chore(deps): bump webpack and @angular-devkit/build-angular in /samples/js-angular/genkit-app by dependabot[bot] · Pull Request #4458 · firebase/genkit

dependabot · 2026-02-05T19:58:36Z

Bumps webpack to 5.104.1 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates webpack from 5.98.0 to 5.104.1

Release notes

Sourced from webpack's releases.

v5.104.1

5.104.1

Patch Changes

2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.

c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

5.104.0

Minor Changes

d3dd841: Use method shorthand to render module content in __webpack_modules__ object.

d3dd841: Enhance import.meta.env to support object access.

4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.

04cd530: Handle more at-rules for CSS modules.

cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.

d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.

5983843: Provide a stable runtime function variable __webpack_global__.

d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

22c48fb: Added module existence check for informative error message in development mode.

50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.

d3dd841: Support universal lazy compilation.

d3dd841: Fixed module library export definitions when multiple runtimes.

d3dd841: Fixed CSS nesting and CSS custom properties parsing.

d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.

aab1da9: Fixed bugs for css/global type.

d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.

d3dd841: Handle nested __webpack_require__.

728ddb7: The speed of identifier parsing has been improved.

0f8b31b: Improve types.

d3dd841: Don't corrupt debugId injection when hidden-source-map is used.

2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.

d3dd841: Serialize HookWebpackError.

d3dd841: Added ability to use built-in properties in dotenv and define plugin.

3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.

d3dd841: Reduce collision for local indent name in CSS.

d3dd841: Remove CSS link tags when CSS imports are removed.

v5.103.0

Features

Added DotenvPlugin and top level dotenv option to enable this plugin

Added WebpackManifestPlugin

Added support the ignoreList option in devtool plugins

Allow to use custom javascript parse function

... (truncated)

Changelog

Sourced from webpack's changelog.

5.104.1

Patch Changes

2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.

c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

5.104.0

Minor Changes

d3dd841: Use method shorthand to render module content in __webpack_modules__ object.

d3dd841: Enhance import.meta.env to support object access.

4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.

04cd530: Handle more at-rules for CSS modules.

cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.

d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.

5983843: Provide a stable runtime function variable __webpack_global__.

d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

22c48fb: Added module existence check for informative error message in development mode.

50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.

d3dd841: Support universal lazy compilation.

d3dd841: Fixed module library export definitions when multiple runtimes.

d3dd841: Fixed CSS nesting and CSS custom properties parsing.

d3dd841: Don't write fragment from URL to filename and apply fragment to module URL.

aab1da9: Fixed bugs for css/global type.

d3dd841: Compatibility import.meta.filename and import.meta.dirname with eval devtools.

d3dd841: Handle nested __webpack_require__.

728ddb7: The speed of identifier parsing has been improved.

0f8b31b: Improve types.

d3dd841: Don't corrupt debugId injection when hidden-source-map is used.

2179fdb: Re-validate HttpUriPlugin redirects against allowedUris, restrict to http(s) and add a conservative redirect limit to prevent SSRF and untrusted content inclusion. Redirects failing policy are rejected before caching/lockfile writes.

d3dd841: Serialize HookWebpackError.

d3dd841: Added ability to use built-in properties in dotenv and define plugin.

3c4319f: Optimizing the regular expression character class by specifying ranges for runtime code.

d3dd841: Reduce collision for local indent name in CSS.

d3dd841: Remove CSS link tags when CSS imports are removed.

Commits

24e3c2d chore(release): new release (#20253)
2efd21b fix(re-exports): reexports runtime calculation should not accessing `__WEBPAC...
c510070 fix(security): userinfo bypass vulnerability in HttpUriPlugin allowedUris
4b0501c ci: fix release (#20252)
0c213ce ci: use \<@&1450591255485743204> over @here for discord notificationw
5bf8bc5 refactor: types for benchmarks and tests
505a5e7 chore(release): new release (#20188)
0c06680 refactor: update eslint configuration
2eb0d6a ci: release announcement (#20238)
b2b2459 ci: cancel in progress (#20239)
Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 19.2.1 to 21.1.2

Release notes

Sourced from @angular-devkit/build-angular's releases.

21.1.2

@angular-devkit/schematics-cli

Commit Description

Add boolean type inference for 'true' and 'false' string values in argument parsing

@angular-devkit/architect

Commit Description

Add boolean type inference for 'true' and 'false' string values in argument parsing

@angular/build

Commit Description

loosen Vitest dependency checks when runnerConfig is used

support merging coverage thresholds with Vitest runnerConfig

21.1.1

@schematics/angular

Commit Description

correct vscode MCP configuration for new projects

remove special characters from jasmine-vitest report filename

@angular/cli

Commit Description

Remove nonexistent link from MCP response

@angular/build

Commit Description

allow application assets in workspace root

prevent incorrect catch binding removal in downleveled for-await

update undici to v7.18.2

21.1.0

@schematics/angular

Commit Description

add browserMode option to jasmine-vitest schematic

generate detailed migration report for refactor-jasmine-vitest

add MCP configuration file to new workspaces

@angular/cli

Commit Description

add 'test' and 'e2e' MCP tools

Add "all" as an experimental tool group

Add MCP tools for building and running devservers

add signal forms lessons

correctly handle yarn classic tag manifest fetching

correctly spawn package managers on Windows in new abstraction

enhance list_projects MCP tool file system traversal and symlink handling

handle array output from npm view in manifest parser

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

21.1.2 (2026-01-28)

