[Copilot]

webpack-dev-server <5.2.5 allows a broadly-scoped proxy (/ with ws: true) to intercept the dev server's own HMR WebSocket, leaking browser cookies and Origin headers to the proxy backend while corrupting the HMR socket.

Changes — twm/application/lib/ol-mapbox-style-6.3.0/

package.json — Bumped devDependencies to webpack 5-compatible versions:

• webpack-dev-server: ^3.9.0 → ^5.2.5
• webpack: ^4.41.3 → ^5.0.0 (required peer for wds v5)
• webpack-cli: ^3.3.10 → ^5.0.0
• html-webpack-plugin: ^3.2.0 → ^5.5.0
• karma-webpack: ^3.0.5 → ^5.0.0
• mini-css-extract-plugin: ^0.4.5 → ^2.0.0

Webpack configs (webpack.config.examples.js, webpack.config.olms.js, test/karma.conf.js) — Removed webpack 4-only node: {fs: 'empty'} option, which is unsupported in webpack 5.

package-lock.json — Regenerated; resolves webpack-dev-server to 5.2.5.

Note: this is a vendored library consumed via its pre-built dist/olms.js; the webpack toolchain changes only affect local development of the library itself.

---

Thanks for the PR!

After merge, new images are deployed and promoted to DEV:

• DEV Homepage

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud