# webpack-dev-server changelog

> Development server with live reloading for webpack projects.

- Vendor: webpack
- Category: Developer Tools
- Official site: https://github.com/webpack/webpack-dev-server
- Tracked by: What's New (https://whatsnew.fyi/product/webpack-dev-server)
- Harvested from: GitHub (webpack/webpack-dev-server)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v6.0.0

- Date: 2026-07-03
- Version: v6.0.0
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v6.0.0

- **changed** — Bump Express to v5
- **changed** — Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0
- **removed** — Drop support for Node.js < 22.15.0
- **changed** — Convert the source to native ES modules with both ESM and CommonJS builds via the exports field
- **removed** — Remove CLI flags
- **removed** — Remove the internalIP and internalIPSync static methods from Server
- **removed** — Remove the bypass option from proxy configuration
- **removed** — Remove SockJS support from the webSocketServer option
- **removed** — Remove the spdy dependency
- **changed** — Update http-proxy-middleware to v4
- **changed** — Update webpack-dev-middleware to v8 and make server.middleware.getFilenameFromUrl() asynchronous
- **added** — Add plugin support to webpack-dev-server for integrating with the compiler lifecycle
- **changed** — Enable the compression middleware for HTTP/2 connections
- **removed** — Remove the colorette dependency in favor of native ANSI styling
- **changed** — Update chokidar to v5 and extend watchFiles.options.ignored to support glob string patterns via tinyglobby
- **changed** — Use compiler.platform to determine the target environment instead of inspecting the resolved target string
- **changed** — Use the WHATWG URL API instead of the deprecated url.parse
- **changed** — Bump production dependencies notably open to v11 and p-retry to v8
- **security** — Reject cross-site requests to the internal open-editor and invalidate endpoints requiring same-origin validation
- **fixed** — Treat loopback aliases as equivalent in isSameOrigin so the WebSocket client does not reject valid same-origin connections

###### Major Changes

- Bump Express to v5. See the [Express 5 migration guide](https://expressjs.com/en/guide/migrating-5.html) for the full list of breaking changes. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Bump the `webpack` peer dependency range from `^5.0.0` to `^5.101.0`. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Drop support for Node.js < 22.15.0. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Convert the source to native ES modules. The package keeps `"type": "module"` and now exposes both an ESM and a CommonJS build via the `exports` field: ESM consumers import the native `lib/`, while CommonJS consumers `require()` a transpiled `dist/` build, allowing the package to be consumed from both ESM and CommonJS without relying on `require(ESM)` for CommonJS consumers. (by @bjohansebas in #5674)


- Remove CLI flags. Use the `serve` command from `webpack-cli` together with a configuration file or the programmatic API instead. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Remove the `internalIP` and `internalIPSync` static methods from `Server`. Resolve the local IP yourself if you need it. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Remove the `bypass` option from proxy configuration. Use the `router` or `context` options provided by `http-proxy-middleware` instead. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Remove SockJS support. The `webSocketServer` option no longer accepts `"sockjs"`; use the default `"ws"` transport instead. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Remove the `spdy` dependency. Use the built-in `node:http2` module via the `server` option for HTTP/2 support. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Update `http-proxy-middleware` to v4. See the [http-proxy-middleware v3 release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v3.0.0) and [v4 release notes](https://github.com/chimurai/http-proxy-middleware/releases/tag/v4.0.0) for the full list of breaking changes. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Update `webpack-dev-middleware` to v8 and sync `originalUrl` for middleware compatibility. `server.middleware.getFilenameFromUrl()` is now asynchronous and resolves to `{ filename, extra: { stats, outputFileSystem } }`. See the [webpack-dev-middleware v8 release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.0.0) for details. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

###### Minor Changes

- Add plugin support. `webpack-dev-server` can now be used as a webpack plugin, integrating with the compiler lifecycle without explicitly passing a compiler, preventing multiple server starts on recompilation, ensuring clean shutdown, and supporting `MultiCompiler` setups with multiple independent plugin servers. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Enable the compression middleware for HTTP/2 connections. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/webpack/webpack-dev-server/pull/5674))

