[dependabot]

Bumps webpack-dev-middleware to 8.5.0 and updates ancestor dependency webpack-dev-server. These dependencies need to be updated together.

Updates webpack-dev-middleware from 5.3.3 to 8.5.0

Release notes

Sourced from webpack-dev-middleware's releases.

v8.5.0

Minor Changes

• hot.token also takes { value, required }. With required: false a token is minted (or value used) and handed to the injected client as usual, but the endpoint does not refuse a client without it, so a server with policy of its own can compare it in onConnect alongside, say, the origins it already allows. The instance's new hot.tokenRequired says which applies. (by @​alexander-akait in #2486)

v8.4.0

Minor Changes

• The client posts build events to the page the way webpack-dev-server's does (webpackOk, webpackErrors, webpackClose and the rest), logs Disconnected! when the connection drops and clears the build's problems from the overlay until it is back. progress accepts "circular" or "linear". Reloads skip a page that is already navigating away, use the nearest ancestor with a url of its own inside an about:blank iframe, and in apply: "reload" follow a sibling compilation's build too. (by @​alexander-akait in #2425)

• HotModuleReplacementPlugin now goes to every compilation the middleware serves, including server bundles that hot-reload through webpack/hot/poll. hot.client.transport also accepts a module exporting a client class of your own, and the new hot.ws option is passed to the ws server (compression, verifyClient, or a port or server of its own), with hot.cors and hot.token still checked. The connection the runtime holds is exported as webpack-dev-middleware/client/socket for tooling that listens alongside it. (by @​alexander-akait in #2472)

• Grouped etag, lastModified, cacheControl and cacheImmutable into cache.*, and mimeTypes and mimeTypeDefault into mime.*; the old names warn and keep working until the next major release, and the grouped name wins when both are set. Media types now resolve through mime-db directly, and mime.types belongs to its own middleware instead of being written into the table mime-types shares with the whole process. instance.context.options is a copy of the options passed, cache.control included. (by @​alexander-akait in #2455)

• hot.client.apply ("hmr", "hmr-only", "reload" or "nothing") says what a build does to the page, so a project without HMR still reloads on a change; a single page can choose its own mode with ?webpack-dev-middleware-apply=, and publishing { action: "reload" } reloads every page. hot.client.connect (false, or { retries, timeout }) controls connecting and reconnecting, with retries honoured on both transports. The hot, liveReload, reload, autoConnect, reconnect and timeout query parameters they replace are still read until the next major release, with a deprecation warning for this package's own three. (by @​alexander-akait in #2458)

• Added hot.client, which sets the browser runtime's options on the middleware under the same names the entry query takes, so a configuration no longer needs a hand-written query string. url accepts a url or its parts ({ port: 8080 }) and resolves the rest in the page, pageParamPrefix renames the per-page ?webpack-dev-middleware-apply= parameter, and logging accepts { level, name } so an embedding package can label the console with its own name. (by @​alexander-akait in #2436)

• Added hot.cors to choose which origins may reach the hot endpoint: Server-Sent Events still allow every origin until the next major release, while the new WebSocket transport allows only local origins and refuses others with 403 before the handshake. Added hot.token, a secret the injected client carries and the endpoint requires, for the case where a browser sends no Origin; it is off by default. (by @​alexander-akait in #2444)

• hot now adds the client and HotModuleReplacementPlugin to the compilation itself, so enabling it is all a webpack configuration needs. hot.inject says what is added: "all" (the default), "plugin" for a page with a client of its own, "client" for a configuration that applies the plugin itself, or "none". Web workers get a client too, nothing is injected into a non-browser target, and the HMR plugin is left out when hot.client.apply is reload or nothing. (by @​alexander-akait in #2430)

• The instance gains attach(server), handleUpgrade(req, socket, head), onConnect(fn) (now given the request as well as the client), publish(payload) and publishTo(client, payload), so a server can own the upgrade, decide who may listen and put payloads of its own on the stream, such as ProgressPlugin ticks. The client understands { action: "error", message }, logging the reason a server refused it and posting it to the page as webpackError. (by @​alexander-akait in #2431)

