Fix security issues reported by Dependabot for version 4 #5514
+265
−7
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…lowed to connect to WebSocket
kretajak
requested review from
alexander-akait,
hiroppy,
snitin315 and
anshumanv
as code owners
| const headers = | ||
| /** @type {{ [key: string]: string | undefined }} */ | ||
| (req.headers); | ||
| if ( |
There was a problem hiding this comment.
Recently we added some fixes here to skip check for allowedHost, please add it here
|
Thanks, we'd also appreciate a backport for Docusaurus because our current minor supports Node 18.0, incompatible with dev server v5, and all newly initialized Docusaurus sites will get dev server v4. We could bump to the latest Node 18 like Astro did recently (since it reached end of life) but if it's possible to avoid that it's better to not force our users to upgrade Node.js when upgrading a minor version (and I'd rather not release a new major version just for that security fix) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
For Bugs and Features; did you add new tests?
Fixes Security issues present in version 4 of
webpack-dev-server. Similar fixes were already merged into version 5 ofwebpack-dev-server.Motivation / Use-Case
Fix issues reported by Dependabot:
Breaking Changes
It is breaking change but it's security wise. Similar changes are already in 5.x.x branch. See commits d2575ad and 5c9378b
Additional Info