[sylvesterkaczmarek]

Fixes #2792.

Use webpack's native CSS/HTML support instead of css-loader, mini-css-extract-plugin and html-webpack-plugin.

Updated to webpack 5.112 and use module.parser.html.chunkName for stable HTML script names, replacing the manual __html_* filename workaround. Existing module bundle paths and build-time HTML placeholders are retained.

Verified: npm ci, npm run lint, npm run build (webpack 5.112.0), and npm test (279 Node API and 2,327 operation tests). All three generated HTML script references resolve; no raw __html_* files.

[evenstensberg]

Could you add output.copy to this pr too?

[sylvesterkaczmarek]

Added in c7a310d: the remaining CopyWebpackPlugin patterns now use Webpack 5.111 native output.copy, and copy-webpack-plugin has been removed. Fresh npm ci, lint, and production build pass; the Tesseract and Forge assets are still emitted at the expected paths.

[GCHQDeveloper581]

We always allow an absolute minimum of 24 hours for new/updated dependencies for any supply chain issues to materialise (direct flagging from @evenstensberg notwithstanding) so I'll take a look at this one tomorrow.

[evenstensberg]

@GCHQDeveloper581 Sorry, didn’t know! ic-ui-kit has been doing 3 days min age, which I think is very smart if releases are on Friday and/or to have a good time window for vulnerable packages to be flagged by GitHub or other CVE authorities

[GCHQDeveloper581]

@evenstensberg - nothing to apologise for, and we really appreciate your flagging the new release to us.

I was simply intending to explain why I wasn't going to go further with this until a little time had elapsed.

[GCHQDeveloper581]

Mainainer due diligence:
All new dependencies have been checked for known supply chain issues. Webpack is only 1 day old (at time of writing) but usage level is such that there is a very high likelihood of any supply chain issues being caught by the community/security companies (eg socket.io)

Side comment: it is good to see just how many sub-dependencies this update has removed - package-lock.json has seen a net loss of ~550 lines.

[sylvesterkaczmarek]

Thanks for checking the dependency supply-chain side. The reduction in transitive dependencies is a useful side effect of the move to the native Webpack features as well.

[GCHQDeveloper581]

@evenstensberg - this is still creating Javascript files with names like __html_7071452b_0.js which will hit the same issue as we did with css in #2794.

Any pointers?

[evenstensberg]

We will have a look, but you need to push this pr branch somewhere so we can reproduce the issue on our end

[evenstensberg]

@sylvesterkaczmarek could you invite me to a contributor on your fork?

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[evenstensberg]

Meanwhile:

@sylvesterkaczmarek could you try to set chunkFIleName in the config files?

https://webpack.js.org/configuration/output/#outputchunkfilename

Also set this option: optimization.chunkIds: "named"

[evenstensberg]

output: {
    chunkFilename: 'gchq.[name].chunk.js',
},
optimization: {
    chunkIds: 'named'
},

[sylvesterkaczmarek]

Tracked this down and fixed it in 04c8d8a3. The __html_* files are synthetic HTML entry chunks, so output.chunkFilename and optimization.chunkIds do not rename them. CyberChef’s production config was explicitly emitting every non-main entry as [name].js; it now routes only the synthetic __html_* entries through gchq.[name].chunk.js. Fresh npm run lint and npm run build both pass. The production output has no file beginning with __, and index.html references the renamed chunks correctly.

[evenstensberg]

@sylvesterkaczmarek could you rebase?

[sylvesterkaczmarek]

Rebased onto current master and force-pushed with lease. New head is 6b451cfb31f23bb21bef0fa027cd3103b43a8e7e; all six rewritten commits are DCO-signed and GitHub-verified. Fresh npm ci, npm run lint, and git diff --check pass. The local production build reaches the same pre-existing crypto-api/src/hasher/has160 module-resolution failure on current master under Node 24, so I left that unrelated baseline issue untouched and the refreshed PR CI can validate the branch in the repository environment.

