chore(deps): upgrade webpack-dev-server to v5, auth0-password-policies to 3.1.0, and fix dev setup - #2771

Changes

This PR consolidates three related dependency upgrades and fixes the local development setup that had been broken since PR #2622 . It supersedes #2769 (which will be closed).

1. webpack-dev-server v4 → v5 (package.json, webpack.config.js)

PR #2622 bumped webpack-dev-server from 4.15.2 to 5.2.1. This was a breaking change that went unnoticed because CI only runs tests, it never starts the dev server. Running npm start after that bump resulted in:

_ValidationError: Invalid options object. Dev Server has been initialized using
an options object that does not match the API schema.

• options has an unknown property 'https'._

Root cause: webpack-dev-server v5 removed the https shorthand option that existed in v4. The replacement is the server object API.

Fix in webpack.config.js:

// Before (v4 API — broken in v5)
https: getDevCerts() || true

// After (v5 API)

server: {
  type: 'https',
  options: getDevCerts() || {}
}

package.json: Version constraint updated from ^4.15.2 back to ^5.2.1 (resolves to 5.2.3, also covering PR #2767's bump).

2. Fix 403 Forbidden when loading bundle from Auth0 hosted pages (webpack.config.js)

After fixing the startup crash, a second issue surfaced when testing against a custom hosted login page on manage.auth0.com: the browser reported Auth0Lock is not defined.Inspecting the Network tab showed the bundle request returning 403 Forbidden.

Root cause: webpack-dev-server v5 introduced a security middleware (cross-origin-header-check) that blocks any request where both of these are true:

• sec-fetch-mode: no-cors — always set by <script> tags
• sec-fetch-site: cross-site — always set when an external origin (e.g. manage.auth0.com) loads a resource from localhost:3000

The combination of these two headers causes webpack-dev-server to return 403 before the bundle is served.

Fix:

allowedHosts: 'all'

This disables the cross-origin host check. It is safe for a local dev server — it has no effect on production builds and only applies when npm start is running. The original v4 server had no such restriction.

3. auth0-password-policies 1.0.2 → 3.1.0 and password-sheriff 1.1.1 → 2.0.0 (package.json, webpack.config.js)

[email protected] was published in November 2018. After 7 years of inactivity, versions 1.1.0 through 3.1.0 were released between August 2025 and February 2026.Dependabot opened PR #2705 targeting 1.1.1 (the first post-gap release), but that PR failed CI and was superseded by two further major versions before it could be merged. This PR
jumps directly to the current latest (3.1.0).

Why password-sheriff is also bumped:
[email protected] declares password-sheriff@^2.0.0 as a peer/dependency. Lock also uses password-sheriff directly in src/field/password.js and src/ui/input/password/password_strength.jsx via password-sheriff/lib/policy. The lib/policy.js API is identical between v1 and v2 , the only additions are two new built-in rule types (sequentialChars, maxLength) which Lock does not use. Bumping Lock's direct constraint to ^2.0.0 avoids having two copies of password-sheriff in the install tree.

Why webpack.config.js needed a new babel-loader rule:
[email protected] ships its source with ES2020 syntax (optional chaining ?.). The project runs es-check es2017 against the built bundle as a CI gate. The existing webpack babel rule has exclude: node_modules, so third-party packages are bundled as-is. For most packages this is fine since they ship pre-built ES5, but auth0-password-policies does not.

A dedicated babel-loader rule for auth0-password-policies is added before the main rule. There is one non-obvious subtlety: Babel 7's .babelrc is file-relative, it only applies to files within the same package root and is silently ignored when Babel processes files in a different package under node_modules. This means Babel would run but apply no transforms, leaving ?. in the output. The fix is to pass presets explicitly in the rule's options alongside configFile: false and babelrc: false, so Babel uses exactly those presets regardless of config file boundaries:

  {
    test: /\.js$/,
    include: path.join(__dirname, 'node_modules', 'auth0-password-policies'),
    loader: 'babel-loader',
    options: {
      presets: [['@babel/preset-env', { useBuiltIns: 'entry', corejs: '3.26.1' }]],
      configFile: false,
      babelrc: false
    }
  }

4. Fix webpack 5 compilation warning for CordovaAuth0Plugin (src/core/web_api/p2_api.js)

After the auth0-js bump in PR #2766 (9.30.1 → 9.32.0), webpack emitted two warnings on every build:

WARNING in ./src/core/web_api/p2_api.js
export 'default' (imported as 'CordovaAuth0Plugin') was not found in
'auth0-js/dist/cordova-auth0-plugin.min.js' (module has no exports)

Root cause: cordova-auth0-plugin.min.js uses a UMD format (module.exports = factory()). Webpack 5's static analysis cannot resolve a default export from a module.exports assignment inside a UMD IIFE, so it warns when the file is imported with ES module import default syntax.

Fix: Replace the ES module import with require(), which webpack handles correctly for CommonJS/UMD modules:

// Before
import CordovaAuth0Plugin from 'auth0-js/dist/cordova-auth0-plugin.min.js';

// After
const CordovaAuth0Plugin = require('auth0-js/dist/cordova-auth0-plugin.min.js');

Runtime behaviour is unchanged, the typeof CordovaAuth0Plugin === 'function' guard already in place handles the case where the plugin is unavailable.

References

• Supersedes chore(deps): upgrade auth0-password-policies to 3.1.0 #2769
• Supersedes chore(deps): Bump auth0-password-policies from 1.0.2 to 1.1.1 #2705
• Fixes dev setup broken by chore(deps-dev): Bump webpack-dev-server from 4.15.2 to 5.2.1 #2622
• Related to chore(deps-dev): Bump webpack-dev-server from 5.2.1 to 5.2.3 #2767 (webpack-dev-server 5.2.1 → 5.2.3, covered by ^5.2.1 range)
• Related to chore(deps): Bump auth0-js from 9.30.1 to 9.32.0 #2766 (auth0-js 9.30.1 → 9.32.0, source of the CordovaAuth0Plugin warning)

Testing

Tested with local development setup.

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed
• All relevant assets have been compiled