The webpack latest version lives in the webpack 5 (5.x) release line, which receives frequent patch releases, so "latest" is best read as the newest 5.x published on npm rather than a fixed number. webpack 5 has been the current major since 2020, and the project ships regular minor and patch updates carrying bug fixes, performance work, and security patches for it and its dependency tree.
Because build tooling sits at the heart of your supply chain, knowing your webpack version and keeping it current is not just housekeeping. It is a security control.
How to check the version you actually run
Do not guess. Ask your project:
# The version resolved in your project
npm ls webpack
# The latest published on the registry right now
npm view webpack version
# The webpack CLI, versioned separately
npx webpack --version
npm ls webpack is the important one, because webpack is frequently a transitive dependency. Frameworks and toolchains (older Angular CLI, Vue CLI, Create React App-style setups, Storybook) bundle their own webpack, so your app may run a version you never chose directly. You can easily be several minors behind without realizing it.
Note that "latest webpack version" on the registry moves constantly; the number you see today will be superseded within weeks, which is exactly why you check programmatically instead of trusting a blog post's number.
Why the version matters for security
webpack is a build-time dependency, and build-time dependencies are a prized supply-chain target. They run on developer machines and in CI runners that often hold registry tokens, cloud credentials, and signing keys. A vulnerability in the build toolchain can be a foothold into everything the pipeline can reach.
Two concrete reasons to stay current:
- webpack's own transitive dependency tree gets security fixes in patch releases. Floating far behind means inheriting known-vulnerable transitive packages that a newer webpack already resolved.
- Newer versions maintain compatibility with current loaders and plugins, so staying current keeps you off abandoned plugin versions that themselves stop receiving fixes.
The risk is rarely a dramatic webpack-core CVE. It is the slow accumulation of stale transitive dependencies underneath an outdated build tool.
The webpack 4 problem
If you are still on webpack 4, treat that as a security item, not a backlog nicety. webpack 4 is end-of-life and no longer receives updates, which means its dependency tree is frozen with whatever vulnerabilities it carried at retirement. Any advisory published against those transitive packages will never be patched in a webpack 4 context. Migrating to webpack 5 is the real remedy; there is no supported way to keep webpack 4 secure indefinitely.
Upgrading within 5.x safely
Moving from one 5.x version to a newer 5.x is almost always low-risk, because semantic versioning means minors and patches should not break your build. A safe sequence:
# See what is outdated
npm outdated webpack webpack-cli
# Update to the latest 5.x
npm install --save-dev webpack@latest webpack-cli@latest
# Reinstall cleanly from the lockfile and run your build + tests
npm ci
npm run build
Always commit the lockfile change and run your full build plus test suite after the bump. Pin through the lockfile so CI installs exactly what you tested, rather than silently drifting to a newer patch on the next pipeline run.
Keeping it current without manual chasing
Nobody wants to run npm outdated by hand across dozens of repos. Two practices scale this:
- Automated update PRs (Dependabot, Renovate) that propose webpack bumps and run your CI against them, so upgrades become a reviewed merge rather than a chore.
- Continuous dependency scanning so you are alerted when the webpack version you run, or something in its transitive tree, gets an advisory. An SCA tool such as Safeguard can watch build-time dependencies like webpack and flag when your pinned version falls behind a security fix. Our software composition analysis product covers scanning dev dependencies specifically.
Treat "which webpack are we on?" as a question your tooling answers automatically, per repo, rather than something a human remembers to check. The security academy has a playbook for managing build-time dependency freshness across a fleet.
FAQ
What is the latest version of webpack?
webpack's current major is webpack 5, and the latest version is the newest 5.x patch published on npm, which changes frequently. Check npm view webpack version for the live number rather than relying on a static figure in an article.
How do I know which webpack version my project uses?
Run npm ls webpack. Because webpack is often a transitive dependency bundled by frameworks and tools, this shows the version actually resolved in your tree, which may differ from anything you installed directly.
Is it safe to upgrade webpack to the latest 5.x?
Generally yes. Moving between 5.x versions follows semantic versioning, so minors and patches should not break your build. Update, reinstall cleanly with npm ci, then run your full build and test suite to confirm before committing the lockfile.
Should I still be using webpack 4?
No. webpack 4 is end-of-life and no longer patched, so its transitive dependency tree accumulates unfixable vulnerabilities. Migrating to webpack 5 is the supported path and should be treated as a security priority, not just a maintenance task.