chore(deps): bump webpack-dev-server and @angular-devkit/build-angular in /src

[dependabot]

Bumps webpack-dev-server to 5.2.6 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates webpack-dev-server from 5.2.3 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

v5.2.5

Patch Changes

• Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

• set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

5.2.5

Patch Changes

• Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.2.4 (2026-05-11)

Bug Fixes

• set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

Commits

• 8a37b0e chore(release): new release (#5697)
• f21ed0f fix: handle malformed Host and Origin headers (#5699)
• 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
• 308e853 fix: handle undefined options in Server constructor (#5695)
• 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
• 870ed22 chore: add v5 branch to release workflow triggers
• c3ee325 chore(release): new release (#5682)
• 60173be feat: add changeset validation and release workflow (#5680)
• 948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
• 93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Updates @angular-devkit/build-angular from 22.0.8 to 22.1.3

Release notes

Sourced from @​angular-devkit/build-angular's releases.

22.1.3

@​angular/cli

Commit	Description
	always install package during ng add to inspect manifest on disk for schematics (#33718)
	correctly report available package updates during bare ng update
	discover migrations from installed packages when omitted by registry metadata (#33718)
	normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit	Description
	prevent build process hang on unhandled error (#33715)
	retain watch files on error in load result cache
	support case-insensitive and alternative license file names
	release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit	Description
	settle writeResponseToNodeResponse when client disconnects
	avoid buffering request body when sanitizing headers

22.1.2

@​angular/cli

Commit	Description
	add packages with built-in schematics to devDependencies only

@​angular/build

Commit	Description
	prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1

@​angular/cli

Commit	Description
	support npm 12 metadata array and error formats

@​angular/build

Commit	Description
	rewrite paths from sandboxed execroots when running under Bazel

22.1.0

@​angular/cli

Commit	Description
	abort and guide manual mitigation when updating catalog packages
	prevent Yarn registry environment variable override
	remove algoliasearch dependency and support latest docs versions
	resolve correct registry name when using npm alias syntax during update
	respect client-side release age settings during update resolution

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

22.1.3 (2026-08-05)

@​angular/cli

Commit	Type	Description
f837b788c6	fix	always install package during ng add to inspect manifest on disk for schematics (#33718)
72ae93638d	fix	correctly report available package updates during bare ng update
a949e06568	fix	discover migrations from installed packages when omitted by registry metadata (#33718)
1d9122fd50	fix	normalize Windows drive-letter casing for process.cwd

@​angular/build

Commit	Type	Description
a4860d505a	fix	prevent build process hang on unhandled error (#33715)
7686d66cab	fix	retain watch files on error in load result cache
25b7cf7504	fix	support case-insensitive and alternative license file names
4fd81402ce	perf	release build resources early in non-watch mode (#33715)

@​angular/ssr

Commit	Type	Description
6af906cb94	fix	settle writeResponseToNodeResponse when client disconnects
917d3b2254	perf	avoid buffering request body when sanitizing headers

21.2.20 (2026-08-05)

@​angular-devkit/build-angular

Commit	Type	Description
972f6db7e9	fix	upgrade postcss to 8.5.23

@​angular/build

Commit	Type	Description
8de75ada50	fix	upgrade postcss to 8.5.23

20.3.33 (2026-08-05)

... (truncated)

Commits

• 60078fc release: cut the v22.1.3 release
• 434e070 refactor(@​angular/cli): remove unused eslint-disable comment in git utility
• 3a49bd4 build: update pnpm to v11.20.0
• 7686d66 fix(@​angular/build): retain watch files on error in load result cache
• 1d9122f fix(@​angular/cli): normalize Windows drive-letter casing for process.cwd
• 4e54f3a ci: schedule ng-snapshot Renovate updates for early morning only
• 6f75b73 build: update cross-repo angular dependencies
• 25b7cf7 fix(@​angular/build): support case-insensitive and alternative license file names
• 212373a build: lock file maintenance
• 74d6d0b build: update dependency postcss to v8.5.25
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​angular-devkit/​build-angular@​22.0.8 ⏵ 22.1.3			+1	+48

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: src/package-lock.json → npm/@nx/angular@23.1.1 → npm/@angular-devkit/build-angular@22.1.3 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm lmdb is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: src/package-lock.json → npm/@nx/angular@23.1.1 → npm/@angular-devkit/build-angular@22.1.3 → npm/lmdb@3.5.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lmdb@3.5.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: src/package-lock.json → npm/@nx/angular@23.1.1 → npm/@angular-devkit/build-angular@22.1.3 → npm/webpack@5.109.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.109.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[ikemtz]

@dependabot rebase