chore(deps): bump webpack-dev-server and @angular-devkit/build-angular

[dependabot]

Bumps webpack-dev-server to 5.2.6 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates webpack-dev-server from 5.2.3 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

v5.2.5

Patch Changes

• Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

• set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

5.2.5

Patch Changes

• Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.2.4 (2026-05-11)

Bug Fixes

• set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

Commits

• 8a37b0e chore(release): new release (#5697)
• f21ed0f fix: handle malformed Host and Origin headers (#5699)
• 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
• 308e853 fix: handle undefined options in Server constructor (#5695)
• 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
• 870ed22 chore: add v5 branch to release workflow triggers
• c3ee325 chore(release): new release (#5682)
• 60173be feat: add changeset validation and release workflow (#5680)
• 948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
• 93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Updates @angular-devkit/build-angular from 22.0.8 to 22.1.6

Release notes

Sourced from @​angular-devkit/build-angular's releases.

22.1.6

@​angular/build

Commit	Description
	ignore side-effect annotations in unit test builds
	batch prerender routes and share in-memory server bundles

@​angular/ssr

Commit	Description
	abort web request signal when node request is aborted

22.1.5

@​schematics/angular

Commit	Description
	transform fail() to expect.fail() in refactor-jasmine-vitest

@​angular/cli

Commit	Description
	enforce MCP roots in get_best_practices tool
	handle errors from isAllowedWorkspacePath in best-practices tool
	throw on out-of-roots workspace in best-practices tool

@​angular/build

Commit	Description
	correct misleading error message for top-level await
	disable code splitting for unit test builds
	preserve integrity and crossorigin in autoCsp loader
	traverse AST with iterative post-order walker in i18n inliner

22.1.4

@​schematics/angular

Commit	Description
	generate CLAUDE.md for Claude Code instead of AGENTS.md
	import UrlSegment instead of subPath in guard generator

@​angular/cli

Commit	Description
	disable searching current directory for bare executable names on Windows
	serialize configuration as a single argv token in run_target strategies (#33657)
	avoid eager module loading during global bootstrap

@​angular/build

Commit	Description
	count statically imported chunks in the initial total
	normalize setupFiles paths to POSIX for vitest runner
	prevent syntax corruption for Crockford-style enum IIFE
	prevent syntax corruption in oxc transform
	return direct file contents for non-Angular TypeScript files

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

22.1.6 (2026-08-26)

@​angular/build

Commit	Type	Description
3f132eaa97	fix	ignore side-effect annotations in unit test builds
5b1028936f	perf	batch prerender routes and share in-memory server bundles

@​angular/ssr

Commit	Type	Description
76818cb811	fix	abort web request signal when node request is aborted

21.2.22 (2026-08-26)

@​angular-devkit/build-angular

Commit	Type	Description
b0047b04f5	fix	update webpack-dev-server to 5.2.6

20.3.35 (2026-08-26)

@​angular-devkit/build-angular

Commit	Type	Description
94b620acd7	fix	update webpack-dev-server to 5.2.6

22.2.0-next.4 (2026-08-19)

@​angular/cli

Commit	Type	Description
34e1e0bb5	fix	enforce MCP roots in get_best_practices tool

... (truncated)

Commits

• 16ad630 release: cut the v22.1.6 release
• 745c973 build: update pnpm to v11.24.0
• 3f132ea fix(@​angular/build): ignore side-effect annotations in unit test builds
• 2dc7cd7 build: lock file maintenance
• 5b10289 perf(@​angular/build): batch prerender routes and share in-memory server bundles
• a4c10f3 build: remove scorecard workflow
• 087d313 build: update github/codeql-action action to v4.37.7
• 3f5304a build: update cross-repo angular dependencies
• 76818cb fix(@​angular/ssr): abort web request signal when node request is aborted
• 3954730 release: cut the v22.1.5 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.