[dependabot]

Bumps webpack from 5.112.2 to 5.112.1.

Changelog

Sourced from webpack's changelog.

5.112.2

Patch Changes

• Reduce repeated scans when concatenating imported modules. (by @​xiaoxiaojx in #22865)

• Avoid allocating CSS module sets for single-group chunks. (by @​xiaoxiaojx in #22866)

• Return the value of every module type loaded with importModule(). (by @​alexander-akait in #22869)

5.112.1

Patch Changes

• Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @​aryanraj45 in #22699)

• Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @​aryanraj45 in #22749)

• Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @​alexander-akait in #22791)

• Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @​lazerg in #22833)

• Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @​codeXsidd in #22846)

• Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @​alexander-akait in #22794)

• Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @​alexander-akait in #22804)

• Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @​dependabot in #22811)

• Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @​alexander-akait in #22733)

• Await asynchronous modules that ProvidePlugin injects into ES modules. (by @​alexander-akait in #22728)

• Keep a resolve that ends after the compiler closed from throwing. (by @​alexander-akait in #22795)

• Preserve string names passed to SharedWorker constructors. (by @​bjohansebas in #22770)

• Preserve string contents when extracting source map comments. (by @​bjohansebas in #22768)

• Scope strict-mode, async and generator block function declarations to their block. (by @​alexander-akait in #22800)

• Preserve raw dotenv values when reusing cached environment files. (by @​Eshiv-Pandey in #22787)

• Preserve assigned or patched built-ins, conversions and pattern targets. (by @​aryanraj45 in #22761)

• Keep globals a globalThis write replaces, and slice on a patched array. (by @​alexander-akait in #22862)

• Skip HTML script tags for shared chunks that emit no JavaScript. (by @​bjohansebas in #22779)

... (truncated)

Commits

• 4ea65cb fix(deps): bump follow-redirects (#22828)
• 8741598 feat(minify): fold string methods on constants and more aliases written throu...
• f48f90e ci: pin the benchmark jobs to one Node version (#22822)
• e048c15 test: group the syntax unit tests by language, merge the JavaScript ones (#22...
• 3271edb chore: turn off CodeRabbit review status notes (#22820)
• 966963d perf(css): print repeated blocks and declarations once, and remove quadratic ...
• d17ffd8 feat(minifier): take swc's and oxc's assumptions about globals and prototypes...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 31f38cd9-63fb-41b9-bd0e-6724a70e844c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T06:11:00.288399Z	42c9e86	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud