Update dependency webpack-dev-server to v5 - autoclosed #476

mend-for-github-com · 2025-01-31T18:05:36Z

This PR contains the following updates:

Package	Type	Update	Change
webpack-dev-server	dependencies	major	`^3.1.14` -> `^5.0.0`

By merging this PR, the below issues will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability	GitHub Issue
Critical	9.8	CVE-2019-10747	#379
Critical	9.8	CVE-2020-7720	#429
Critical	9.8	CVE-2021-44906	#394
Critical	9.8	CVE-2022-0691	#398
Critical	9.8	CVE-2023-42282	#423
Critical	9.1	CVE-2022-0686	#419
High	8.1	CVE-2022-1650	#414
High	7.7	CVE-2021-23386	#395
High	7.5	CVE-2019-20149	#376
High	7.5	CVE-2021-23424	#396
High	7.5	CVE-2021-3807	#415
High	7.5	CVE-2022-24771	#408
High	7.5	CVE-2022-24772	#406
High	7.5	CVE-2022-24999	#417
High	7.5	CVE-2024-45296	#446
High	7.5	CVE-2024-45590	#447
High	7.5	CVE-2024-52798	#465
High	7.4	CVE-2024-29180	#377
High	7.3	CVE-2020-7774	#388
High	7.3	CVE-2021-23440	#428
High	7.3	CVE-2023-26159	#393
High	7.2	CVE-2021-23337	#390

Release Notes

webpack/webpack-dev-server (webpack-dev-server)

`v5.1.0`

Compare Source

Features

add visual progress indicators (a8f40b7)
added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
allow the server option to be Function (#5275) (02a1c6d)
http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

check the platform property to determinate the target (#5269) (c3b532c)
ipv6 output (#5270) (06005e7)
replace rimraf with rm (#5162) (1a1561f)
replace default gateway (#5255) (f5f0902)
support devServer: false (#5272) (8b341cb)

5.0.4 (2024-03-19)

Bug Fixes

security: bump webpack-dev-middleware (#5112) (aab576a)

5.0.3 (2024-03-12)

Bug Fixes

types: proxy (#5101) (6e1aed3)

5.0.2 (2024-02-16)

Bug Fixes

types (#5057) (da2c24d)

5.0.1 (2024-02-13)

Bug Fixes

avoid using eval in client (#5045) (7681477)
overlay and require-trusted-types-for (#5046) (e115436)

`v5.0.4`

Compare Source

Security

cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

`v5.0.3`

Compare Source

Features

add visual progress indicators (a8f40b7)
added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
allow the server option to be Function (#5275) (02a1c6d)
http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

check the platform property to determinate the target (#5269) (c3b532c)
ipv6 output (#5270) (06005e7)
replace rimraf with rm (#5162) (1a1561f)
replace default gateway (#5255) (f5f0902)
support devServer: false (#5272) (8b341cb)

5.0.4 (2024-03-19)

Bug Fixes

security: bump webpack-dev-middleware (#5112) (aab576a)

5.0.3 (2024-03-12)

Bug Fixes

types: proxy (#5101) (6e1aed3)

5.0.2 (2024-02-16)

Bug Fixes

types (#5057) (da2c24d)

5.0.1 (2024-02-13)

Bug Fixes

avoid using eval in client (#5045) (7681477)
overlay and require-trusted-types-for (#5046) (e115436)

`v5.0.2`

Compare Source

Features

add visual progress indicators (a8f40b7)
added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
allow the server option to be Function (#5275) (02a1c6d)
http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

check the platform property to determinate the target (#5269) (c3b532c)
ipv6 output (#5270) (06005e7)
replace rimraf with rm (#5162) (1a1561f)
replace default gateway (#5255) (f5f0902)
support devServer: false (#5272) (8b341cb)

5.0.4 (2024-03-19)

Bug Fixes

security: bump webpack-dev-middleware (#5112) (aab576a)

5.0.3 (2024-03-12)

Bug Fixes

types: proxy (#5101) (6e1aed3)

