@@ -0,0 +1,5 @@
+---
+"webpack": patch
+---
+
+Minify data: URL payloads in HTML attributes and `new URL`, and web manifests.
@@ -4161,7 +4161,35 @@ Or do you want to use the entrypoints '${name}' and '${runtime}' independently o
 			(err) => {
 				if (err) return callback(/** @type {WebpackError} */ (err));
 				const affected = new Set(pending.map(({ jobModule }) => jobModule));
-				const redo = jobs.filter(({ module }) => affected.has(module));
+				// A module referencing one of these may have copied what it generated
+				// into its own code (an analyzable `new URL`), so it goes again after.
+				/** @type {Set<Module>} */
+				const referencing = new Set();
+				for (const { info } of pending) {
+					for (const connection of this.moduleGraph.getIncomingConnections(
+						info.module
+					)) {
+						const { originModule } = connection;
+						if (originModule !== null && !affected.has(originModule)) {
+							referencing.add(originModule);
+						}
+					}
+				}
+
+				const ConcatenatedModule = require("./optimize/ConcatenatedModule");
+
+				const redo = [
+					...jobs.filter(({ module }) => affected.has(module)),
+					// A referencing module concatenated into another is generated as
+					// part of it, so the job to redo is the concatenated module's.
+					...jobs.filter(
+						({ module }) =>
+							!affected.has(module) &&
+							((module instanceof ConcatenatedModule &&
+								module.modules.some((inner) => referencing.has(inner))) ||
+								referencing.has(module))
+					)
+				];
 				// Generated directly rather than through the codegen cache: the module
 				// hash is unchanged, so the cache would hand back the first pass again.
 				const results =
 
@@ -27,7 +27,10 @@ const RuntimeGlobals = require("../runtime/RuntimeGlobals");
 const { toTemplateSourceFileName } = require("../template/TemplatedPathPlugin");
 const { getScheme } = require("../util/URLAbsoluteSpecifier");
 const createHash = require("../util/createHash");
-const { languageOfMediaType } = require("../util/dataURL");
+const {
+	encodeDataURIPayload,
+	languageOfMediaType
+} = require("../util/dataURL");
 const { makePathsRelative, parseResource } = require("../util/identifier");
 const memoize = require("../util/memoize");
 const nonNumericOnlyHash = require("../util/nonNumericOnlyHash");
@@ -635,6 +638,17 @@ class AssetGenerator extends Generator {
 				encodedContent =
 					/** @type {string} */
 					(module.resourceResolveData.encodedContent);
+			} else if (
+				renderedSource !== undefined &&
+				encoding === false &&
+				module.resourceResolveData &&
+				module.resourceResolveData.encoding === false
+			) {
+				// A rendered payload of a `data:` URI written as text is written back
+				// as text: percent-encoding all of it outgrows what minifying saved.
+				encodedContent = encodeDataURIPayload(
+					/** @type {string} */ (source.source())
+				);
 			} else {
 				encodedContent = encodeDataUri(
 					/** @type {"base64" | false} */ (encoding),
@@ -676,13 +690,12 @@ class AssetGenerator extends Generator {
 			(module.buildInfo).dataUrl &&
 			needContent
 		) {
-			// A payload bound for CSS or HTML is offered by their serializers, which
-			// see the `url()` it ends up in; only the JavaScript one is ours.
+			// WHY: CSS and HTML serializers offer the payload in the `url()` or
+			// attribute it lands in, but the `asset-url` value is also what an
+			// analyzable `new URL` copies into JavaScript, which nothing re-reads.
 			const encodedSource = this.generateDataUri(
 				module,
-				type === JAVASCRIPT_TYPE
-					? this._renderEmbedded(module, runtimeTemplate)
-					: undefined
+				this._renderEmbedded(module, runtimeTemplate)
 			);
 			content =
 				type === JAVASCRIPT_TYPE
 
