Bump webpack-dev-server, @angular-builders/custom-webpack and @angular-devkit/build-angular

[dependabot]

Bumps webpack-dev-server to 5.2.5 and updates ancestor dependencies webpack-dev-server, @angular-builders/custom-webpack and @angular-devkit/build-angular. These dependencies need to be updated together.

Updates webpack-dev-server from 5.2.2 to 5.2.5

Release notes

Sourced from webpack-dev-server's releases.

v5.2.5

Patch Changes

• Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

v5.2.4

5.2.4 (2026-05-11)

Bug Fixes

• set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

v5.2.3

5.2.3 (2026-01-12)

Bug Fixes

• add cause for errorObject (#5518) (37b033d)
• compatibility with event target and universal target and lazy compilation (574026c)
• overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
• progress indicator styles (#5557) (41a53a1)
• upgrade selfsigned to v5

Changelog

Sourced from webpack-dev-server's changelog.

5.2.5

Patch Changes

• Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by @​bjohansebas in #5680)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

5.2.4 (2026-05-11)

Bug Fixes

• set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

5.2.3 (2026-01-12)

Bug Fixes

• add cause for errorObject (#5518) (37b033d)
• compatibility with event target and universal target and lazy compilation (574026c)
• overlay: add ESC key to dismiss overlay (#5598) (f91baa8)
• progress indicator styles (#5557) (41a53a1)
• upgrade selfsigned to v5

Commits

• c3ee325 chore(release): new release (#5682)
• 60173be feat: add changeset validation and release workflow (#5680)
• 948d5e6 fix(proxy): match the HMR upgrade path exactly like the ws server (#5678)
• 93e8996 fix: skip HMR websocket path when forwarding upgrades to user-defined proxies...
• fd40130 chore(release): 5.2.4
• ece4f36 chore: update deps (#5661)
• a216144 ci: fix test (#5658)
• df073c5 Merge commit from fork
• b550a70 chore(release): 5.2.3
• 9704dc5 chore: upgrade selfsigned to v5 and remove node-forge dependency (#5618)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Updates @angular-builders/custom-webpack from 19.0.1 to 22.0.1

Changelog

Sourced from @​angular-builders/custom-webpack's changelog.

22.0.1 (2026-06-23)

Note: Version bump only for package @​angular-builders/custom-webpack

22.0.1-beta.0 (2026-06-22)

Note: Version bump only for package @​angular-builders/custom-webpack

22.0.0 (2026-06-10)

Note: Version bump only for package @​angular-builders/custom-webpack

22.0.0-beta.1 (2026-06-09)

Note: Version bump only for package @​angular-builders/custom-webpack

22.0.0-beta.0 (2026-06-09)

⚠ BREAKING CHANGES

• All packages now require Angular 22.
• User TypeScript config/plugin modules now load via jiti instead of ts-node. Configs are transpiled rather than type-checked (run tsc --noEmit separately if you relied on build-time type-checking); ts-node and tsconfig-paths are no longer dependencies; and the NODE_OPTIONS='--loader ts-node/esm' workaround for ESM apps is no longer needed.

Features

• ng add / ng update schematics for jest, custom-esbuild, custom-webpack (#2267) (062f423), closes #22
• replace ts-node with jiti for loading TypeScript modules (#2287) (0348e06), closes #816
• upgrade builders + examples to Angular 22 (22.0.0-rc.2) (#2264) (9ed7020)

Miscellaneous Chores

• graduate Angular 22 from RC to GA (daec882)

21.1.0 (2026-06-08)

Note: Version bump only for package @​angular-builders/custom-webpack

21.1.0-beta.13 (2026-06-05)

Reverts

• remove redundant TS2742 builder annotations (#2275, #2278) (#2279) (a2882e5)

21.1.0-beta.12 (2026-06-04)

Bug Fixes

• builders: annotate builder default exports with Builder to avoid TS2742 (#2278) (7db3848)

21.1.0-beta.11 (2026-06-01)

... (truncated)

Commits

• 0a130ae ci(release): publish
• 79b145a ci(release): publish
• 6cdd684 style: format repo with prettier and add CI format gate (#2323)
• 7cebff9 ci(release): publish
• 6647e73 ci(release): publish
• 49f90e4 docs(changelog): clean up v22 breaking-change sections
• a27c6b0 ci(release): publish
• daec882 chore!: graduate Angular 22 from RC to GA
• 2cb9a56 chore(deps): update bazel-example to Angular CLI 22
• 0348e06 feat!: replace ts-node with jiti for loading TypeScript modules (#2287)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​angular-builders/custom-webpack since your current version.

