deps(node): upgrade ws transitive dependency to fix CVE-2026-45736

[matthewelwell]

• I have read the Contributing Guide.
• I have added information to docs/ if required so people know about the feature.
• I have filled in the "Changes" section below.
• I have filled in the "How did you test this code" section below.

Changes

Fixes the Dependabot alert for CVE-2026-45736 — uninitialized memory disclosure in ws when a TypedArray is passed as the close reason. The fix requires ws >= 8.20.1.

ws is a transitive dependency, so the upgrade required unblocking the packages that constrained it:

• webpack-bundle-analyzer ^4.5.0 → ^5.0.0 — v4 depended on ws@^7.x; v5 uses ws@^8.19.0, consistent with the rest of the build toolchain.

• @rspack/cli, @rspack/core, @rspack/dev-server, @rspack/plugin-react-refresh ^1.x → ^2.0.0 — rspack v1's CLI pinned @rspack/dev-server@~1.1.5, which depended on ws@^8.18.0 and was locked at 8.20.0 (vulnerable). rspack v2 dropped the bundled dev-server dependency entirely, removing that ws consumer. No override was required.

• sass-loader 16.0.1 → ^17.0.0 — sass-loader@16 declares @rspack/core as an optional peer for "0.x || 1.x" only; npm 10 in strict mode raises ERESOLVE against rspack v2. v17 adds "^2.0.0-0" to the peer range, resolving the conflict.

• sass 1.54.8 → ^1.80.0 — sass-loader@17 switched from require("sass") to await import("sass"). sass@1.54.8 is pure CJS, so dynamic import returns info on module.default rather than as a named export, causing sass-loader@17 to throw Unknown Sass implementation. sass@1.80.0+ ships proper ESM named exports, including info at the top level.

• rspack/rspack.config.local.js — @rspack/plugin-react-refresh v2 changed from a default export to a named export (ReactRefreshRspackPlugin); updated the import accordingly.

After the upgrade, the only ws instances in the tree are ws@8.21.0 (from storybook and webpack-bundle-analyzer@5), and npm audit reports no ws vulnerabilities.

How did you test this code?

• Ran npm ls ws to confirm all ws instances are at 8.21.0.
• Ran npm audit to confirm no ws vulnerabilities remain.
• Ran npm install (npm 10.9.3, matching CI, without --legacy-peer-deps) to confirm clean peer dep resolution.
• Ran npm run bundle to confirm the production build compiles successfully.
• Verified all rspack config files load without errors via node -e "require('./rspack/rspack.config.*.js')".
• Verified key @rspack/core APIs (CssExtractRspackPlugin, DefinePlugin, HtmlRspackPlugin, IgnorePlugin) are present in v2.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
flagsmith-frontend-preview	Ready	Preview, Comment	May 29, 2026 2:58pm
flagsmith-frontend-staging	Ready	Preview, Comment	May 29, 2026 2:58pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Ignored	Preview	May 29, 2026 2:58pm

[gemini-code-assist]

Code Review

This pull request updates several frontend dependencies, upgrading Rspack-related packages (@rspack/cli, @rspack/core, @rspack/dev-server, and @rspack/plugin-react-refresh) to version ^2.0.0 and webpack-bundle-analyzer to version ^5.0.0. It also updates the local Rspack configuration to import ReactRefreshRspackPlugin as ReactRefreshPlugin to align with the upgraded plugin version. There are no review comments to address.

[github-actions]

Docker builds report

Image	Build Status	Security report
ghcr.io/flagsmith/flagsmith-api-test:pr-7634	Finished ✅	Skipped
ghcr.io/flagsmith/flagsmith-api:pr-7634	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith:pr-7634	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-frontend:pr-7634	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-private-cloud:pr-7634	Finished ✅	Results ✅
ghcr.io/flagsmith/flagsmith-e2e:pr-7634	Finished ✅	Skipped

[github-actions]

Playwright Test Results (oss - depot-ubuntu-latest-16)

 1 passed

Details

 1 test across 1 suite
 34.2 seconds
 3433220
 🔄 Run: #17108 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

 1 passed

Details

 1 test across 1 suite
 44.6 seconds
 3433220
 🔄 Run: #17108 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-16)

 3 passed

Details

 3 tests across 3 suites
 34.2 seconds
 3433220
 🔄 Run: #17108 (attempt 1)

Playwright Test Results (private-cloud - depot-ubuntu-latest-arm-16)

 2 passed

Details

 2 tests across 2 suites
 57.2 seconds
 3433220
 🔄 Run: #17108 (attempt 1)

[github-actions]

Visual Regression

19 screenshots compared. See report for details.
View full report

[matthewelwell]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates several frontend dependencies in package.json, including upgrading @rspack packages to version ^2.0.0, sass to ^1.80.0, sass-loader to ^17.0.0, and webpack-bundle-analyzer to ^5.0.0. It also updates frontend/rspack/rspack.config.local.js to import ReactRefreshRspackPlugin as ReactRefreshPlugin from @rspack/plugin-react-refresh to accommodate the major version upgrade. There are no review comments, and I have no additional feedback to provide.

[talissoncosta]

One thing still broke for me: npm run dev crashes on startup with

TypeError: app.get is not a function
    at setupRoutes (api/dev-routes.js:6:7)
    at setupMiddlewares (rspack/rspack.config.local.js:17:35)

@rspack/dev-server v2 hands setupMiddlewares a connect app by default rather than an Express one, so app.get(...) in api/dev-routes.js (shared with the prod api/index.js) blows up. Giving the dev server an explicit Express app fixes it:

devServer: {
  app: async () => express(),
  setupMiddlewares: (middlewares, devServer) => {
    require('../api/dev-routes')(devServer.app)
    return middlewares
  },
  ...
}

With that change: npm ci clean, npm run dev starts with 0 errors (/health and /config/project-overrides both 200, bundle compiles), and ENV=prod npm run bundle compiles + emits CSS fine. Happy to push the one-line fix to your branch if that's easier — just let me know.