From aaff3a79ae8171b6c67cffdccb50fee3ac740887 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 21:38:55 +0000 Subject: [PATCH] chore(release): new release --- .changeset/feat-multi-compiler-plugin.md | 5 ----- .../fix-beforeunload-cancel-blocks-reload.md | 5 ----- .changeset/fix-client-and-server-defects.md | 5 ----- .../fix-overlay-dismissed-on-initial-load.md | 5 ----- .changeset/fix-proxied-websocket-origin.md | 5 ----- .changeset/perf-precompiled-options-schema.md | 5 ----- .changeset/reuse-dev-middleware-client.md | 5 ----- .changeset/tidy-host-headers.md | 5 ----- CHANGELOG.md | 22 +++++++++++++++++++ package.json | 2 +- 10 files changed, 23 insertions(+), 41 deletions(-) delete mode 100644 .changeset/feat-multi-compiler-plugin.md delete mode 100644 .changeset/fix-beforeunload-cancel-blocks-reload.md delete mode 100644 .changeset/fix-client-and-server-defects.md delete mode 100644 .changeset/fix-overlay-dismissed-on-initial-load.md delete mode 100644 .changeset/fix-proxied-websocket-origin.md delete mode 100644 .changeset/perf-precompiled-options-schema.md delete mode 100644 .changeset/reuse-dev-middleware-client.md delete mode 100644 .changeset/tidy-host-headers.md diff --git a/.changeset/feat-multi-compiler-plugin.md b/.changeset/feat-multi-compiler-plugin.md deleted file mode 100644 index 94905f464d..0000000000 --- a/.changeset/feat-multi-compiler-plugin.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": minor ---- - -Run as a plugin from the top-level `plugins` of a multi-configuration, serving every configuration from one server. diff --git a/.changeset/fix-beforeunload-cancel-blocks-reload.md b/.changeset/fix-beforeunload-cancel-blocks-reload.md deleted file mode 100644 index 23bab78542..0000000000 --- a/.changeset/fix-beforeunload-cancel-blocks-reload.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": patch ---- - -Keep hot and live reload working after a cancelled "Leave site?" dialog. diff --git a/.changeset/fix-client-and-server-defects.md b/.changeset/fix-client-and-server-defects.md deleted file mode 100644 index 04e996c606..0000000000 --- a/.changeset/fix-client-and-server-defects.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": minor ---- - -Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export `BaseServer`. diff --git a/.changeset/fix-overlay-dismissed-on-initial-load.md b/.changeset/fix-overlay-dismissed-on-initial-load.md deleted file mode 100644 index 721f809b5b..0000000000 --- a/.changeset/fix-overlay-dismissed-on-initial-load.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": patch ---- - -Keep the overlay for a runtime error thrown while the page is still loading. diff --git a/.changeset/fix-proxied-websocket-origin.md b/.changeset/fix-proxied-websocket-origin.md deleted file mode 100644 index ade201f3f0..0000000000 --- a/.changeset/fix-proxied-websocket-origin.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": patch ---- - -Validate the `Host` and `Origin` headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with `ws: true`. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. diff --git a/.changeset/perf-precompiled-options-schema.md b/.changeset/perf-precompiled-options-schema.md deleted file mode 100644 index dec27df3be..0000000000 --- a/.changeset/perf-precompiled-options-schema.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": patch ---- - -Validate options with a precompiled schema to cut ~115ms from startup. diff --git a/.changeset/reuse-dev-middleware-client.md b/.changeset/reuse-dev-middleware-client.md deleted file mode 100644 index ca742f4d27..0000000000 --- a/.changeset/reuse-dev-middleware-client.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": minor ---- - -The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, `allowedHosts` and the origin checks still apply here, and this server's `{ type }` messages are still sent next to the middleware's, so React Refresh keeps working. `client/index.js`, `client/socket.js` and `client/clients/WebSocketClient.js` still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. `client.webSocketTransport: "sse"` adds Server-Sent Events, a universal build now runs in Node without the client throwing, and `sendMessage()`, `getClientEntry()` and `getClientHotEntry()` still work, a subclass's overrides included, but are deprecated. diff --git a/.changeset/tidy-host-headers.md b/.changeset/tidy-host-headers.md deleted file mode 100644 index 0f3562e27e..0000000000 --- a/.changeset/tidy-host-headers.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": patch ---- - -Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when `allowedHosts` is `"all"`. Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. diff --git a/CHANGELOG.md b/CHANGELOG.md index 50332894d9..2fd2b9ede6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,27 @@ # Changelog +## 6.1.0 + +### Minor Changes + +- Run as a plugin from the top-level `plugins` of a multi-configuration, serving every configuration from one server. (by [@alexander-akait](https://github.com/alexander-akait) in [#5765](https://github.com/webpack/webpack-dev-server/pull/5765)) + +- Fix client progress modes, socket URL credentials, overlay and progress lifecycles, server startup error handling and local IP lookup; export `BaseServer`. (by [@alexander-akait](https://github.com/alexander-akait) in [#5739](https://github.com/webpack/webpack-dev-server/pull/5739)) + +- The browser client, the error overlay and both transports now come from webpack-dev-middleware, so this package has no client code of its own. Every option keeps its name and meaning, `allowedHosts` and the origin checks still apply here, and this server's `{ type }` messages are still sent next to the middleware's, so React Refresh keeps working. `client/index.js`, `client/socket.js` and `client/clients/WebSocketClient.js` still resolve while the client's internal files are gone, and the console wording, the overlay and the progress indicator are now the middleware's. `client.webSocketTransport: "sse"` adds Server-Sent Events, a universal build now runs in Node without the client throwing, and `sendMessage()`, `getClientEntry()` and `getClientHotEntry()` still work, a subclass's overrides included, but are deprecated. (by [@alexander-akait](https://github.com/alexander-akait) in [#5750](https://github.com/webpack/webpack-dev-server/pull/5750)) + +### Patch Changes + +- Keep hot and live reload working after a cancelled "Leave site?" dialog. (by [@alexander-akait](https://github.com/alexander-akait) in [#5744](https://github.com/webpack/webpack-dev-server/pull/5744)) + +- Keep the overlay for a runtime error thrown while the page is still loading. (by [@alexander-akait](https://github.com/alexander-akait) in [#5745](https://github.com/webpack/webpack-dev-server/pull/5745)) + +- Validate the `Host` and `Origin` headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with `ws: true`. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by [@UlisesGascon](https://github.com/UlisesGascon) in [`cb1534a`](https://github.com/webpack/webpack-dev-server/commit/cb1534a097f21cf611995d70d83eb4ead69d1b64)) + +- Validate options with a precompiled schema to cut ~115ms from startup. (by [@alexander-akait](https://github.com/alexander-akait) in [#5746](https://github.com/webpack/webpack-dev-server/pull/5746)) + +- Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when `allowedHosts` is `"all"`. Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by [@bjohansebas](https://github.com/bjohansebas) in [#5771](https://github.com/webpack/webpack-dev-server/pull/5771)) + ## 6.0.0 ### Major Changes diff --git a/package.json b/package.json index 1513bdfb1b..ab6a54e55d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "webpack-dev-server", - "version": "6.0.0", + "version": "6.1.0", "description": "Serves a webpack app. Updates the browser on changes.", "homepage": "https://github.com/webpack/webpack-dev-server#readme", "bugs": "https://github.com/webpack/webpack-dev-server/issues",