5.0.2 (2024-02-16)

Bug Fixes

types (#5057) (da2c24d)

5.0.1 (2024-02-13)

Bug Fixes

avoid using eval in client (#5045) (7681477)
overlay and require-trusted-types-for (#5046) (e115436)

`v5.0.1`

Compare Source

Features

add visual progress indicators (a8f40b7)
added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
allow the server option to be Function (#5275) (02a1c6d)
http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

check the platform property to determinate the target (#5269) (c3b532c)
ipv6 output (#5270) (06005e7)
replace rimraf with rm (#5162) (1a1561f)
replace default gateway (#5255) (f5f0902)
support devServer: false (#5272) (8b341cb)

5.0.4 (2024-03-19)

Bug Fixes

security: bump webpack-dev-middleware (#5112) (aab576a)

5.0.3 (2024-03-12)

Bug Fixes

types: proxy (#5101) (6e1aed3)

5.0.2 (2024-02-16)

Bug Fixes

types (#5057) (da2c24d)

5.0.1 (2024-02-13)

Bug Fixes

avoid using eval in client (#5045) (7681477)
overlay and require-trusted-types-for (#5046) (e115436)

`v5.0.0`

Compare Source

Features

add visual progress indicators (a8f40b7)
added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
allow the server option to be Function (#5275) (02a1c6d)
http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

check the platform property to determinate the target (#5269) (c3b532c)
ipv6 output (#5270) (06005e7)
replace rimraf with rm (#5162) (1a1561f)
replace default gateway (#5255) (f5f0902)
support devServer: false (#5272) (8b341cb)

5.0.4 (2024-03-19)

Bug Fixes

security: bump webpack-dev-middleware (#5112) (aab576a)

5.0.3 (2024-03-12)

Bug Fixes

types: proxy (#5101) (6e1aed3)

5.0.2 (2024-02-16)

Bug Fixes

types (#5057) (da2c24d)

5.0.1 (2024-02-13)

Bug Fixes

avoid using eval in client (#5045) (7681477)
overlay and require-trusted-types-for (#5046) (e115436)

`v4.15.2`

Compare Source

4.15.2 (2024-03-20)

Bug Fixes

security: bump webpack-dev-middleware (4116209)

`v4.15.1`

Compare Source

Migration Guide and Changes.

4.15.1 (2023-06-09)

Bug Fixes

replace :: with localhost before openBrowser() (#4856) (874c44b)
types: compatibility with @types/ws (#4899) (34bcec2)

`v4.15.0`

Compare Source

Migration Guide and Changes.

4.15.1 (2023-06-09)

Bug Fixes

replace :: with localhost before openBrowser() (#4856) (874c44b)
types: compatibility with @types/ws (#4899) (34bcec2)

`v4.14.0`

Compare Source

Features

allow CLI to be ESM (#4837) (bb4a5d9)
allow filter overlay errors/warnings with function (#4813) (aab01b3)

4.13.3 (2023-04-15)

Bug Fixes

perf: reduced initial start time (#4818) (fcf01d1)

4.13.2 (2023-03-31)

Bug Fixes

prevent open 0.0.0.0 in browser due windows problems (04e74f2)

4.13.1 (2023-03-18)

Bug Fixes

make webpack optional peer dependency (#4778) (71be54e)

`v4.13.3`

Compare Source

Features

allow CLI to be ESM (#4837) (bb4a5d9)
allow filter overlay errors/warnings with function (#4813) (aab01b3)

4.13.3 (2023-04-15)

Bug Fixes

perf: reduced initial start time (#4818) (fcf01d1)

4.13.2 (2023-03-31)

Bug Fixes

prevent open 0.0.0.0 in browser due windows problems (04e74f2)

4.13.1 (2023-03-18)

Bug Fixes

make webpack optional peer dependency (#4778) (71be54e)

`v4.13.2`

Compare Source

Features

allow CLI to be ESM (#4837) (bb4a5d9)
allow filter overlay errors/warnings with function (#4813) (aab01b3)

