[heft-web-rig] Upgrade webpack 5 to ~5.112.0 - #6180

Summary

Update the coordinated webpack 5 pins from ~5.105.2 to ~5.112.0, including @rushstack/heft-web-rig. This addresses installs where schema-utils@4.8.1 resolves transitively and requires the webpack ^5.112.0 peer range.

Draft / release blocker: published webpack still has the source-map file hash regression described in webpack/webpack#22939. The fix is merged in webpack/webpack#22941 but is not in the latest npm release (5.112.2). The regression reproduces with plain webpack, without Rushstack plugins, on both 5.112.0 and 5.112.2. Keep this draft until a fixed webpack release can be selected; existing source-map assertions remain unchanged.

Details

• Align 24 webpack 5 rig, tooling, and sample/test pins and regenerate the default subspace lockfile and repository state. Preserve webpack 4 pins, existing peer compatibility ranges, and the intentionally older local-webpack fixture (~5.105.0).
• Use the chunk filename-template type and an explicitly present chunk in the localization plugin to accommodate newer webpack callback typing without requiring a new-only named webpack type export.
• Regenerate webpack-generated runtime/hash snapshots. Disable constant-export inlining only in the license-metadata fixture so it still exercises wrapped-module offsets; retain the assertions.
• Rename the dashboard keyframe, not its class, to avoid the new CSS module class/keyframe export collision without changing animation behavior.
• Include patch changes for the web rig and localization plugin, with non-bumping change files for development-only updates.

How it was tested

Node 24.22.1 on Linux.

• rush check, rush update --bypass-policy, frozen rush install --bypass-policy, rush change --verify --target-branch microsoft/main --no-fetch, and the repository formatter pass.
• Verified the installed rig resolves webpack 5.112.0 and schema-utils 4.8.1.
• Ran the affected production build/test graph, including webpack 4 and the older local-version fixture. Reverified localization (20 tests), license/source-map/module-position metadata (16 tests), minifier output formats/AMD externals/multiple runtimes (7 tests), hashed-folder-copy (3 tests), and themed-style loader (8 tests) after regenerating snapshots, without snapshot-update mode.
• The remaining affected project roots pass their production build/test checks, and the dashboard/serve-plugin production build passes without the CSS export warning.
• Rush-core tests pass with a clean temporary home (1,924 passed, two skipped). The initial run inherited this machine local Rush user environment file, which is not supported by daemon-mode tests; no user configuration was read or modified.
• Known failing upstream source-map assertions are intentionally retained: the three SourceMapTest filename/file checks in heft-webpack5-everything-test, and the sourceMap=true runtime test in webpack5-module-minifier-plugin. The final affected production graph was rerun on commit 1aa7f65f41: only these four source-map assertions and an SDK install-run stdout snapshot under the isolated HOME failed. The SDK suite was then rerun under the normal HOME and passed all six tests. Rush-core passed separately under the isolated HOME (1,924 passed, two skipped), so the environment-sensitive suites were verified separately rather than changing snapshots for local paths. No source-map assertion was changed, skipped, or relaxed.

No documentation changes are required. Implementation and test investigation were AI-assisted.

Snapshot portability follow-up

Updated in f6841959ef.

The first CI run reported seven failing minified localization snapshots on Linux and Windows. The new webpack default minimizer includes its implementation-module path relative to the virtual compilation context in the chunk hash. Since these fixtures use a virtual root context, the checkout location changes expected hashes even when the visible minified JavaScript is equivalent.

The test-only MemFSPlugin now explicitly selects terser-webpack-plugin using the repository-standard ~5.3.1 range and the same compression passes, rather than inheriting the path-sensitive default. Regenerated the seven affected snapshot files through Jest; no snapshot assertions were weakened or normalized away.

Validation: production build, ESLint, TypeScript, and API Extractor pass; all 20 localization tests pass in production/CI mode without snapshot updates. A separate two-context compilation check confirms the old default produces different output names, while the updated harness emits identical names and code. rush check, change-file verification, and the repository formatter pass.

The separate upstream source-map release blocker remains unchanged. This PR remains a draft pending that fix; source-map behavior assertions were not edited.