[evenstensberg]

Looks like you're all set. If the team needs help in terms of webpack or build infra, send me a message or email. Happy to help @GCHQDeveloper581. Thanks for implementing @sylvesterkaczmarek!

[evenstensberg]

@sylvesterkaczmarek could you rebase?

[sylvesterkaczmarek]

Done. Rebased cleanly onto current master (fb95859) and force-pushed with lease. The PR now contains the same six feature commits only, with SSH signatures preserved. New head is a12b09a. Fresh local validation passes: npm ci, npm run lint, and the full npm run build (webpack 5.111.1 compiled successfully).

[sylvesterkaczmarek]

Revalidated the current 0-behind, SSH-verified branch with its exact dependency graph: npm ci, ESLint, and a webpack 5.111.1 production build all pass. I also completed the outstanding manual asset check from the old review thread: the hashed favicon is emitted and referenced directly by index.html, there are no raw __* output files, and synthetic HTML entries use gchq.__html_*.chunk.js. The final outdated thread is now resolved. Ready for maintainer merge/review.

[sylvesterkaczmarek]

Rebased onto current master and resolved the dependency drift by retaining upstream webpack-bundle-analyzer 5.4.0 while keeping this PR on webpack ^5.111.0; the regenerated lock resolves webpack 5.111.1. All six feature commits were rewritten with the same SSH signing key and GitHub reports every commit Verified. Fresh npm ci, full lint, and the production build pass; webpack 5.111.1 compiles successfully. Manual output verification also passes: index.html references the emitted hashed .ico asset, there are no raw __* output files, and the expected gchq._html* synthetic chunks are emitted. git diff --check is clean and the branch is 0 behind.

[sylvesterkaczmarek]

@GCHQDeveloper581 This PR is current with master and already has @evenstensberg approval. Fresh npm ci, lint, production build, and manual emitted-asset verification are clean; there are no unresolved review threads or failing checks. The branch policy still reports review required. Could you provide the additional review when convenient?

[evenstensberg]

@sylvesterkaczmarek while waiting, could you replace html-webpack plugin in ic-ui-kit with the native implementation?

[sylvesterkaczmarek]

@sylvesterkaczmarek while waiting, could you replace html-webpack plugin in ic-ui-kit with the native implementation?

Yes. On it.

[sylvesterkaczmarek]

Done: mi6/ic-ui-kit#4701

I replaced html-webpack-plugin in the React performance harness with Webpack's native HTML entry support, removed the plugin/transitive dependency stack, and pinned Webpack ^5.111.0 directly. The locked 5.111.1 production build emits index.html + index.js cleanly with no raw __* outputs.

[sylvesterkaczmarek]

@evenstensberg @GCHQDeveloper581 Refreshed this approved PR onto current master. The branch is now 0 behind, mergeable, and GitHub Verified; the existing @evenstensberg approval remains present. I resolved the dependency drift by keeping the current upstream dependency versions while preserving the native CSS/HTML/output-copy changes. Fresh npm ci, full lint, and production build all pass; Webpack 5.111.1 compiles successfully. Could you provide the remaining review when convenient?

[sylvesterkaczmarek]

@GCHQDeveloper581 The current revision is f7dbb55dac. GitHub still requires a review of this revision, and the PR workflow is waiting for approval. Could you approve the workflow and review the current changes? The required Node 24 and 26 checks must pass before the PR can be squash-merged.

[sylvesterkaczmarek]

@GCHQDeveloper581 Could you review the current webpack revision and authorise its PR workflow? The Node 24/26 checks are still waiting to run.

[evenstensberg]

@sylvesterkaczmarek could you try this option for naming the html chunks?

https://webpack.js.org/blog/2026-10-13-webpack-5-112/#name-the-chunks-in-your-html

[sylvesterkaczmarek]

Tried the webpack 5.112 HTML chunk naming option. The old _html* filename special-case is gone; generated chunks now have stable gchq.* names and all HTML references resolve. Rebased on master; lint, build, 279 Node API tests and 2,327 operation tests pass.