4.13.3 (2023-04-15)

Bug Fixes

perf: reduced initial start time (#4818) (fcf01d1)

4.13.2 (2023-03-31)

Bug Fixes

prevent open 0.0.0.0 in browser due windows problems (04e74f2)

4.13.1 (2023-03-18)

Bug Fixes

make webpack optional peer dependency (#4778) (71be54e)

`v4.13.1`

Compare Source

Features

allow CLI to be ESM (#4837) (bb4a5d9)
allow filter overlay errors/warnings with function (#4813) (aab01b3)

4.13.3 (2023-04-15)

Bug Fixes

perf: reduced initial start time (#4818) (fcf01d1)

4.13.2 (2023-03-31)

Bug Fixes

prevent open 0.0.0.0 in browser due windows problems (04e74f2)

4.13.1 (2023-03-18)

Bug Fixes

make webpack optional peer dependency (#4778) (71be54e)

`v4.13.0`

Compare Source

Features

allow CLI to be ESM (#4837) (bb4a5d9)
allow filter overlay errors/warnings with function (#4813) (aab01b3)

4.13.3 (2023-04-15)

Bug Fixes

perf: reduced initial start time (#4818) (fcf01d1)

4.13.2 (2023-03-31)

Bug Fixes

prevent open 0.0.0.0 in browser due windows problems (04e74f2)

4.13.1 (2023-03-18)

Bug Fixes

make webpack optional peer dependency (#4778) (71be54e)

`v4.12.0`

Compare Source

Features

allow to set the sockjs_url option (only sockjs) using the webSocketServer.options.sockjsUrl option (#4586) (69a2fba)
catch runtime error (#4605) (87a26cf)
improve styles for overlay (#4576) (791fb85)
open editor when clicking error on overlay (#4587) (efb2cec)

Bug Fixes

compatibility with experiments.buildHttp (#4585) (5b846cb)
respect NODE_PATH env variable (#4581) (b857e6f)

4.11.1 (2022-09-19)

Bug Fixes

respect client.logging option for all logs (#4572) (375835c)

`v4.11.1`

Compare Source

Features

allow to set the sockjs_url option (only sockjs) using the webSocketServer.options.sockjsUrl option (#4586) (69a2fba)
catch runtime error (#4605) (87a26cf)
improve styles for overlay (#4576) (791fb85)
open editor when clicking error on overlay (#4587) (efb2cec)

Bug Fixes

compatibility with experiments.buildHttp (#4585) (5b846cb)
respect NODE_PATH env variable (#4581) (b857e6f)

4.11.1 (2022-09-19)

Bug Fixes

respect client.logging option for all logs (#4572) (375835c)

`v4.11.0`

Compare Source

Features

allow to set the sockjs_url option (only sockjs) using the webSocketServer.options.sockjsUrl option (#4586) (69a2fba)
catch runtime error (#4605) (87a26cf)
improve styles for overlay (#4576) (791fb85)
open editor when clicking error on overlay (#4587) (efb2cec)

Bug Fixes

compatibility with experiments.buildHttp (#4585) (5b846cb)
respect NODE_PATH env variable (#4581) (b857e6f)

4.11.1 (2022-09-19)

Bug Fixes

respect client.logging option for all logs (#4572) (375835c)

`v4.10.1`

Compare Source

Features

make allowedHosts accept localhost subdomains by default (#4357) (0a33e6a)

Bug Fixes

auto reply to OPTIONS requests only when unhandled (#4559) (984af02), closes #4551

4.10.1 (2022-08-29)

Bug Fixes

compatibility with old browsers (#4544) (6a430d4)

`v4.10.0`

Compare Source

Features

make allowedHosts accept localhost subdomains by default (#4357) (0a33e6a)

Bug Fixes

auto reply to OPTIONS requests only when unhandled (#4559) (984af02), closes #4551

4.10.1 (2022-08-29)

Bug Fixes

compatibility with old browsers (#4544) (6a430d4)

