trust downgrade for `webpack-dev-middleware` v7

Have you used AI?

None

Bug Description

Hey

I don't know if this should be considered a bug, but since this package is widely used, I just wanted to report this little DX annoyance in case you'd want to fix it.

pnpm can detect package trust-level downgrades (staged publishing -> trusted publishing -> provenance -> publish) to prevent malicious takeovers.

https://pnpm.io/settings/dependency-resolution#trustpolicy

Unfortunately it's not based on semver but publication dates, and v8 has trusted publishing while v7 doesn't.

Due to the recent v7 npm publish after a v8 that uses trusted publishing, we now have a downgrade detected:

This means newly initialized Docusaurus sites using pnpm with trustPolicy: no-downgrade will get an error such as:

[ERR_PNPM_TRUST_DOWNGRADE] High-risk trust downgrade for "webpack-dev-middleware@7.4.6" (possible package takeover)

This error happened while installing the dependencies of @docusaurus/core@3.10.1
 at webpack-dev-server@5.2.6

It doesn't seem mandatory to fix the problem, but if you can publish a v7 with trusted publishing, that would fix the problem and prevent users from getting this pnpm error.

Link to Minimal Reproduction and step to reproduce

N/A

Expected Behavior

no trust downgrade

Actual Behavior

trust downgrade detected by pnpm

Environment

N/A

Is this a regression?

None

Last Working Version

No response

Additional Context

No response

The report concerns webpack-dev-middleware v7 publication metadata and pnpm's trustPolicy: no-downgrade behavior; no source file or test is identified. Start by reviewing the v7 publish configuration and trusted-publishing setup, then verify that a new v7 publication no longer triggers pnpm's trust-downgrade error.