Register | Log in

node-webpack

Packs CommonJs/AMD modules for the browser

Choose email to subscribe with

general

source: node-webpack (main)
version: 5.108.0+dfsg1+~cs14.7.20-3
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Pirate Praveen [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.43.0-6+deb11u1
oldstable: 5.75.0+dfsg+~cs17.16.14-1+deb12u1
stable: 5.97.1+dfsg1+~cs11.18.27-3
testing: 5.108.0+dfsg1+~cs14.7.20-3
unstable: 5.108.0+dfsg1+~cs14.7.20-3

versioned links

4.43.0-6+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.75.0+dfsg+~cs17.16.14-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.97.1+dfsg1+~cs11.18.27-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.108.0+dfsg1+~cs14.7.20-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

webpack (1 bugs: 0, 1, 0, 0)

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://api.github.com/repos/webpack/webpack/git/matching-refs/tags/ failed: 500 Can't connect to api.github.com:443 (Temporary failure in name resolution)

Created: 2026-10-17 Last update: 2026-10-18 16:31

lintian reports 13 warnings normal

Lintian reports 13 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-06-24 Last update: 2026-08-26 12:19

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2025-68157: (needs triaging) Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled). This issue has been patched in version 5.104.0.
CVE-2025-68458: (needs triaging) Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled). This issue has been patched in version 5.104.1.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-02-06 Last update: 2026-09-06 01:00

news

[2026-09-06] node-webpack 5.108.0+dfsg1+~cs14.7.20-3 MIGRATED to testing (Debian testing watch)
[2026-08-25] Accepted node-webpack 5.108.0+dfsg1+~cs14.7.20-3 (source) into unstable (Xavier Guimard)
[2026-07-29] node-webpack 5.108.0+dfsg1+~cs14.7.20-2 MIGRATED to testing (Debian testing watch)
[2026-07-02] Accepted node-webpack 5.108.0+dfsg1+~cs14.7.20-2 (source) into unstable (Bastien Roucariès) (signed by: Xavier Guimard)
[2026-07-01] Accepted node-webpack 5.108.0+dfsg1+~cs14.7.20-1 (source) into unstable (Xavier Guimard)
[2026-06-28] node-webpack 5.107.2+dfsg1+~cs15.16.25-2 MIGRATED to testing (Debian testing watch)
[2026-06-24] Accepted node-webpack 5.107.2+dfsg1+~cs15.16.25-2 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-24] Accepted node-webpack 5.107.2+dfsg1+~cs15.16.25-1.1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-21] node-webpack 5.107.2+dfsg1+~cs15.16.25-1 MIGRATED to testing (Debian testing watch)
[2026-06-17] Accepted node-webpack 5.107.2+dfsg1+~cs15.16.25-1 (source) into unstable (Xavier Guimard)
[2026-05-29] node-webpack 5.106.2+dfsg1+~cs15.15.23-3 MIGRATED to testing (Debian testing watch)
[2026-05-22] Accepted node-webpack 5.106.2+dfsg1+~cs15.15.23-3 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-21] Accepted node-webpack 5.106.2+dfsg1+~cs15.15.23-2 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-06] Accepted node-webpack 5.106.2+dfsg1+~cs15.15.23-1 (source) into unstable (Xavier Guimard)
[2026-04-06] node-webpack 5.105.4+dfsg1+~cs15.13.23-3 MIGRATED to testing (Debian testing watch)
[2026-04-01] Accepted node-webpack 5.105.4+dfsg1+~cs15.13.23-3 (source) into unstable (Xavier Guimard)
[2026-03-31] Accepted node-webpack 5.105.4+dfsg1+~cs15.13.23-2 (source) into unstable (Xavier Guimard)
[2026-03-29] Accepted node-webpack 5.105.4+dfsg1+~cs15.13.23-1 (source) into experimental (Xavier Guimard)
[2026-03-29] Accepted node-webpack 5.97.1+dfsg1+~cs11.18.27-4 (source) into unstable (Xavier Guimard)
[2025-06-13] node-webpack 5.97.1+dfsg1+~cs11.18.27-3 MIGRATED to testing (Debian testing watch)
[2025-05-23] Accepted node-webpack 5.97.1+dfsg1+~cs11.18.27-3 (source) into unstable (Jérémy Lal)
[2025-03-24] node-webpack 5.97.1+dfsg1+~cs11.18.27-2 MIGRATED to testing (Debian testing watch)
[2025-03-21] Accepted node-webpack 5.97.1+dfsg1+~cs11.18.27-2 (source) into unstable (Jérémy Lal)
[2024-12-24] node-webpack 5.97.1+dfsg1+~cs11.18.27-1 MIGRATED to testing (Debian testing watch)
[2024-12-18] Accepted node-webpack 5.97.1+dfsg1+~cs11.18.27-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-11-08] node-webpack 5.96.1+dfsg1+~cs11.18.26-1 MIGRATED to testing (Debian testing watch)
[2024-11-03] Accepted node-webpack 5.96.1+dfsg1+~cs11.18.26-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-11-02] node-webpack 5.95.0+dfsg1+~cs11.18.26-1 MIGRATED to testing (Debian testing watch)
[2024-10-28] Accepted node-webpack 5.95.0+dfsg1+~cs11.18.26-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2024-09-21] node-webpack 5.94.0+dfsg1+~cs11.18.26-2 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 13)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.108.0+dfsg1+~cs14.7.20-2
2 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing