Backport security fixes from v5.2.1 to v4

[nikwen]

Modification Proposal

Some projects are stuck on webpack-dev-server v4 because they have to support old Node.js versions.

v4 is still used by a large number of users. During the last 7 days, v4.15.2 alone received 3,356,309 downloads.

Expected Behavior / Situation

It would be great to have the security fixes from v5.2.1 backported to v4 and released as v4.15.3.

Actual Behavior / Situation

v4 currently does not have the security fixes. Millions of users are exposed to security vulnerabilities.

Please paste the results of npx webpack-cli info here, and mention other relevant information

  System:
    OS: macOS 15.5
    CPU: (8) arm64 Apple M1
    Memory: 212.97 MB / 16.00 GB
  Binaries:
    Node: 22.16.0 - /usr/local/bin/node
    Yarn: 1.22.19 - /opt/homebrew/bin/yarn
    npm: 10.9.2 - /usr/local/bin/npm
  Browsers:
    Brave Browser: 118.1.59.122
    Chrome: 137.0.7151.69
    Safari: 18.5

[MrBMT]

There's already a PR for this: #5514 though it looks like there may be further changes needed

[nikwen]

The PR was closed. It would be awesome if someone else could continue the work on the PR.

[ronakmaheshwari]

Hey @nikwen sir can I work on this issue

[alexander-akait]

@nikwen Why you can't update webpack-dev-server? What is the problem?

[nikwen]

@alexander-akait Thanks for your message! I use webpack-dev-server indirectly through another build tool. Its latest stable version still relies on webpack-dev-server v4: https://github.com/electron/forge/blob/f2a3ec8aa9c836aff95fcd83ce9c99842f0cda8a/package.json#L76

[nikwen]

webpack-dev-server v4.15.2 is still getting >500,000 downloads per day according to npm.

[alexander-akait]

@nikwen The main problem webpack-dev-server v4 is very deprecated and have a lot of bugs and security problems, I think it will be good to ask electron (and maybe not only if you use other tool) to update webpack dev server, migration in 99% is very simplify, just bumping version (+- couple strings if you use directly)

And other things, many of security problems are just non fixable in v4 due outputdated dependencies, if we will bump them - you will get a breaking change, some of security fixes require breaking changes too so many old projects can just stop working, we don't make security fixes in v4 not because we don't want to do it, just because it is often impossible or break the old code

[nikwen]

@alexander-akait Thanks for the context. That makes sense!

And thanks for the work that you put into webpack and webpack-dev-server!