- Remove the `colorette` dependency in favor of native ANSI styling. (by [@bjohansebas](https://github.com/bjohansebas) in [#5674](https://github.com/we

_[Truncated at 4000 characters — full notes: https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0]_

### v5.2.6

- Date: 2026-07-02
- Version: v5.2.6
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.2.6

- **fixed** — Allow `undefined` as the `Server` constructor `options` argument, defaulting it to `{}`
- **security** — Protect the built-in state-changing routes (`/webpack-dev-server/invalidate` and `/webpack-dev-server/open-editor`) against cross-site request forgery by checking requests with `Sec-Fetch-Site` header or `Origin`/`Host` comparison
- **fixed** — Handle malformed `Host` and `Origin` header values gracefully when validating requests

###### Patch Changes

- fix: allow `undefined` as the `Server` constructor `options` argument again (by [@bjohansebas](https://github.com/bjohansebas) in [#5695](https://github.com/webpack/webpack-dev-server/pull/5695))

  Restores accepting `undefined` (defaulting it to `{}`) for the `options`
  argument, so passing a webpack config's optional `devServer` field type-checks and works as before.

- Protect the built-in state-changing routes (`/webpack-dev-server/invalidate` and `/webpack-dev-server/open-editor`) against cross-site request forgery. Requests are now checked with `Sec-Fetch-Site` (falling back to an `Origin`/`Host` comparison when it is absent), so a cross-site page can no longer trigger a rebuild or open a file in the editor. Same-origin requests, user-initiated navigations, and non-browser clients (e.g. curl) are unaffected. (by [@bjohansebas](https://github.com/bjohansebas) in [#5698](https://github.com/webpack/webpack-dev-server/pull/5698))

- Handle malformed `Host` and `Origin` header values gracefully when validating requests. (by [@bjohansebas](https://github.com/bjohansebas) in [#5699](https://github.com/webpack/webpack-dev-server/pull/5699))

### v5.2.5

- Date: 2026-06-12
- Version: v5.2.5
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.5
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.2.5

- **fixed** — Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server

###### Patch Changes

- Skip the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted by the dev server. (by [@bjohansebas](https://github.com/bjohansebas) in [#5680](https://github.com/webpack/webpack-dev-server/pull/5680))

### v5.2.4

- Date: 2026-05-11
- Version: v5.2.4
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.4
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.2.4

- **fixed** — set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

###### [5.2.4](https://github.com/webpack/webpack-dev-server/compare/v5.2.3...v5.2.4) (2026-05-11)

###### Bug Fixes

* set Cross-Origin-Resource-Policy header to prevent source code theft over HTTP

### v5.2.3

- Date: 2026-01-12
- Version: v5.2.3
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.3
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.2.3

- **fixed** — Add `cause` for `errorObject`
- **fixed** — Fix compatibility with event target and universal target and lazy compilation
- **fixed** — Add ESC key to dismiss overlay
- **fixed** — Fix progress indicator styles
- **changed** — Upgrade selfsigned to v5

###### [5.2.3](https://github.com/webpack/webpack-dev-server/compare/v5.2.2...v5.2.3) (2026-01-12)


###### Bug Fixes

* add `cause` for `errorObject` ([#5518](https://github.com/webpack/webpack-dev-server/issues/5518)) ([37b033d](https://github.com/webpack/webpack-dev-server/commit/37b033da2c48335178495a1987c469a26ef3de60))
* compatibility with event target and universal target and lazy compilation  ([574026c](https://github.com/webpack/webpack-dev-server/commit/574026c44b9c51f0bbd2f5a2836c54607289a071))
* **overlay:** add ESC key to dismiss overlay ([#5598](https://github.com/webpack/webpack-dev-server/issues/5598)) ([f91baa8](https://github.com/webpack/webpack-dev-server/commit/f91baa8831e061e2998849966b8002b40b83fb07))
* progress indicator styles ([#5557](https://github.com/webpack/webpack-dev-server/issues/5557)) ([41a53a1](https://github.com/webpack/webpack-dev-server/commit/41a53a1accdb0a90785d82cbe8a079794eeed3c8))
* upgrade selfsigned to v5

### v5.2.2

- Date: 2025-06-03
- Version: v5.2.2
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.2
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.2.2

- **fixed** — Fix "Overlay enabled" false positive
- **fixed** — Prevent crash when error is null for runtime errors
- **fixed** — Remove unnecessary header X_TEST
- **fixed** — Respect the allowedHosts option for cross-origin header check

###### [5.2.2](https://github.com/webpack/webpack-dev-server/compare/v5.2.1...v5.2.2) (2025-06-03)


###### Bug Fixes

* "Overlay enabled" false positive ([18e72ee](https://github.com/webpack/webpack-dev-server/commit/18e72ee3e57a6e7598a6c068c0ff7c7bb6a857f1))
* do not crush when error is null for runtime errors ([#5447](https://github.com/webpack/webpack-dev-server/issues/5447)) ([309991f](https://github.com/webpack/webpack-dev-server/commit/309991f947baa0354140b9930a9654ac792e20c4))
* remove unnecessary header `X_TEST` ([#5451](https://github.com/webpack/webpack-dev-server/issues/5451)) ([64a6124](https://github.com/webpack/webpack-dev-server/commit/64a6124bf1b4d158bb42a4341dd03121ae3759fa))
* respect the `allowedHosts` option for cross-origin header check ([#5510](https://github.com/webpack/webpack-dev-server/issues/5510)) ([03d1214](https://github.com/webpack/webpack-dev-server/commit/03d12141bf7be09dfb14e91e5c834ee63bd9a9a2))

### v5.2.1

- Date: 2025-03-26
- Version: v5.2.1
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.1
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.2.1

- **security** — Cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
- **security** — Requests with IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or if different from the Host header
- **fixed** — Prevent overlay for errors caught by React error boundaries
- **fixed** — Take the first network found instead of the last one to restore the same behavior as 5.0.4

##### [5.2.1](https://github.com/webpack/webpack-dev-server/compare/v5.2.0...v6.0.0) (2025-03-26)

###### Security

* cross-origin requests are not allowed unless allowed by `Access-Control-Allow-Origin` header
* requests with an IP addresses in the `Origin` header are not allowed to connect to WebSocket server unless configured by `allowedHosts` or it different from the `Host` header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

###### Bug Fixes

* prevent overlay for errors caught by React error boundaries ([#5431](https://github.com/webpack/webpack-dev-server/issues/5431)) ([8c1abc9](https://github.com/webpack/webpack-dev-server/commit/8c1abc903ab444d9ce99e567b9a6c603e1ec06be))
* take the first network found instead of the last one, this restores the same behavior as 5.0.4 ([#5411](https://github.com/webpack/webpack-dev-server/issues/5411)) ([ffd0b86](https://github.com/webpack/webpack-dev-server/commit/ffd0b86b790d372f90e17aea92cfd9def83fee96))

### v5.2.0

- Date: 2024-12-11
- Version: v5.2.0
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.0
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.2.0

- **added** — Add `getClientEntry` and `getClientHotEntry` methods to get client entries
- **fixed** — Speed up initial client bundling

##### [5.2.0](https://github.com/webpack/webpack-dev-server/compare/v5.1.0...v5.2.0) (2024-12-11)


###### Features

* added `getClientEntry` and `getClientHotEntry` methods to get clients entries ([dc642a8](https://github.com/webpack/webpack-dev-server/commit/dc642a832d45c23c5c7a08fbf29995e0db7e0d95))


