chore: replace portfinder with get-port

Gets rid of security warnings in async. New package has less dependencies
because it targets more recent Node versions. Drop lodash from prod.
COuld not use latest because get-port 6 is ESM-only. new package used a lot,
for example Vite.
Behaviour is not identical as portfinder tries ports in ascending
order while portfinder tries random ports if the preferred port is closed.

Both have race conditions visible when tests run in parallel.
Demands should not be too high as this only runs once when the server starts,
not meant to find ports in a production service.

lib/Server.js

@@ -393,9 +393,9 @@ class Server {
     }
 
     const pRetry = require("p-retry");
-    const portfinder = require("portfinder");
+    const getPort = require("get-port");
 
-    portfinder.basePort =
+    const basePort =
       typeof process.env.WEBPACK_DEV_SERVER_BASE_PORT !== "undefined"
         ? parseInt(process.env.WEBPACK_DEV_SERVER_BASE_PORT, 10)
         : 8080;
@@ -407,7 +407,7 @@ class Server {
         ? parseInt(process.env.WEBPACK_DEV_SERVER_PORT_RETRY, 10)
         : 3;
 
-    return pRetry(() => portfinder.getPortPromise(), {
+    return pRetry(() => getPort({ port: basePort }), {
       retries: defaultPortRetry,
     });
   }

package.json

@@ -49,13 +49,13 @@
     "connect-history-api-fallback": "^1.6.0",
     "default-gateway": "^6.0.3",
     "express": "^4.17.3",
+    "get-port": "^5.1.1",
     "graceful-fs": "^4.2.6",
     "html-entities": "^2.3.2",
     "http-proxy-middleware": "^2.0.3",
     "ipaddr.js": "^2.0.1",
     "open": "^8.0.9",
     "p-retry": "^4.5.0",
-    "portfinder": "^1.0.28",
     "rimraf": "^3.0.2",
     "schema-utils": "^4.0.0",
     "selfsigned": "^2.0.1",

test/e2e/api.test.js

@@ -803,10 +803,8 @@ describe("API", () => {
     it("should throw the error when the port isn't found", async () => {
       expect.assertions(1);
 
-      jest.mock("portfinder", () => {
-        return {
-          getPortPromise: () => Promise.reject(new Error("busy")),
-        };
+      jest.mock("get-port", () => {
+        return () => Promise.reject(new Error("busy"));
       });
 
       process.env.WEBPACK_DEV_SERVER_PORT_RETRY = 1;