Bump webpack-dev-server from 1.16.5 to 5.2.4#38
Conversation
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) from 1.16.5 to 5.2.4. - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v1.16.5...v5.2.4) --- updated-dependencies: - dependency-name: webpack-dev-server dependency-version: 5.2.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Semgrep found 1 Risk: Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise. Fix: Upgrade this library to at least version 0.31.0 at contact-form/package-lock.json:1339. Reference(s): GHSA-fvcv-3m26-pcqx, CVE-2026-40175 Semgrep found 1 Risk: Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying Manual Review Advice: A vulnerability from this advisory is reachable if you have Fix: Upgrade this library to at least version 0.31.0 at contact-form/package-lock.json:1339. Reference(s): GHSA-3p68-rc4w-qgx5, CVE-2025-62718 Semgrep found 1 Risk: Affected versions of jquery are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Improper handling of attacker-controlled HTML during DOM insertion may result in unintended script execution in the context of the affected page. Manual Review Advice: A vulnerability from this advisory is reachable if you pass HTML from untrusted sources to a jQuery's DOM manipulation method without any sanitization like DOMPurify with its SAFE_FOR_JQUERY option when using jQuery in Browser Fix: Upgrade this library to at least version 3.5.0 at contact-form/package-lock.json:8357. Reference(s): GHSA-jpcq-cgw6-v4j6, CVE-2020-11023 Semgrep found 1 Risk: Affected versions of jquery are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Passing HTML from untrusted sources—even after sanitization—to DOM manipulation methods in jquery may result in execution of untrusted code. Manual Review Advice: A vulnerability from this advisory is reachable if you have not added the Fix: Upgrade this library to at least version 3.5.0 at contact-form/package-lock.json:8357. Reference(s): GHSA-gxr4-xjj5-5px2, CVE-2020-11022 Semgrep found 1 Risk: This specific version of fsevents contains malicious code. Upgrade to the safe version immediately. Fix: Upgrade this library to at least version 1.2.11 at contact-form/package-lock.json:5775. Reference(s): https://osv.dev/vulnerability/MAL-2023-462 Semgrep found 1 Risk: Affected versions of acorn are vulnerable to Uncontrolled Resource Consumption. A regular-expression denial-of-service exists in Acorn's RegExp parser: a pattern like Manual Review Advice: A vulnerability from this advisory is reachable if you are using acorn on the CLI Fix: Upgrade this library to at least version 5.7.4 at contact-form/package-lock.json:899. Reference(s): GHSA-6chw-6frg-f759 Semgrep found 1 Risk: Affected versions of http-proxy are vulnerable to Incomplete List of Disallowed Inputs / Protection Mechanism Failure. A denial-of-service exists in node-http-proxy when using Manual Review Advice: A vulnerability from this advisory is reachable if you set headers on the proxy request using the proxyReq.setHeader function in a standalone proxy server implemented using the http-proxy package Fix: Upgrade this library to at least version 1.18.1 at contact-form/package-lock.json:7352. Reference(s): GHSA-6x33-pw7p-hmpq Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. UAParser.js uses a vulnerable regular expression to parse User-Agent headers. A malicious header can trigger catastrophic backtracking in the regex, resulting in prolonged processing times and potential denial of service. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.24 at contact-form/package-lock.json:13108. Reference(s): GHSA-78cj-fxph-m83p, CVE-2021-27292 Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. A specially crafted user agent string can trigger catastrophic backtracking in the regex designed for Redmi Phones and Mi Pad Tablets. This may result in a Regular Expression Denial of Service, causing resource exhaustion when ua-parser-js attempts to parse the malicious input. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.22 at contact-form/package-lock.json:13108. Reference(s): GHSA-662x-fhqg-9p8v, CVE-2020-7733 Semgrep found 1 Risk: Affected versions of ua-parser-js are vulnerable to Uncontrolled Resource Consumption. UAParser.js is vulnerable to Regular Expression Denial of Service (ReDoS) attacks. Maliciously crafted user agent strings can trigger inefficient regex patterns, leading to excessive backtracking and high CPU consumption, which may ultimately cause service degradation or a denial of service. Manual Review Advice: A vulnerability from this advisory is reachable if you are using ua-parser-js via npx cli Fix: Upgrade this library to at least version 0.7.23 at contact-form/package-lock.json:13108. Reference(s): GHSA-394c-5j6w-4xmx, CVE-2020-7793 Semgrep found 1 Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation. Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript Fix: There are no safe versions of this library available for upgrade. Library included at contact-form/package-lock.json:2164. Reference(s): GHSA-67hx-6x53-jw92, CVE-2023-45133 Semgrep found 1 Risk: uglify-js 2.x before 2.4.24 is vulnerable to Incorrect Comparison Logic Granularity which may cause crafted JavaScript to have altered functionality after minification. Manual Review Advice: A vulnerability from this advisory is reachable if you are using uglifyjs on CLI to minify Fix: Upgrade this library to at least version 2.4.24 at contact-form/package-lock.json:12978. Reference(s): GHSA-34r7-q49f-h37c, CVE-2015-8857 Semgrep found 1 Risk: Affected version of deep-extend is vulnerable to Prototype Pollution. Malicious input passed to deep-extend allows an attacker to overwrite the prototype of Fix: Upgrade this library to at least version 0.5.1 at contact-form/package-lock.json:5899. Reference(s): GHSA-hr2v-3952-633q, CVE-2018-3750 Semgrep found 1 Risk: Affected version of constantinople 3.x before 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution. Fix: Upgrade this library to at least version 3.1.1 at contact-form/package-lock.json:3309. Reference(s): GHSA-4vmm-mhcq-4x9j Semgrep found 2 Risk: Affected versions of set-value and set-value are vulnerable to Improperly Controlled Modification Of Object Prototype Attributes ('Prototype Pollution'). The Fix: Upgrade this library to at least version 2.0.1 at contact-form/package-lock.json:11813. Reference(s): GHSA-4g88-fppr-53pp, CVE-2019-10747 |
Bumps webpack-dev-server from 1.16.5 to 5.2.4.
Release notes
Sourced from webpack-dev-server's releases.
... (truncated)
Changelog
Sourced from webpack-dev-server's changelog.
... (truncated)
Commits
fd40130chore(release): 5.2.4ece4f36chore: update deps (#5661)a216144ci: fix test (#5658)df073c5Merge commit from forkb550a70chore(release): 5.2.39704dc5chore: upgrade selfsigned to v5 and remove node-forge dependency (#5618)92bf644chore: bump express to update qs (#5621)792b2f0chore(deps-dev): bump the dependencies group with 4 updates (#5606)6d587cachore(deps): bump the dependencies group across 1 directory with 27 updates (...f91baa8fix(overlay): add ESC key to dismiss overlay (#5598)Maintainer changes
This version was pushed to npm by evilebottnawi, a new releaser for webpack-dev-server since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.