Skip to content

Re-encode inline hash digests ([contenthash]/[chunkhash]/[fullhash]/[modulehash]) from full content#21267

Merged
alexander-akait merged 8 commits into
mainfrom
claude/css-hash-inline-digest-7806a1
Jun 24, 2026
Merged

Re-encode inline hash digests ([contenthash]/[chunkhash]/[fullhash]/[modulehash]) from full content#21267
alexander-akait merged 8 commits into
mainfrom
claude/css-hash-inline-digest-7806a1

Conversation

@alexander-akait

Copy link
Copy Markdown
Member

Summary

Follow-up to #21259 (#21141). The inline hash digest feature re-encoded the already-truncated stored hash, so [contenthash:<digest>] carried no extra entropy, threw under optimization.realContentHash, and produced 404s for dynamically-loaded chunks (the runtime dropped the digest hash entirely). This re-encodes [contenthash]/[chunkhash]/[fullhash]/[modulehash] from the full content hash so the value is full-entropy and the runtime URL matches the emitted filename. Also makes RealContentHashPlugin digest-aware, supports [fullhash:<digest>] in dynamic chunk filenames (inlined after hashing), and fixes base-N digests to preserve leading zero bytes (a latent collision).

What kind of change does this PR introduce?

feat (includes a base-N digest collision fix).

Did you add tests for your changes?

Yes — test/hash-digest.unittest.js, additions to test/TemplatedPathPlugin.unittest.js, and test/configCases/hash-length/{digest,digest-async-chunk,digest-asset-module,digest-fullhash-chunkname}. Full ConfigTestCases + HotTestCases + stats/unit suites pass.

Does this PR introduce a breaking change?

Only output-value changes, no API breakage (signature changes are added optional params). base-N output.hashDigest (e.g. base58) changes the filename for digests that start with a 0x00 byte (~0.4% per leading byte) — this fixes a real collision where two distinct digests encoded to the same string; migration is a one-time cache-bust. The inline [*:<digest>] syntax is from the unreleased #21259, so no published version changes behavior.

If relevant, what needs to be documented once your changes are merged or what have you already documented?

docs.webpack.js.org: note that an inline [..:<digest>] re-encodes from the full hash (full entropy, can exceed hashDigestLength), that the digit-only [..:N] form stays bound to hashDigestLength, and that base64 is filename/ident-unsafe (use base64url).

Use of AI

Implemented with Claude Code (Anthropic). AI was used to analyze the existing hash/runtime paths, write the implementation and tests, and run the test suite and a CPU/memory benchmark (no measurable regression); all changes were reviewed before committing.


Generated by Claude Code

@changeset-bot

changeset-bot Bot commented Jun 24, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 844a4a1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
webpack Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions

github-actions Bot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

This PR is packaged and the instant preview is available (7c81bde).

Install it locally:

  • npm
npm i -D webpack@https://pkg.pr.new/webpack@7c81bde
  • yarn
yarn add -D webpack@https://pkg.pr.new/webpack@7c81bde
  • pnpm
pnpm add -D webpack@https://pkg.pr.new/webpack@7c81bde

@codecov

codecov Bot commented Jun 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.84%. Comparing base (eefaf44) to head (844a4a1).

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #21267      +/-   ##
==========================================
+ Coverage   92.81%   92.84%   +0.02%     
==========================================
  Files         592      592              
  Lines       64964    65022      +58     
  Branches    18135    18162      +27     
==========================================
+ Hits        60299    60368      +69     
+ Misses       4665     4654      -11     
Flag Coverage Δ
css-parsing 28.63% <18.75%> (-0.02%) ⬇️
html5lib 31.08% <17.50%> (-0.02%) ⬇️
integration 88.98% <87.50%> (-0.01%) ⬇️
test262 45.57% <30.00%> (+0.01%) ⬆️
unit 41.43% <56.25%> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@codspeed-hq

codspeed-hq Bot commented Jun 24, 2026

Copy link
Copy Markdown

Merging this PR will improve performance by ×2.2

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 4 improved benchmarks
❌ 2 regressed benchmarks
✅ 138 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

Mode Benchmark BASE HEAD Efficiency
Memory benchmark "many-chunks-commonjs", scenario '{"name":"mode-production","mode":"production"}' 7.3 MB 9.7 MB -25.41%
Memory benchmark "many-modules-commonjs", scenario '{"name":"mode-production","mode":"production"}' 7.7 MB 10 MB -22.83%
Memory benchmark "lodash", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}' 850.9 KB 127.6 KB ×6.7
Memory benchmark "side-effects-reexport", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}' 860 KB 130.9 KB ×6.6
Memory benchmark "asset-modules-bytes", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}' 859.4 KB 245.7 KB ×3.5
Memory benchmark "devtool-eval", scenario '{"name":"mode-production","mode":"production"}' 7.8 MB 6.1 MB +26.31%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.