###### Bug Fixes

* speed up initial client bundling ([145b5d0](https://github.com/webpack/webpack-dev-server/commit/145b5d01610a16468fc32719a20366682b0e8572))

### v5.1.0

- Date: 2024-09-03
- Version: v5.1.0
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v5.1.0
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v5.1.0

- **added** — Add visual progress indicators
- **added** — Add the `app` option to be `Function` (by default only with `connect` compatibility frameworks)
- **added** — Allow the `server` option to be `Function`
- **added** — Add HTTP2 support for `connect` and `connect` compatibility frameworks which support HTTP2
- **fixed** — Check the `platform` property to determinate the target
- **fixed** — Fix IPv6 output
- **fixed** — Replace `rimraf` with `rm`
- **fixed** — Replace default gateway
- **fixed** — Support `devServer: false`

##### [5.1.0](https://github.com/webpack/webpack-dev-server/compare/v5.0.4...v5.1.0) (2024-09-03)


###### Features

* add visual progress indicators ([a8f40b7](https://github.com/webpack/webpack-dev-server/commit/a8f40b74e6439a8281b9fe8868eb9db7e4c5de50))
* added the `app` option to be `Function` (by default only with `connect` compatibility frameworks) ([3096148](https://github.com/webpack/webpack-dev-server/commit/3096148746c906105c4424352f5b5ad1bff0fd4f))
* allow the `server` option to be `Function` ([#5275](https://github.com/webpack/webpack-dev-server/issues/5275)) ([02a1c6d](https://github.com/webpack/webpack-dev-server/commit/02a1c6d788f5fc47c11cc7d910fd1b5e17aed886))
* http2 support for `connect` and `connect` compatibility frameworks which support HTTP2 ([#5267](https://github.com/webpack/webpack-dev-server/issues/5267)) ([6509a3f](https://github.com/webpack/webpack-dev-server/commit/6509a3fd3eb5decb61f60a9f2db97d76f71ecb99))


###### Bug Fixes

* check the `platform` property to determinate the target ([#5269](https://github.com/webpack/webpack-dev-server/issues/5269)) ([c3b532c](https://github.com/webpack/webpack-dev-server/commit/c3b532c6360317319793dcda22c76fbfc05fbdcf))
* ipv6 output ([#5270](https://github.com/webpack/webpack-dev-server/issues/5270)) ([06005e7](https://github.com/webpack/webpack-dev-server/commit/06005e7cb99e4c412b968ed3fb786acfb8c2e037))
* replace `rimraf` with `rm` ([#5162](https://github.com/webpack/webpack-dev-server/issues/5162)) ([1a1561f](https://github.com/webpack/webpack-dev-server/commit/1a1561f09bdfa7a98434d7d9cd62e323b887dfbf))
* replace default gateway ([#5255](https://github.com/webpack/webpack-dev-server/issues/5255)) ([f5f0902](https://github.com/webpack/webpack-dev-server/commit/f5f09024ff4fe6625aa94bcd69439462d74013f0))
* support `devServer: false` ([#5272](https://github.com/webpack/webpack-dev-server/issues/5272)) ([8b341cb](https://github.com/webpack/webpack-dev-server/commit/8b341cb8c1dc01cef62c70959620cd0cbd87fee7))

### v4.15.2

- Date: 2024-03-20
- Version: v4.15.2
- Original notes: https://github.com/webpack/webpack-dev-server/releases/tag/v4.15.2
- Permalink: https://whatsnew.fyi/product/webpack-dev-server/releases/v4.15.2

- **security** — Bump webpack-dev-middleware

###### [4.15.2](https://github.com/webpack/webpack-dev-server/compare/v4.15.1...v4.15.2) (2024-03-20)


###### Bug Fixes

* **security:** bump webpack-dev-middleware ([4116209](https://github.com/webpack/webpack-dev-server/commit/411620997594d24cd1f788e8533a5c6fa2736143))