@@ -2646,7 +2646,8 @@ const applyOptimizationDefaults = (
 				if (minifyJson) {
 					minify.push(require("../json/jsonMinify"));
 					minimizerOptions.push({});
-					extensions.push("json");
+					// A web app manifest is JSON under its own extension.
+					extensions.push("json", "webmanifest");
 				}
 				new TerserPlugin({
 					test: assetNameTest(extensions),
 
@@ -57,7 +57,11 @@ module.exports = (compiler) => {
 	for (const candidate of [...minimizer, ...plugins]) {
 		if (!css) css = claims(candidate, "file.css");
 		if (!html) html = claims(candidate, "file.html");
-		if (!json) json = claims(candidate, "file.json");
+		// The JSON minifier takes web app manifests too, so claiming either stops it.
+		if (!json) {
+			json =
+				claims(candidate, "file.json") || claims(candidate, "file.webmanifest");
+		}
 		if (css && html && json) break;
 	}
 	return { css, html, json };
 
@@ -9,12 +9,7 @@ const { CSS_TYPE } = require("../module/ModuleSourceTypeConstants");
 
 const GenericSourceProcessor = require("../util/SourceProcessor");
 
-const {
-	buildDataURI,
-	decodeDataURIPayload,
-	languageOfMediaType,
-	parseDataURI
-} = require("../util/dataURL");
+const { buildDataURI, readEmbeddedDataURI } = require("../util/dataURL");
 
 /**
  * Renders source this stylesheet embeds — a `data:` URL's payload today.
@@ -1575,18 +1570,32 @@ const _minifyUrlFunction = (fn, inner) => {
 	// whether a data URL holds a document.
 	const decoded = _decodePercentEscapes(written, false, mark);
 	// A `data:` payload a renderer rewrites is serialized afresh, so what it hands
-	// back is no longer what the quotes were written around. Quoted as written
-	// until then, the unquoted form below not carrying a document payload.
+	// back is no longer what the quotes were written around; declined, it is
+	// printed as an untapped run prints it.
 	if (_S._deferEmbeddedSource !== undefined) {
 		const deferred = _deferDataUrl(
 			decoded,
 			(url) => `${fn}(${_serializeUrl(url, mark)})`,
-			`${fn}(${mark}${written}${mark})`
+			_plainUrlFunction(fn, written, decoded, mark) ||
+				`${fn}(${mark}${written}${mark})`
 		);
 		if (deferred !== null) return deferred;
 	}
 	const rendered = _renderDataUrl(decoded);
 	if (rendered !== null) return `${fn}(${_serializeUrl(rendered, mark)})`;
+	return _plainUrlFunction(fn, written, decoded, mark);
+};
+
+/**
+ * A quoted `url()` as it prints with nothing rendered: unquoted where it is a
+ * url-token without the quotes, its needless percent-escapes decoded.
+ * @param {string} fn the lowercased function name
+ * @param {string} written the url as written, quotes excluded
+ * @param {string} decoded the url with its needless percent-escapes decoded
+ * @param {string} mark the quote it was written in
+ * @returns {string | null} the shorter `url()`, or null to keep the function
+ */
+const _plainUrlFunction = (fn, written, decoded, mark) => {
 	// Taking the quotes off what is a url-token without them is `normalizeQuotes`;
 	// writing a percent-escape as the byte it names is not a switch of its own —
 	// an escape and the byte name one string, so nothing reads them apart.
@@ -4142,14 +4151,37 @@ const printer = (path, writer) => {
 				}
 			}
 			const percent = raw.includes("%");
+			/**
+			 * @returns {string} the url-token as it prints with nothing rendered
+			 */
+			const plainUrl = () => {
+				// Padding only exists when the content is whitespace-bounded; checking
+				// that costs two char reads, reading the content costs a slice.
+				if (
+					!percent &&
+					!isWhitespace(raw.charCodeAt(open + 1)) &&
+					!isWhitespace(raw.charCodeAt(raw.length - 2))
+				) {
+					return head === null ? raw : head + raw.slice(open + 1);
+				}
+				const name = head === null ? raw.slice(0, open + 1) : head;
+				const value = _urlValue(path, unterminated);
+				// A url-token already carrying an escape is one this printer did not
+				// write, so its `\%` is not read as the start of a percent-escape.
+				return `${name}${
+					percent && !value.includes("\\")
+						? _decodePercentEscapes(value, true, "")
+						: value
+				})`;
+			};
 			// Ahead of the padding fast path below: a base64 `data:` url is
 			// whitespace-free and `%`-free, so it would take it and never be offered.
 			if (_S._deferEmbeddedSource !== undefined) {
 				const opener = head === null ? raw.slice(0, open + 1) : head;
 				const deferred = _deferDataUrl(
 					_urlValue(path, unterminated),
 					(url) => `${opener}${_serializeUrl(url, '"')})`,
-					raw
+					plainUrl()
 				);
 				if (deferred !== null) return deferred;
 			}
@@ -4160,24 +4192,7 @@ const printer = (path, writer) => {
 					return `${name}${_serializeUrl(renderedUrl, '"')})`;
 				}
 			}
-			// Padding only exists when the content is whitespace-bounded; checking
-			// that costs two char reads, reading the content costs a slice.
-			if (
-				!percent &&
-				!isWhitespace(raw.charCodeAt(open + 1)) &&
-				!isWhitespace(raw.charCodeAt(raw.length - 2))
-			) {
-				return head === null ? raw : head + raw.slice(open + 1);
-			}
-			if (head === null) head = raw.slice(0, open + 1);
-			const value = _urlValue(path, unterminated);
-			// A url-token already carrying an escape is one this printer did not
-			// write, so its `\%` is not read as the start of a percent-escape.
-			return `${head}${
-				percent && !value.includes("\\")
-					? _decodePercentEscapes(value, true, "")
-					: value
-			})`;
+			return plainUrl();
 		}
 		case T_STRING: {
 			const source = path.source();
@@ -4846,13 +4861,7 @@ const _readDataUrl = (url) => {
 	// A CSS escape is still written here — the quoted form is percent-decoded,
 	// not unescaped — so the payload would be read with its backslashes in it.
 	if (url.includes("\\")) return null;
-	const parsed = parseDataURI(url);
-	if (parsed === null) return null;
-	const type = languageOfMediaType(parsed.mediaType);
-	if (type === undefined) return null;
-	const payload = decodeDataURIPayload(parsed);
-	if (payload === null || payload === "") return null;
-	return { parsed, type, payload };
+	return readEmbeddedDataURI(url);
 };
 
 /**
 
@@ -131,8 +131,12 @@ const htmlMinify = async (input, sourceMap, minimizerOptions = {}) => {
 	 */
 	const printDocument = async (text) => {
 		// The built-in renderer is synchronous, so with no caller's renderer only
-		// a nested document needs the async pass — and no `srcdoc`, none is there.
-		if (renderEmbeddedSource === undefined && !/srcdoc/i.test(text)) {
+		// a nested document needs the async pass — an `<iframe srcdoc>` or a
+		// `data:` URL naming HTML; with neither spelled, none is there.
+		if (
+			renderEmbeddedSource === undefined &&
+			!/srcdoc|data:[^,]*html/i.test(text)
+		) {
 			return new SourceProcessor().process(text, {
 				...printOptions,
 				renderEmbeddedSource: builtin
 
@@ -12,6 +12,7 @@ const {
 } = require("../module/ModuleSourceTypeConstants");
 
 const GenericSourceProcessor = require("../util/SourceProcessor");
+const { buildDataURI, readEmbeddedDataURI } = require("../util/dataURL");
 
 const {
 	ADDRESS_DIV_P,
@@ -10098,6 +10099,26 @@ const _isEventHandlerAttribute = (tagName, name) => {
 	return elements === null || elements.has(tagName);
 };
 
+/**
+ * The `data:` URL a URL attribute holds, read for the renderer, or null where
+ * the attribute is no URL on this element or the URL offers nothing.
+ * @param {string} tagName lowercased element name
+ * @param {string} name lowercased attribute name
+ * @param {string} value the attribute's decoded value
+ * @returns {ReturnType<typeof readEmbeddedDataURI>} the payload and its language, or null
+ */
+const _attributeDataUrl = (tagName, name, value) => {
+	const elements = URL_ATTRIBUTES.get(name);
+	if (elements === undefined || (elements !== null && !elements.has(tagName))) {
+		return null;
+	}
+	const url = _asciiTrim(value);
+	// The URL parser drops every tab and newline, so a payload holding one is
+	// not the text the browser reads.
+	if ((url.charCodeAt(0) | 0x20) !== 0x64 || /[\t\n\r]/.test(url)) return null;
+	return readEmbeddedDataURI(url);
+};
+
 // One list's token spans, reused: ordering a list allocates only its result.
 /** @type {number[]} */
 const _tokenSpanStarts = [];
@@ -11122,6 +11143,71 @@ const _minifyOpenTag = (path, open) => {
 				continue;
 			}
 
+			// A URL attribute's `data:` payload, offered decoded as its media type's
+			// language and written back only where the rebuilt URL spells shorter.
+			const dataUrl =
+				html &&
+				!isStyle &&
+				!verbatim &&
+				(_S._renderEmbeddedSource !== undefined ||
+					_S._deferEmbeddedSource !== undefined)
+					? _attributeDataUrl(
+							elementName,
+							attributeName,
+							hasReference ? /** @type {string} */ (spellable) : rawValue
+						)
+					: null;
+
+			if (dataUrl !== null) {
+				// HTML only, so no foreign `/>` reads back how this value ends.
+				const asWritten =
+					written === null
+						? ` ${attributeName}=${sourceDelimiter}${rawValue}${sourceDelimiter}`
+						: written.text;
+				const declinedTail = written !== null && written.unquotedTail;
+				/**
+				 * @param {string | null | undefined} rendered what the renderer answered
+				 * @returns {{ text: string, unquotedTail: boolean } | null} what to emit, or null where nothing it answered is written
+				 */
+				const writeDataUrl = (rendered) => {
+					if (typeof rendered !== "string" || rendered === dataUrl.payload) {
+						return null;
+					}
+					const url = buildDataURI(dataUrl.parsed, rendered);
+					const answered = _writeAttribute(
+						attributeName,
+						escapeAttribute(url, CC_QUOTATION_MARK, true),
+						rawValue,
+						url,
+						quoted,
+						sourceDelimiter
+					);
+
+					return answered !== null && answered.text.length < asWritten.length
+						? answered
+						: null;
+				};
+
+				if (_S._deferEmbeddedSource !== undefined) {
+					out += _deferEmbedded(dataUrl.payload, dataUrl.type, (rendered) => {
+						const answered = writeDataUrl(rendered);
+
+						return answered === null ? asWritten : answered.text;
+					});
+					unquotedTail = declinedTail;
+				} else {
+					const answered = writeDataUrl(
+						_renderEmbeddedOrNull(dataUrl.payload, dataUrl.type)
+					);
+
+					out += answered === null ? asWritten : answered.text;
+					unquotedTail =
+						answered === null ? declinedTail : answered.unquotedTail;
+				}
+				consumedEnd = valueEnd;
+				continue;
+			}
+
 			// Offered whatever the built-in made of it: a list already at its
 			// shortest is one `_writeAttribute` declines, not one to ask nobody about.
 			if (
 
@@ -61,8 +61,9 @@ jsonMinify.getTypes = () => ["json"];
 
 /**
  * @param {string} name asset filename
- * @returns {boolean} true for JSON assets
+ * @returns {boolean} true for JSON assets, a web app manifest included
  */
-jsonMinify.filter = (name) => /^[^?#]*\.json(?:[?#].*)?$/i.test(name);
+jsonMinify.filter = (name) =>
+	/^[^?#]*\.(?:json|webmanifest)(?:[?#].*)?$/i.test(name);
 
 module.exports = jsonMinify;
-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"webpack": patch
 +---
++
 +Minify data: URL payloads in HTML attributes and `new URL`, and web manifests.