Comparing claude/css-hash-inline-digest-7806a1 (844a4a1) with main (eefaf44)

Open in CodSpeed

…:<digest>]

Inline `[contenthash:<digest>]` previously threw under
optimization.realContentHash because the plugin recomputed content hashes
in output.hashDigest, ignoring the inline digest. Record the requested
digest per hash during path interpolation and re-encode the recomputed
real content hash in it, so the inline digest now works (and carries full
content entropy) instead of being rejected.
…ntent

Inline `[contenthash:<digest>]`/`[chunkhash:<digest>]` re-encoded the
already-truncated stored hash, and in the dynamic chunk-filename runtime
module the digest re-encode mangled the per-chunk map, dropping the hash
entirely so dynamically-loaded chunks 404'd.

Retain the full content digest per chunk (transient, recomputed each seal)
and re-encode from it in both the static asset path and the per-chunk
runtime map, so the value carries full entropy and the runtime URL matches
the emitted filename. `[fullhash:<digest>]`/`[hash:<digest>]` in a
dynamically-loaded chunk filename now throws a clear error, since it resolves
to a runtime getFullHash() expression that cannot be re-encoded.
The base-N encoder dropped leading 0x00 bytes (whole digest collapsed to one
BigInt), so two distinct digests could collide and a zero-heavy digest encoded
far shorter than requested, making [contenthash:baseN:N] slices too short. Re-
emit one leading alphabet[0] char per leading zero byte (and decode the inverse),
matching the function's own documented contract. Digests without a leading zero
byte are unchanged, so typical output hashes are unaffected.
…full content

Inline [contenthash:<digest>]/[modulehash:<digest>] in module/asset contexts
(asset-module filenames) re-encoded the already-truncated stored hash, so the
digest carried no extra entropy and an inline length couldn't exceed
output.hashDigestLength. Thread the full content digest through AssetGenerator
into PathData (contentHashFull) and pass the full module hash (getModuleHash,
not getRenderedModuleHash), so the static re-encode uses full entropy — matching
the chunk-context behaviour added earlier.
[fullhash:<digest>]/[hash:<digest>] in a dynamically-loaded chunk filename
previously threw, because the runtime builds it from getFullHash() — a runtime
expression that cannot be re-encoded. When such a template is used, flag the
GetChunkFilenameRuntimeModule as fullHash so it re-renders after hashing, and
inline the re-encoded full compilation hash directly instead of getFullHash().
The inlined value is byte-identical to the statically emitted filename, so the
chunk loads with full entropy (no 404). The length-only [fullhash:8] form is
unchanged and still uses the getFullHash() runtime expression.
lint:types-test (tsc -p tsconfig.types.test.json) type-checks the test files;
the new cases passed synthetic object literals that don't satisfy PathData /
AssetInfo. Cast them with EXPECTED_ANY, matching the existing idiom in this file.
@alexander-akait alexander-akait force-pushed the claude/css-hash-inline-digest-7806a1 branch from 251d21e to 05f73cb Compare June 24, 2026 12:17
…imeModule

A function chunkFilename routes chunks through addStaticUrl rather than the
dynamic map, so its inline-digest handlers (chunkhash/contenthash) had no test.
Add a config case that loads an async chunk through that path.
@github-actions

