Bump webpack-dev-server and @angular-devkit/build-angular in /CloudPatterns/ClientApp

[dependabot]

Bumps webpack-dev-server to 5.2.6 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates webpack-dev-server from 5.2.5 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Commits

• 8a37b0e chore(release): new release (#5697)
• f21ed0f fix: handle malformed Host and Origin headers (#5699)
• 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
• 308e853 fix: handle undefined options in Server constructor (#5695)
• 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
• 870ed22 chore: add v5 branch to release workflow triggers
• See full diff in compare view

Updates @angular-devkit/build-angular from 20.3.32 to 22.1.5

Release notes

Sourced from @​angular-devkit/build-angular's releases.

22.1.5

@​schematics/angular

Commit	Description
	transform fail() to expect.fail() in refactor-jasmine-vitest

@​angular/cli

Commit	Description
	enforce MCP roots in get_best_practices tool
	handle errors from isAllowedWorkspacePath in best-practices tool
	throw on out-of-roots workspace in best-practices tool

@​angular/build

Commit	Description
	correct misleading error message for top-level await
	disable code splitting for unit test builds
	preserve integrity and crossorigin in autoCsp loader
	traverse AST with iterative post-order walker in i18n inliner

22.1.4

@​schematics/angular

Commit	Description
	generate CLAUDE.md for Claude Code instead of AGENTS.md
	import UrlSegment instead of subPath in guard generator

@​angular/cli

Commit	Description
	disable searching current directory for bare executable names on Windows
	serialize configuration as a single argv token in run_target strategies (#33657)
	avoid eager module loading during global bootstrap

@​angular/build

Commit	Description
	count statically imported chunks in the initial total
	normalize setupFiles paths to POSIX for vitest runner
	prevent syntax corruption for Crockford-style enum IIFE
	prevent syntax corruption in oxc transform
	return direct file contents for non-Angular TypeScript files
	return only lowest version per target engine
	set target for Rolldown dependency prebundling in Vite dev server
	avoid encoding the inline source map before remapping
	batch last_accessed updates in sqlite cache store
	hash the i18n inline cache key options once per locale
	optimize template string size calculation in server manifest
	share i18n translations with the inliner workers by reference
	use Map for chunk asset size lookups in budget calculator

@​angular/ssr

Commit	Description

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

22.1.5 (2026-08-19)

@​angular/cli

Commit	Type	Description
e672271f8	fix	enforce MCP roots in get_best_practices tool
a14916cc4	fix	handle errors from isAllowedWorkspacePath in best-practices tool
d6e1cddff	fix	throw on out-of-roots workspace in best-practices tool

@​schematics/angular

Commit	Type	Description
ba2b0e4c2	fix	transform fail() to expect.fail() in refactor-jasmine-vitest

@​angular/build

Commit	Type	Description
cba72902d	fix	correct misleading error message for top-level await
b4679998c	fix	disable code splitting for unit test builds
ff1d3565e	fix	preserve integrity and crossorigin in autoCsp loader
1fc1fb05c	perf	traverse AST with iterative post-order walker in i18n inliner

22.2.0-next.3 (2026-08-13)

@​angular/cli

Commit	Type	Description
7106676e6	fix	disable searching current directory for bare executable names on Windows
ecf8c0822	fix	serialize configuration as a single argv token in run_target strategies (#33657)
2e4dd90c3	perf	avoid eager module loading during global bootstrap

@​schematics/angular

Commit	Type	Description
1161e6c99	fix	generate CLAUDE.md for Claude Code instead of AGENTS.md
c536ae364	fix	import UrlSegment instead of subPath in guard generator

@​angular/build

Commit	Type	Description

... (truncated)

Commits

• 3954730 release: cut the v22.1.5 release
• 7b7064f build: update dependency listr2 to v11
• 262562d docs: mention Vitest instead of Karma in README template of schematic library...
• 712e74e build: lock file maintenance
• 93d9cff refactor(@​angular-devkit/schematics): add missing comma to reordered componen...
• 528114c refactor(@​angular-devkit/schematics): add consistent spacing and ordering
• cba7290 fix(@​angular/build): correct misleading error message for top-level await
• 0e36040 build: update pnpm to v11.22.0
• d01d2c6 build: update cross-repo angular dependencies
• ba2b0e4 fix(@​schematics/angular): transform fail() to expect.fail() in refactor-jasmi...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.