diff --git a/.cspell.json b/.cspell.json
index 77c778432f..1976882978 100644
--- a/.cspell.json
+++ b/.cspell.json
@@ -2,6 +2,7 @@
"version": "0.2",
"language": "en,en-gb",
"words": [
+ "apos",
"camelcase",
"tapable",
"sockjs",
@@ -64,7 +65,13 @@
"omnibox",
"swiftshader",
"hoge",
- "subsubcomain"
+ "subsubcomain",
+ "noselect",
+ "commitlint",
+ "eslintcache",
+ "hono",
+ "privkey",
+ "geomanist"
],
"ignorePaths": [
"CHANGELOG.md",
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8505d9a5fd..2db9dc995b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,3 +8,7 @@ updates:
timezone: Europe/Berlin
open-pull-requests-limit: 10
versioning-strategy: lockfile-only
+ groups:
+ dependencies:
+ patterns:
+ - "*"
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 24a35a06ad..8caf799d12 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -9,6 +9,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: "Checkout Repository"
- uses: actions/checkout@v3
+ uses: actions/checkout@v4
- name: "Dependency Review"
- uses: actions/dependency-review-action@v3
+ uses: actions/dependency-review-action@v4
diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 9642a61189..d6ef806925 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -69,7 +69,7 @@ jobs:
strategy:
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
- node-version: [18.x, 20.x, 21.x]
+ node-version: [18.x, 20.x, 22.x, 23.x]
shard: ["1/4", "2/4", "3/4", "4/4"]
webpack-version: [latest]
@@ -120,6 +120,6 @@ jobs:
if: matrix.node-version != '18.x'
- name: Submit coverage data to codecov
- uses: codecov/codecov-action@v3
+ uses: codecov/codecov-action@v5
with:
token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.gitignore b/.gitignore
index 389040450b..de3b694aec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,4 +20,5 @@ test/fixtures/static-config/public/assets/non-exist.txt
test/fixtures/watch-files-config/public/assets/non-exist.txt
test/fixtures/reload-config/main.css
test/fixtures/reload-config-2/main.css
+test/fixtures/worker-config-dev-server-false/public
!/test/fixtures/static-config/public/node_modules
diff --git a/.husky/commit-msg b/.husky/commit-msg
index fd2bf708ee..dbce4f4cf4 100755
--- a/.husky/commit-msg
+++ b/.husky/commit-msg
@@ -1 +1 @@
-npx --no-install commitlint --edit $1
+commitlint --edit $1
diff --git a/.husky/pre-commit b/.husky/pre-commit
index 2312dc587f..c27d8893a9 100755
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1 +1 @@
-npx lint-staged
+lint-staged
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b8c907652..1845e61878 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,51 @@
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
+## [5.2.1](https://github.com/webpack/webpack-dev-server/compare/v5.2.0...v6.0.0) (2025-03-26)
+
+### Security
+
+* cross-origin requests are not allowed unless allowed by `Access-Control-Allow-Origin` header
+* requests with an IP addresses in the `Origin` header are not allowed to connect to WebSocket server unless configured by `allowedHosts` or it different from the `Host` header
+
+The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.
+
+### Bug Fixes
+
+* prevent overlay for errors caught by React error boundaries ([#5431](https://github.com/webpack/webpack-dev-server/issues/5431)) ([8c1abc9](https://github.com/webpack/webpack-dev-server/commit/8c1abc903ab444d9ce99e567b9a6c603e1ec06be))
+* take the first network found instead of the last one, this restores the same behavior as 5.0.4 ([#5411](https://github.com/webpack/webpack-dev-server/issues/5411)) ([ffd0b86](https://github.com/webpack/webpack-dev-server/commit/ffd0b86b790d372f90e17aea92cfd9def83fee96))
+
+## [5.2.0](https://github.com/webpack/webpack-dev-server/compare/v5.1.0...v5.2.0) (2024-12-11)
+
+
+### Features
+
+* added `getClientEntry` and `getClientHotEntry` methods to get clients entries ([dc642a8](https://github.com/webpack/webpack-dev-server/commit/dc642a832d45c23c5c7a08fbf29995e0db7e0d95))
+
+
+### Bug Fixes
+
+* speed up initial client bundling ([145b5d0](https://github.com/webpack/webpack-dev-server/commit/145b5d01610a16468fc32719a20366682b0e8572))
+
+## [5.1.0](https://github.com/webpack/webpack-dev-server/compare/v5.0.4...v5.1.0) (2024-09-03)
+
+
+### Features
+
+* add visual progress indicators ([a8f40b7](https://github.com/webpack/webpack-dev-server/commit/a8f40b74e6439a8281b9fe8868eb9db7e4c5de50))
+* added the `app` option to be `Function` (by default only with `connect` compatibility frameworks) ([3096148](https://github.com/webpack/webpack-dev-server/commit/3096148746c906105c4424352f5b5ad1bff0fd4f))
