Breaking change in patch version breaks Module Federation cross-origin development (semver violation)

Setup: Module Federation development pattern:

• Host app on localhost:8000
• Exposed app on localhost:8001

Error: Error: [ Federation Runtime ]: Failed to load script resources. #RUNTIME-008 at http://localhost:8000/ trying to load http://localhost:8001/remoteEntry.js

Problem: A breaking change was added in https://github.com/webpack/webpack-dev-server/commit/df073c5 (Cross-Origin-Resource-Policy: same-origin header) in a patch version.

This common, working development setup now silently fails unless Access-Control-Allow-Origin header is explicitly added.

• Before patch: worked without CORS configuration
• After patch: breaks silently