Update dependency webpack-dev-server to v3 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
webpack-dev-server	2.11.5 -> 3.1.11

GitHub Vulnerability Alerts

CVE-2018-14732

Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.

Recommendation

For webpack-dev-server update to version 3.1.11 or later.

---

Release Notes

webpack/webpack-dev-server (webpack-dev-server)

v3.1.11

Compare Source

Bug Fixes

• bin/options: correct check for color support (options.color) (#​1555) (55398b5)
• package: update spdy v3.4.1...4.0.0 (assertion error) (#​1491) (#​1563) (7a3a257)
• Server: correct node version checks (#​1543) (927a2b3)
• Server: mime type for wasm in contentBase directory (#​1575) (#​1580) (fadae5d)
• add url for compatibility with webpack@5 (#​1598) (#​1599) (68dd49a)
• check origin header for websocket connection (#​1603) (b3217ca)

v3.1.10

Compare Source

Bug Fixes

• options: add writeToDisk option to schema (#​1520) (d2f4902)
• package: update sockjs-client v1.1.5...1.3.0 (url-parse vulnerability) (#​1537) (e719959)
• Server: set tls.DEFAULT_ECDH_CURVE to 'auto' (#​1531) (c12def3)

v3.1.9

Compare Source

3.1.9 (2018-09-24)

v3.1.8

Compare Source

Bug Fixes

• package: yargs security vulnerability (dependencies) (#​1492) (8fb67c9)
• utils/createLogger: ensure quiet always takes precedence (options.quiet) (#​1486) (7a6ca47)

v3.1.7

Compare Source

Bug Fixes

• Server: don't use spdy on node >= v10.0.0 (#​1451) (8ab9eb6)

v3.1.6

Compare Source

Bug Fixes

• bin: handle process signals correctly when the server isn't ready yet (#​1432) (334c3a5)
• examples/cli: correct template path in open-page example (#​1401) (df30727)
• schema: allow the output filename to be a {Function} (#​1409) (e2220c4)

v3.1.5

Compare Source

• Send the Progress event in the client so plugins can use it (#​1427)
• Update sockjs-client to fix infinite reconnection loop (#​1434)

v3.1.4

Compare Source

• Update to webpack-dev-middleware 3.1.3, which should fix paths with a space not working on Windows (#​1392)
• Fix logLevel option silent not being accepted by schema validation (#​1372)

v3.1.3

Compare Source

• Fix HMR causing a crash when trying to reload

v3.1.2

Compare Source

• Speed up incremental builds (#​1362)
• Update webpack-dev-middleware to 3.1.2

v3.1.1

Compare Source

Bug Fixes

• add workaround for Origin header in sockjs (#​1608) (1dfd4fb)

v3.1.0

Compare Source

Updates

• Fancy logging; webpack-log is now used for logging to the terminal (webpack-dev-middleware was already using this).
• The logLevel option is added for more fine-grained control over the logging.

Bugfixes

• MultiCompiler was broken with webpack 4.
• Fix deprecation warnings caused by webpack 4. Note that you will still see some deprecation warnings because webpack-dev-middleware has not been updated yet.

v3.0.0

Compare Source

Updates

• Breaking change: webpack v4 is now supported. Older versions of webpack are not supported.
• Breaking change: drops support for Node.js v4, going forward we only support v6+ (same as webpack).
• webpack-dev-middleware updated to v2 (see changes).

Bugfixes

• After starting webpack-dev-server with an error in your code, it would not reload the page after fixing that error (#​1317).
• DynamicEntryPlugin is now supported correctly (#​1319).

Huge thanks to all the contributors!

Please note that webpack-serve will eventually be the successor of webpack-dev-server. The core features already work so if you're brave enough give it a try!

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pils-frontend/package-lock.json

/usr/local/bin/docker: line 4: .: filename argument required
.: usage: . filename [arguments]
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: undefined@undefined
npm ERR! Found: [email protected]
npm ERR! node_modules/webpack
npm ERR!   dev webpack@"3.12.0" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer webpack@"^4.0.0" from [email protected]
npm ERR! node_modules/webpack-dev-server
npm ERR!   dev webpack-dev-server@"3.1.11" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! 
npm ERR! For a full report see:
npm ERR! /tmp/worker/1b4392/3a0723/cache/others/npm/_logs/2023-08-07T19_44_57_423Z-eresolve-report.txt

npm ERR! A complete log of this run can be found in: /tmp/worker/1b4392/3a0723/cache/others/npm/_logs/2023-08-07T19_44_57_423Z-debug-0.log

[codecov]

Codecov Report

Patch and project coverage have no change.

Comparison is base (85cc939) 22.34% compared to head (636c844) 22.34%.
Report is 2 commits behind head on main.

❗ Current head 636c844 differs from pull request most recent head 977c8dc. Consider uploading reports for the commit 977c8dc to get more accurate results

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1026   +/-   ##
=======================================
  Coverage   22.34%   22.34%           
=======================================
  Files          14       14           
  Lines         179      179           
  Branches       21       21           
=======================================
  Hits           40       40           
  Misses        121      121           
  Partials       18       18           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication