chore: note the security defaults to change in the next major release

[alexander-akait]

Summary

Adds TODOs, as code comments only, for the security defaults to change in the next major release. They join the ones #5770 already left: allowedOrigins defaulting to [], allowedHosts/headers no longer granting origins, static.deny on by default, and the hot token for every client.

• host defaults to "localhost" (listen()). With no host, Node listens on every interface, so the server, its sources and the internal endpoints are reachable from the whole network by default. Reaching it from another machine should take host: "0.0.0.0", "local-ip" or an address.
• static.serveIndex defaults to false (static option defaults). A directory listing names every file in it, so turning it on should be explicit.
• /webpack-dev-server/invalidate and /webpack-dev-server/open-editor require the per-run token once it is handed to every client. Both act on the developer's machine, and Sec-Fetch-*/Origin are not sent over plain http to anything but localhost. The overlay's open-editor request then has to carry the token from webpack-dev-middleware's client.

What kind of change does this PR introduce?

chore (comments only; no behaviour changes)

Did you add tests for your changes?

No; nothing to test. Lint passes and the generated types are unchanged.

Does this PR introduce a breaking change?

No. It records breaking changes for the next major release.

If relevant, what needs to be documented once your changes are merged or what have you already documented?

Nothing now; the migration guide for the next major release should cover these.

Use of AI

Written with Claude Code, directed and reviewed by the author.

---

Generated by Claude Code

Summary by CodeRabbit

• Documentation
  • Added notes outlining planned changes for a future major release, including static directory listings, invalidate endpoint token validation, and default host binding.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2a03a3b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1f56934c-e622-4674-bd59-a6a73784236b

📥 Commits

Reviewing files that changed from the base of the PR and between f62b534 and 2a03a3b.

📒 Files selected for processing: 1

• lib/Server.js

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

The change adds TODO comments in lib/Server.js. The comments describe planned changes to default static directory listings, token validation for the invalidate and open-editor endpoints, and the default host binding.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 2a03a

No actionable merge-blocking risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: documenting planned security-default changes for the next major release. It is concise and specific.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.80%. Comparing base (f62b534) to head (2a03a3b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5775   +/-   ##
=======================================
  Coverage   95.79%   95.80%           
=======================================
  Files           6        6           
  Lines        5539     5551   +12     
=======================================
+ Hits         5306     5318   +12     
  Misses        233      233           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.