🚨 [security] Update webpack: 5.10.0 → 5.78.0 (minor)

[depfu]

---

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

---

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ webpack (5.10.0 → 5.78.0) · Repo

Security Advisories 🚨

🚨 Cross-realm object access in Webpack 5

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 21 commits:

• 5.78.0
• Merge pull request #16685 from weareoutman/main
• Merge pull request #16477 from xiaoxiaojx/fix/issue-16466
• Merge pull request #16904 from webpack/issue-16724
• Merge pull request #16864 from janlent1/fixnativecssparsingissue
• Merge pull request #15812 from noreiller/fix-experiments-css-at-rule-nested
• Merge pull request #16562 from long76/patch-1
• ci: update actions/cache to v3
• fix: detect `createRequire` when imported with `node:` prefix
• Always add a ) when using pseudofunctions
• Merge pull request #16898 from webpack/thelarkinn/refactor-profiling-plugin
• Merge pull request #16894 from webpack/thelarkinn/refactor-flag-dep-plugins
• add more module type constants, use them across codebase
• Merge pull request #16896 from webpack/thelarkinn/module-type-constants
• yarn lint fix
• refactor(moduletypes): introduce module type constants, reduce memory footprint define/json plugins
• Merge pull request #16893 from webpack/thelarkinn/refactor-error-helpers
• refactor(plugins): Reduce memory footprint in string usages for flag plugins
• refactor(ErrorHelpers): Make error helpers named functions; add types
• Merge pull request #16890 from geromegrignon/fix/copilot-template
• fix: copilot command typo

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6602b10

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

New dependency changes detected. Learn more about Socket for GitHub ↗︎

---

👍 No new dependency issues detected in pull request

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

Pull request alert summary

Issue	Status
Install scripts	✅ 0 issues
Native code	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

---

📊 Modified Dependency Overview:

🚮 Removed packages: webpack@5.10.0

[depfu]

Closed in favor of #39.

[depfu]

Closed in favor of #39.