Breaking change in patch version breaks Module Federation cross-origin development (semver violation)

[vitaliypogoretskyy-art]

Setup:
Module Federation development pattern:

• Host app on localhost:8000
• Exposed app on localhost:8001

Error:
Error: [ Federation Runtime ]: Failed to load script resources. #RUNTIME-008
at http://localhost:8000/ trying to load http://localhost:8001/remoteEntry.js

Problem:
A breaking change was added in df073c5
(Cross-Origin-Resource-Policy: same-origin header) in a patch version.

This common, working development setup now silently fails unless Access-Control-Allow-Origin header is explicitly added.

• Before patch: worked without CORS configuration
• After patch: breaks silently

[alexander-akait]

It is a security patch, otherwise you can have a problem, please fill the issue template and describe your problem

[vitaliypogoretskyy-art]

It is a security patch, otherwise you can have a problem, please fill the issue template and describe your problem

webpack-dev-server is a dev dependency, so this security patch
only affects developers during local development, not production
apps or end users, right?

Silently breaking working setups in a patch version violates
semver expectations, regardless of the security reasoning.

[alexander-akait]

This is a security patch, no matter is it a dev dependency or production, if you expose your application at your network you can be attacked, please provide your configuration and structure, you can use github to create a small reproducible test repo, I feel like you have wrong configurations