[Snyk] Security upgrade webpack-dev-server from 3.11.3 to 4.7.3

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/@vue/cli-service/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	566/1000 Why? Recently disclosed, Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	651/1000 Why? Recently disclosed, Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	566/1000 Why? Recently disclosed, Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: webpack-dev-server

The new version differs by 250 commits.

• 5280ee7 docs: fix typo
• d834582 chore(release): 4.7.3
• 7b8c85b chore(deps): update `selfsigned` (linux vue-cli-service build 命令 segmentation fault vuejs/vue-cli#4170)
• d598325 chore: fix lint
• c1907f1 refactor: remove redundant `if` statements (<div id="app"> is in App.vue and index.html vuejs/vue-cli#4158)
• e535f25 ci: debug (更新@vue/cli-service到3.8.3后，热重载network显示unavailable vuejs/vue-cli#4144)
• 75999bb chore(release): 4.7.2
• 90a96f7 ci: fix (type error; sercet => secret vuejs/vue-cli#4143)
• f6bc644 fix: compatible with `onAfterSetupMiddleware`
• 317e4b9 docs: fix testing instructions (Really need a way to minimize/alter build output information vuejs/vue-cli#4133)
• ff4550e test: remove redundant test cases related to 3rd party code (vue cli3 创建的项目在IE11中运行，出现白屏，通过console调试发现报错SCRIPT1003: 缺少 ':'文件: app.js，行: 7391，列: 3 vuejs/vue-cli#4131)
• 0dd1ee6 test: add e2e tests for `setupExitSignals` option (Starting type checking service... Using 1 worker with 2048MB memory limit vuejs/vue-cli#4130)
• afe4975 chore(release): 4.1.7
• 4e5d8ea fix: droped `url` package (How to eject vuejs/vue-cli#4132)
• b0c98f0 chore(release): 4.7.0
• 3138213 chore(deps): update (Property 'observable' does not exist on type 'SymbolConstructor'. vuejs/vue-cli#4127)
• 8f02c3f feat: added types
• f4fb15f fix: update description of `onAfterSetupMiddleware` and `onBeforeSetupMiddleware` options (npm run serve的时候可以正常访问但是编译时，会出现红字 Replace Autoprefixer browsers option to Browserslist config. Use browserslist key in package.json or .browserslistrc file. Using browsers option cause some error. Browserslist config can be used for Babel, Autoprefixer, postcss-normalize and other tools. If you really need to use option, rename it to overrideBrowserslist. Learn more at: https://github.com/browserslist/browserslist#readme https://twitter.com/browserslist vuejs/vue-cli#4126)
• 37b73d5 test: add e2e test for `WEBPACK_SERVE` env variable ([WSL] Error: spawn cmd.exe ENOENT vuejs/vue-cli#4125)
• f5a9d05 chore(deps-dev): bump eslint from 8.4.1 to 8.5.0 (Travis ci build failure due to @vue/babel-preset-app/index.js provided an invalid property of "default"  vuejs/vue-cli#4121)
• c9b959f chore(deps): bump ws from 8.3.0 to 8.4.0 (CSS minification doesn't works if CSS filename pattern contains query string vuejs/vue-cli#4124)
• 42208aa chore(deps-dev): bump lint-staged from 12.1.2 to 12.1.3 (Travis ci build failure due to @vue/babel-preset-app/index.js provided an invalid property of "default"  vuejs/vue-cli#4122)
• f440f84 chore(deps): bump express from 4.17.1 to 4.17.2 (Move core plugins docs to documentation website vuejs/vue-cli#4120)
• c13aa56 feat: added the `setupMiddlewares` option (To -- target lib model generated when a lot of small files vuejs/vue-cli#4068)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.