2018-09-10

Features

• middleware: expose the memory filesystem (response.locals.fs) (#337) (f9a138e)

2018-08-23

Bug Fixes

• package: 18 security vulnerabilities (#329) (5951de9)

Features

• middleware: add methods option (options.methods) (#319) (fe6bb86)

Bugfixes

• Excluded outputPath from URI escaping to fix #297. (#303)
• fix: fixes #290 - MultiCompiler exception with writeToDisk (#301)

Updates

• refactor: use chalk from webpack-log (#293)

Bugfixes

• fix(package): add chalk to peerDeps (#292)

Bugfixes

• On windows path spaces should resolve to %20 (#288)
• fixes #282. credit @cexoso. in certain edge situations res.locals is undefined (d26c67c)

Features

• Allow Writing Files to Disk (#287)

Updates

• Webpack 4 (#267)
• remove watchOffset option in favor of time-fix-plugin

Breaking Changes

• Introduces full support for webpack v4 and removes support for lesser versions.
• The watchOffset option has been removed and the README has been updated with alternative means of accomplishing the same result for this module and webpack v4.
• middleware.webpack now returns a Promise that should be handled with .then when needing to perform other actions, like adding additional middleware.

Updates

• Implemented webpack-log, removed dependencies related to the previous logging implementation.

Publish to correct package.json.

This major release introduces a comprehensive refactor of the codebase and move to leverage more ES6 as supported by Node 6+. It also introduced a number of breaking changes, as outlined below.

Node Version Support

webpack-dev-middleware version 2 and higher will only support Node 6.x and higher. Active LTS for Node 4.x ended October 31st, 2017 and entered maintenance on that date. Likewise, the version 1.x branch of webpack-dev-middleware will enter maintenance on that date.

Informative Changes

• logging is now handled by log-level and follows the same patterns as webpack-dev-server.

Breaking Changes

• watchDelay option was previous deprecated and has now been removed.
• reportTime option renamed to logTime
• noInfo option removed in favor of setting a logLevel higher than 'info'
• quiet option removed in favor of logLevel: 'silent'
• reporter signature changed to reporter(middlewareOptions, reporterOptions)

Bugfixes

• serve .wasm files as application/wasm (without charset) (#230)

Updates

• update mime package to avoid security vulnerability (#231)

Updates

• Test updates for Node 8 and Sinon

Features

• Added optional time output for logging

Bugfixes

• Stop serving index.html if options.index is falsy
• Use querystring.unescape to fallback to safer equivalent that does not throw on malformed URIs

Updates

• Webpack@3 Support
• Koa@2 Support

Features

• add mimeTypes option

Bugfixes

• Use options.log, warn and error for messages
• serverSideRendering example corrected
• added support for multi-compiler configuration

Security fix:

This version contains a security fix, which is also breaking change if you have an insecure configuration. We are releasing this breaking change as patch version to protect you from attacks. Sorry if this breaks your setup, but the fix is easy.

We removed setting Access-Control-Allow-Origin to * be default. This allowed evil websites to access your assets. Instead we ask you to set Access-Control-Allow-Origin manually to your host if required in your setup. Use the headers option to do so.

middleware(compiler, {
    headers: {
        "Access-Control-Allow-Origin": "your-host"
    }
})

Read more about CORS here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

Bugfixes:

• Remove Access-Control-Allow-Origin = * default

• Files with non-ascii names were not getting served (#171).

• You probably have seen the infamous message webpack: bundle is now (IN)VALID. a lot of times. This has now been changed to more clear messages, clearly indicating when compiling and when done compiling, it will tell you if it was successful or with errors (#164).

• Allow latest webpack 2.2.0-rc.0 as peer dependency (#160).
• Fix error handling for plugins (#157).
• Update memory-fs dependency to 0.4.1.
• Refactoring to make it easier to support other frameworks then Express in the future (#140).

• Enforce UTF-8 in requests. This fixes a lot of issues with special characters (#136).

The last few releases had a few bugs in them that shouldn't have reached stable. We're working hard on adding enough tests to prevent these kind of failures.

• Fix for output.path check with node < 0.12 (38ff513).
• Fix for output.path check on Windows with node < 5.0 (38ff513).
• Fix exception when using the deprecated watchDelay option (#131).

• Add a nice error message when output.path in the webpack config is relative.
• Expose stats when using the advanced API (#127).
• Make log & warn functions replaceable (#124).
• Fix protocol-relative urls with publicPath (#129).

• Fix exception thrown when using webpack array config (#125).

• Add tests for everything (#121)!
• Use valid license for npm (af6243b).
• Instantiate the in-memory filesystem only once, meaning it can be shared when using multiple middleware instances with one webpack config (#120).
• When sending requests with a Range header, the status code would not always be correct (cedc09f).
• Middleware would not work with a proxy (#80).
• Add index option (default: index.html) to customize the file used as index for a directory (#123).

• Add reporter option for custom logs (#91).
• Add serverSideRender option to help support server-side rendering (#118).
• Set statusCode to 200 for served files (#94).
• Fix waitUntilValid callback always being called immediately when using MultiCompiler (#100).
• Fix range support not working (#116).
• Only use middleware for GET requests (#96).