Bump webpack-dev-server from 4.11.1 to 5.2.6 by dependabot[bot] · Pull Request #1582 · blockprotocol/blockprotocol

dependabot · 2026-07-23T15:58:22Z

Bumps webpack-dev-server from 4.11.1 to 5.2.6.

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)

Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

v5.2.5

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)

compatibility with event target and universal target and lazy compilation (574026c)

overlay: add ESC key to dismiss overlay (#5598) (f91baa8)

progress indicator styles (#5557) (41a53a1)

upgrade selfsigned to v5

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)

do not crush when error is null for runtime errors (#5447) (309991f)

remove unnecessary header X_TEST (#5451) (64a6124)

respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

fix: allow undefined as the Server constructor options argument again (by @bjohansebas in #5695)

Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)

Handle malformed Host and Origin header values gracefully when validating requests. (by @bjohansebas in #5699)

5.2.5

Patch Changes

Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.2.4 (2026-05-11)

Bug Fixes

set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

add cause for errorObject (#5518) (37b033d)

compatibility with event target and universal target and lazy compilation (574026c)

overlay: add ESC key to dismiss overlay (#5598) (f91baa8)

progress indicator styles (#5557) (41a53a1)

upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

"Overlay enabled" false positive (18e72ee)

do not crush when error is null for runtime errors (#5447) (309991f)

remove unnecessary header X_TEST (#5451) (64a6124)

respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

... (truncated)

Commits

8a37b0e chore(release): new release (#5697)
f21ed0f fix: handle malformed Host and Origin headers (#5699)
80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
308e853 fix: handle undefined options in Server constructor (#5695)
8b2b915 chore: update branch references from v4 to v5 in workflow configuration
870ed22 chore: add v5 branch to release workflow triggers
c3ee325 chore(release): new release (#5682)
60173be feat: add changeset validation and release workflow (#5680)
948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 4.11.1 to 5.2.6. - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v4.11.1...v5.2.6) --- updated-dependencies: - dependency-name: webpack-dev-server dependency-version: 5.2.6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

cursor · 2026-07-23T15:58:28Z

PR Summary

Medium Risk
Major-version dev-server bump with a large transitive lockfile churn; impact is limited to local development tooling, but regressions would affect block dev workflows until caught manually.

Overview
Upgrades webpack-dev-server from ^4.11.1 to ^5.2.6 in block-scripts and mock-block-dock, with a refreshed yarn.lock for the v5 dependency tree (e.g. webpack-dev-middleware 7.x, memfs 4.x, newer express / selfsigned stack).

There are no application or webpack config edits in this diff—only the declared versions and lockfile. Local block dev (block-scripts dev.js server setup, mock-block-dock devServer in webpack config) should be exercised after merge to confirm HMR, proxies, and HTTPS dev certs still behave as expected under v5.

^{Reviewed by Cursor Bugbot for commit 531cc42. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 531cc42. Configure here.}

cursor · 2026-07-23T15:59:59Z

    "webpack-assets-manifest": "^5.1.0",
    "webpack-bundle-analyzer": "^4.8.0",
-    "webpack-dev-server": "^4.11.1",
+    "webpack-dev-server": "^5.2.6",


CORP header breaks cross-origin loading

High Severity

webpack-dev-server 5.2.4+ sets Cross-Origin-Resource-Policy: same-origin by default. Existing devServer configs still only set CORS (Access-Control-Allow-Origin: *), so browsers will block cross-origin script loads of locally served blocks. That breaks the intended block-dev workflow that embeds blocks from localhost into other origins.

Additional Locations (1)

libs/mock-block-dock/package.json#L86-L87

^{Reviewed by Cursor Bugbot for commit 531cc42. Configure here.}

cursor · 2026-07-23T15:59:59Z

    "webpack-assets-manifest": "^5.1.0",
    "webpack-bundle-analyzer": "^4.8.0",
-    "webpack-dev-server": "^4.11.1",
+    "webpack-dev-server": "^5.2.6",


Node engines below required version

Medium Severity

webpack-dev-server 5 requires Node.js >=18.12.0, but block-scripts still declares engines as ^14.15.0 || >=16.13.0, and the monorepo root allows >=16.14.0. Installs or runs on those older Node versions that the packages claim to support will fail after this bump.

Additional Locations (1)

libs/block-scripts/package.json#L68-L71

^{Reviewed by Cursor Bugbot for commit 531cc42. Configure here.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 23, 2026

dependabot Bot mentioned this pull request Jul 23, 2026

Bump webpack-dev-server from 4.11.1 to 5.2.1 #1498

Closed

cursor Bot reviewed Jul 23, 2026

View reviewed changes

Navigation Menu

Uh oh!

Bump webpack-dev-server from 4.11.1 to 5.2.6 - #1582

Bump webpack-dev-server from 4.11.1 to 5.2.6#1582
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/webpack-dev-server-5.2.6

dependabot Bot commented on behalf of github Jul 23, 2026

Uh oh!

cursor Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 23, 2026

Uh oh!

cursor Bot Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 23, 2026

v5.2.6

Patch Changes

v5.2.5

Patch Changes

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

v5.2.1

5.2.1 (2025-03-26)

5.2.6

Patch Changes

5.2.5

Patch Changes

5.2.4 (2026-05-11)

Bug Fixes

5.2.3 (2026-01-12)

Bug Fixes

5.2.2 (2025-06-03)

Bug Fixes

5.2.1 (2025-03-26)

Security

Uh oh!

cursor Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 23, 2026

Choose a reason for hiding this comment

CORP header breaks cross-origin loading

Uh oh!

cursor Bot Jul 23, 2026

Choose a reason for hiding this comment

Node engines below required version

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cursor Bot commented Jul 23, 2026 •

edited

Loading