[alexander-akait]

Configuration files were loaded with eval(\import("…")`). That was a workaround for TypeScript compiling import()intorequire()` in CommonJS output, which can't load ES modules.

The package now compiles with module: "nodenext", and TypeScript keeps import() as a real dynamic import in CommonJS output. The compiled lib/webpack-cli.js already does this for the other dynamic imports in the same file, for example the YAML/TOML parser import next to this code. So the configuration is now loaded with a plain await import(...), and the compiled output has no eval left.

The behavior is the same: the configuration is imported from its file:// URL, and if that fails, the interpret/rechoir fallback still runs.

Checked locally:

• the compiled output uses import(…) with no eval;
• the full test suite except create-webpack-app passes (154 suites), including the config-format tests (ESM, CommonJS, TypeScript, Babel, CoffeeScript, YAML, TOML and others).

---

Generated by Claude Code

Summary by CodeRabbit

• Bug Fixes
  • ES module configuration files are now loaded using native dynamic imports. When that loading attempt fails, the existing fallback behavior remains unchanged. This update does not alter available configuration options or the public interface, and configurations that load successfully continue to be available to webpack as before.

[changeset-bot]

🦋 Changeset detected

Latest commit: 42cf33b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
webpack-cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

This PR is packaged and the instant preview is available (4a88999).

Install it locally:

• npm

npm i -D webpack-cli@https://pkg.pr.new/webpack-cli@4a88999

• yarn

yarn add -D webpack-cli@https://pkg.pr.new/webpack-cli@4a88999

• pnpm

pnpm add -D webpack-cli@https://pkg.pr.new/webpack-cli@4a88999

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.24%. Comparing base (3942417) to head (42cf33b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4893      +/-   ##
==========================================
+ Coverage   94.95%   95.24%   +0.28%     
==========================================
  Files          14       14              
  Lines        5950     5949       -1     
  Branches      915      916       +1     
==========================================
+ Hits         5650     5666      +16     
+ Misses        296      282      -14     
+ Partials        4        1       -3     

Files with missing lines	Coverage Δ
packages/webpack-cli/src/webpack-cli.ts	97.15% <100.00%> (+0.31%)	⬆️

... and 2 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3942417...42cf33b. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4f49c717-621c-43c3-8fe5-1638968e469e

Commits

Reviewing files that changed from the base of the PR and between be2f4f1 and 42cf33b.

Files selected for processing: 1

• test/build/config/basic/basic-config.test.js

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Walkthrough

The ESM configuration-load attempt now calls import() directly with the file URL or path URL. It no longer uses eval to construct the import expression. The existing loading-error fallback remains unchanged. A new test checks that a crafted configuration path fails to load, returns exit code 2, and does not create a marker file. A patch changeset describes the change.

Priority: Low

Merge Risk: Minimal · up to 42cf3

No actionable merge-blocking risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: loading configuration files without using eval.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

test/build/config/basic/basic-config.test.js

Oops! Something went wrong! :(

ESLint: 10.14.0

Error: Error while loading rule 'jest/no-deprecated-functions': Unable to detect Jest version - please ensure jest package is installed, or otherwise set version explicitly
Occurred while linting /test/build/config/basic/basic-config.test.js
at detectJestVersion (/.eslint-tmp/node_modules/eslint-plugin-jest/lib/rules/utils/detectJestVersion.js:22:9)
at create (/.eslint-tmp/node_modules/eslint-plugin-jest/lib/rules/no-deprecated-functions.js:31:107)
at Object.create (/.eslint-tmp/node_modules/@typescript-eslint/utils/dist/eslint-utils/RuleCreator.js:39:20)
at createRuleListeners (/.eslint-tmp/node_modules/eslint/lib/linter/linter.js:502:15)
at /.eslint-tmp/node_modules/eslint/lib/linter/linter.js:628:7
at Array.forEach ()
at runRules (/.eslint-tmp/node_modules/eslint/lib/linter/linter.js:562:31)
at #flatVerifyWithoutProcessors (/.eslint-tmp/node_modules/eslint/lib/linter/linter.js:1297:4)
at Linter._verifyWithFlatConfigArrayAndWithoutProcessors (/.eslint-tmp/node_modules/eslint/lib/linter/linter.js:1382:43)
at Linter._verifyWithFlatConfigArray (/.eslint-tmp/node_modules/eslint/lib/linter/linter.js:1449:15)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}