build(deps-dev): bump webpack from 5.108.1 to 5.108.4

[dependabot]

Bumps webpack from 5.108.1 to 5.108.4.

Release notes

Sourced from webpack's releases.

v5.108.4

Patch Changes

• Speed up non-CSS-Modules parsing by not building unused selector AST nodes. (by @​alexander-akait in #21324)

• Speed up non-CSS-Modules CSS parsing by dropping value tokens nothing reads. (by @​alexander-akait in #21324)

• Resolve HTML asset URLs against the document <base href>. (by @​alexander-akait in #21329)

• Add HTML integration tests: generateError output, ignored src, null-char parse. (by @​aryanraj45 in #21328)

• Reduce CPU and memory overhead of HTML and CSS parsing and code generation. (by @​alexander-akait in #21332)

• Reduce HTML parser memory and CPU by skipping unused AST nodes. (by @​alexander-akait in #21323)

• Reduce HTML parser memory by storing the AST in struct-of-arrays form. (by @​alexander-akait in #21331)

• Key the provided-exports cache on a lazy barrel's still-lazy re-export targets. (by @​hai-x in #21326)

• Default output.globalObject to globalThis for universal targets. (by @​alexander-akait in #21314)

• Pass through new URL(...) directory references instead of resolving them. (by @​alexander-akait in #21312)

v5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

v5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

Changelog

Sourced from webpack's changelog.

5.108.4

Patch Changes

• Speed up non-CSS-Modules parsing by not building unused selector AST nodes. (by @​alexander-akait in #21324)

• Speed up non-CSS-Modules CSS parsing by dropping value tokens nothing reads. (by @​alexander-akait in #21324)

• Resolve HTML asset URLs against the document <base href>. (by @​alexander-akait in #21329)

• Add HTML integration tests: generateError output, ignored src, null-char parse. (by @​aryanraj45 in #21328)

• Reduce CPU and memory overhead of HTML and CSS parsing and code generation. (by @​alexander-akait in #21332)

• Reduce HTML parser memory and CPU by skipping unused AST nodes. (by @​alexander-akait in #21323)

• Reduce HTML parser memory by storing the AST in struct-of-arrays form. (by @​alexander-akait in #21331)

• Key the provided-exports cache on a lazy barrel's still-lazy re-export targets. (by @​hai-x in #21326)

• Default output.globalObject to globalThis for universal targets. (by @​alexander-akait in #21314)

• Pass through new URL(...) directory references instead of resolving them. (by @​alexander-akait in #21312)

5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

Commits

• bb9ccfd chore(release): new release (#21319)
• 7639066 fix: invalidate provided-exports cache with lazy barrel (#21326)
• ae28c54 perf: reduce CPU and memory overhead of the HTML and CSS pipelines (#21332)
• e6fb547 perf: re-encode the HTML AST as struct-of-arrays behind a path-based visitor ...
• 5ce1c22 fix(html): resolve asset URLs against <base href> (#21329)
• 0e43c4a test(html): cover generateError, ignored-source, and null-character parse pat...
• cebd793 refactor: build export-presence guards from a lazy boolean formula (#21320)
• c2628cf fix: don't resolve new URL() directory references as modules (#21312)
• 00d8b2f perf: speed up non-CSS-Modules CSS parsing by skipping unused AST work (#21324)
• f7a3f6d perf: reduce HTML parser memory and CPU with parser-level skip options (#21323)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	webpack@​5.108.1 ⏵ 5.108.4			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/webpack@5.108.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.108.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report