chore(deps): bump webpack-dev-server and @angular-builders/jest

[dependabot]

Bumps webpack-dev-server to 5.2.6 and updates ancestor dependency @angular-builders/jest. These dependencies need to be updated together.

Updates webpack-dev-server from 5.2.5 to 5.2.6

Release notes

Sourced from webpack-dev-server's releases.

v5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.6

Patch Changes

• fix: allow undefined as the Server constructor options argument again (by @​bjohansebas in #5695)

  Restores accepting undefined (defaulting it to {}) for the options argument, so passing a webpack config's optional devServer field type-checks and works as before.

• Protect the built-in state-changing routes (/webpack-dev-server/invalidate and /webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked with Sec-Fetch-Site (falling back to an Origin/Host comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @​bjohansebas in #5698)

• Handle malformed Host and Origin header values gracefully when validating requests. (by @​bjohansebas in #5699)

Commits

• 8a37b0e chore(release): new release (#5697)
• f21ed0f fix: handle malformed Host and Origin headers (#5699)
• 80cd9ee fix: reject cross-site requests to open-editor and invalidate endpoints (#5698)
• 308e853 fix: handle undefined options in Server constructor (#5695)
• 8b2b915 chore: update branch references from v4 to v5 in workflow configuration
• 870ed22 chore: add v5 branch to release workflow triggers
• See full diff in compare view

Updates @angular-builders/jest from 21.0.4 to 22.0.1

Changelog

Sourced from @​angular-builders/jest's changelog.

22.0.1 (2026-06-23)

Note: Version bump only for package @​angular-builders/jest

22.0.1-beta.2 (2026-06-22)

Note: Version bump only for package @​angular-builders/jest

22.0.1-beta.1 (2026-06-22)

Bug Fixes

• jest: stop pinning jest-preset-angular in ng-add; resolve it transitively (#2319) (f5f993f)

22.0.1-beta.0 (2026-06-22)

Note: Version bump only for package @​angular-builders/jest

22.0.0 (2026-06-10)

Note: Version bump only for package @​angular-builders/jest

22.0.0-beta.1 (2026-06-09)

Note: Version bump only for package @​angular-builders/jest

22.0.0-beta.0 (2026-06-09)

⚠ BREAKING CHANGES

• All packages now require Angular 22.
• User TypeScript config/plugin modules now load via jiti instead of ts-node. Configs are transpiled rather than type-checked (run tsc --noEmit separately if you relied on build-time type-checking); ts-node and tsconfig-paths are no longer dependencies; and the NODE_OPTIONS='--loader ts-node/esm' workaround for ESM apps is no longer needed.
• isolatedModules now defaults to true for faster compilation, which disables cross-file TypeScript type-checking during Jest runs. Set isolatedModules: false in your config to restore the previous behavior.
• Coverage output is now scoped per project: coverageDirectory defaults to <projectRoot>/coverage instead of ./coverage, so projects in a multi-project workspace no longer overwrite each other's reports.

Features

• ng add / ng update schematics for jest, custom-esbuild, custom-webpack (#2267) (062f423), closes #22
• replace ts-node with jiti for loading TypeScript modules (#2287) (0348e06), closes #816
• upgrade builders + examples to Angular 22 (22.0.0-rc.2) (#2264) (9ed7020)

Bug Fixes

• jest: default isolatedModules to true for faster compilation (fixes #1899) (#2191) (acd2d37)
• jest: scope coverage output per-project in multi-project workspaces (fixes #1009) (#2212) (0ac5d6d)

Miscellaneous Chores

• graduate Angular 22 from RC to GA (daec882)

Commits

• 0a130ae ci(release): publish
• 79b145a ci(release): publish
• 6cdd684 style: format repo with prettier and add CI format gate (#2323)
• ed21d04 ci(release): publish
• f5f993f fix(jest): stop pinning jest-preset-angular in ng-add; resolve it transitivel...
• 5afafd6 ci(release): publish
• 6f14a1d chore(deps): update dependency jest-preset-angular to v17 (#2313)
• 7cebff9 ci(release): publish
• 6647e73 ci(release): publish
• 49f90e4 docs(changelog): clean up v22 breaking-change sections
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.