[Snyk] Fix for 2 vulnerabilities

[caniszczyk]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• ui/package.json
• ui/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncaught Exception SNYK-JS-QS-19432019	738
	Allocation of Resources Without Limits or Throttling SNYK-JS-QS-19432017	708

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncaught Exception
🦉 Allocation of Resources Without Limits or Throttling

[caniszczyk]

Both upgrades are major versions with significant breaking changes that require developer action, including mandatory code modifications and runtime environment updates.

1. webpack-dev-server: 4.15.2 → 6.0.0 (HIGH RISK)

This is a two-version major upgrade (from v4 to v6) and introduces substantial breaking changes.

Key Changes:

• Node.js Requirement: Support for Node.js versions below 22.15.0 has been dropped. This is a very significant jump and will likely require an environment upgrade. [5, 9, 11, 17]
• ESM Module: The package is now published as native ES Modules (ESM). This will break require() imports in CommonJS projects, which must be converted to import syntax or other workarounds. [5, 9, 11]
• CLI Flags Removed: All command-line flags have been removed. Configuration must now be managed exclusively through webpack.config.js and webpack-cli. [5, 9, 11]
• Configuration Changes: Middleware setup options like onBeforeSetupMiddleware have been replaced by setupMiddlewares. The proxy configuration syntax has also changed. [3]
• Dependency Upgrades: This version bundles Express v5 and upgrades webpack-dev-middleware to v8, inheriting their respective breaking changes. [9, 11]

Recommendation: This upgrade requires a major refactor. Developers must update their Node.js environment, migrate configuration from CLI flags to the config file, and handle the transition to ESM. Review the v5 and v6 migration guides carefully.

2. express: 4.22.1 → 5.1.0 (HIGH RISK)

This major version upgrade modernizes the framework but includes several breaking API changes.

Key Changes:

• Node.js Requirement: Requires Node.js 18 or higher. [1, 10, 15]
• API Removals & Renames:
  • app.del() has been removed; use app.delete(). [2, 13]
  • req.param(name) has been removed; use req.params, req.body, or req.query directly. [1, 4, 13]
  • The res.send(status) signature is no longer supported; use res.sendStatus(status) or res.status(status).send(). [1, 6]
• Behavioral Changes:
  • Async Error Handling: Rejected promises in async middleware are now automatically caught and forwarded to error handlers, which may alter application control flow. [10, 12, 15]
  • Routing: Route path matching is stricter. For example, '/foo*' must be changed to '/foo(.*)'. [2, 13]

Recommendation: Use the official Express codemods to automate many of the required code changes: npx @expressjs/codemod upgrade. [1] Thoroughly test async error handling and route matching after the upgrade.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[netlify]

✅ Deploy Preview for devspace-docs canceled.

Name	Link
🔨 Latest commit	f9e93f7
🔍 Latest deploy log	https://app.netlify.com/projects/devspace-docs/deploys/6a93e70041875700088b270b