build(deps): upgrade webpack-dev-server to v5.2.4 on next

[claude]

Requested by Samuel Attard · Slack thread

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project follows, as appropriate.
• The changes are appropriately documented (if applicable).
• The changes have sufficient test coverage (if applicable).
• The testsuite passes successfully on my local machine (if applicable).

Summarize your changes:

Bumps webpack-dev-server in @electron-forge/plugin-webpack from ^4.0.0 to ^5.2.4 on the release-bearing next branch.

Before: next pins webpack-dev-server ^4.0.0, which is affected by the moderate advisory GHSA-9jgg-88mc-972h (source code can be stolen via a malicious site in a non-Chromium browser).

After: bumped to ^5.2.4 (resolves to 5.2.5 in the lockfile), resolving the advisory.

How: mirrors the fix already merged to main in #4274; re-applied manually because that commit does not cherry-pick cleanly onto next (branches diverged since Nov 2025).

One deliberate difference from #4274: the // eslint-disable-next-line import/default suppression added on main is not needed here. next has migrated its JS/TS linting from ESLint to oxlint (.oxlintrc.json), and the import/default rule is not enabled in that config. oxlint reports 0 errors on the unchanged default import import WebpackDevServer from 'webpack-dev-server'; in both Config.ts and WebpackPlugin.ts, and the package type-checks/builds cleanly under wds v5.

Reference: fixes part of #4084 on the release-bearing next branch (main was already fixed by #4274).

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	webpack-dev-server@​4.15.2 ⏵ 5.2.5	+1	+6

View full report