fix(deps): update dependency webpack to v5.105.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
webpack	5.105.0 → 5.105.4

---

Release Notes

webpack/webpack (webpack)

v5.105.4

Compare Source

Patch Changes

• Add Module.getSourceBasicTypes to distinguish basic source types and clarify how modules with non-basic source types like remote still produce JavaScript output. (by @​xiaoxiaojx in #​20546)

• Handle createRequire in expressions. (by @​alexander-akait in #​20549)

• Fixed types for multi stats. (by @​alexander-akait in #​20556)

• Remove empty needless js output for normal css module. (by @​JSerFeng in #​20162)

• Update enhanced-resolve to support new features for tsconfig.json. (by @​alexander-akait in #​20555)

• Narrows export presence guard detection to explicit existence checks on namespace imports only, i.e. patterns like "x" in ns. (by @​hai-x in #​20561)

v5.105.3

Compare Source

Patch Changes

• Context modules now handle rejections correctly. (by @​alexander-akait in #​20455)

• Only mark asset modules as side-effect-free when experimental.futureDefaults is set to true, so asset-copying use cases (e.g. import "./x.png") won’t break unless the option is enabled. (by @​hai-x in #​20535)

• Add the missing webpack_exports declaration in certain cases when bundling a JS entry together with non-JS entries (e.g., CSS entry or asset module entry). (by @​hai-x in #​20463)

• Fixed HMR failure for CSS modules with @​import when exportType !== "link". When exportType is not "link", CSS modules now behave like JavaScript modules and don't require special HMR handling, allowing @​import CSS to work correctly during hot module replacement. (by @​xiaoxiaojx in #​20514)

• Fixed an issue where empty JavaScript files were generated for CSS-only entry points. The code now correctly checks if entry modules have JavaScript source types before determining whether to generate a JS file. (by @​xiaoxiaojx in #​20454)

• Do not crash when a referenced chunk is not a runtime chunk. (by @​alexander-akait in #​20461)

• Fix some types. (by @​alexander-akait in #​20412)

• Ensure that missing module error are thrown after the interception handler (if present), allowing module interception to customize the module factory. (by @​hai-x in #​20510)

• Added createRequire support for ECMA modules. (by @​stefanbinoj in #​20497)

• Added category for CJS reexport dependency to fix issues with ECMA modules. (by @​hai-x in #​20444)

• Implement immutable bytes for bytes import attribute to match tc39 spec. (by @​alexander-akait in #​20481)

• Fixed deterministic search for graph roots regardless of edge order. (by @​veeceey in #​20452)

v5.105.2

Compare Source

Patch Changes

• Fixed WebpackPluginInstance type regression. (by @​alexander-akait in #​20440)

v5.105.1

Compare Source

Patch Changes

• Fix VirtualUrlPlugin Windows compatibility by sanitizing cache keys and filenames. Cache keys now use toSafePath to replace colons (:) with double underscores (__) and sanitize other invalid characters, ensuring compatibility with Windows filesystem restrictions. (by @​xiaoxiaojx in #​20424)

• Revert part of the createRequire generation behavior for require("node:...") to keep compatibility with those modules exports, e.g. const EventEmitter = require("node:events");. (by @​hai-x in #​20433)

• Skip guard collection when exports-presence mode is disabled to improve parsing performance. (by @​hai-x in #​20433)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[amrsalama]

@kamilmysliwiec Can this be merged and released, please?
Older versions contain a vulnerable version of serialize-javascript
GHSA-5c6j-r48x-rmvq

Ref:

• fix: update serialize-javascript webpack/terser-webpack-plugin#654