[Cycode] Fix for vulnerable manifest file dependency - @rspack/cli updated to version 2.0.0-alpha.0

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
ui/app/package.json	1

📂 ui/app/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
@rspack/cli	1.4.11	2.0.0-alpha.0

Important

This pull request updates the major version for one or more packages. Make sure changes are tested before merging.

Warning

Lock file generation failed for one or more manifest files in this pull request. Please regenerate the lock file manually before merging.

---

Note

Medium Risk
Major pre-release @rspack/cli upgrade may break or mismatch @rspack/core ^1.4.11 build/dev tooling; lockfile was not regenerated in the PR.

Overview
Security-driven dependency bump in ui/app/package.json: devDependency @rspack/cli moves from ^1.4.11 to ^2.0.0-alpha.0 to address a reported vulnerable manifest dependency (Cycode).

@rspack/core and @rspack/plugin-react-refresh are unchanged; scripts still invoke rspack serve / rspack build via rspack.config.mjs (defineConfig from @rspack/cli). Treat this as a major CLI jump to a pre-release—verify start, build, and analyze after reinstalling deps and regenerating the lockfile (called out as failed in the PR).

^{Reviewed by Cursor Bugbot for commit 8f43825. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8f43825. Configure here.}

[cursor]

Incompatible Rspack CLI and core versions

High Severity

@rspack/cli is now on a 2.x range while @rspack/core stays at ^1.4.11 and @rspack/plugin-react-refresh stays at ^1.4.3. Rspack CLI 2 requires @rspack/core ^2.0.0-0, so install hits a peer conflict and a mixed 1.x/2.x stack cannot build the app.

 

^{Reviewed by Cursor Bugbot for commit 8f43825. Configure here.}

[cursor]

Dev server missing after CLI upgrade

High Severity

Rspack 2 no longer ships @rspack/dev-server inside @rspack/cli. The start script still runs rspack serve, so local UI development fails once the new CLI is installed.

Additional Locations (1)

• ui/app/package.json#L6-L7

 

^{Reviewed by Cursor Bugbot for commit 8f43825. Configure here.}

[cursor]

Analyze script uses removed CLI flag

Medium Severity

The analyze script still passes --analyze to rspack build. Rspack 2 removed that flag and the built-in bundle analyzer, so the script fails after the CLI upgrade.

Additional Locations (1)

• ui/app/package.json#L12-L13

 

^{Reviewed by Cursor Bugbot for commit 8f43825. Configure here.}