Update dependency webpack-dev-server to v6 #48
No reviewers
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
andylockran/TwoFacedCalendar!48
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/webpack-dev-server-6.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
4.7.4→6.1.0Release Notes
webpack/webpack-dev-server (webpack-dev-server)
v6.1.0Compare Source
Minor Changes
Run as a plugin from the top-level
pluginsof a multi-configuration, serving every configuration from one server. (by @alexander-akait in #5765)Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export
BaseServer. (by @alexander-akait in #5739)The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning,
allowedHostsand the origin checks still apply here, and this server's{ type }messages are still sent next to the middleware's, so React Refresh keeps working.client/index.js,client/socket.jsandclient/clients/WebSocketClient.jsstill resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's.client.webSocketTransport: "sse"adds Server-Sent Events, a universal build now runs in Node without the client throwing, andsendMessage(),getClientEntry()andgetClientHotEntry()still work, a subclass's overrides included, but are deprecated. (by @alexander-akait in #5750)Patch Changes
Keep hot and live reload working after a cancelled "Leave site?" dialog. (by @alexander-akait in #5744)
Keep the overlay for a runtime error thrown while the page is still loading. (by @alexander-akait in #5745)
Validate the
HostandOriginheaders and enforce same-origin checks on WebSocket upgrade requests handled by proxies withws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @UlisesGascon incb1534a)Validate options with a precompiled schema to cut ~115ms from startup. (by @alexander-akait in #5746)
Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when
allowedHostsis"all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @bjohansebas in #5771)v6.0.0Compare Source
Major Changes
Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @bjohansebas in #5674)
Bump the
webpackpeer dependency range from^5.0.0to^5.101.0. (by @bjohansebas in #5674)Drop support for Node.js < 22.15.0. (by @bjohansebas in #5674)
Convert the source to native ES modules. The package keeps
"type": "module"and now exposes both an ESM and a CommonJS build via theexportsfield: ESM consumersimportthe nativelib/, while CommonJS consumersrequire()a transpileddist/build — so the package works from both ESM and CommonJS, including environments whererequire(ESM)is not supported. (by @bjohansebas in #5674)Remove CLI flags. Use the
servecommand fromwebpack-clitogether with a configuration file or the programmatic API instead. (by @bjohansebas in #5674)Remove the
internalIPandinternalIPSyncstatic methods fromServer. Resolve the local IP yourself if you need it. (by @bjohansebas in #5674)Remove the
bypassoption from proxy configuration. Use therouterorcontextoptions provided byhttp-proxy-middlewareinstead. (by @bjohansebas in #5674)Remove SockJS support. The
webSocketServeroption no longer accepts"sockjs"; use the default"ws"transport instead. (by @bjohansebas in #5674)Remove the
spdydependency. Use the built-innode:http2module via theserveroption for HTTP/2 support. (by @bjohansebas in #5674)Update
http-proxy-middlewareto v4. See the http-proxy-middleware v3 release notes and v4 release notes for the full list of breaking changes. (by @bjohansebas in #5674)Update
webpack-dev-middlewareto v8 and syncoriginalUrlfor middleware compatibility.server.middleware.getFilenameFromUrl()is now asynchronous and resolves to{ filename, extra: { stats, outputFileSystem } }. See the webpack-dev-middleware v8 release notes for details. (by @bjohansebas in #5674)Minor Changes
Add plugin support.
webpack-dev-servercan now be used as a webpack plugin, integrating with the compiler lifecycle without explicitly passing a compiler, preventing multiple server starts on recompilation, ensuring clean shutdown, and supportingMultiCompilersetups with multiple independent plugin servers. (by @bjohansebas in #5674)Enable the compression middleware for HTTP/2 connections. (by @bjohansebas in #5674)
Remove the
colorettedependency in favor of native ANSI styling. (by @bjohansebas in #5674)Update
chokidarto v5 and extendwatchFiles.options.ignoredto support glob string patterns viatinyglobby. (by @bjohansebas in #5674)Use
compiler.platformto determine the target environment instead of inspecting the resolvedtargetstring. Universal targets ("universal"or["web", "node"], wherecompiler.platform.universalistruesince webpack5.108.0) are treated as web targets so the client runtime is injected. (by @bjohansebas in #5674)Use the WHATWG
URLAPI instead of the deprecatedurl.parse. (by @bjohansebas in #5674)Patch Changes
Bump production dependencies, notably
opento v11 andp-retryto v8. (by @bjohansebas in #5674)Reject cross-site requests to the internal
open-editorandinvalidateendpoints. They performed state-changing actions (opening a file in the editor, forcing a recompilation) on any GET request, so a page the developer visited could trigger them. They now require a same-origin request, validated viaSec-Fetch-Sitewith anOrigin/Hostfallback. (by @bjohansebas in #5691)Treat loopback aliases (
