Skip to content

chore(deps-dev): bump webpack-dev-server from 5.2.5 to 5.2.6 in /app - #260

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/app/webpack-dev-server-5.2.6
Closed

chore(deps-dev): bump webpack-dev-server from 5.2.5 to 5.2.6 in /app#260
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/app/webpack-dev-server-5.2.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps webpack-dev-server from 5.2.5 to 5.2.6.

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

  • fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

    Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

  • Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

  • Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

  • fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

    Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

  • Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

  • Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Commits
  • 8a37b0e chore(release): new release (#5697)
  • f21ed0f fix: handle malformed Host and Origin headers (#5699)
  • 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
  • 308e853 fix: handle undefined options in Server constructor (#5695)
  • 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
  • 870ed22 chore: add v5 branch to release workflow triggers
  • See full diff in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps-dev): bump webpack-dev-server from 5.2.5 to 5.2.6 in /app
7bae3c2 
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 5.2.5 to 5.2.6.
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.2.5...v5.2.6)

---
updated-dependencies:
- dependency-name: webpack-dev-server
  dependency-version: 5.2.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 26, 2026
@bpiwowar bpiwowar mentioned this pull request Jul 31, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

Looks like webpack-dev-server is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 31, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/app/webpack-dev-server-5.2.6 branch July 31, 2026 12:31
VictorMorand pushed a commit to VictorMorand/experimaestro-python that referenced this pull request Jul 31, 2026
@bpiwowar @claude
chore(deps): consolidate the nine open Dependabot bumps
8c1a064 
All nine open Dependabot PRs were green and mergeable, but eight of them edit
app/package-lock.json, so merging any one would leave the other seven
conflicting. Applying them together avoids that.

npm (supersedes experimaestro#250 experimaestro#251 experimaestro#252 experimaestro#253 experimaestro#255 experimaestro#258 experimaestro#259 experimaestro#260):
  axios              1.16.0 -> 1.19.0   (direct)
  postcss            8.5.13 -> 8.5.25   (direct, dev)
  webpack-dev-server  5.2.5 -> 5.2.6    (direct, dev)
  websocket-driver    0.7.4 -> 0.7.5    (transitive)
  svgo                4.0.1 -> 4.0.2    (transitive)
  immutable           5.1.5 -> 5.1.9    (transitive)
  fast-uri            3.1.2 -> 3.1.5    (transitive)
  shell-quote         1.8.4 -> 1.10.0   (transitive)

uv (supersedes experimaestro#254):
  setuptools         82.0.1 -> 83.0.0

Some land above the version Dependabot asked for because the caret ranges
resolve to the current latest.

The packaged bundle is rebuilt and committed. It has to be: the publish
workflow ships the committed src/experimaestro/webui/data (no Node in CI), so a
lockfile bump alone would leave users on the old code. CI does not cover this
either -- pytest.yml creates an empty webui data directory -- so `npm run build`
was run locally and the Python suite re-run against the new uv.lock
(1133 passed, 10 skipped, 1 xfailed).

The rebuild changes exactly one byte sequence: index.css now starts with a
UTF-8 BOM. No CSS source carries one, so it comes from the toolchain bump. The
CSS spec requires parsers to strip a leading BOM and browsers do, so this is
inert, but it is a behaviour change rather than a content change and is called
out here rather than buried in a generated diff.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LU56vLBFQz5ryt2Sovf9Hj
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants