[Cycode] Fix for vulnerable manifest file dependency - @rspack/cli updated to version 2.0.0-alpha.0

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
ui/app/package.json	1

📂 ui/app/package.json

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
@rspack/cli	1.4.11	2.0.0-alpha.0

Important

This pull request updates the major version for one or more packages. Make sure changes are tested before merging.

Warning

Lock file generation failed for one or more manifest files in this pull request. Please regenerate the lock file manually before merging.

---

Note

Medium Risk
Major bump to an alpha CLI while @rspack/core remains on 1.4.x can break rspack serve/build, and the failed lockfile generation increases merge risk until dependencies are reinstalled and CI is green.

Overview
Bumps the @rspack/cli devDependency in ui/app/package.json from ^1.4.11 to ^2.0.0-alpha.0 to address a reported vulnerable dependency (Cycode). @rspack/core and @rspack/plugin-react-refresh are unchanged, so the CLI major jump may not align with the rest of the Rspack stack until versions are reconciled.

The PR does not update the lockfile; install/build should be verified and the lockfile regenerated before merge.

^{Reviewed by Cursor Bugbot for commit b3829cf. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b3829cf. Configure here.}

[cursor]

Incompatible Rspack major versions

High Severity

Updating @rspack/cli to 2.0.0-alpha.0 while @rspack/core and @rspack/plugin-react-refresh remain on 1.x creates a version mismatch. Rspack packages require aligned major versions, so this breaks rspack build and rspack serve. The 2.0.0-alpha.0 version is also an unstable alpha.

 

^{Reviewed by Cursor Bugbot for commit b3829cf. Configure here.}