`v4.9.3`

Compare Source

Features

allow to configure more client options via resource URL (#4274) (216e3cb)

Bug Fixes

response correctly when receive an OPTIONS request (#4185) (2b3b7e0)

4.9.3 (2022-06-29)

Bug Fixes

avoid creation unnecessary stream for static sockjs file (#4482) (049b153)
history-api-fallback now supports HEAD requests and handles them the same as GET (8936082)

4.9.2 (2022-06-06)

Bug Fixes

add @types/serve-static to dependencies (#4468) (af83deb)

4.9.1 (2022-05-31)

Bug Fixes

security problem with sockjs (#4465) (e765182)

`v4.9.2`

Compare Source

Features

allow to configure more client options via resource URL (#4274) (216e3cb)

Bug Fixes

response correctly when receive an OPTIONS request (#4185) (2b3b7e0)

4.9.3 (2022-06-29)

Bug Fixes

avoid creation unnecessary stream for static sockjs file (#4482) (049b153)
history-api-fallback now supports HEAD requests and handles them the same as GET (8936082)

4.9.2 (2022-06-06)

Bug Fixes

add @types/serve-static to dependencies (#4468) (af83deb)

4.9.1 (2022-05-31)

Bug Fixes

security problem with sockjs (#4465) (e765182)

`v4.9.1`

Compare Source

Features

allow to configure more client options via resource URL (#4274) (216e3cb)

Bug Fixes

response correctly when receive an OPTIONS request (#4185) (2b3b7e0)

4.9.3 (2022-06-29)

Bug Fixes

avoid creation unnecessary stream for static sockjs file (#4482) (049b153)
history-api-fallback now supports HEAD requests and handles them the same as GET (8936082)

4.9.2 (2022-06-06)

Bug Fixes

add @types/serve-static to dependencies (#4468) (af83deb)

4.9.1 (2022-05-31)

Bug Fixes

security problem with sockjs (#4465) (e765182)

`v4.9.0`

Compare Source

Features

allow to configure more client options via resource URL (#4274) (216e3cb)

Bug Fixes

response correctly when receive an OPTIONS request (#4185) (2b3b7e0)

4.9.3 (2022-06-29)

Bug Fixes

avoid creation unnecessary stream for static sockjs file (#4482) (049b153)
history-api-fallback now supports HEAD requests and handles them the same as GET (8936082)

4.9.2 (2022-06-06)

Bug Fixes

add @types/serve-static to dependencies (#4468) (af83deb)

4.9.1 (2022-05-31)

Bug Fixes

security problem with sockjs (#4465) (e765182)

`v4.8.1`

Compare Source

Features

support Trusted Types for client overlay (#4404) (8132e1d)

Bug Fixes

ie11 runtime (#4403) (256d5fb)
replace portfinder with custom implementation and fix security problem (#4384) (eea50f3)
use the host in options to check if port is available (#4385) (a10c7cf)

4.8.1 (2022-04-06)

Bug Fixes

types (#4373) (f6fe6be)

`v4.8.0`

Compare Source

Features

support Trusted Types for client overlay (#4404) (8132e1d)

Bug Fixes

ie11 runtime (#4403) (256d5fb)
replace portfinder with custom implementation and fix security problem (#4384) (eea50f3)
use the host in options to check if port is available (#4385) (a10c7cf)

4.8.1 (2022-04-06)

Update dependency webpack-dev-server to v5

4d33e6f

mend-for-github-com bot added the security fix Security fix generated by WhiteSource label Jan 31, 2025

mend-for-github-com bot changed the title ~~Update dependency webpack-dev-server to v5~~ Update dependency webpack-dev-server to v5 - autoclosed Mar 19, 2025

mend-for-github-com bot closed this Mar 19, 2025

mend-for-github-com bot deleted the whitesource-remediate/webpack-dev-server-5.x branch March 19, 2025 18:05

mend-for-github-com bot changed the title ~~Update dependency webpack-dev-server to v5 - autoclosed~~ Update dependency webpack-dev-server to v5 Mar 24, 2025

