chore(deps-dev): bump webpack from 5.99.9 to 5.104.1

[dependabot]

Bumps webpack from 5.99.9 to 5.104.1.

Release notes

Sourced from webpack's releases.

v5.104.1

5.104.1

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

5.104.0

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Features

• Added DotenvPlugin and top level dotenv option to enable this plugin
• Added WebpackManifestPlugin
• Added support the ignoreList option in devtool plugins
• Allow to use custom javascript parse function

... (truncated)

Changelog

Sourced from webpack's changelog.

5.104.1

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

5.104.0

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.
• aab1da9: Fixed bugs for css/global type.
• d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.
• d3dd841: Handle nested __webpack_require__.
• 728ddb7: The speed of identifier parsing has been improved.
• 0f8b31b: Improve types.
• d3dd841: Don't corrupt debugId injection when hidden-source-map is used.
• 2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.
• d3dd841: Serialize HookWebpackError.
• d3dd841: Added ability to use built-in properties in dotenv and define plugin.
• 3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.
• d3dd841: Reduce collision for local indent name in CSS.
• d3dd841: Remove CSS link tags when CSS imports are removed.

Commits

• 24e3c2d chore(release): new release (#20253)
• 2efd21b fix(re-exports): reexports runtime calculation should not accessing `__WEBPAC...
• c510070 fix(security): userinfo bypass vulnerability in HttpUriPlugin allowedUris
• 4b0501c ci: fix release (#20252)
• 0c213ce ci: use \<@&1450591255485743204> over @here for discord notificationw
• 5bf8bc5 refactor: types for benchmarks and tests
• 505a5e7 chore(release): new release (#20188)
• 0c06680 refactor: update eslint configuration
• 2eb0d6a ci: release announcement (#20238)
• b2b2459 ci: cancel in progress (#20239)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[rtibblesbot]

Dependency Update Review

Package: webpack 5.99.9 → 5.104.1
Semver risk: Minor (spans 5 minor releases: v5.100.0 through v5.104.0, plus v5.104.1 patch)
Dependency type: devDependency (build tool)
CI status: All checks passing (frontend tests, linting, build assets, message files)

Changelog Analysis

Sources consulted:

• Release notes v5.104.1
• Release notes v5.104.0
• Release notes v5.103.0
• Release notes v5.102.0
• Release notes v5.101.0
• Release notes v5.100.0
• Compare v5.99.9...v5.104.1

Breaking changes: None documented across any of these releases.

Security fixes:

• v5.104.1: Fixed a user information bypass vulnerability in HttpUriPlugin (commit c510070)
• v5.104.0: Re-validated HttpUriPlugin redirects against allowedUris, restricted to http(s) with redirect limit to prevent SSRF (commit 2179fdb)
• Impact on this project: None — HttpUriPlugin is not used in this codebase (verified via codebase search).

Notable new features across the range:

• v5.103.0: Built-in DotenvPlugin, WebpackManifestPlugin, import.meta.env/import.meta.dirname/import.meta.filename support, deferred imports
• v5.102.0: Import assertions for bytes/text types, topLevelAwait and layers promoted to stable, static analysis for dynamic imports
• v5.101.0: Tree-shaking for ESM external modules with named imports
• v5.100.0: HMR for ES modules output, full splitChunks support in ESM mode, VirtualUrlPlugin
• v5.104.0: CSS modules improvements, new digest formats, import.meta.env object access, performance optimizations

All new features are opt-in and do not change existing behavior.

Compatibility Assessment

• Project uses affected APIs: No — all changes are additive or fix edge cases not triggered by this project
• Peer dependency requirements satisfied: Yes — lockfile resolves cleanly
• Code changes required: No — only package.json and pnpm-lock.yaml modified
• New transitive dependencies: A few expected additions (acorn-import-phases, baseline-browser-mapping, es-module-lexer@2.0.0) consistent with new webpack features
• Prior attempts: No previous PRs for this upgrade found

Recommendation

APPROVE — Minor dev dependency bump with no breaking changes, all CI passing, and security fixes (though not applicable to this project). Safe to merge.

[rtibbles]

No concerns from changelog, and build still builds!

[rtibblesbot]

Dependency Update Review

Package: webpack 5.99.9 → 5.104.1
Semver risk: Minor (within 5.x)
Dependency type: devDependency
CI status: Passing (linting, frontend build, frontend tests all green)

Changelog Analysis

Sources consulted:

• Release notes v5.104.1
• Release notes v5.104.0
• Release notes v5.103.0
• Release notes v5.102.0
• Release notes v5.101.0
• Release notes v5.100.0
• Compare v5.99.9...v5.104.1

Breaking changes: None across all 6 releases.

Deprecations: None.

Security fixes:

• v5.104.1: Fixed a user information bypass vulnerability in HttpUriPlugin (commit c510070)
• v5.104.0: Re-validated HttpUriPlugin redirects against allowedUris, restricted to http(s) and added redirect limit to prevent SSRF (commit 2179fdb)

These security fixes are specific to HttpUriPlugin. This project doesn't appear to use it, so runtime impact is minimal — but the fixes are still good to pick up.

Other notable changes: New DotenvPlugin, import.meta.env support, CSS modules improvements, topLevelAwait and layers promoted to stable, performance optimizations. All additive and backward-compatible.

Compatibility Assessment

• Project uses affected APIs: No (HttpUriPlugin not used)
• Peer dependency changes: None
• Code changes required: None
• Prior failed attempts: None

Recommendation

No issues found. Minor dev dependency bump, no breaking changes, CI passing, includes security hardening. Safe to merge.

• suggestion: The pnpm-lock.yaml in this branch was generated from an older unstable baseline (before recent axios and mathlive upgrades landed). While git should merge package.json cleanly, the lockfile may need regeneration after merge. Consider running @dependabot rebase first for a cleaner lockfile, or regenerate it post-merge.

[rtibblesbot]

suggestion: The lockfile was generated against an older unstable baseline. After merge, verify the lockfile is consistent (or run @dependabot rebase first to pick up recent axios and mathlive upgrades in unstable before merging).