build(deps-dev): bump webpack from 5.87.0 to 5.101.3

[dependabot]

Bumps webpack from 5.87.0 to 5.101.3.

Release notes

Sourced from webpack's releases.

v5.101.3

Fixes

• Fixed resolve execution order issue from extra await in async modules
• Avoid empty block for unused statement
• Collect only specific expressions for destructuring assignment

v5.101.2

Fixes

• Fixed syntax error when comment is on the last line
• Handle var declaration for createRequire
• Distinguish free variable and tagged variable

v5.101.1

Fixes

• Filter deleted assets in processAdditionalAssets hook
• HMR failure in defer module
• Emit assets even if invalidation occurs again
• Export types for serialization and deserialization in plugins and export the ModuleFactory class
• Fixed the failure export of internal function for ES module chunk format
• Fixed GetChunkFilename failure caused by dependOn entry
• Fixed the import of missing dependency chunks
• Fixed when entry chunk depends on the runtime chunk hash
• Fixed module.exports bundle to ESM library
• Adjusted the time of adding a group depending on the fragment of execution time
• Fixed circle dependencies when require RawModule and condition of isDeferred
• Tree-shakable module library should align preconditions of allowInlineStartup

v5.101.0

Fixes

• Fixed concatenate optimization for ESM that caused undefined export
• Respect the output.environment.nodePrefixForCoreModules option everywhere
• Respect the output.importMetaName option everywhere
• Fixed await async dependencies when accepting them during HMR
• Better typescript types

Features

• Added colors helpers for CLI
• Enable tree-shaking for ESM external modules with named imports
• Added the deferImport option to parser options

Performance Improvements

• Fixed a regression in module concatenation after implementing deferred import support
• Fixed a potential performance issue in CleanPlugin
• Avoid extra require in some places

... (truncated)

Commits

• 07b1ac0 chore(release): 5.101.3
• 8d7efb8 chore(deps-dev): bump the dependencies group with 2 updates (#19816)
• 935cbd8 docs: update examples (#19812)
• dc79e95 fix: collect only specific expressions for destructuring assignment
• 90ae8af fix: avoid empty block for unused statement
• 8db97f8 fix: resolve execution order issue from extra await in async modules
• c92deaf ci: pin Node.js 24.x to 24.5.0 in CI workflow (#19813)
• c50930b refactor(test): correct the value retrieval
• 613a5ad chore(deps-dev): bump @​babel/core in the dependencies group (#19807)
• 1d9cc24 chore(release): 5.101.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gh-pages@​4.0.0
	internal-slot@​1.0.3 ⏵ 1.0.5			+3
	is-core-module@​2.9.0 ⏵ 2.11.0			+1
	jest@​27.5.1
	eslint-module-utils@​2.7.3 ⏵ 2.7.4	+1		+1
	eslint-config-prettier@​8.8.0
	esbuild@​0.17.12
	caniuse-lite@​1.0.30001546 ⏵ 1.0.30001743	+1		+1
	jasmine-expect@​5.0.0
	eslint-watch@​8.0.0
	is-callable@​1.2.4 ⏵ 1.2.7			+6
	eslint-plugin-flowtype@​8.0.3
	husky@​8.0.3
	eslint-import-resolver-node@​0.3.6 ⏵ 0.3.7			+1
	esquery@​1.4.0 ⏵ 1.5.0
	glob@​7.1.7 ⏵ 8.1.0	+1		+1		+31
	get-intrinsic@​1.1.1 ⏵ 1.2.0			+2
	espree@​9.3.2 ⏵ 9.5.0	+1
	fill-range@​7.1.1 ⏵ 7.0.1	+1
	eslint-plugin-import@​2.26.0 ⏵ 2.27.5
	eslint-config-airbnb@​19.0.4
	eslint-plugin-react@​7.30.0 ⏵ 7.32.2
	eslint-plugin-jsx-a11y@​6.5.1 ⏵ 6.7.1			+1
	acorn@​8.8.2 ⏵ 8.15.0
	eslint-scope@​5.1.1
	find-up@​2.1.0 ⏵ 4.1.0			+7
	eslint-plugin-jest@​26.9.0
	eslint-plugin-prettier@​4.2.1
	eslint-plugin-react-hooks@​4.5.0 ⏵ 4.6.0
	eslint@​8.16.0 ⏵ 8.36.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		form-data@3.0.1 has a Critical CVE. CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL) Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4 Patched version: 3.0.4 From: package-lock.json → npm/form-data@3.0.1 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/form-data@3.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		gh-pages@4.0.0 has a Critical CVE. CVE: GHSA-8mmm-9v2q-x3f9 tschaub gh-pages vulnerable to prototype pollution (CRITICAL) Affected versions: < 5.0.0 Patched version: 5.0.0 From: package-lock.json → npm/gh-pages@4.0.0 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/gh-pages@4.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[dependabot]

Superseded by #1213.