mend-for-github-com bot reopened this Mar 24, 2025

mend-for-github-com bot force-pushed the whitesource-remediate/webpack-dev-server-5.x branch from c56cbcb to 4d33e6f Compare March 24, 2025 00:12

mend-for-github-com bot changed the title ~~Update dependency webpack-dev-server to v5~~ Update dependency webpack-dev-server to v5 - autoclosed Apr 15, 2025

mend-for-github-com bot closed this Apr 15, 2025

mend-for-github-com bot changed the title ~~Update dependency webpack-dev-server to v5 - autoclosed~~ Update dependency webpack-dev-server to v5 Apr 15, 2025

mend-for-github-com bot reopened this Apr 15, 2025

mend-for-github-com bot changed the title ~~Update dependency webpack-dev-server to v5~~ Update dependency webpack-dev-server to v5 - autoclosed Apr 29, 2025

mend-for-github-com bot closed this Apr 29, 2025

mend-for-github-com bot changed the title ~~Update dependency webpack-dev-server to v5 - autoclosed~~ Update dependency webpack-dev-server to v5 Apr 30, 2025

mend-for-github-com bot reopened this Apr 30, 2025

mend-for-github-com bot force-pushed the whitesource-remediate/webpack-dev-server-5.x branch from 7a66c3c to 4d33e6f Compare April 30, 2025 00:11

mend-for-github-com bot changed the title ~~Update dependency webpack-dev-server to v5~~ Update dependency webpack-dev-server to v5 - autoclosed Jul 29, 2025

mend-for-github-com bot closed this Jul 29, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update dependency webpack-dev-server to v5 - autoclosed #476

Update dependency webpack-dev-server to v5 - autoclosed #476

Uh oh!

mend-for-github-com bot commented Jan 31, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Update dependency webpack-dev-server to v5 - autoclosed #476

Update dependency webpack-dev-server to v5 - autoclosed #476

Uh oh!

Conversation

mend-for-github-com bot commented Jan 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Bug Fixes

5.0.4 (2024-03-19)

Bug Fixes

5.0.3 (2024-03-12)

Bug Fixes

5.0.2 (2024-02-16)

Bug Fixes

5.0.1 (2024-02-13)

Bug Fixes

Security

Bug Fixes

Features

Bug Fixes

5.0.4 (2024-03-19)

Bug Fixes

5.0.3 (2024-03-12)

Bug Fixes

5.0.2 (2024-02-16)

Bug Fixes

5.0.1 (2024-02-13)

Bug Fixes

Features

Bug Fixes

5.0.4 (2024-03-19)

Bug Fixes

5.0.3 (2024-03-12)

Bug Fixes

5.0.2 (2024-02-16)

Bug Fixes

5.0.1 (2024-02-13)

Bug Fixes

Features

Bug Fixes

5.0.4 (2024-03-19)

Bug Fixes

5.0.3 (2024-03-12)

Bug Fixes

5.0.2 (2024-02-16)

Bug Fixes

5.0.1 (2024-02-13)

Bug Fixes

Features

Bug Fixes

5.0.4 (2024-03-19)

Bug Fixes

5.0.3 (2024-03-12)

Bug Fixes

5.0.2 (2024-02-16)

Bug Fixes

5.0.1 (2024-02-13)

Bug Fixes

4.15.2 (2024-03-20)

Bug Fixes

4.15.1 (2023-06-09)

Bug Fixes

4.15.1 (2023-06-09)

Bug Fixes

Features

4.13.3 (2023-04-15)

Bug Fixes

4.13.2 (2023-03-31)

Bug Fixes

4.13.1 (2023-03-18)

Bug Fixes

Features

4.13.3 (2023-04-15)

Bug Fixes

4.13.2 (2023-03-31)

Bug Fixes

4.13.1 (2023-03-18)

Bug Fixes

Features

mend-for-github-com bot commented Jan 31, 2025 •

edited

Loading