• hot.transport chooses how events reach the browser: Server-Sent Events (the default), "ws" for a WebSocket, or a transport of your own, which only needs onConnect, publish, publishTo and close. The client speaks both built-in wires, also exported as webpack-dev-middleware/client/sse and webpack-dev-middleware/client/ws, and behaves the same on either. (by @​alexander-akait in #2420)

• overlay.id names the overlay element, so a package embedding it can keep the id its users already query. The new webpack-dev-middleware/client/problem export formats one of webpack's errors or warnings with formatProblem, and showProblems accepts webpack's objects as well as strings. (by @​alexander-akait in #2438)

Patch Changes

• Bound the internal url and Range header caches, which grew for the life of the process and were never released, even by close(). (by @​alexander-akait in #2405)

• The client exports ship type declarations and are marked as the ES modules they are. The client logs through webpack's Logger without webpack/lib/logging/runtime.js, so universal and ["web", "node"] bundles no longer pull in a node builtin and a page enforcing Trusted Types needs no guard. A module that re-exports the client can hand it its options through __webpack_dev_middleware_client_query__, and ?autoConnect is read like every other boolean. (by @​alexander-akait in #2428)

• Deprecated hot.progress, which keeps working until the next major release: a server that applies ProgressPlugin itself ended up with two on one compiler. Remove it, apply the plugin yourself and hand its ticks to publish; the browser-side hot.client.progress is unaffected. (by @​alexander-akait in #2451)

• The client keeps doing what webpack-dev-server's did: (by @​alexander-akait in #2472)

  • A page url with a malformed escape no longer stops every update.
  • apply: "reload" reloads a reconnected page whose build is out of date.
  • A build's warnings are logged and posted along with its errors.
  • An entry written for that server's query (hostname, port, pathname, live-reload, hot=only) still connects, with no deprecation warning for that server's own spelling.
  • The published client is ES5 down to the logger.
  • The overlay sits at the highest z-index and closes on Esc.
  • The building indicator works without Shadow DOM and is announced as a progress bar.

• The overlay takes focus when it opens and gives it back when it closes, keeps an uncaught runtime error through a successful build, passes a rejected value to runtimeErrors filters as error.cause, and no longer shows an empty card or leaves the building indicator up after a multi-compiler build. File references in absolute, Windows and file:// stack frames are now clickable. The ANSI-to-HTML conversion is built in, dropping ansi-html-community and fixing its handling of combined, short and unbalanced sequences. (by @​alexander-akait in #2437)

• Validate options with a precompiled schema to cut ~155ms from startup. (by @​alexander-akait in #2413)

... (truncated)

Changelog

Sourced from webpack-dev-middleware's changelog.

8.5.0

Minor Changes

• hot.token also takes { value, required }. With required: false a token is minted (or value used) and handed to the injected client as usual, but the endpoint does not refuse a client without it, so a server with policy of its own can compare it in onConnect alongside, say, the origins it already allows. The instance's new hot.tokenRequired says which applies. (by @​alexander-akait in #2486)

8.4.0

Minor Changes

• The client posts build events to the page the way webpack-dev-server's does (webpackOk, webpackErrors, webpackClose and the rest), logs Disconnected! when the connection drops and clears the build's problems from the overlay until it is back. progress accepts "circular" or "linear". Reloads skip a page that is already navigating away, use the nearest ancestor with a url of its own inside an about:blank iframe, and in apply: "reload" follow a sibling compilation's build too. (by @​alexander-akait in #2425)

• HotModuleReplacementPlugin now goes to every compilation the middleware serves, including server bundles that hot-reload through webpack/hot/poll. hot.client.transport also accepts a module exporting a client class of your own, and the new hot.ws option is passed to the ws server (compression, verifyClient, or a port or server of its own), with hot.cors and hot.token still checked. The connection the runtime holds is exported as webpack-dev-middleware/client/socket for tooling that listens alongside it. (by @​alexander-akait in #2472)

• Grouped etag, lastModified, cacheControl and cacheImmutable into cache.*, and mimeTypes and mimeTypeDefault into mime.*; the old names warn and keep working until the next major release, and the grouped name wins when both are set. Media types now resolve through mime-db directly, and mime.types belongs to its own middleware instead of being written into the table mime-types shares with the whole process. instance.context.options is a copy of the options passed, cache.control included. (by @​alexander-akait in #2455)

• hot.client.apply ("hmr", "hmr-only", "reload" or "nothing") says what a build does to the page, so a project without HMR still reloads on a change; a single page can choose its own mode with ?webpack-dev-middleware-apply=, and publishing { action: "reload" } reloads every page. hot.client.connect (false, or { retries, timeout }) controls connecting and reconnecting, with retries honoured on both transports. The hot, liveReload, reload, autoConnect, reconnect and timeout query parameters they replace are still read until the next major release, with a deprecation warning for this package's own three. (by @​alexander-akait in #2458)

• Added hot.client, which sets the browser runtime's options on the middleware under the same names the entry query takes, so a configuration no longer needs a hand-written query string. url accepts a url or its parts ({ port: 8080 }) and resolves the rest in the page, pageParamPrefix renames the per-page ?webpack-dev-middleware-apply= parameter, and logging accepts { level, name } so an embedding package can label the console with its own name. (by @​alexander-akait in #2436)

• Added hot.cors to choose which origins may reach the hot endpoint: Server-Sent Events still allow every origin until the next major release, while the new WebSocket transport allows only local origins and refuses others with 403 before the handshake. Added hot.token, a secret the injected client carries and the endpoint requires, for the case where a browser sends no Origin; it is off by default. (by @​alexander-akait in #2444)

• hot now adds the client and HotModuleReplacementPlugin to the compilation itself, so enabling it is all a webpack configuration needs. hot.inject says what is added: "all" (the default), "plugin" for a page with a client of its own, "client" for a configuration that applies the plugin itself, or "none". Web workers get a client too, nothing is injected into a non-browser target, and the HMR plugin is left out when hot.client.apply is reload or nothing. (by @​alexander-akait in #2430)

• The instance gains attach(server), handleUpgrade(req, socket, head), onConnect(fn) (now given the request as well as the client), publish(payload) and publishTo(client, payload), so a server can own the upgrade, decide who may listen and put payloads of its own on the stream, such as ProgressPlugin ticks. The client understands { action: "error", message }, logging the reason a server refused it and posting it to the page as webpackError. (by @​alexander-akait in #2431)

• hot.transport chooses how events reach the browser: Server-Sent Events (the default), "ws" for a WebSocket, or a transport of your own, which only needs onConnect, publish, publishTo and close. The client speaks both built-in wires, also exported as webpack-dev-middleware/client/sse and webpack-dev-middleware/client/ws, and behaves the same on either. (by @​alexander-akait in #2420)

• overlay.id names the overlay element, so a package embedding it can keep the id its users already query. The new webpack-dev-middleware/client/problem export formats one of webpack's errors or warnings with formatProblem, and showProblems accepts webpack's objects as well as strings. (by @​alexander-akait in #2438)

Patch Changes

• Bound the internal url and Range header caches, which grew for the life of the process and were never released, even by close(). (by @​alexander-akait in #2405)

• The client exports ship type declarations and are marked as the ES modules they are. The client logs through webpack's Logger without webpack/lib/logging/runtime.js, so universal and ["web", "node"] bundles no longer pull in a node builtin and a page enforcing Trusted Types needs no guard. A module that re-exports the client can hand it its options through __webpack_dev_middleware_client_query__, and ?autoConnect is read like every other boolean. (by @​alexander-akait in #2428)

• Deprecated hot.progress, which keeps working until the next major release: a server that applies ProgressPlugin itself ended up with two on one compiler. Remove it, apply the plugin yourself and hand its ticks to publish; the browser-side hot.client.progress is unaffected. (by @​alexander-akait in #2451)

• The client keeps doing what webpack-dev-server's did: (by @​alexander-akait in #2472)

  • A page url with a malformed escape no longer stops every update.
  • apply: "reload" reloads a reconnected page whose build is out of date.
  • A build's warnings are logged and posted along with its errors.
  • An entry written for that server's query (hostname, port, pathname, live-reload, hot=only) still connects, with no deprecation warning for that server's own spelling.
  • The published client is ES5 down to the logger.
  • The overlay sits at the highest z-index and closes on Esc.
  • The building indicator works without Shadow DOM and is announced as a progress bar.

• The overlay takes focus when it opens and gives it back when it closes, keeps an uncaught runtime error through a successful build, passes a rejected value to runtimeErrors filters as error.cause, and no longer shows an empty card or leaves the building indicator up after a multi-compiler build. File references in absolute, Windows and file:// stack frames are now clickable. The ANSI-to-HTML conversion is built in, dropping ansi-html-community and fixing its handling of combined, short and unbalanced sequences. (by @​alexander-akait in #2437)

... (truncated)

Commits

• 0ffba03 chore(release): new release (#2487)
• 32f3902 feat: hand the hot token over without requiring it (#2486)
• d1ecd3d chore(release): new release (#2406)
• 34e1a27 chore: mark the query's path alias for removal in the next major release (#...
• f084ec9 refactor: one hot.inject enum for what is added to the compilation (#2484)
• f9ad683 chore(deps-dev): bump del-cli from 7.0.0 to 8.0.1 (#2483)
• a8d9184 chore(deps-dev): bump the dependencies group with 8 updates (#2482)
• ca773fb refactor: settle the hot option names before release (#2476)
• 77de822 chore(deps): bump the dependencies group with 5 updates (#2480)
• 8a7af5e feat(hot): take over the last of webpack-dev-server's compiler and socket wir...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-middleware since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates webpack-dev-server from 4.13.2 to 6.1.0

Release notes

Sourced from webpack-dev-server's releases.

v6.1.0

Minor Changes

• Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @​alexander-akait in #5765)

• Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export BaseServer. (by @​alexander-akait in #5739)

• The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, allowedHosts and the origin checks still apply here, and this server's { type } messages are still sent next to the middleware's, so React Refresh keeps working. client/index.js, client/socket.js and client/clients/WebSocketClient.js still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. client.webSocketTransport: "sse" adds Server-Sent Events, a universal build now runs in Node without the client throwing, and sendMessage(), getClientEntry() and getClientHotEntry() still work, a subclass's overrides included, but are deprecated. (by @​alexander-akait in #5750)

Patch Changes

• Keep hot and live reload working after a cancelled "Leave site?" dialog. (by @​alexander-akait in #5744)

• Keep the overlay for a runtime error thrown while the page is still loading. (by @​alexander-akait in #5745)

• Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @​UlisesGascon in cb1534a)

• Validate options with a precompiled schema to cut ~115ms from startup. (by @​alexander-akait in #5746)

• Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @​bjohansebas in #5771)

v6.0.0

Major Changes

• Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @​bjohansebas in #5674)

• Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0. (by @​bjohansebas in #5674)

• Drop support for Node.js < 22.15.0. (by @​bjohansebas in #5674)

• Convert the source to native ES modules. The package keeps "type": "module" and now exposes both an ESM and a CommonJS build via the exports field: ESM consumers import the native lib/, while CommonJS consumers require() a transpiled dist/ build, allowing the package to be consumed from both ESM and CommonJS without relying on require(ESM) for CommonJS consumers. (by @​bjohansebas in #5674)

• Remove CLI flags. Use the serve command from webpack-cli together with a configuration file or the programmatic API instead. (by @​bjohansebas in #5674)

• Remove the internalIP and internalIPSync static methods from Server. Resolve the local IP yourself if you need it. (by @​bjohansebas in #5674)

• Remove the bypass option from proxy configuration. Use the router or context options provided by http-proxy-middleware instead. (by @​bjohansebas in #5674)

• Remove SockJS support. The webSocketServer option no longer accepts "sockjs"; use the default "ws" transport instead. (by @​bjohansebas in #5674)

• Remove the spdy dependency. Use the built-in node:http2 module via the server option for HTTP/2 support. (by @​bjohansebas in #5674)

• Update http-proxy-middleware to v4. See the http-proxy-middleware v3 release notes and v4 release notes for the full list of breaking changes. (by @​bjohansebas in #5674)

• Update webpack-dev-middleware to v8 and sync originalUrl for middleware compatibility. server.middleware.getFilenameFromUrl() is now asynchronous and resolves to { filename, extra: { stats, outputFileSystem } }. See the webpack-dev-middleware v8 release notes for details. (by @​bjohansebas in #5674)

