Bump node-forge and webpack-dev-server #40
Conversation
Bumps [node-forge](https://github.com/digitalbazaar/forge) to 1.3.2 and updates ancestor dependency [webpack-dev-server](https://github.com/webpack/webpack-dev-server). These dependencies need to be updated together. Updates `node-forge` from 0.10.0 to 1.3.2 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@0.10.0...v1.3.2) Updates `webpack-dev-server` from 3.11.2 to 5.2.2 - [Release notes](https://github.com/webpack/webpack-dev-server/releases) - [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md) - [Commits](webpack/webpack-dev-server@v3.11.2...v5.2.2) --- updated-dependencies: - dependency-name: node-forge dependency-version: 1.3.2 dependency-type: indirect - dependency-name: webpack-dev-server dependency-version: 5.2.2 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
![sentry[bot]](https://avatars.githubusercontent.com/u/1396951?s=60&v=4){kind=small}
| "webpack": "^4.25.1", | ||
| "webpack-cli": "^3.1.2", |
There was a problem hiding this comment.
Bug: Incompatible webpack and webpack-cli versions with webpack-dev-server v5.2.2 and outdated API usage.
Severity: CRITICAL | Confidence: High
🔍 Detailed Analysis
The package.json specifies webpack: ^4.25.1, webpack-cli: ^3.1.2, and webpack-dev-server: ^5.2.2. However, webpack-dev-server v5.2.2 requires webpack >= v5.0.0 and webpack-cli >= v4.7.0. This creates fundamentally incompatible dependency versions. Additionally, the code in webpack/server.js uses the webpack-dev-server v3 API (new WebpackDevServer(webpack(config), config.devServer).listen(...)), which is incompatible with webpack-dev-server v5.x's API (new WebpackDevServer(devServerOptions, compiler) and .start() or .startCallback()). This will lead to a critical server crash during startup.
💡 Suggested Fix
Update webpack and webpack-cli to versions compatible with webpack-dev-server v5.2.2, and refactor webpack/server.js to use the webpack-dev-server v5.x API, specifically new WebpackDevServer(devServerOptions, compiler) and .start() or .startCallback().
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: package.json#L125-L126
Potential issue: The `package.json` specifies `webpack: ^4.25.1`, `webpack-cli: ^3.1.2`,
and `webpack-dev-server: ^5.2.2`. However, `webpack-dev-server v5.2.2` requires `webpack
>= v5.0.0` and `webpack-cli >= v4.7.0`. This creates fundamentally incompatible
dependency versions. Additionally, the code in `webpack/server.js` uses the
`webpack-dev-server v3` API (`new WebpackDevServer(webpack(config),
config.devServer).listen(...)`), which is incompatible with `webpack-dev-server v5.x`'s
API (`new WebpackDevServer(devServerOptions, compiler)` and `.start()` or
`.startCallback()`). This will lead to a critical server crash during startup.
Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 3998651
| "webpack-dev-server": "^3.1.10", | ||
| "webpack-dev-server": "^5.2.2", | ||
| "weinre": "^2.0.0-pre-I0Z7U9OV" | ||
| }, |
There was a problem hiding this comment.
Bug: webpack-dev-server v5.2.2 requires Node.js v18.12.0+, but package.json allows older Node.js versions.
Severity: CRITICAL | Confidence: High
🔍 Detailed Analysis
webpack-dev-server v5.2.2 requires Node.js v18.12.0+, but the package.json engines field specifies "node": ">= 8". This allows npm install to succeed on Node.js versions older than v18.12.0. When npm start is subsequently run on an incompatible Node.js version, webpack-dev-server v5.2.2 will crash due to import errors, native module binding errors, or unavailable APIs, making the application non-functional.
💡 Suggested Fix
Update the engines field in package.json to "node": ">= 18.12.0" to prevent installation on incompatible Node.js versions.
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: package.json#L129
Potential issue: `webpack-dev-server v5.2.2` requires Node.js `v18.12.0+`, but the
`package.json` `engines` field specifies `"node": ">= 8"`. This allows `npm install` to
succeed on Node.js versions older than `v18.12.0`. When `npm start` is subsequently run
on an incompatible Node.js version, `webpack-dev-server v5.2.2` will crash due to import
errors, native module binding errors, or unavailable APIs, making the application
non-functional.
Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 3998651
Bumps node-forge to 1.3.2 and updates ancestor dependency webpack-dev-server. These dependencies need to be updated together.
Updates
node-forgefrom 0.10.0 to 1.3.2Changelog
Sourced from node-forge's changelog.
... (truncated)
Commits
235ad3eRelease 1.3.2.2598244Update changelog.0032dd0Fix typos.d75e08dRun new security test.a5ce91dUpdate changelog formatting.4652de6Cleanups.eb932d9Fix typo.db6954bFix style.afbf7d8Align error message style.6607445Revert minor changes.Updates
webpack-dev-serverfrom 3.11.2 to 5.2.2Release notes
Sourced from webpack-dev-server's releases.
... (truncated)
Changelog
Sourced from webpack-dev-server's changelog.
... (truncated)
Commits
195a7e6chore(release): 5.2.2620bef1chore(deps): update (#5511)03d1214fix: respect theallowedHostsoption for cross-origin header check (#5510)5ba862echore(deps-dev): bump the dependencies group across 1 directory with 7 update...f7fec94chore: fix typo (#5508)6ee8cd0ci: add Node.js v24 (#5492)d30f963chore: update http-proxy-middleware to ^2.0.9 (#5503)66cf033chore(deps-dev): bump the dependencies group with 2 updates (#5504)4367a5crefactor: use 'String#startsWith' & replace if-then-else (#5501)8e6604fchore(deps): bump the dependencies group across 1 directory with 4 updates (#...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.