chore: remove universal-hot-reload and webpack-serve from examples#403
chore: remove universal-hot-reload and webpack-serve from examples#403kparkinson-ld wants to merge 2 commits into
Conversation
Remove universal-hot-reload and webpack-serve devDependencies from both example apps. These packages pulled in vulnerable transitive deps: - webpack-dev-server@3.x (GHSA-9hcv-j9pv-qmph) - uuid@3.4.0 (GHSA-rr56-j5qj-qrhg) - node-forge@0.10.0 (multiple CVEs) Replace with explicit webpack CLI build scripts. The examples now use 'npm run build' to compile client/server bundles and 'npm start' to build and run the server. Hot module replacement is removed as these examples are for a deprecated SDK.
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 22a56e9. Configure here.
| "scripts": { | ||
| "start": "NODE_OPTIONS=--openssl-legacy-provider node src/server/index.js", | ||
| "build": "NODE_OPTIONS=--openssl-legacy-provider webpack --config webpack.config.client.js && NODE_OPTIONS=--openssl-legacy-provider webpack --config webpack.config.server.js", | ||
| "start": "npm run build && node dist/serverBundle.js", |
There was a problem hiding this comment.
Client script port no longer served
High Severity
The updated start script only builds assets and runs dist/serverBundle.js on port 3000. The server HTML still requests bundle.js from http://localhost:3002, which webpack-serve used to provide. With that dev server removed, nothing listens on 3002, so the example page renders without client JavaScript.
Reviewed by Cursor Bugbot for commit 22a56e9. Configure here.
There was a problem hiding this comment.
Good catch — fixed in c2b3f2b. Updated both server.js HTML templates to use /dist/bundle.js (served by Express on the same port) and removed the stale localhost:3002 webpack publicPath from both webpack.config.client.js files.
The HTML templates and webpack configs referenced http://localhost:3002 which was served by the now-removed webpack-serve. Update to use relative /dist/ path since Express already serves static files from the dist directory on the same port.
|
since these are examples, we do not need to bump a patch version. The PR title should be prefixed with |
devin-ai-integration
Bot
changed the title
|
Good call — updated the title to |
2 participants
Requirements
Related issues
Resolves Dependabot alerts #250, #249 (uuid), #248, #247 (webpack-dev-server).
Describe the solution you've provided
Removes
universal-hot-reloadandwebpack-servefrom both example apps' devDependencies. These packages pulled in vulnerable transitive deps (webpack-dev-server@3.x,uuid@3.4.0,node-forge@0.10.0).Replaces with explicit webpack CLI build scripts:
npm run build— compiles client + server bundles via webpack CLInpm start— builds then runs the server bundleHMR is removed since these examples are for a deprecated SDK.
Describe alternatives you've considered
Upgrading
universal-hot-reloadto a version that useswebpack-dev-server@5would require also upgrading to webpack 5, which is a larger migration.Additional context
This is one of two follow-up PRs to #401. The other is #402 (react-router-dom v5→v6).
Link to Devin session: https://app.devin.ai/sessions/381e0dd095a446e49ba0e8a9c9022c0c
Requested by: @kparkinson-ld
Note
Low Risk
Dev-only example tooling and scripts; no SDK or production runtime behavior changes.
Overview
Removes
universal-hot-reloadandwebpack-servefrom the example apps (async-provider,hoc) to drop vulnerable transitive dependencies. Example workflows now usenpm run build(webpack CLI for client + server) andnpm start(build thennode dist/serverBundle.js); theservescript is gone and HMR is no longer used.Server bootstrapping is simplified:
src/server/index.jsonlyrequires the compileddist/serverBundleinstead of wiring hot reload. Client assets are served from the same Express app via/dist/bundle.js(replacing a separate dev-server URL), with webpackpublicPathset to/dist/.Reviewed by Cursor Bugbot for commit c2b3f2b. Bugbot is set up for automated code reviews on this repo. Configure here.