		const importedModule = moduleGraph.getModule(this);
+		if (
+			importedModule &&
+			isRequireEsmModuleExportsModule(importedModule, moduleGraph)
+		) {
+			// When `require(esm)` unwraps a `"module.exports"` named export, the
+			// user's property access lands on that value (which webpack does not
+			// model), so only the "module.exports" export itself is referenced.
+			return [[ESM_MODULE_EXPORTS_NAME]];
+		}
+		if (
+			this.call &&
+			(!importedModule ||
+				importedModule.getExportsType(moduleGraph, false) !== "namespace")
+		) {
+			return [this.names.slice(0, -1)];
 		}
 		return [this.names];
 	}
@@ -128,6 +141,10 @@ CommonJsFullRequireDependency.Template = class CommonJsFullRequireDependencyTemp
 			runtimeRequirements
 		});
 
+		const esmRequireAccess = importedModule
+			? getRequireEsmModuleExportsAccess(importedModule, moduleGraph, runtime)
+			: null;
+
 		const {
 			trimmedRange: [trimmedRangeStart, trimmedRangeEnd],
 			trimmedIds
@@ -139,7 +156,13 @@ CommonJsFullRequireDependency.Template = class CommonJsFullRequireDependencyTemp
 			dep
 		);
 
-		if (importedModule) {
+		if (esmRequireAccess !== null) {
+			const access = `${esmRequireAccess}${propertyAccess(trimmedIds)}`;
+			requireExpr =
+				dep.asiSafe === true
+					? `(${requireExpr}${access})`
+					: `${requireExpr}${access}`;
+		} else if (importedModule) {
 			const usedImported = moduleGraph
 				.getExportsInfo(importedModule)
 				.getUsedName(trimmedIds, runtime);

package/lib/dependencies/CommonJsImportsParserPlugin.js

@@ -5,9 +5,9 @@
 
 "use strict";
 
-const CommentCompilationWarning = require("../CommentCompilationWarning");
 const RuntimeGlobals = require("../RuntimeGlobals");
-const UnsupportedFeatureWarning = require("../UnsupportedFeatureWarning");
+const CommentCompilationWarning = require("../errors/CommentCompilationWarning");
+const UnsupportedFeatureWarning = require("../errors/UnsupportedFeatureWarning");
 const {
 	evaluateToIdentifier,
 	evaluateToString,
@@ -48,6 +48,22 @@ const RequireResolveHeaderDependency = require("./RequireResolveHeaderDependency
  * @property {string} context
  */
 
+/**
+ * Per-`const NAME = require(LITERAL)` binding state used to forward
+ * member-access references on `NAME` to the `CommonJsRequireDependency`
+ * created for the `require()` call.
+ * @typedef {object} RequireBindingData
+ * @property {RawReferencedExports} referencedExports mutable list shared with the dependency; pushed to as `NAME.x.y` accesses are walked
+ * @property {InstanceType<typeof import("./CommonJsRequireDependency")> | null} dep dependency for the `require()` call (assigned during walk)
+ */
+
+/** @type {WeakMap<CallExpression, RequireBindingData>} */
+const requireBindingData = new WeakMap();
+
+const REQUIRE_BINDING_TAG = Symbol(
+	"CommonJsImportsParserPlugin require binding"
+);
+
 const PLUGIN_NAME = "CommonJsImportsParserPlugin";
 
 /**
@@ -152,16 +168,26 @@ const createRequireCallHandler = (parser, options, getContext) => {
 	 */
 	const processRequireItem = (expr, param) => {
 		if (param.isString()) {
-			const referencedExports = getRequireReferencedExportsFromDestructuring(
+			let referencedExports = getRequireReferencedExportsFromDestructuring(
 				parser,
 				expr
 			);
+			const binding = requireBindingData.get(
+				/** @type {CallExpression} */ (expr)
+			);
+			if (binding && !referencedExports) {
+				// `const NAME = require(LITERAL)` — let later member-access walks
+				// on `NAME` populate the dependency's referenced exports.
+				referencedExports = binding.referencedExports;
+			}
 			const dep = new CommonJsRequireDependency(
 				/** @type {string} */ (param.string),
 				/** @type {Range} */ (param.range),
 				getContext(),
-				referencedExports
+				referencedExports,
+				/** @type {Range} */ (expr.range)
 			);
+			if (binding) binding.dep = dep;
 			dep.loc = /** @type {DependencyLocation} */ (expr.loc);
 			dep.optional = Boolean(parser.scope.inTry);
 			parser.state.current.addDependency(dep);
@@ -661,6 +687,88 @@ class CommonJsImportsParserPlugin {
 			.tap(PLUGIN_NAME, callChainHandler);
 		// #endregion
 
+		// #region Require bound to a const variable
+		// Track `const NAME = require(LITERAL)` so that static member accesses on
+		// `NAME` (e.g. `NAME.foo`, `NAME.foo()`) are forwarded to the same
+		// `CommonJsRequireDependency` as referenced exports — enabling tree
+		// shaking of CommonJS modules that are imported into a named binding
+		// rather than destructured.
+		parser.hooks.preDeclarator.tap(PLUGIN_NAME, (declarator, statement) => {
+			if (statement.kind !== "const") return;
+			if (declarator.id.type !== "Identifier") return;
+			if (!declarator.init || declarator.init.type !== "CallExpression") {
+				return;
+			}
+			const init = declarator.init;
+			if (
+				init.callee.type !== "Identifier" ||
+				init.callee.name !== "require" ||
+				init.arguments.length !== 1
+			) {
+				return;
+			}
+			const arg = init.arguments[0];
+			if (arg.type !== "Literal" || typeof arg.value !== "string") return;
+			// Only attach binding state when `require` resolves to the free
+			// `require` (i.e. it isn't shadowed in the current scope).
+			const requireInfo = parser.getFreeInfoFromVariable("require");
+			if (!requireInfo || requireInfo.name !== "require") return;
+			/** @type {RequireBindingData} */
+			const binding = {
+				referencedExports: [],
+				dep: null
+			};
+			requireBindingData.set(init, binding);
+			parser.tagVariable(declarator.id.name, REQUIRE_BINDING_TAG, binding);
+			return true;
+		});
+
+		parser.hooks.expression.for(REQUIRE_BINDING_TAG).tap(PLUGIN_NAME, () => {
+			const binding =
+				/** @type {RequireBindingData} */
+				(parser.currentTagData);
+			if (binding && binding.dep) {
+				// `NAME` is read as a value (not as the object of a static member
+				// chain), so we have to assume the whole exports object is used.
+				binding.dep.referencedExports = null;
+			}
+		});
+
+		parser.hooks.expressionMemberChain
+			.for(REQUIRE_BINDING_TAG)
+			.tap(PLUGIN_NAME, (_expr, members) => {
+				const binding =
+					/** @type {RequireBindingData} */
+					(parser.currentTagData);
+				if (binding && binding.dep && binding.dep.referencedExports) {
+					binding.dep.referencedExports.push(members);
+				}
+				// Returning truthy suppresses the parser's fallback chain (which
+				// would otherwise walk `NAME` as a bare expression and trigger our
+				// `expression` hook above, marking the whole namespace as used).
+				return true;
+			});
+
+		parser.hooks.callMemberChain
+			.for(REQUIRE_BINDING_TAG)
+			.tap(PLUGIN_NAME, (expr, members) => {
+				const binding =
+					/** @type {RequireBindingData} */
+					(parser.currentTagData);
+				if (binding && binding.dep && binding.dep.referencedExports) {
+					if (members.length === 0) {
+						// `NAME(...)` — calling the require result directly; the
+						// whole exports object is observable.
+						binding.dep.referencedExports = null;
+					} else {
+						binding.dep.referencedExports.push(members);
+					}
+				}
+				if (expr.arguments) parser.walkExpressions(expr.arguments);
+				return true;
+			});
+		// #endregion
+
 		// #region Require.resolve
 		/**
 		 * Processes the provided expr.