127.0.0.1,::1,localhost) as equivalent inisSameOriginso the WebSocket client does not reject valid same-origin connections. (by @bjohansebas in #5674)Migrate the test suite from Jest to
node:testand set up the jsdom environment. (by @bjohansebas in #5674)Update
webpack-clito v7.0.2. (by @bjohansebas in #5674)v5.2.7Compare Source
Patch Changes
Validate the
HostandOriginheaders and enforce same-origin checks on WebSocket upgrade requests handled by proxies withws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @github-actions in #5766)Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when
allowedHostsis"all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @bjohansebas in #5772)v5.2.6Compare Source
Patch Changes
fix: allow
undefinedas theServerconstructoroptionsargument again (by @bjohansebas in #5695)Restores accepting
undefined(defaulting it to{}) for theoptionsargument, so passing a webpack config's optional
devServerfield type-checks and works as before.Protect the built-in state-changing routes (
/webpack-dev-server/invalidateand/webpack-dev-server/open-editor) against cross-site request forgery. Requests are now checked withSec-Fetch-Site(falling back to anOrigin/Hostcomparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by @bjohansebas in #5698)Handle malformed
HostandOriginheader values gracefully when validating requests. (by @bjohansebas in #5699)v5.2.5Compare Source
Patch Changes
All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
5.2.4 (2026-05-11)
Bug Fixes
5.2.3 (2026-01-12)
Bug Fixes
causeforerrorObject(#5518) (37b033d)5.2.2 (2025-06-03)
Bug Fixes
X_TEST(#5451) (64a6124)allowedHostsoption for cross-origin header check (#5510) (03d1214)v5.2.4Compare Source
v5.2.3Compare Source
v5.2.2Compare Source
v5.2.1Compare Source
Security
Access-Control-Allow-OriginheaderOriginheader are not allowed to connect to WebSocket server unless configured byallowedHostsor it different from theHostheaderThe above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.
Bug Fixes
v5.2.0Compare Source
Features
getClientEntryandgetClientHotEntrymethods to get clients entries (dc642a8)Bug Fixes
v5.1.0Compare Source
Features
appoption to beFunction(by default only withconnectcompatibility frameworks) (3096148)serveroption to beFunction(#5275) (02a1c6d)connectandconnectcompatibility frameworks which support HTTP2 (#5267) (6509a3f)Bug Fixes
platformproperty to determinate the target (#5269) (c3b532c)rimrafwithrm(#5162) (1a1561f)devServer: false(#5272) (8b341cb)5.0.4 (2024-03-19)
Bug Fixes
5.0.3 (2024-03-12)
Bug Fixes
5.0.2 (2024-02-16)
Bug Fixes
5.0.1 (2024-02-13)
Bug Fixes
require-trusted-types-for(#5046) (e115436)v5.0.4Compare Source
Security
Access-Control-Allow-OriginheaderOriginheader are not allowed to connect to WebSocket server unless configured byallowedHostsor it different from theHostheaderThe above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.
Bug Fixes
v5.0.3Compare Source
Features
appoption to beFunction(by default only withconnectcompatibility frameworks) (3096148)serveroption to beFunction(#5275) (02a1c6d)connectandconnectcompatibility frameworks which support HTTP2 (#5267) (6509a3f)Bug Fixes
platformproperty to determinate the target (#5269) (c3b532c)rimrafwithrm(#5162) (1a1561f)devServer: false(#5272) (8b341cb)5.0.4 (2024-03-19)
Bug Fixes
5.0.3 (2024-03-12)
Bug Fixes
5.0.2 (2024-02-16)
Bug Fixes
5.0.1 (2024-02-13)
Bug Fixes
require-trusted-types-for(#5046) (e115436)v5.0.2Compare Source
Features
appoption to beFunction(by default only withconnectcompatibility frameworks) (3096148)serveroption to beFunction(#5275) (02a1c6d)connectandconnectcompatibility frameworks which support HTTP2 (#5267) (6509a3f)Bug Fixes
platformproperty to determinate the target (#5269) (c3b532c)rimrafwithrm(#5162) (1a1561f)devServer: false(#5272) (8b341cb)5.0.4 (2024-03-19)
Bug Fixes
5.0.3 (2024-03-12)
Bug Fixes
5.0.2 (2024-02-16)
Bug Fixes
5.0.1 (2024-02-13)
Bug Fixes
require-trusted-types-for(#5046) (e115436)v5.0.1Compare Source
Features
appoption to beFunction(by default only withconnectcompatibility frameworks) (3096148)serveroption to beFunction(#5275) (02a1c6d)connectandconnectcompatibility frameworks which support HTTP2 (#5267) (6509a3f)Bug Fixes
platformproperty to determinate the target (#5269) (c3b532c)rimrafwithrm(#5162) (1a1561f)devServer: false(#5272) (8b341cb)5.0.4 (2024-03-19)
Bug Fixes
5.0.3 (2024-03-12)
Bug Fixes
5.0.2 (2024-02-16)
Bug Fixes
5.0.1 (2024-02-13)
Bug Fixes
require-trusted-types-for(#5046) (e115436)v5.0.0Compare Source
Features
appoption to beFunction(by default only withconnectcompatibility frameworks) (3096148)serveroption to beFunction(#5275) (02a1c6d)connectandconnectcompatibility frameworks which support HTTP2 (#5267) (6509a3f)Bug Fixes
platformproperty to determinate the target (#5269) (c3b532c)rimrafwithrm(#5162) (1a1561f)devServer: false(#5272) (8b341cb)5.0.4 (2024-03-19)
Bug Fixes
5.0.3 (2024-03-12)
Bug Fixes
5.0.2 (2024-02-16)
Bug Fixes
5.0.1 (2024-02-13)
Bug Fixes
require-trusted-types-for(#5046) (e115436)v4.15.2Compare Source
4.15.2 (2024-03-20)
Bug Fixes
v4.15.1Compare Source
Migration Guide and Changes.