Minor Changes

• Add plugin support. webpack-dev-server can now be used as a webpack plugin, integrating with the compiler lifecycle without explicitly passing a compiler, preventing multiple server starts on recompilation, ensuring clean shutdown, and supporting MultiCompiler setups with multiple independent plugin servers. (by @​bjohansebas in #5674)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

6.1.0

Minor Changes

• Run as a plugin from the top-level plugins of a multi-configuration, serving every configuration from one server. (by @​alexander-akait in #5765)

• Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export BaseServer. (by @​alexander-akait in #5739)

• The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, allowedHosts and the origin checks still apply here, and this server's { type } messages are still sent next to the middleware's, so React Refresh keeps working. client/index.js, client/socket.js and client/clients/WebSocketClient.js still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. client.webSocketTransport: "sse" adds Server-Sent Events, a universal build now runs in Node without the client throwing, and sendMessage(), getClientEntry() and getClientHotEntry() still work, a subclass's overrides included, but are deprecated. (by @​alexander-akait in #5750)

Patch Changes

• Keep hot and live reload working after a cancelled "Leave site?" dialog. (by @​alexander-akait in #5744)

• Keep the overlay for a runtime error thrown while the page is still loading. (by @​alexander-akait in #5745)

• Validate the Host and Origin headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with ws: true. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by @​UlisesGascon in cb1534a)

• Validate options with a precompiled schema to cut ~115ms from startup. (by @​alexander-akait in #5746)

• Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when allowedHosts is "all". Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by @​bjohansebas in #5771)

6.0.0

Major Changes

• Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @​bjohansebas in #5674)

• Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0. (by @​bjohansebas in #5674)

• Drop support for Node.js < 22.15.0. (by @​bjohansebas in #5674)

• Convert the source to native ES modules. The package keeps "type": "module" and now exposes both an ESM and a CommonJS build via the exports field: ESM consumers import the native lib/, while CommonJS consumers require() a transpiled dist/ build — so the package works from both ESM and CommonJS, including environments where require(ESM) is not supported. (by @​bjohansebas in #5674)

• Remove CLI flags. Use the serve command from webpack-cli together with a configuration file or the programmatic API instead. (by @​bjohansebas in #5674)

• Remove the internalIP and internalIPSync static methods from Server. Resolve the local IP yourself if you need it. (by @​bjohansebas in #5674)

• Remove the bypass option from proxy configuration. Use the router or context options provided by http-proxy-middleware instead. (by @​bjohansebas in #5674)

• Remove SockJS support. The webSocketServer option no longer accepts "sockjs"; use the default "ws" transport instead. (by @​bjohansebas in #5674)

• Remove the spdy dependency. Use the built-in node:http2 module via the server option for HTTP/2 support. (by @​bjohansebas in #5674)

• Update http-proxy-middleware to v4. See the http-proxy-middleware v3 release notes and v4 release notes for the full list of breaking changes. (by @​bjohansebas in #5674)

• Update webpack-dev-middleware to v8 and sync originalUrl for middleware compatibility. server.middleware.getFilenameFromUrl() is now asynchronous and resolves to { filename, extra: { stats, outputFileSystem } }. See the webpack-dev-middleware v8 release notes for details. (by @​bjohansebas in #5674)

Minor Changes

... (truncated)

Commits

• 50f2c43 chore(release): new release (#5740)
• 807c441 fix: validate host headers and handle malformed editor URLs (#5771)
• b4eb797 feat: run as a plugin from the top-level plugins of a multi-configuration (#5...
• 9915359 fix: update generated websocket proxy types (#5767)
• cb1534a Merge commit from fork
• be1ca90 chore(deps): bump the dependencies group across 1 directory with 19 updates (...
• dc9a72c feat: run on webpack-dev-middleware's client, with compatibility kept here (#...
• d16ad96 chore(deps): bump the dependencies group with 3 updates (#5762)
• 69077c9 chore(deps-dev): bump hono (#5756)
• 6a11ab1 chore(deps): bump the dependencies group across 1 directory with 4 updates (#...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-server since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.