webpack
webpack (latest known version: 5.109.0) has 8 known breaking changes on record, each backed by a source URL.
Security advisories
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Recent changes
* Replace Source in assets with SizeOnlySource after emitting * Do no read source or map from assets after emitting * upgraded webpack-sources to new major version * no longer sort file/context/missingDependencies in Compilation * change Cache Plugin API for better performance * got hook removed * get hook as new argument `gotHandlers`
* config options have moved * `cache.managedPaths/immutablePaths` -> `snapshot.managedPaths/immutablePaths` * `output.hotUpdateFunction` -> `output.hotUpdateGlobal` * `output.jsonpFunction` -> `output.chunkLoadingGlobal` * `output.chunkCallbackFunction` -> `output.chunkLoadingGlobal`
* uses `target: "browserslist"` as default when a browserslist config has been found, otherwise fallback to `target: "web"` as usual * This could have unexpected changed to the EcmaScript version of the generated code * In same cases this might causes builds to fail because browserslist contain web and node versions * In most cases we expect this to simplify migration while still allowing to generate better code * This partially reverts a breaking change: Instead of changing the generated code from ES5 to ES6, this now changes it from ES5 to an automatic version depending on browserslist when available
Version 5.0.0 is a semver-major release over 4.47.0, but no breaking change was detected in the release notes text - flagged for manual review.
Version 4.0.0 is a semver-major release over 3.12.0, but no breaking change was detected in the release notes text - flagged for manual review.
Version 3.0.0 is a semver-major release over 2.7.0, but no breaking change was detected in the release notes text - flagged for manual review.
Version 2.1.0-beta.28 is a semver-major release over 1.15.0, but no breaking change was detected in the release notes text - flagged for manual review.
Check what changed for webpack since your installed version, live.
Open the playground →