Skip to content

chore(dev-deps): bump webpack from 5.110.1 to 5.110.2 - #1697

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/webpack-5.110.2
Open

chore(dev-deps): bump webpack from 5.110.1 to 5.110.2#1697
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/webpack-5.110.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps webpack from 5.110.1 to 5.110.2.

Release notes

Sourced from webpack's releases.

v5.110.2

Patch Changes

Changelog

Sourced from webpack's changelog.

5.110.2

Patch Changes

Commits
  • 75eec50 chore(release): new release (#21850)
  • 0b28311 fix: move the source map with a removed BOM (#21861)
  • c5fb111 fix(css): skip the loading runtime when every css chunk is initial (#21862)
  • 17fa705 docs: update examples (#21860)
  • e7ad244 fix: do not emit a JS chunk for an output.html generated page (#21859)
  • b74192f fix(loaders): strip a BOM from a string result in the loader chain (#21857)
  • 852e759 fix: report an unused named import that names a missing export (#21856)
  • 2a6a4fa docs: drop the built-in-superseded loaders and plugins from the README (#21855)
  • 1f3264e fix: ESM correctness in circular re-exports, imported bindings and defer orde...
  • e9a34ae fix(analyzable): bake urls past cycles, mixed-served wasm and partial style m...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(dev-deps): bump webpack from 5.110.1 to 5.110.2
669c57d 
Bumps [webpack](https://github.com/webpack/webpack) from 5.110.1 to 5.110.2.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack@v5.110.1...v5.110.2)

---
updated-dependencies:
- dependency-name: webpack
  dependency-version: 5.110.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Sep 9, 2026
@azure-pipelines

azure-pipelines Bot commented Sep 9, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

@chagong

Changyong Gong (chagong) commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Dependabot (@dependabot) rebase

@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@chagong

Changyong Gong (chagong) commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Dependabot (@dependabot) recreate

@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

The dependabot.yml entry that created this PR has been deleted so this PR can't be recreated. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@chagong

Changyong Gong (chagong) commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Decision: NOT_MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-debug
Pull request: microsoft/vscode-java-debug#1697 — chore(dev-deps): bump webpack from 5.110.1 to 5.110.2
Update: webpack 5.110.1 -> 5.110.2 — direct development dependency, patch update, not security-related.
Safety assessment: Dependabot-only provenance verified. The manifest/lockfile-only diff has standard dependency-gate scope, and webpack is required by the compile, watch, production packaging, and test scripts. However, the low-risk requirement fails: webpack 5.110.2 has a confirmed production-mode sideEffects regression (webpack/webpack#21869), fixed only in 5.110.3 by webpack/webpack#21874. This repository packages in production mode, while its CI does not exercise the affected barrel-re-export case.
Final state: Head 669c57dbe2b028b296540521a622e397736c11f8; open, mergeable, review required. GitHub reports BEHIND, but direct ancestry proves current base 5735c4b8bbe299c51c6f31992662cef3cef7c5e6 is the head’s parent (behind_by: 0). CI: 4 successful, 0 failed, 0 non-terminal (Linux, Windows, macOS, license/cla), all on the current head. No unresolved review threads or change requests.
Actions taken: Audited the complete diff, commit provenance, dependency usage, upstream release history, reviews, branch ancestry, and current-head checks. No rerun, rebase, remediation, approval, or merge was attempted because the upstream regression is a definitive static blocker.
Reason: webpack 5.110.2 is a known-bad release for production-mode tree-shaking and therefore is not eligible as a low-risk patch update.
Next action: Close this PR and wait for a webpack release newer than 5.110.3 that resolves the subsequent reported regressions before opening a replacement update.
Workflow run: https://github.com/chagong/JavaForge/actions/runs/34573424885

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@testforstephen Jinbo Wang (testforstephen) Awaiting requested review from testforstephen testforstephen is a code owner
@jdneo Sheng Chen (jdneo) Awaiting requested review from jdneo jdneo is a code owner
@wenytang-ms wenyt (wenytang-ms) Awaiting requested review from wenytang-ms wenytang-ms is a code owner
@chagong Changyong Gong (chagong) Awaiting requested review from chagong chagong is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chagong