chore(deps): update dependency webpack-dev-server to v5.2.4 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
webpack-dev-server	5.2.2 → 5.2.4

---

webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

CVE-2026-6402 / GHSA-79cf-xcqc-c78w

More information

Details

Impact

When webpack-dev-server is running on a non-HTTPS origin (the default), cross-origin requests from malicious websites can load the dev server's JavaScript bundles via <script> tags. The fix introduced in v5.2.1 (CVE-2025-30359) relied on Sec-Fetch-Mode and Sec-Fetch-Site request headers to block these requests, but browsers only send these headers for potentially trustworthy origins. Over plain HTTP, the headers are absent and the check is bypassed.

An attacker who knows the dev server's host, port, and output path can exfiltrate all module source code by intercepting the webpack runtime's module registration.

This does not affect Chrome 142+ (and other Chromium-based browsers) due to local network access restrictions.

Patches

Patched in webpack-dev-server >= 5.2.4 by setting Cross-Origin-Resource-Policy: same-origin on responses.

Workarounds

Run the dev server with HTTPS enabled (--https or server.type: 'https' in config).

Resources

• GHSA-4v9v-hfq4-rm2v (CVE-2025-30359) - original vulnerability
• GHSA-9jgg-88mc-972h (CVE-2025-30360) - prior bypass

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-4v9v-hfq4-rm2v
• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w
• https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-9jgg-88mc-972h
• https://nvd.nist.gov/vuln/detail/CVE-2026-6402
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-79cf-xcqc-c78w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

webpack/webpack-dev-server (webpack-dev-server)

v5.2.4

Compare Source

v5.2.3

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[relativeci]

#1039 Bundle Size — 1.28MiB (0%).

1cd05b0(current) vs 75a5498 update-dependencies#1034(baseline)

Bundle metrics  no changes

	Current #1039	Baseline #1034
Initial JS	965.19KiB	965.19KiB
Initial CSS	5.44KiB	5.44KiB
Cache Invalidation	0%	0%
Chunks	2	2
Assets	8	8
Modules	1044	1044
Duplicate Modules	0	0
Duplicate Code	0%	0%
Packages	99	99
Duplicate Packages	0	0

Bundle size by type  no changes

	Current #1039	Baseline #1034
JS	965.19KiB	965.19KiB
Fonts	327.73KiB	327.73KiB
IMG	12.58KiB	12.58KiB
CSS	5.44KiB	5.44KiB
HTML	290B	290B

Bundle analysis report Branch renovate-npm-webpack-dev-server-... Project dashboard

---

^{Generated by RelativeCI Documentation Report issue}