Copy link
Copy Markdown
Contributor

Types Coverage

Coverage after merging claude/css-hash-inline-digest-7806a1 into main will be
99.36%
Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
bin
   webpack.js98.77%100%100%98.77%91
examples
   build-common.js100%100%100%100%
   buildAll.js100%100%100%100%
   examples.js100%100%100%100%
   template-common.js98.21%100%100%98.21%72
examples/custom-javascript-parser
   test.filter.js100%100%100%100%
examples/custom-javascript-parser/internals
   acorn-parse.js100%100%100%100%
   meriyah-parse.js100%100%100%100%
   oxc-parse.js91.30%100%100%91.30%140, 142–143, 145, 147, 153–154, 161, 168, 90
examples/markdown
   webpack.config.mjs100%100%100%100%
examples/module-federation
   test.filter.js100%100%100%100%
examples/reexport-components
   test.filter.js100%100%100%100%
examples/typescript
   test.filter.js100%100%100%100%
examples/typescript-non-erasable
   test.filter.js50%100%100%50%5
examples/virtual-modules
   test.filter.js100%100%100%100%
examples/wasm-bindgen-esm
   test.filter.js100%100%100%100%
examples/wasm-complex
   test.filter.js100%100%100%100%
examples/wasm-emscripten
   test.filter.js100%100%100%100%
examples/wasm-simple
   test.filter.js100%100%100%100%
examples/wasm-simple-source-phase
   test.filter.js100%100%100%100%
lib
   APIPlugin.js100%100%100%100%
   AsyncDependenciesBlock.js100%100%100%100%
   AutomaticPrefetchPlugin.js100%100%100%100%
   BannerPlugin.js100%100%100%100%
   Cache.js98.21%100%100%98.21%101
   CacheFacade.js100%100%100%100%
   Chunk.js99.72%100%100%99.72%39
   ChunkGraph.js100%100%100%100%
   ChunkGroup.js100%100%100%100%
   ChunkTemplate.js100%100%100%100%
   CircularModulesPlugin.js98.81%100%100%98.81%136
   CleanPlugin.js99.15%100%100%99.15%207, 227
   CodeGenerationResults.js100%100%100%100%
   CompatibilityPlugin.js100%100%100%100%
   Compilation.js98.43%100%100%98.43%1641, 1960, 1967, 1975, 1997, 2000, 2940, 3419–3420, 3452, 4118, 4148, 4201–4202, 4206, 4211, 4227–4228, 4242–4243, 4248–4249, 4726, 4752, 526, 531, 5560, 5592, 5609, 5625, 5641, 5656, 5681–5682, 5684, 6012, 6017, 6023, 6026, 6038, 6040, 6044, 6060, 6075, 6107, 6161, 6185, 6299, 777–778
   Compiler.js99.56%100%100%99.56%1147–1148, 1156
   ConcatenationScope.js98.65%100%100%98.65%195
   ConditionalInitFragment.js100%100%100%100%
   ConstPlugin.js100%100%100%100%
   ContextExclusionPlugin.js100%100%100%100%
   ContextModule.js100%100%100%100%
   ContextModuleFactory.js97.40%100%100%97.40%258, 395, 418, 420, 424, 433–434
   ContextReplacementPlugin.js100%100%100%100%
   DefinePlugin.js99%100%100%99%171–172, 188, 207, 281
   DependenciesBlock.js100%100%100%100%
   Dependency.js98.51%100%100%98.51%479, 525
   DependencyTemplate.js100%100%100%100%
   DependencyTemplates.js100%100%100%100%
   DotenvPlugin.js98.41%100%100%98.41%378, 391–392
   DynamicEntryPlugin.js100%100%100%100%
   EntryOptionPlugin.js100%100%100%100%
   EntryPlugin.js100%100%100%100%
   Entrypoint.js100%100%100%100%
   EnvironmentPlugin.js97.14%100%100%97.14%49
   ErrorHelpers.js100%100%100%100%
   EvalDevToolModulePlugin.js100%100%100%100%
   EvalSourceMapDevToolPlugin.js100%100%100%100%
   ExportsInfo.js100%100%100%100%
   ExportsInfoApiPlugin.js100%100%100%100%
   ExternalModule.js98.50%100%100%98.50%1062, 1065, 450–454, 456, 602
   ExternalModuleFactoryPlugin.js100%100%100%100%
   ExternalsPlugin.js100%100%100%100%
   FileSystemInfo.js99.52%100%100%99.52%182, 2382–2383, 2386, 2397, 2408, 2419, 280, 3823, 3838, 3862
   FlagAllModulesAsUsedPlugin.js100%100%100%100%
   FlagDependencyExportsPlugin.js98.42%100%100%98.42%413, 422, 424, 428
   FlagDependencyUsagePlugin.js100%100%100%100%
   FlagEntryExportAsUsedPlugin.js100%100%100%100%
   Generator.js100%100%100%100%
   HotModuleReplacementPlugin.js100%100%100%100%
   HotUpdateChunk.js100%100%100%100%
   IgnorePlugin.js100%100%100%100%
   IgnoreWarningsPlugin.js100%100%100%100%
   InitFragment.js100%100%100%100%
   JavascriptMetaInfoPlugin.js100%100%100%100%
   LazyBarrel.js100%100%100%100%
   LibraryTemplatePlugin.js100%100%100%100%
   LoaderOptionsPlugin.js100%100%100%100%
   LoaderTargetPlugin.js100%100%100%100%
