webpack-dev-server version

[matthughes]

When creating a new project with 3.8.1 why does it use webpack-dev-server 4.x instead of 5.x when it uses web pack proper 5.x? There is a open CVE with server 4.x: https://security.snyk.io/package/npm/webpack-dev-server

[slorber]

See also #11239

Docusaurus v3 supports Node.js 18.0

Webpack Dev Server requires a newer minor version of v18, so depending on v5 means a breaking change that can only be done for Docusaurus v4, forcing some users to upgrade their Node.js version in CI/production.

I could do like Astro and decide it's fine to upgrade to Node 20 considering Node 18 is now unsupported: https://astro.build/blog/astro-580/

But I think it won't be necessarily and the security patch is in the process of being backported from v5 to v4: webpack/webpack-dev-server#5514

[matthughes]

Thanks. I'm mostly concerned with getting the CVE fixed. Why is dev-server used as part of main instead of dev-dependencies though? If I run build on my site, I'm not including webpack-dev-server am I?

[slorber]

The difference between dependencies and devDependencies is only when you use npm install --production to install faster.

dev dependencies of transitive dependencies are never installed. And webpack-dev-server is a transitive dependency of docusaurus. If we moved that dependency as a dev dependency, it wouldn't be installed on your site, and would prevent you from using npm run start. The alternative could only be to use it as an optional peer dependency, and require you to install it on your site's package.json directly. But we don't want that, because it prevents us from upgrading it when we need to, or replacing it with Rspack dev server if you plan to use Docusaurus Faster. The dev server shouldn't be exposed, it's an implementation detail of Docusaurus. When you use Docusaurus locally, it's local production usage, not development.

If I run build on my site, I'm not including webpack-dev-server am I?

No, Docusaurus is a static site generator and most npm dependencies we use for docusaurus start/build are not included in the generated website/build folder. At best, this security vulnerability can only affect your local environment you run docusaurus start on. Having the vulnerable dependency installed doesn't mean you are affected.

---

If you are concerned about the CVE for compliance reasons, you can force an upgrade to v5 using overrides in npm. Your dev server may not start though, but for production usage you might not care

[tony19]

Overriding to use Webpack 5 works fine for me:

client (webpack 5.96.1) compiled successfully

[slorber]

Fixed in #11410