• Move loglevel from devDependencies to dependencies #1001

• Browser console messages now respect clientLogLevel (#921).
• Don't output startup info if quiet is set to true (#970).
• Only load Bonjour when needed (#958).
• Set HMR log level (#926).
• Do not show warnings @ overlay unless explicitly set (#881).
• Add cli option --disable-host-check (#980).

Bugfixes

Fix peer dependencies to support webpack 3 ( #946 ) ( Fixes #932 )

Security

Don't provide a SSL cert, but generate one on demand. Unique for each developer.

https://medium.com/@mikenorth/961572624c54 by Mike North

Bugfixes

• allow port 0 again
• add allowedHosts option
• better check for WebWorker
• add openPage option to open a specific page
• add --bonjour
• add lan option, which listen on lan ip by default

Bugfixes

• fix a bug preventing publicHost from working

Bugfixes:

• add disableHostCheck to schema

Security fix:

This version contains a security fix, which is also breaking change if you have an insecure configuration. We are releasing this breaking change as patch version to protect you from attacks. Sorry if this breaks your setup, but the fix is easy.

We added a check for the correct Host header to the webpack-dev-server. This allowed evil websites to access your assets.

The Host header of the request have to match the listening adress or the host provided in the public option. Make sure to provide correct values here.

The response will contain a note when using an incorrect Host header.

For usage behind a Proxy or similar setups we also added a disableHostCheck option to disable this check. Only use it when you know what you do. Not recommended.

This version also includes this security fix for webpack-dev-middleware: https://github.com/webpack/webpack-dev-middleware/releases/tag/v1.10.2

Note: This only affect the development server and middleware. webpack and built bundles are not affected.

Credits to Ed Morley from Mozilla for reporting the issue.

Bugfixes:

• Requests are not blocked when Host doesn't match listening host or public option.
• Requests to localhost or 127.0.0.1 are not blocked.

Features:

• Added disableHostCheck option to disable the host check

• Properly close CLI when SIGINT or SIGTERM is called. This should fix some Docker issues (#787).
• Fix for entry not working when it was a function (#802).
• Fix for exception when using webpack-dev-server in a webworker (#813).
• Fix refresh loop that could happen on Firefox (#841).
• contentBase as an array did not work when used via CLI (#832).
• Proxy options were mutated, so this could lead to problems when re-using them (#836).

• After fixing a warning/error, the overlay was not always cleared correctly (3cb79bd39489d12a2df9896ce204b8de15e636f4).

• contentBase: false in combination with the historyApiFallback option threw an error (#791).
• Separate logic of adding entry points to the webpack config; this allows alternative implementations like the webpack grunt plugin to use this instead of copying the code (#782).
• Update SockJS dependency to fix issue with FireFox constantly refreshing the page (#762).
• Show clear error message when --open fails to open the browser (#780).
• Allow overlay option to also show compiler warnings (off by default) (#790):

overlay: {
  errors: true,
  warnings: true
}

• Add new fancy error overlay in-browser, which shows up when there are compilation errors. Disabled by default, add overlay: true to enable (#764)!
• If you use --open and options.public, the browser will now open the same URL as you have defined in public (#749).
• options.port now allows strings to be passed in, previously only integers were accepted (#766).

First webpack-dev-server 2 release

Following the webpack 2 release. It's equal to the last RC.

If you're curious about the highlights, read this fancy Medium post.

• Allow latest webpack 2.2.0-rc.0 as peer dependency (#714).

• beta.11 prevented the page from reloading when there was an error or a warning. Now it will only prevent a reload when there are errors, since you can ignore warnings (#697).
• beta.11 introduced configuration validation. There was a small error that prevented clientLogLevel: "none" from working (#693).
• Fix startup information not using colors in some cases (8a4b0709c9479b87bc3238e3ae690fd5a6c26df6).

• Breaking change: all options passed to the server get validated now, just like the webpack options already are. In most cases this shouldn't break anything, but it is possible we missed some valid usages (#654).
• webpack 2.1.0-beta.26 or higher is required.
• If no port is specified, the CLI will now find the first available port that is not in use instead of crashing when port 8080 is in use (#685).
• When the webpack compiler threw an error or warning, the page would be reloaded. Now, it doesn't reload the page (#209).
• The startup information that denotes the URL, path etc. is more fancy now and uses colors (#681).
• Fix --version flag not working in CLI (#679).
• Fix --open flag opening the wrong URL when using lazy mode (7cb0490bcaedd5ac32e6e1834b9da7a9de777303).
• Compilation errors were duplicated in the DevTools (webpack/webpack#3008).
• Expose events to the page, so e.g. plugins can show a custom error modal in the browser (#481).

• Breaking change: only support Node.js 0.12 and higher.
• Update SSL certificate in https mode to fix issues with Windows (#648).
• Add option to listen on unix socket instead of a port with the --socket flag (#661).
• Add deprecation warnings for using contentBase with a URL or port, since the proxy option does about the same and is more powerful (61b46ba).
• Fix more issues with IPv6 (#676).

• Add support for watching files provided by the contentBase option. Enable with watchContentBase: true or --watch-content-base in the CLI (#649).
• Support IPv6 addresses as host option (#644).
• Fix historyApiFallback taking preference of contentBase files instead of the in-memory files; this caused issues with html-webpack-plugin (#640).
• Fix edge case where rapidly refreshing the page caused the server to crash (#637).

