build(deps-dev): bump webpack-dev-server from 5.2.4 to 5.2.6 by dependabot[bot] · Pull Request #4402 · ever-co/ever-teams

dependabot · 2026-07-27T15:19:32Z

Bumps webpack-dev-server from 5.2.4 to 5.2.6.

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)

Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

v5.2.5

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)

Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

5.2.5

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

Commits

8a37b0e chore(release): new release (#5697)
f21ed0f fix: handle malformed Host and Origin headers (#5699)
80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
308e853 fix: handle undefined options in Server constructor (#5695)
8b2b915 chore: update branch references from v4 to v5 in workflow configuration
870ed22 chore: add v5 branch to release workflow triggers
c3ee325 chore(release): new release (#5682)
60173be feat: add changeset validation and release workflow (#5680)
948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Upgrade webpack-dev-server to 5.2.6 to improve dev server security and compatibility. No app code changes.

Bug Fixes
- Block CSRF on /webpack-dev-server/invalidate and /webpack-dev-server/open-editor.
- Restore support for undefined Server options; handle malformed Host/Origin headers.
- Don’t intercept custom proxy WebSocket upgrades for HMR.
Dependencies
- Bump webpack-dev-server 5.2.4 -> 5.2.6 (transitive: launch-editor 2.14.1, shell-quote 1.10.0).

^{Written for commit 05ed86d. Summary will update on new commits.}

Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.4 to 5.2.6. - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.4...v5.2.6) --- updated-dependencies: - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Copilot wasn't able to review any files in this pull request.

cla-assistant · 2026-07-27T15:19:46Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

cla-assistant · 2026-07-27T15:19:51Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

sonarqubecloud · 2026-07-27T15:21:06Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

socket-security · 2026-07-27T15:21:15Z

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

codacy-production · 2026-07-27T15:22:05Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

Copilot AI review requested due to automatic review settings July 27, 2026 15:19

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 27, 2026

dependabot Bot mentioned this pull request Jul 27, 2026

build(deps-dev): bump webpack-dev-server from 5.2.4 to 5.2.5 #4381

Closed

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Navigation Menu

Uh oh!

build(deps-dev): bump webpack-dev-server from 5.2.4 to 5.2.6 - #4402

build(deps-dev): bump webpack-dev-server from 5.2.4 to 5.2.6#4402
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/webpack-dev-server-5.2.6

dependabot Bot commented on behalf of github Jul 27, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

cla-assistant Bot commented Jul 27, 2026

Uh oh!

cla-assistant Bot commented Jul 27, 2026

Uh oh!

sonarqubecloud Bot commented Jul 27, 2026

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

codacy-production Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.2.6

Patch Changes

v5.2.5

Patch Changes

5.2.6

Patch Changes

5.2.5

Patch Changes

Summary by cubic

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

cla-assistant Bot commented Jul 27, 2026

Uh oh!

cla-assistant Bot commented Jul 27, 2026

Uh oh!

sonarqubecloud Bot commented Jul 27, 2026

Quality Gate passed

Uh oh!

socket-security Bot commented Jul 27, 2026

Uh oh!

codacy-production Bot commented Jul 27, 2026

Up to standards ✅

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 27, 2026 •

edited by cubic-dev-ai Bot

Loading