chore(deps): update dependency webpack to v5.109.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
webpack	5.109.0 → 5.109.1

---

Release Notes

webpack/webpack (webpack)

v5.109.1

Compare Source

Patch Changes

• Fix stray semicolon emitted before an imported call following a parenthesized sequence element. (by @​alexander-akait in #​21533)

• Make require(esm) module.exports re-export analysis independent of module processing order. (by @​alexander-akait in #​21521)

• Ignore ERR_SERVER_NOT_RUNNING on lazy-compilation backend dispose so compiler.close() succeeds on Bun. (by @​alexander-akait in #​21521)

• Name the failing key when DefinePlugin fails to evaluate a typeof value. (by @​alexander-akait in #​21503)

• Improve Deno compatibility: guard setNoDelay and force-close connections on lazy-compilation backend dispose, and return a real ArrayBuffer from the Node async/sync wasm loader so WebAssembly.instantiate accepts it. (by @​alexander-akait in #​21524)

• Speed up the HTML parser and cut its peak memory: module-scope helpers/state and tokenizer callbacks, plus exact AST column pre-sizing. (by @​alexander-akait in #​21492)

• Track CommonJS build dependencies by parsing sources when require.cache children are unavailable (e.g. Bun). (by @​alexander-akait in #​21531)

• Cook common string-literal escapes on the JS parser fast path and own the tokenizer's cold-path readers. (by @​alexander-akait in #​21500)

• Build the CSS parseA* AST on the SoA store instead of node classes, cutting parse memory and time. (by @​alexander-akait in #​21498)

• Speed up and cut memory of the experimental CSS and HTML parsers: drop two derivable AST node columns, and scan long string, url, comment, and plaintext token bodies natively. (by @​alexander-akait in #​21504)

• Speed up non-modules CSS parsing: skip redundant token re-reads, drop selector-prelude tokens without materializing nodes, allocate rule preludes lazily, and fast-path empty list seals. (by @​alexander-akait in #​21511)

• Speed up stats generation and cut its peak memory: reuse cached sort comparators instead of thrashing the comparator caches on every sort, and drop redundant module-graph lookups and allocations in the extractors. (by @​alexander-akait in #​21506)

• Speed up CSS parsing: byte-range function-name checks, indexed sibling lookahead. (by @​bjohansebas in #​21520)

• Reduce allocations and redundant work across the code-generation, module-concatenation, exports/usage-analysis, hashing, and chunk-splitting hot paths. (by @​alexander-akait in #​21516)

• Enable the Node.js compile cache in the webpack CLI entry point. (by @​bjohansebas in #​21523)

• Encode the persistent cache with V8's value serializer. (by @​avivkeller in #​21514)

• Speed up SplitChunksPlugin: reject non-subset chunk sets with 64-bit signatures, cache unnamed entry keys, and drop per-module closures. (by @​avivkeller in #​21529)

• Initialize NormalModule._ast in the constructor so each instance keeps a single hidden-class shape. (by @​alexander-akait in #​21515)

• Reduce allocations in the binary serialization hot paths. (by @​alexander-akait in #​21526)

• Deduplicate and simplify several lib modules and speed up AggressiveMergingPlugin. (by @​alexander-akait in #​21525)

• Rename nested const/let __webpack_require__ and __webpack_exports__ declarations in bundled webpack output. (by @​hai-x in #​21508)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/webpack	5.109.1	🟢 5.6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 2 Found 6/25 approved changesets -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 2 badge detected: InProgress License 🟢 10 license file detected Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Pinned-Dependencies 🟢 10 all dependencies are pinned Binary-Artifacts ⚠️ 0 binaries present in source code SAST 🟢 9 SAST tool is not run on all commits -- score normalized to 9 Fuzzing ⚠️ 0 project is not fuzzed

Scanned Files

• package-lock.json