Repository navigation
Breaking change in patch version breaks Module Federation cross-origin development (semver violation) #5679
Description
Setup:
Module Federation development pattern:
- Host app on localhost:8000
- Exposed app on localhost:8001
Error:
Error: [ Federation Runtime ]: Failed to load script resources. #RUNTIME-008
at http://localhost:8000/ trying to load http://localhost:8001/remoteEntry.js
Problem:
A breaking change was added in df073c5
(Cross-Origin-Resource-Policy: same-origin header) in a patch version.
This common, working development setup now silently fails unless Access-Control-Allow-Origin header is explicitly added.
- Before patch: worked without CORS configuration
- After patch: breaks silently
Activity
alexander-akait commentedon Jun 9, 2026
It is a security patch, otherwise you can have a problem, please fill the issue template and describe your problem
[-]Specify the change about adding CORS same-origin as breaking change, because it breakes the app when you were not passing the CORS header in the config[/-][+]Breaking change in patch version breaks Module Federation cross-origin development (semver violation)[/+]vitaliypogoretskyy-art commentedon Jun 9, 2026
webpack-dev-server is a dev dependency, so this security patch
only affects developers during local development, not production
apps or end users, right?
Silently breaking working setups in a patch version violates
semver expectations, regardless of the security reasoning.
alexander-akait commentedon Jun 9, 2026
This is a security patch, no matter is it a dev dependency or production, if you expose your application at your network you can be attacked, please provide your configuration and structure, you can use github to create a small reproducible test repo, I feel like you have wrong configurations