Bump webpack-dev-server and @angular-devkit/build-angular

[dependabot]

Bumps webpack-dev-server to 5.2.6 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates webpack-dev-server from 5.2.5 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Commits

• 8a37b0e chore(release): new release (#5697)
• f21ed0f fix: handle malformed Host and Origin headers (#5699)
• 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
• 308e853 fix: handle undefined options in Server constructor (#5695)
• 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
• 870ed22 chore: add v5 branch to release workflow triggers
• See full diff in compare view

Updates @angular-devkit/build-angular from 20.3.32 to 22.1.2

Release notes

Sourced from @​angular-devkit/build-angular's releases.

22.1.2

@​angular/cli

Commit	Description
	add packages with built-in schematics to devDependencies only

@​angular/build

Commit	Description
	prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1

@​angular/cli

Commit	Description
	support npm 12 metadata array and error formats

@​angular/build

Commit	Description
	rewrite paths from sandboxed execroots when running under Bazel

22.1.0

@​angular/cli

Commit	Description
	abort and guide manual mitigation when updating catalog packages
	prevent Yarn registry environment variable override
	remove algoliasearch dependency and support latest docs versions
	resolve correct registry name when using npm alias syntax during update
	respect client-side release age settings during update resolution
	revert package.json changes if installation tasks fail during update
	robustly parse npm manifest from array

@​schematics/angular

Commit	Description
	update ai-config to include Angular MCP server config
	remove unused spec tsconfig outDir

@​angular-devkit/core

Commit	Description
	deprecate stringToFileBuffer and fileBufferToString

@​angular/build

Commit	Description
	add built-in SQLite cache store fallback
	emit debug ids for stable subresource integrity hashes
	enable chunk optimization for server builds
	migrate advanced optimization Babel plugins to oxc-parser + magic-string
	migrate i18n inliner to oxc-parser + magic-string
	share persistent build cache across git worktrees
	add bounded timeout to vitest executor disposal

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

22.1.2 (2026-07-30)

@​angular/cli

Commit	Type	Description
57db27ea91	fix	add packages with built-in schematics to devDependencies only

@​angular/build

Commit	Type	Description
baed978885	fix	prevent IIFE wrapper interleaving for adjacent classes in minified files

22.1.1 (2026-07-30)

@​angular/cli

Commit	Type	Description
ab971a8543	fix	support npm 12 metadata array and error formats

@​angular/build

Commit	Type	Description
db24220fb8	fix	rewrite paths from sandboxed execroots when running under Bazel

22.2.0-next.0 (2026-07-30)

@​angular/cli

Commit	Type	Description
e148a8df93	fix	support npm 12 metadata array and error formats

@​angular/build

Commit	Type	Description
6469b5f1f5	fix	rewrite paths from sandboxed execroots when running under Bazel

... (truncated)

Commits

• bccc749 release: cut the v22.1.2 release
• 57db27e fix(@​angular/cli): add packages with built-in schematics to devDependencies only
• baed978 fix(@​angular/build): prevent IIFE wrapper interleaving for adjacent classes i...
• dde9aed build: update cross-repo angular dependencies
• 51efbd8 build: update github/codeql-action action to v4.37.4
• 6c15ac8 ci: add branch tracking comments to dev-infra GitHub actions
• 5d92c65 release: cut the v22.1.1 release
• e30e18a build: update dependency webpack to v5.109.2
• 46d42d8 build: update dependency oxc-parser to v0.142.0
• 9ccb475 build: update bazel dependencies
• Additional commits viewable in compare view