@angular-devkit/schematics-cli

Commit Type Description

e7458c81d fix Add boolean type inference for 'true' and 'false' string values in argument parsing

@angular-devkit/architect

Commit Type Description

d66f1fe64 fix Add boolean type inference for 'true' and 'false' string values in argument parsing

@angular/build

Commit Type Description

80911af67 fix loosen Vitest dependency checks when runnerConfig is used

2d30639d3 fix support merging coverage thresholds with Vitest runnerConfig

21.1.1 (2026-01-21)

@angular/cli

Commit Type Description

151b69587 fix Remove nonexistent link from MCP response

@schematics/angular

Commit Type Description

9da6d8fa7 fix correct vscode MCP configuration for new projects

361758c75 fix remove special characters from jasmine-vitest report filename

@angular/build

Commit Type Description

1b7e3307a fix allow application assets in workspace root

d1e596dc5 fix prevent incorrect catch binding removal in downleveled for-await

98ef0981a fix update undici to v7.18.2

... (truncated)

Commits

702d717 release: cut the v21.1.2 release
d66f1fe fix(@angular-devkit/architect): Add boolean type inference for 'true' and 'fa...
e7458c8 fix(@angular-devkit/schematics-cli): Add boolean type inference for 'true' an...
e974e40 build: lock file maintenance
2d30639 fix(@angular/build): support merging coverage thresholds with Vitest runnerCo...
80911af fix(@angular/build): loosen Vitest dependency checks when runnerConfig is used
7cf1d3b build: update cross-repo angular dependencies
165e7d6 build: update all github actions
8e7f86b build: update bazel dependencies
3206b8b build: update cross-repo angular dependencies
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [webpack](https://github.com/webpack/webpack) to 5.104.1 and updates ancestor dependency [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies need to be updated together. Updates `webpack` from 5.98.0 to 5.104.1 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.98.0...v5.104.1) Updates `@angular-devkit/build-angular` from 19.2.1 to 21.1.2 - [Release notes](https://github.com/angular/angular-cli/releases) - [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md) - [Commits](angular/angular-cli@19.2.1...v21.1.2) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.104.1 dependency-type: indirect - dependency-name: "@angular-devkit/build-angular" dependency-version: 21.1.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Feb 5, 2026

github-project-automation bot added this to Genkit Backlog Feb 5, 2026

dependabot bot added the javascript Pull requests that update Javascript code label Feb 5, 2026

github-actions bot added js config sample labels Feb 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump webpack and @angular-devkit/build-angular in /samples/js-angular/genkit-app#4458

chore(deps): bump webpack and @angular-devkit/build-angular in /samples/js-angular/genkit-app#4458
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/samples/js-angular/genkit-app/multi-6a7c507882

dependabot bot commented on behalf of github Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	loosen Vitest dependency checks when runnerConfig is used
	support merging coverage thresholds with Vitest runnerConfig

Commit	Description
	correct vscode MCP configuration for new projects
	remove special characters from jasmine-vitest report filename

Commit	Description
	allow application assets in workspace root
	prevent incorrect catch binding removal in downleveled for-await
	update undici to v7.18.2

Commit	Description
	add browserMode option to jasmine-vitest schematic
	generate detailed migration report for `refactor-jasmine-vitest`
	add MCP configuration file to new workspaces

Commit	Description
	add 'test' and 'e2e' MCP tools
	Add "all" as an experimental tool group
	Add MCP tools for building and running devservers
	add signal forms lessons
	correctly handle yarn classic tag manifest fetching
	correctly spawn package managers on Windows in new abstraction
	enhance list_projects MCP tool file system traversal and symlink handling
	handle array output from npm view in manifest parser

Commit	Type	Description
80911af67	fix	loosen Vitest dependency checks when runnerConfig is used
2d30639d3	fix	support merging coverage thresholds with Vitest runnerConfig

Commit	Type	Description
9da6d8fa7	fix	correct vscode MCP configuration for new projects
361758c75	fix	remove special characters from jasmine-vitest report filename

Commit	Type	Description
1b7e3307a	fix	allow application assets in workspace root
d1e596dc5	fix	prevent incorrect catch binding removal in downleveled for-await
98ef0981a	fix	update undici to v7.18.2

Conversation

dependabot bot commented on behalf of github Feb 5, 2026

v5.104.1

5.104.1

Patch Changes

v5.104.0

5.104.0

Minor Changes

Patch Changes

v5.103.0

Features

5.104.1

Patch Changes

5.104.0

Minor Changes

Patch Changes

21.1.2

@​angular-devkit/schematics-cli

@​angular-devkit/architect

@​angular/build

21.1.1

@​schematics/angular

@​angular/cli

@​angular/build

21.1.0

@​schematics/angular

@​angular/cli

21.1.2 (2026-01-28)

@​angular-devkit/schematics-cli

@​angular-devkit/architect

@​angular/build

21.1.1 (2026-01-21)

@​angular/cli

@​schematics/angular

@​angular/build

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@angular-devkit/schematics-cli`

`@angular-devkit/architect`

`@angular/build`

`@schematics/angular`

`@angular/cli`

`@angular/build`

`@schematics/angular`

`@angular/cli`

`@angular-devkit/schematics-cli`

`@angular-devkit/architect`

`@angular/build`

`@angular/cli`

`@schematics/angular`

`@angular/build`