+* allow the `server` option to be `Function` ([#5275](https://github.com/webpack/webpack-dev-server/issues/5275)) ([02a1c6d](https://github.com/webpack/webpack-dev-server/commit/02a1c6d788f5fc47c11cc7d910fd1b5e17aed886))
+* http2 support for `connect` and `connect` compatibility frameworks which support HTTP2 ([#5267](https://github.com/webpack/webpack-dev-server/issues/5267)) ([6509a3f](https://github.com/webpack/webpack-dev-server/commit/6509a3fd3eb5decb61f60a9f2db97d76f71ecb99))
+
+
+### Bug Fixes
+
+* check the `platform` property to determinate the target ([#5269](https://github.com/webpack/webpack-dev-server/issues/5269)) ([c3b532c](https://github.com/webpack/webpack-dev-server/commit/c3b532c6360317319793dcda22c76fbfc05fbdcf))
+* ipv6 output ([#5270](https://github.com/webpack/webpack-dev-server/issues/5270)) ([06005e7](https://github.com/webpack/webpack-dev-server/commit/06005e7cb99e4c412b968ed3fb786acfb8c2e037))
+* replace `rimraf` with `rm` ([#5162](https://github.com/webpack/webpack-dev-server/issues/5162)) ([1a1561f](https://github.com/webpack/webpack-dev-server/commit/1a1561f09bdfa7a98434d7d9cd62e323b887dfbf))
+* replace default gateway ([#5255](https://github.com/webpack/webpack-dev-server/issues/5255)) ([f5f0902](https://github.com/webpack/webpack-dev-server/commit/f5f09024ff4fe6625aa94bcd69439462d74013f0))
+* support `devServer: false` ([#5272](https://github.com/webpack/webpack-dev-server/issues/5272)) ([8b341cb](https://github.com/webpack/webpack-dev-server/commit/8b341cb8c1dc01cef62c70959620cd0cbd87fee7))
+
### [5.0.4](https://github.com/webpack/webpack-dev-server/compare/v5.0.3...v5.0.4) (2024-03-19)
diff --git a/README.md b/README.md
index 37221aaa30..e8ceea5f5f 100644
--- a/README.md
+++ b/README.md
@@ -190,7 +190,7 @@ CLI documentation: https://webpack.js.org/api/cli/.
Made with ♥ by the webpack team.
```
-> **Note**
+> [!NOTE]
>
> _Detailed documentation for above options is available on this [link](https://webpack.js.org/configuration/dev-server/)._
diff --git a/client-src/index.js b/client-src/index.js
index 4523ef845c..c9ea5d1233 100644
--- a/client-src/index.js
+++ b/client-src/index.js
@@ -1,14 +1,12 @@
/* global __resourceQuery, __webpack_hash__ */
///
import webpackHotLog from "webpack/hot/log.js";
-import stripAnsi from "./utils/stripAnsi.js";
-import parseURL from "./utils/parseURL.js";
+import hotEmitter from "webpack/hot/emitter.js";
import socket from "./socket.js";
import { formatProblem, createOverlay } from "./overlay.js";
-import { log, logEnabledFeatures, setLogLevel } from "./utils/log.js";
+import { log, setLogLevel } from "./utils/log.js";
import sendMessage from "./utils/sendMessage.js";
-import reloadApp from "./utils/reloadApp.js";
-import createSocketURL from "./utils/createSocketURL.js";
+import { isProgressSupported, defineProgressElement } from "./progress.js";
/**
* @typedef {Object} OverlayOptions
@@ -47,13 +45,11 @@ const decodeOverlayOptions = (overlayOptions) => {
);
// eslint-disable-next-line no-new-func
- const overlayFilterFunction = new Function(
+ overlayOptions[property] = new Function(
"message",
`var callback = ${overlayFilterFunctionString}
return callback(message)`,
);
-
- overlayOptions[property] = overlayFilterFunction;
}
});
}
@@ -68,13 +64,75 @@ const status = {
currentHash: __webpack_hash__,
};
-/** @type {Options} */
-const options = {
- hot: false,
- liveReload: false,
- progress: false,
- overlay: false,
+/**
+ * @returns {string}
+ */
+const getCurrentScriptSource = () => {
+ // `document.currentScript` is the most accurate way to find the current script,
+ // but is not supported in all browsers.
+ if (document.currentScript) {
+ return document.currentScript.getAttribute("src");
+ }
+
+ // Fallback to getting all scripts running in the document.
+ const scriptElements = document.scripts || [];
+ const scriptElementsWithSrc = Array.prototype.filter.call(
+ scriptElements,
+ (element) => element.getAttribute("src"),
+ );
+
+ if (scriptElementsWithSrc.length > 0) {
+ const currentScript =
+ scriptElementsWithSrc[scriptElementsWithSrc.length - 1];
+
+ return currentScript.getAttribute("src");
+ }
+
+ // Fail as there was no script to use.
+ throw new Error("[webpack-dev-server] Failed to get current script source.");
};
+
+/**
+ * @param {string} resourceQuery
+ * @returns {{ [key: string]: string | boolean }}
+ */
+const parseURL = (resourceQuery) => {
+ /** @type {{ [key: string]: string }} */
+ let result = {};
+
+ if (typeof resourceQuery === "string" && resourceQuery !== "") {
+ const searchParams = resourceQuery.slice(1).split("&");
+
+ for (let i = 0; i < searchParams.length; i++) {
+ const pair = searchParams[i].split("=");
+
+ result[pair[0]] = decodeURIComponent(pair[1]);
+ }
+ } else {
+ // Else, get the url from the
+