🚨 webpack-dev-server shipped a security release fixing 2 CVEs (1 high, 1 medium) in 5.x and 6.x: cross-origin WebSocket access on proxied upgrades, and a Host-validation info leak.
Upgrade to 5.2.7 or 6.1.0.
https://github.com/webpack/webpack-dev-server/releases/tag/v6.1.0