Updates @angular-devkit/build-angular from 19.2.19 to 21.2.17

Release notes

Sourced from @​angular-devkit/build-angular's releases.

21.2.17

@​angular/build

Commit	Description
	bump @​babel/core to 7.29.7
	bump esbuild to 0.28.1
	bump piscina to 5.2.0
	bump vite to 7.3.5

21.2.16

@​angular/cli

Commit	Description
	update pacote to 21.5.1

@​angular/ssr

Commit	Description
	prioritize options over environment variables in AngularNodeAppEngine

21.2.15

@​angular/cli

Commit	Description
	remove forceAuth and unscoped credential parsing
	support registry metadata fetching under bun package manager

21.2.14

@​angular/cli

Commit	Description
	expand package groups for newly added peer dependencies in update schematic

@​angular/build

Commit	Description
	prevent esbuild service child process leakage

21.2.13

@​angular-devkit/build-angular

Commit	Description
	remove unconditional CORS wildcard from webpack dev-server

@​angular/build

Commit	Description
	assert that asset input paths are within workspace root

21.2.12

@​angular/build

Commit	Description

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

21.2.17 (2026-06-24)

@​angular/build

Commit	Type	Description
9c366e8be	fix	bump @​babel/core to 7.29.7
6a06ce9e9	fix	bump esbuild to 0.28.1
637b84877	fix	bump piscina to 5.2.0
e86d58a12	fix	bump vite to 7.3.5

20.3.30 (2026-06-24)

@​angular/build

Commit	Type	Description
36adca99c	fix	bump @​babel/core to 7.29.7
7f236cfea	fix	bump esbuild to 0.28.1
94fb3c122	fix	bump piscina to 5.2.0
1f283a41c	fix	bump vite to 7.3.5

22.0.3 (2026-06-18)

@​schematics/angular

Commit	Type	Description
0eddea898	fix	remove default workspace vscode mcp.json configuration

21.2.16 (2026-06-17)

@​angular/cli

Commit	Type	Description
77c9047ac	fix	update pacote to 21.5.1

... (truncated)

Commits

• 9c1edbc release: cut the v21.2.17 release
• 637b848 fix(@​angular/build): bump piscina to 5.2.0
• 9c366e8 fix(@​angular/build): bump @​babel/core to 7.29.7
• 6a06ce9 fix(@​angular/build): bump esbuild to 0.28.1
• e86d58a fix(@​angular/build): bump vite to 7.3.5
• 1efc647 release: cut the v21.2.16 release
• 14459e2 build: update dependency webpack-dev-server to 5.2.5
• 77c9047 fix(@​angular/cli): update pacote to 21.5.1
• d052e97 fix(@​angular/ssr): prioritize options over environment variables in AngularNo...
• d318ddd release: cut the v21.2.15 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​angular-devkit/​build-angular@​19.2.19 ⏵ 21.2.17			+1	+1
	webpack@​5.99.9 ⏵ 5.106.2	-12	+2	+1
	@​angular-builders/​custom-webpack@​19.0.1 ⏵ 22.0.1			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @angular-devkit/build-angular is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-devkit/build-angular@21.2.17 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@angular-devkit/build-angular@21.2.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @angular-devkit/build-angular is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-devkit/build-angular@21.2.17 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@angular-devkit/build-angular@21.2.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @angular-devkit/build-angular is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-builders/custom-webpack@22.0.1 → npm/@angular-devkit/build-angular@22.0.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@angular-devkit/build-angular@22.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @angular/build is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-devkit/build-angular@21.2.17 → npm/@angular/build@21.2.17 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@angular/build@21.2.17. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @angular/build is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-builders/custom-webpack@22.0.1 → npm/@angular/build@22.0.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@angular/build@22.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @schematics/angular is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-builders/custom-webpack@22.0.1 → npm/@schematics/angular@22.0.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@schematics/angular@22.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm lmdb is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-devkit/build-angular@21.2.17 → npm/lmdb@3.5.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lmdb@3.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm lmdb is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-builders/custom-webpack@22.0.1 → npm/lmdb@3.5.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/lmdb@3.5.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm powershell-utils is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-builders/custom-webpack@22.0.1 → npm/@angular-devkit/build-angular@21.2.17 → npm/powershell-utils@0.1.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/powershell-utils@0.1.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm typescript License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: package-lock.json → npm/@angular-builders/custom-webpack@22.0.1 → npm/typescript@6.0.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@6.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@angular-devkit/build-angular@21.2.17 → npm/webpack@5.105.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.105.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm webpack is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/webpack@5.106.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.106.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report