Skip to content

Update dependency webpack-dev-middleware to v5 [SECURITY] #5373

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency webpack-dev-middleware to v5 [SECURITY] #5373

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@
"webpack": "^4.46.0",
"webpack-bundle-tracker": "^0.4.3",
"webpack-cli": "^3.3.10",
"webpack-dev-middleware": "^1.9.0",
"webpack-dev-middleware": "^5.0.0",
Copy link
Copy Markdown

@sentry sentry Bot Feb 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Upgrading webpack-dev-middleware to v5 while using webpack v4 will cause a runtime error, as v5 requires webpack v5. This will break the development server.
Severity: CRITICAL

Suggested Fix

To resolve this incompatibility, either upgrade webpack to version 5.0.0 or higher to match the webpack-dev-middleware requirement, or find a version of webpack-dev-middleware that is compatible with webpack v4 and also contains the necessary security fix.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L132

Potential issue: The project upgrades `webpack-dev-middleware` to version `^5.0.0` but
continues to use `webpack` version `^4.46.0`. `webpack-dev-middleware` v5 has a peer
dependency on `webpack` v5 and is not backward compatible. When the development server
in `hot-reload-dev-server.js` initializes the middleware, it passes a `webpack` v4
compiler object. The middleware expects a `webpack` v5 compiler, and the mismatch in
APIs will cause a runtime error, preventing the development server from starting. This
will block all local development workflows.

Did we get this right? 👍 / 👎 to inform future reviews.

Copy link
Copy Markdown

@sentry sentry Bot Mar 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The webpack-dev-middleware v5 upgrade is incompatible with the project's webpack v4 without manual configuration, which will cause the development server to crash on startup.
Severity: CRITICAL

Suggested Fix

To resolve the incompatibility, either upgrade webpack to v5, or manually configure the outputFileSystem for webpack-dev-middleware. If staying with webpack v4, you must provide an outputFileSystem instance that has the required .join() and mkdirp methods.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L132

Potential issue: The project's `webpack` version is `^4.46.0`, but
`webpack-dev-middleware` is being upgraded to v5. Version 5 of `webpack-dev-middleware`
is designed for `webpack` v5 and has breaking changes when used with `webpack` v4.
Specifically, it requires the `outputFileSystem` to have `.join()` and `mkdirp` methods,
which are not provided by default in the `webpack` v4 environment. Since the code does
not manually configure the `outputFileSystem`, the development server will fail to
start, preventing developers from running the application locally.

Copy link
Copy Markdown

@sentry sentry Bot Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The upgrade of webpack-dev-middleware to v5 is incompatible with the project's existing webpack v4 dependency, which will break the development server.
Severity: CRITICAL

Suggested Fix

To resolve this incompatibility, either upgrade webpack to version 5 alongside the webpack-dev-middleware upgrade, or revert the webpack-dev-middleware upgrade to a version compatible with webpack v4.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: package.json#L132

Potential issue: The pull request updates `webpack-dev-middleware` to version 5.0.0
while `webpack` remains at version 4.46.0. `webpack-dev-middleware` v5 has a peer
dependency requirement for `webpack` v5. The development server, initiated via
`hot-reload-dev-server.js`, passes a `webpack` v4 compiler instance to the
`webpack-dev-middleware`. This will cause a runtime crash during initialization because
the middleware will attempt to use webpack v5 APIs that do not exist in webpack v4,
breaking the local development workflow.

"webpack-hot-middleware": "^2.17.1"
},
"engines": {
Expand Down
Loading