4.15.1 (2023-06-09)
Bug Fixes
::withlocalhostbefore openBrowser() (#4856) (874c44b)@types/ws(#4899) (34bcec2)v4.15.0Compare Source
Migration Guide and Changes.
4.15.1 (2023-06-09)
Bug Fixes
::withlocalhostbefore openBrowser() (#4856) (874c44b)@types/ws(#4899) (34bcec2)v4.14.0Compare Source
Features
4.13.3 (2023-04-15)
Bug Fixes
4.13.2 (2023-03-31)
Bug Fixes
4.13.1 (2023-03-18)
Bug Fixes
v4.13.3Compare Source
Features
4.13.3 (2023-04-15)
Bug Fixes
4.13.2 (2023-03-31)
Bug Fixes
4.13.1 (2023-03-18)
Bug Fixes
v4.13.2Compare Source
Features
4.13.3 (2023-04-15)
Bug Fixes
4.13.2 (2023-03-31)
Bug Fixes
4.13.1 (2023-03-18)
Bug Fixes
v4.13.1Compare Source
Features
4.13.3 (2023-04-15)
Bug Fixes
4.13.2 (2023-03-31)
Bug Fixes
4.13.1 (2023-03-18)
Bug Fixes
v4.13.0Compare Source
Features
4.13.3 (2023-04-15)
Bug Fixes
4.13.2 (2023-03-31)
Bug Fixes
4.13.1 (2023-03-18)
Bug Fixes
v4.12.0Compare Source
Features
sockjs_urloption (onlysockjs) using thewebSocketServer.options.sockjsUrloption (#4586) (69a2fba)Bug Fixes
experiments.buildHttp(#4585) (5b846cb)NODE_PATHenv variable (#4581) (b857e6f)4.11.1 (2022-09-19)
Bug Fixes
client.loggingoption for all logs (#4572) (375835c)v4.11.1Compare Source
Features
sockjs_urloption (onlysockjs) using thewebSocketServer.options.sockjsUrloption (#4586) (69a2fba)Bug Fixes
experiments.buildHttp(#4585) (5b846cb)NODE_PATHenv variable (#4581) (b857e6f)4.11.1 (2022-09-19)
Bug Fixes
client.loggingoption for all logs (#4572) (375835c)v4.11.0Compare Source
Features
sockjs_urloption (onlysockjs) using thewebSocketServer.options.sockjsUrloption (#4586) (69a2fba)Bug Fixes
experiments.buildHttp(#4585) (5b846cb)NODE_PATHenv variable (#4581) (b857e6f)4.11.1 (2022-09-19)
Bug Fixes
client.loggingoption for all logs (#4572) (375835c)v4.10.1Compare Source
Features
Bug Fixes
4.10.1 (2022-08-29)
Bug Fixes
v4.10.0Compare Source
Features
Bug Fixes
4.10.1 (2022-08-29)
Bug Fixes
v4.9.3Compare Source
Features
clientoptions via resource URL (#4274) (216e3cb)Bug Fixes
4.9.3 (2022-06-29)
Bug Fixes
4.9.2 (2022-06-06)
Bug Fixes
@types/serve-staticto dependencies (#4468) (af83deb)4.9.1 (2022-05-31)
Bug Fixes
v4.9.2Compare Source
Features
clientoptions via resource URL (#4274) (216e3cb)Bug Fixes
4.9.3 (2022-06-29)
Bug Fixes
4.9.2 (2022-06-06)
Bug Fixes
@types/serve-staticto dependencies (#4468) (af83deb)4.9.1 (2022-05-31)
Bug Fixes
v4.9.1Compare Source
Features
clientoptions via resource URL (#4274) (216e3cb)Bug Fixes
4.9.3 (2022-06-29)
Bug Fixes
4.9.2 (2022-06-06)
Bug Fixes
@types/serve-staticto dependencies (#4468) (af83deb)4.9.1 (2022-05-31)
Bug Fixes
v4.9.0Compare Source
Features
clientoptions via resource URL (#4274) (216e3cb)Bug Fixes
4.9.3 (2022-06-29)
Bug Fixes
4.9.2 (2022-06-06)
Bug Fixes
@types/serve-staticto dependencies (#4468) (af83deb)4.9.1 (2022-05-31)
Bug Fixes
v4.8.1Compare Source
Features
Bug Fixes
4.8.1 (2022-04-06)
Bug Fixes
v4.8.0Compare Source
Features
Bug Fixes
4.8.1 (2022-04-06)
Bug Fixes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.