build(deps): Bump webpack-dev-server from 5.2.2 to 5.2.4#1004
Conversation
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.2 to 5.2.4. - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v5.2.2...v5.2.4) --- updated-dependencies: - dependency-name: webpack-dev-server dependency-version: 5.2.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Changed
🤖 Cursor Dependency AnalysisSupply-Chain Malware ReviewReviewing how this dependency is used in the repo and what changed in the lockfile. This Dependabot PR is a normal patch bump of an official webpack package, driven by a documented security fix—not supply-chain compromise. Scanner vs. interpretation The malware scan reports warn with 76 heuristic hits, but 0 unicode/confusable/IOC findings after allowlisting. Those heuristics are false positives on upstream source, not evidence of compromise:
Dependency integrity
Upstream intent (matches release notes) The meaningful security change is commit Checklist (no red flags)
Recommendation Approve from a supply-chain perspective. The scan warn status reflects noisy heuristics over 191 upstream files in warn-only mode, not malicious content. After merge, a quick Compatibility AnalysisAnalyzing how Compatibility & adoption —
|
| Layer | Detail |
|---|---|
| Direct dependency | None — not listed in package.json. |
| Transitive | @docusaurus/core@3.10.0 declares webpack-dev-server: ^5.2.2; lockfile resolves 5.2.4. |
| Runtime | npm start (docusaurus start) — local dev server, HMR, error overlay. |
| Not used | npm run build, npm run serve, CI deploy (deploy-pages.yml runs npm ci + npm run build only). |
| App code | No imports, no devServer / configureWebpack in docusaurus.config.js or other project sources. |
2) Intersection with upstream changes
No overlap with custom APIs — the repo does not call webpack-dev-server directly.
| Version | Notable changes | Relevance to chia-docs |
|---|---|---|
| 5.2.4 | Default Cross-Origin-Resource-Policy: same-origin on dev responses (source-theft fix) |
Dev-only; standard Docusaurus local usage is unaffected. |
| 5.2.3 | Large internal refactor; overlay ESC; lazy-compilation fixes; selfsigned v5 |
Only matters if you rely on custom webpack targets or HTTPS dev certs — neither appears configured here. |
Upstream diff 5.2.3 → 5.2.4 is small (~9 files, mainly lib/Server.js + security test). The big diff is 5.2.2 → 5.2.3, but it stays within the same major/minor line Docusaurus already accepts (^5.2.2).
3) Risks / unknowns
- Production / CI: Very low — deploy path does not start the dev server.
- Local dev: Low — possible edge case if you load dev assets cross-origin from another site without CORS (CORP hardening); uncommon for a docs site.
- HTTPS dev:
selfsignedv5 only affects optional HTTPS dev-server setup (not used in this repo). - Verification gap: CI does not run
npm start; confidence rests on lockfile-only change + Docusaurus’s supported range.
Malware scan: warn heuristics only; no IOC/confusable hits — consistent with a normal security patch release (Merge commit from fork for CORP fix).
4) Recommendation
Merge
Patch bump within Docusaurus’s existing range, security-motivated (5.2.4), no direct usage or custom webpack config. npm run build in CI is the meaningful gate; optional smoke test: npm start locally if you want extra assurance for contributors.
Malware Scan Summary
- Status: warn
- Warn only mode:
true - Changed upstream files scanned:
191 - Resolution strategy:
tag_range - Changed node/vendor paths:
0 - Changed lockfiles:
1 - Resolved upstream range:
195a7e6f7102e48725b1b1fbc3bb80c5df0efedf..fd401308f1cc026262880e2dab810004d6444282 - Resolved refs: from=
195a7e6f7102e48725b1b1fbc3bb80c5df0efedfto=fd401308f1cc026262880e2dab810004d6444282 - Unicode findings (post-allowlist):
0 - Confusable findings (post-allowlist):
0 - IOC findings (post-allowlist):
0 - Heuristic findings (post-allowlist):
76
Top findings
client-src/overlay.js:14codepoint_decoder ::(input, position) => input.codePointAt(position)client-src/overlay.js:16codepoint_decoder ::(input.charCodeAt(position) - 0xd800) * 0x400 +client-src/overlay.js:17codepoint_decoder ::input.charCodeAt(position + 1) -client-src/overlay.js:73codepoint_decoder ::input.length > 1 ? getCodePoint(input, 0) : input.charCodeAt(0);test/helpers/test-bin.js:24shell_process_spawn ::// exec(taskkill /pid ${process.pid} /T /F);test/helpers/test-bin.js:57shell_process_spawn ::const subprocess = execa("node", args, {test/helpers/test-bin.js:66shell_process_spawn ::subprocess.stdout.pipe(test/helpers/test-bin.js:73shell_process_spawn ::processKill(subprocess);test/helpers/test-bin.js:81shell_process_spawn ::subprocess.stderr.pipe(test/helpers/test-bin.js:88shell_process_spawn ::processKill(subprocess);test/helpers/test-bin.js:96shell_process_spawn ::subprocesstest/cli/basic.test.js:352shell_process_spawn ::/Project is running at http:\/\/localhost:(\d*)\//.exec(bits);test/cli/basic.test.js:367shell_process_spawn ::/Project is running at http:\/\/localhost:(\d*)\//.exec(bits);bin/webpack-dev-server.js:13shell_process_spawn ::const cp = require("node:child_process");bin/webpack-dev-server.js:16shell_process_spawn ::const executedCommand = cp.spawn(command, args, {client-src/overlay.js:29shell_process_spawn ::let replaceMatch = macroRegExp.exec(macroText);client-src/overlay.js:41shell_process_spawn ::} while ((replaceMatch = macroRegExp.exec(macroText)));package-lock.json:9251shell_process_spawn ::"node_modules/cross-spawn": {package-lock.json:9253shell_process_spawn ::"resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",package-lock.json:10606shell_process_spawn ::"cross-spawn": "^7.0.6",
1 participant
Bumps webpack-dev-server from 5.2.2 to 5.2.4.
Release notes
Sourced from webpack-dev-server's releases.
Changelog
Sourced from webpack-dev-server's changelog.
Commits
fd40130chore(release): 5.2.4ece4f36chore: update deps (#5661)a216144ci: fix test (#5658)df073c5Merge commit from forkb550a70chore(release): 5.2.39704dc5chore: upgrade selfsigned to v5 and remove node-forge dependency (#5618)92bf644chore: bump express to update qs (#5621)792b2f0chore(deps-dev): bump the dependencies group with 4 updates (#5606)6d587cachore(deps): bump the dependencies group across 1 directory with 27 updates (...f91baa8fix(overlay): add ESC key to dismiss overlay (#5598)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Low risk dependency-only change limited to local dev server tooling; main impact is updated transitive deps (notably
selfsignedv5 with new crypto libs) and their Node engine requirements.Overview
Updates
webpack-dev-serverfrom5.2.2to5.2.4inpackage-lock.json.This refreshes several transitive dependencies, including upgrading
selfsignedto v5 (droppingnode-forge/@types/node-forgein favor ofpkijs/@peculiar/x509and related ASN.1 utilities), plus minor bumps toexpress/compressionand type packages pulled in by the dev server.Reviewed by Cursor Bugbot for commit 254c917. Bugbot is set up for automated code reviews on this repo. Configure here.