Skip to content

Bump webpack-dev-server and @angular-devkit/build-angular in /todo-ai - #1044

Merged
markafoltz merged 1 commit into
gh-pagesfrom
dependabot/npm_and_yarn/todo-ai/multi-4a9cd2b359
Aug 11, 2026
Merged

Bump webpack-dev-server and @angular-devkit/build-angular in /todo-ai#1044
markafoltz merged 1 commit into
gh-pagesfrom
dependabot/npm_and_yarn/todo-ai/multi-4a9cd2b359

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps webpack-dev-server to 5.2.6 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates webpack-dev-server from 5.1.0 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

  • fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

    Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

  • Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

  • Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

v5.2.5

Patch Changes

  • Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

  • set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

  • add cause for errorObject (#5518) (37b033d)
  • compatibility with event target and universal target and lazy compilation (574026c)
  • overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
  • progress indicator styles (#5557) (41a53a1)
  • upgrade selfsigned to v5

v5.2.2

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

v5.2.1

5.2.1 (2025-03-26)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

  • fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

    Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

  • Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

  • Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

5.2.5

Patch Changes

  • Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.2.4 (2026-05-11)

Bug Fixes

  • set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

  • add cause for errorObject (#5518) (37b033d)
  • compatibility with event target and universal target and lazy compilation (574026c)
  • overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
  • progress indicator styles (#5557) (41a53a1)
  • upgrade selfsigned to v5

5.2.2 (2025-06-03)

Bug Fixes

  • "Overlay enabled" false positive (18e72ee)
  • do not crush when error is null for runtime errors (#5447) (309991f)
  • remove unnecessary header X_TEST (#5451) (64a6124)
  • respect the allowedHosts option for cross-origin header check (#5510) (03d1214)

5.2.1 (2025-03-26)

Security

... (truncated)

Commits
  • 8a37b0e chore(release): new release (#5697)
  • f21ed0f fix: handle malformed Host and Origin headers (#5699)
  • 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
  • 308e853 fix: handle undefined options in Server constructor (#5695)
  • 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
  • 870ed22 chore: add v5 branch to release workflow triggers
  • c3ee325 chore(release): new release (#5682)
  • 60173be feat: add changeset validation and release workflow (#5680)
  • 948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
  • 93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.


Updates @angular-devkit/build-angular from 19.0.4 to 22.1.3

Release notes

Sourced from @​angular-devkit/build-angular's releases.

22.1.3

@​angular/cli

Commit Description
fix - f837b788c6 always install package during ng add to inspect manifest on disk for schematics (#33718)
fix - 72ae93638d correctly report available package updates during bare ng update
fix - a949e06568 discover migrations from installed packages when omitted by registry metadata (#33718)
fix - 1d9122fd50 normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit Description
fix - a4860d505a prevent build process hang on unhandled error (#33715)
fix - 7686d66cab retain watch files on error in load result cache
fix - 25b7cf7504 support case-insensitive and alternative license file names
perf - 4fd81402ce release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit Description
fix - 6af906cb94 settle writeResponseToNodeResponse when client disconnects
perf - 917d3b2254 avoid buffering request body when sanitizing headers

22.1.2

@​angular/cli

Commit Description
fix - 57db27ea91 add packages with built-in schematics to devDependencies only

@​angular/build

Commit Description
fix - baed978885 prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1

@​angular/cli

Commit Description
fix - ab971a8543 support npm 12 metadata array and error formats

@​angular/build

Commit Description
fix - db24220fb8 rewrite paths from sandboxed execroots when running under Bazel

22.1.0

@​angular/cli

Commit Description
fix - f59bcf529 abort and guide manual mitigation when updating catalog packages
fix - 48f90f5d5 prevent Yarn registry environment variable override
fix - c963ecbec remove algoliasearch dependency and support latest docs versions
fix - 6859d25c3 resolve correct registry name when using npm alias syntax during update
fix - 3a2589dac respect client-side release age settings during update resolution

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

22.1.3 (2026-08-05)

@​angular/cli

Commit Type Description
f837b788c6 fix always install package during ng add to inspect manifest on disk for schematics (#33718)
72ae93638d fix correctly report available package updates during bare ng update
a949e06568 fix discover migrations from installed packages when omitted by registry metadata (#33718)
1d9122fd50 fix normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit Type Description
a4860d505a fix prevent build process hang on unhandled error (#33715)
7686d66cab fix retain watch files on error in load result cache
25b7cf7504 fix support case-insensitive and alternative license file names
4fd81402ce perf release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit Type Description
6af906cb94 fix settle writeResponseToNodeResponse when client disconnects
917d3b2254 perf avoid buffering request body when sanitizing headers

21.2.20 (2026-08-05)

@​angular-devkit/build-angular

Commit Type Description
972f6db7e9 fix upgrade postcss to 8.5.23

@​angular/build

Commit Type Description
8de75ada50 fix upgrade postcss to 8.5.23

20.3.33 (2026-08-05)

... (truncated)

Commits
  • 60078fc release: cut the v22.1.3 release
  • 434e070 refactor(@​angular/cli): remove unused eslint-disable comment in git utility
  • 3a49bd4 build: update pnpm to v11.20.0
  • 7686d66 fix(@​angular/build): retain watch files on error in load result cache
  • 1d9122f fix(@​angular/cli): normalize Windows drive-letter casing for process.cwd
  • 4e54f3a ci: schedule ng-snapshot Renovate updates for early morning only
  • 6f75b73 build: update cross-repo angular dependencies
  • 25b7cf7 fix(@​angular/build): support case-insensitive and alternative license file names
  • 212373a build: lock file maintenance
  • 74d6d0b build: update dependency postcss to v8.5.25
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 30, 2026
@markafoltz

markafoltz commented Aug 11, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
Bump webpack-dev-server and @angular-devkit/build-angular in /todo-ai
51c6c76 
Bumps [webpack-dev-server](https://github.com/webpack/webpack-dev-server) to 5.2.6 and updates ancestor dependency [@angular-devkit/build-angular](https://github.com/angular/angular-cli). These dependencies need to be updated together.


Updates `webpack-dev-server` from 5.1.0 to 5.2.6
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/v5.2.6/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v5.1.0...v5.2.6)

Updates `@angular-devkit/build-angular` from 19.0.4 to 22.1.3
- [Release notes](https://github.com/angular/angular-cli/releases)
- [Changelog](https://github.com/angular/angular-cli/blob/main/CHANGELOG.md)
- [Commits](angular/angular-cli@19.0.4...v22.1.3)

---
updated-dependencies:
- dependency-name: "@angular-devkit/build-angular"
  dependency-version: 21.2.17
  dependency-type: direct:development
- dependency-name: webpack-dev-server
  dependency-version: 5.2.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/todo-ai/multi-4a9cd2b359 branch from ca142b4 to 51c6c76 Compare August 11, 2026 22:23
@markafoltz
markafoltz merged commit a8f4cf9 into gh-pages Aug 11, 2026
3 checks passed
@markafoltz
markafoltz deleted the dependabot/npm_and_yarn/todo-ai/multi-4a9cd2b359 branch August 11, 2026 22:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@markafoltz