#9 - Update dependency webpack-dev-server to v5.2.7 - autoclosed - andras/sdf-2d-demo

andras commented

2026-09-20 09:11:25 +01:00

Owner

This PR contains the following updates:

Package	Type	Update	Change
webpack-dev-server	devDependencies	patch	`5.2.4` → `5.2.7`

Release Notes

webpack/webpack-dev-server (webpack-dev-server)

`v5.2.7`

Compare Source

Patch Changes

Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @github-actions in #5766)
Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @bjohansebas in #5772)

`v5.2.6`

Compare Source

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options
argument, so passing a webpack config's optional devServer field type-checks and works as before.
Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)
Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

`v5.2.5`

Compare Source

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)
compatibility with event target and universal target and lazy compilation (574026c)
overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
progress indicator styles (#5557) (41a53a1)
upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)
do not crush when error is null for runtime errors (#5447) (309991f)
remove unnecessary header X_TEST (#5451) (64a6124)
respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [webpack-dev-server](https://github.com/webpack/webpack-dev-server) | devDependencies | patch | [`5.2.4` → `5.2.7`](https://renovatebot.com/diffs/npm/webpack-dev-server/5.2.4/5.2.7) | --- ### Release Notes <details> <summary>webpack/webpack-dev-server (webpack-dev-server)</summary> ### [`v5.2.7`](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.7) [Compare Source](https://github.com/webpack/webpack-dev-server/compare/v5.2.6...v5.2.7) ##### Patch Changes - Validate the `Host` and `Origin` headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with `ws: true`. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by [@github-actions](https://github.com/apps/github-actions) in [#5766](https://github.com/webpack/webpack-dev-server/pull/5766)) - Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when `allowedHosts` is `"all"`. Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by [@bjohansebas](https://github.com/bjohansebas) in [#5772](https://github.com/webpack/webpack-dev-server/pull/5772)) ### [`v5.2.6`](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6) [Compare Source](https://github.com/webpack/webpack-dev-server/compare/v5.2.5...v5.2.6) ##### Patch Changes - fix: allow `undefined` as the `Server` constructor `options` argument again (by [@bjohansebas](https://github.com/bjohansebas) in [#5695](https://github.com/webpack/webpack-dev-server/pull/5695)) Restores accepting `undefined` (defaulting it to `{}`) for the `options` argument, so passing a webpack config's optional `devServer` field type-checks and works as before. - Protect the built-in state-changing routes (`/webpack-dev-server/invalidate` and `/webpack-dev-server/open-editor`) against cross-site request forgery. Requests are now checked with `Sec-Fetch-Site` (falling back to an `Origin`/`Host` comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by [@bjohansebas](https://github.com/bjohansebas) in [#5698](https://github.com/webpack/webpack-dev-server/pull/5698)) - Handle malformed `Host` and `Origin` header values gracefully when validating requests. (by [@bjohansebas](https://github.com/bjohansebas) in [#5699](https://github.com/webpack/webpack-dev-server/pull/5699)) ### [`v5.2.5`](https://github.com/webpack/webpack-dev-server/blob/HEAD/CHANGELOG.md#525) [Compare Source](https://github.com/webpack/webpack-dev-server/compare/v5.2.4...v5.2.5) ##### Patch Changes - Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by [@bjohansebas](https://github.com/bjohansebas) in [#5680](https://github.com/webpack/webpack-dev-server/pull/5680)) All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines. ##### [5.2.4](https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4) (2026-05-11) ##### Bug Fixes - set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP ##### [5.2.3](https://github.com/webpack/webpack-dev-server/compare/v5.2.2...v5.2.3) (2026-01-12) ##### Bug Fixes - add `cause` for `errorObject` ([#5518](https://github.com/webpack/webpack-dev-server/issues/5518)) ([37b033d](https://github.com/webpack/webpack-dev-server/commit/37b033da2c48335178495a1987c469a26ef3de60)) - compatibility with event target and universal target and lazy compilation ([574026c](https://github.com/webpack/webpack-dev-server/commit/574026c44b9c51f0bbd2f5a2836c54607289a071)) - **overlay:** add ESC key to dismiss overlay ([#5598](https://github.com/webpack/webpack-dev-server/issues/5598)) ([f91baa8](https://github.com/webpack/webpack-dev-server/commit/f91baa8831e061e2998849966b8002b40b83fb07)) - progress indicator styles ([#5557](https://github.com/webpack/webpack-dev-server/issues/5557)) ([41a53a1](https://github.com/webpack/webpack-dev-server/commit/41a53a1accdb0a90785d82cbe8a079794eeed3c8)) - upgrade selfsigned to v5 ##### [5.2.2](https://github.com/webpack/webpack-dev-server/compare/v5.2.1...v5.2.2) (2025-06-03) ##### Bug Fixes - "Overlay enabled" false positive ([18e72ee](https://github.com/webpack/webpack-dev-server/commit/18e72ee3e57a6e7598a6c068c0ff7c7bb6a857f1)) - do not crush when error is null for runtime errors ([#5447](https://github.com/webpack/webpack-dev-server/issues/5447)) ([309991f](https://github.com/webpack/webpack-dev-server/commit/309991f947baa0354140b9930a9654ac792e20c4)) - remove unnecessary header `X_TEST` ([#5451](https://github.com/webpack/webpack-dev-server/issues/5451)) ([64a6124](https://github.com/webpack/webpack-dev-server/commit/64a6124bf1b4d158bb42a4341dd03121ae3759fa)) - respect the `allowedHosts` option for cross-origin header check ([#5510](https://github.com/webpack/webpack-dev-server/issues/5510)) ([03d1214](https://github.com/webpack/webpack-dev-server/commit/03d12141bf7be09dfb14e91e5c834ee63bd9a9a2)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

andras added 1 commit

2026-09-20 09:11:25 +01:00

Update dependency webpack-dev-server to v5.2.6

Check & deploy / build (pull_request) Successful in 22s

Details

6d3e4f340b

andras changed title from ~~Update dependency webpack-dev-server to v5.2.6~~ to Update dependency webpack-dev-server to v5.2.7

2026-10-19 02:20:46 +01:00

andras force-pushed renovate/webpack-dev-server-5.x-lockfile from 6d3e4f340b

Check & deploy / build (pull_request) Successful in 22s

Details

to 42f9a44a09