   MainTemplate.js100%100%100%100%
   ManifestPlugin.js100%100%100%100%
   Module.js98.50%100%100%98.50%1285, 1290, 1350, 1364, 1426, 1435
   ModuleFactory.js100%100%100%100%
   ModuleFilenameHelpers.js98.85%100%100%98.85%106, 108
   ModuleGraph.js99.73%100%100%99.73%1005
   ModuleGraphConnection.js100%100%100%100%
   ModuleInfoHeaderPlugin.js100%100%100%100%
   ModuleNotFoundError.js100%100%100%100%
   ModuleProfile.js100%100%100%100%
   ModuleSourceTypeConstants.js100%100%100%100%
   ModuleTemplate.js100%100%100%100%
   ModuleTypeConstants.js100%100%100%100%
   MultiCompiler.js99.69%100%100%99.69%661
   MultiStats.js100%100%100%100%
   MultiWatching.js100%100%100%100%
   NoEmitOnErrorsPlugin.js100%100%100%100%
   NodeStuffPlugin.js100%100%100%100%
   NormalModule.js97.90%100%100%97.90%1237, 1240, 1257, 1274, 1521, 1555, 1571, 1658, 2014, 2313, 2318–2328, 418, 422, 576
   NormalModuleFactory.js99.47%100%100%99.47%1083, 1392, 486, 498
   NormalModuleReplacementPlugin.js100%100%100%100%
   NullFactory.js100%100%100%100%
   OptimizationStages.js100%100%100%100%
   OptionsApply.js100%100%100%100%
   Parser.js100%100%100%100%
   PlatformPlugin.js100%100%100%100%
   PrefetchPlugin.js100%100%100%100%
   ProgressPlugin.js98.85%100%100%98.85%527–528, 533, 535, 599
   ProvidePlugin.js100%100%100%100%
   RawModule.js100%100%100%100%
   RecordIdsPlugin.js100%100%100%100%
   RequestShortener.js100%100%100%100%
   ResolverFactory.js100%100%100%100%
   RuntimeGlobals.js100%100%100%100%
   RuntimeModule.js100%100%100%100%
   RuntimePlugin.js100%100%100%100%
   RuntimeTemplate.js100%100%100%100%
   SelfModuleFactory.js100%100%100%100%
   SingleEntryPlugin.js100%100%100%100%
   SourceMapDevToolModuleOptionsPlugin.js100%100%100%100%
   SourceMapDevToolPlugin.js98.62%100%100%98.62%220, 224, 226, 419, 430, 889
   Stats.js100%100%100%100%
   Template.js100%100%100%100%
   TemplatedPathPlugin.js99.43%100%100%99.43%308–309
   UseStrictPlugin.js100%100%100%100%
   WarnCaseSensitiveModulesPlugin.js100%100%100%100%
   WarnDeprecatedOptionPlugin.js100%100%100%100%
   WarnNoModeSetPlugin.js100%100%100%100%
   WatchIgnorePlugin.js100%100%100%100%
   Watching.js100%100%100%100%
   WebpackError.js100%100%100%100%
   WebpackIsIncludedPlugin.js100%100%100%100%
   WebpackOptionsApply.js100%100%100%100%
   WebpackOptionsDefaulter.js100%100%100%100%
   buildChunkGraph.js99.87%100%100%99.87%371
   cli.js98.63%100%100%98.63%10, 119, 549, 581, 631, 905
   index.js99.72%100%100%99.72%184
   validateSchema.js94.67%100%100%94.67%100, 87, 89, 98
   webpack.js96.33%100%100%96.33%10, 198, 220, 222
lib/asset
   AssetBytesGenerator.js100%100%100%100%
   AssetBytesParser.js100%100%100%100%
   AssetGenerator.js100%100%100%100%
   AssetModule.js100%100%100%100%
   AssetModulesPlugin.js97.33%100%100%97.33%282, 306, 309, 36, 362, 41
   AssetParser.js100%100%100%100%
   AssetSourceGenerator.js100%100%100%100%
   AssetSourceParser.js100%100%100%100%
   RawDataUrlModule.js100%100%100%100%
lib/async-modules
   AsyncModuleHelpers.js100%100%100%100%
   AwaitDependenciesInitFragment.js100%100%100%100%
   InferAsyncModulesPlugin.js100%100%100%100%
lib/bun
   BunTargetPlugin.js100%100%100%100%
lib/cache
   AddBuildDependenciesPlugin.js100%100%100%100%
   AddManagedPathsPlugin.js100%100%100%100%
   IdleFileCachePlugin.js97.92%100%100%97.92%75, 87, 95
   MemoryCachePlugin.js95.83%100%100%95.83%33
   MemoryWithGcCachePlugin.js93.15%100%100%93.15%107, 114–115, 123, 90
   PackFileCacheStrategy.js96.40%100%100%96.40%1251, 1351, 1355, 1417, 628, 647, 657–659, 661, 677–678, 683, 686, 688, 693, 698, 723, 729, 763, 769, 775, 780, 791, 800, 805–806, 808, 825, 831–832, 834
   ResolverCachePlugin.js100%100%100%100%
   getLazyHashedEtag.js100%100%100%100%
   mergeEtags.js100%100%100%100%
lib/config
   browserslistTargetHandler.js100%100%100%100%
   defaults.js99.33%100%100%99.33%1468–1470, 1478, 274,

@alexander-akait alexander-akait merged commit 7c81bde into main Jun 24, 2026
67 of 68 checks passed
@alexander-akait alexander-akait deleted the claude/css-hash-inline-digest-7806a1 branch June 24, 2026 13:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant