diff --git a/.changeset/hot-middleware-migration.md b/.changeset/hot-middleware-migration.md deleted file mode 100644 index 2ca630693..000000000 --- a/.changeset/hot-middleware-migration.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-middleware": minor ---- - -Added a `hot` option that enables hot module replacement, replacing the need for `webpack-hot-middleware`. Pass `hot: true` to enable with defaults, or `hot: { path, heartbeat, progress, statsOptions }` to customize. The client runtime is served by the middleware itself. diff --git a/.changeset/hot-stats-options-deprecation.md b/.changeset/hot-stats-options-deprecation.md deleted file mode 100644 index 21260e3fc..000000000 --- a/.changeset/hot-stats-options-deprecation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-middleware": minor ---- - -Take the diagnostics a hot payload carries from the `stats` option, so one setting governs what a build reports in the terminal and in the browser: `stats: "errors-only"` keeps warnings out of both, and `stats: false` keeps errors and warnings out of both, the client's error overlay included — reach for the client's `?logging=` or `?overlay=` to quiet the browser alone. `hot.statsOptions` is deprecated and will be removed in the next major release; its `hash`, `timings` and `children` keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. diff --git a/.changeset/plugin-mode-invalidate.md b/.changeset/plugin-mode-invalidate.md deleted file mode 100644 index e6d500272..000000000 --- a/.changeset/plugin-mode-invalidate.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-middleware": patch ---- - -Fixed a crash when calling `invalidate()` in plugin mode (`isPlugin = true`). Since the host (webpack-cli, webpack-dev-server, etc.) owns `compiler.watch()`, the middleware now invalidates the host's `watching` instead (each child compiler's one for a `MultiCompiler` on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as `close()` does, rather than leaving `invalidate(callback)` waiting on a build that never runs. diff --git a/.changeset/reject-paths-outside-output-directory.md b/.changeset/reject-paths-outside-output-directory.md deleted file mode 100644 index aab59ddc8..000000000 --- a/.changeset/reject-paths-outside-output-directory.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-middleware": patch ---- - -Reject with `403 Forbidden` the requests whose resolved filename falls outside `outputPath` ([GHSA-g84c-rxfj-3j2c](https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c)). With a `publicPath` without a trailing slash, a sibling path sharing its prefix (`/assets../secret`) escaped the output root once the prefix was stripped and joined. diff --git a/.changeset/update-changesets-tooling.md b/.changeset/update-changesets-tooling.md deleted file mode 100644 index 0a6705fc3..000000000 --- a/.changeset/update-changesets-tooling.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-middleware": patch ---- - -Update the changelog generator to the `@changesets/get-github-info` 1.0 API. diff --git a/.changeset/update-dependencies.md b/.changeset/update-dependencies.md deleted file mode 100644 index 7cab9fa0f..000000000 --- a/.changeset/update-dependencies.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-middleware": patch ---- - -Update dependencies. diff --git a/CHANGELOG.md b/CHANGELOG.md index dfb067efe..c2908a774 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,23 @@ # Changelog +## 8.3.0 + +### Minor Changes + +- Added a `hot` option that enables hot module replacement, replacing the need for `webpack-hot-middleware`. Pass `hot: true` to enable with defaults, or `hot: { path, heartbeat, progress, statsOptions }` to customize. The client runtime is served by the middleware itself. (by [@bjohansebas](https://github.com/bjohansebas) in [#2370](https://github.com/webpack/webpack-dev-middleware/pull/2370)) + +- Take the diagnostics a hot payload carries from the `stats` option, so one setting governs what a build reports in the terminal and in the browser: `stats: "errors-only"` keeps warnings out of both, and `stats: false` keeps errors and warnings out of both, the client's error overlay included — reach for the client's `?logging=` or `?overlay=` to quiet the browser alone. `hot.statsOptions` is deprecated and will be removed in the next major release; its `hash`, `timings` and `children` keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by [@alexander-akait](https://github.com/alexander-akait) in [#2392](https://github.com/webpack/webpack-dev-middleware/pull/2392)) + +### Patch Changes + +- Fixed a crash when calling `invalidate()` in plugin mode (`isPlugin = true`). Since the host (webpack-cli, webpack-dev-server, etc.) owns `compiler.watch()`, the middleware now invalidates the host's `watching` instead (each child compiler's one for a `MultiCompiler` on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as `close()` does, rather than leaving `invalidate(callback)` waiting on a build that never runs. (by [@bjohansebas](https://github.com/bjohansebas) in [#2378](https://github.com/webpack/webpack-dev-middleware/pull/2378)) + +- Reject with `403 Forbidden` the requests whose resolved filename falls outside `outputPath` ([GHSA-g84c-rxfj-3j2c](https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c)). With a `publicPath` without a trailing slash, a sibling path sharing its prefix (`/assets../secret`) escaped the output root once the prefix was stripped and joined. (by [@bjohansebas](https://github.com/bjohansebas) in [#2404](https://github.com/webpack/webpack-dev-middleware/pull/2404)) + +- Update the changelog generator to the `@changesets/get-github-info` 1.0 API. (by [@alexander-akait](https://github.com/alexander-akait) in [#2396](https://github.com/webpack/webpack-dev-middleware/pull/2396)) + +- Update dependencies. (by [@alexander-akait](https://github.com/alexander-akait) in [#2394](https://github.com/webpack/webpack-dev-middleware/pull/2394)) + ## 8.2.0 ### Minor Changes diff --git a/package.json b/package.json index eda3a72cf..ca4e7e3f8 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "webpack-dev-middleware", - "version": "8.2.0", + "version": "8.3.0", "description": "A development middleware for webpack", "keywords": [ "webpack",