• Add full Web Worker support (#632).
• Fix historyApiFallback not working when specifying an index that is not index.html (#627, cb1b32f).
• Add support for new SSL parameters: pfx and pfxPassphrase. Use with --pfx and --pfx-passphrase in the CLI (#631).

• Add support for http/2 when using the https option. Falls back on http/1.1.

• Start with tests! There's still a lot more to test, but at least there are some tests now (#623).
• Add optional callback for the close API (1cf6549).
• Fix historyApiFallback to fallback correctly to contentBase (#617).
• When using the bypass feature in a proxy, it was not possible to use in-memory webpack assets (#613).
• Simplify code for delivering assets (#618).

• Add proxy config hot reloading - needs some additional configuration (#605).
• Fix --progress not working (#609).
• Fix [WDS] Hot Module Replacement enabled appearing even if the clientLogLevel was set to a non-info value (#607).
• Don't rely on a CDN for providing the SockJS script in iframe modus (#493).
• Explain what --inline does in help section for the CLI (#596).

• Fix contentBase option in webpack config being ignored when using the CLI (#597).
• Fix SockJS providing an old SocKJS-client file, causing compatibility error (#474).
• Fix websocket connection issues when using https with a relative script path (#592).
• Fix hostname resolving issues (#594).
• Improve reliability of --open parameter (#593).

• Breaking change: removed overriding output.path to "/" in the webpack config when using the CLI (#337). Note that output.path needs to be an absolute path!
• Breaking change: removed contentBase as a proxy feature (deprecated since 1.x).
• Limit websocket retries when the server can't be reached (#589).
• Improve detection for getting the server URL in the client (#496).
• Add clientLogLevel (--client-log-level for CLI) option. It controls the log messages shown in the browser. Available levels are error, warning, info or none (#579).
• Allow using no content base with the --no-content-base flag (previously it always defaulted to the working directory).
• Use stronger certs for the https modus, to prevent browsers from complaining about it (#572).

• Breaking change: Only compatible with webpack v2.
• Breaking change: --inline is enabled by default now.
• Add compatibility for web workers (#298).
• Convert to yargs to handle command line options.
• Allow a Promise instead of a config object in the CLI (#419).
• Add --hot-only flag, a shortcut that adds webpack/hot/only-dev-server in entry in the webpack config (#439).

Security fix:

This version contains a security fix, which is also breaking change if you have an insecure configuration. We are releasing this breaking change as patch version to protect you from attacks. Sorry if this breaks your setup, but the fix is easy.

We added a check for the correct Host header to the webpack-dev-server. This allowed evil websites to access your assets.

The Host header of the request have to match the listening adress or the host provided in the public option. Make sure to provide correct values here.

The response will contain a note when using an incorrect Host header.

For usage behind a Proxy or similar setups we also added a disableHostCheck option to disable this check. Only use it when you know what you do. Not recommended.

This version also includes this security fix for webpack-dev-middleware: https://github.com/webpack/webpack-dev-middleware/releases/tag/v1.10.2

Note: This only affect the development server and middleware. webpack and built bundles are not affected.

Credits to Ed Morley from Mozilla for reporting the issue.

Bugfixes:

• Requests are not blocked when Host doesn't match listening host or public option.
• Requests to localhost or 127.0.0.1 are not blocked.

Features:

• Added disableHostCheck option to disable the host check

Probably the last release in the v1.x range:

• Backport support for webpack config as a Promise.

• Backport a few fixes from v2:
  • Support for PFX files as SSL connection options (#630).
  • Fix edge case where quickly refreshing the browser could result in the server crashing (#637).
  • Webpack bundle assets were not loaded after using the proxy bypass feature (#614).

• Backport a few more fixes from v2:
  • Add clientLogLevel (--client-log-level for CLI) option. It controls the log messages shown in the browser. Available levels are error, warning, info or none (#579).
  • Limit websocket retries when the server can't be reached (#589).

• Backport a few fixes from v2 (#604):
  • Using https and manually including the client script resulted in a wrong url for the websocket.
  • Manually including the client script didn't work resulted in a wrong url for the websocket in some cases.
  • Compatibility with platforms that don't use a hostname (Electron / Ionic).

• Fix the bypass config option for proxies (#563).
• Reverted a change that prevented clicks from registering in the iframe.
• Fix using * as a proxy wildcard.
• Avoid accessing document when using inline modus (#577).

• Use http-proxy-middleware instead of http-proxy. This fixes compatibility with native web sockets (#359).
• Properly close the server, which fixes issues with the port not freeing up (#357).
• Add --stdin flag, to close the dev server on process exit (#352).
• Fix issues with incorrect socket urls (#338, #443, #447).
• Add --open flag to open a browser pointing to the server (#329).
• Add --public flag to override the url used for connecting to the web socket (#368).
• Allow array for options.contentBase, so multiple sources are allowed (#374).
• Add options.staticOptions to allow passing through Express static options (#385).
• Update self-signed certs (#436).
• Don't reload the app upon proxy errors (#478).
• Allow running dev-server behind https proxy (#470).
• Set headers on all requests to support e.g. CORS (#499).
• Fix --cacert flag not doing anything (#532).
• Allow using Express middleware (#537).