npm / webpack-dev-middleware
webpack-dev-middleware
What changed in webpack-dev-middleware 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-28.
5 breaking3 security7 deprecations23 new APIs and options10 behavior and defaults1 tooling12 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initwebpack-dev-middleware 861 changes
Breaking changes 5
The conversion is built in and handles combined, short, and unbalanced sequences.
Chooses which origins may reach the hot endpoint; WebSocket transport allows only local origins and refuses others with 403 before the handshake.
Renames the per-page webpack-dev-middleware-apply query parameter.
Deprecated and slated for removal in the next major release; its hash, timings, and children keys are ignored.
Requests whose resolved filename falls outside outputPath are rejected with 403 Forbidden, preventing sibling paths from escaping the output root when publicPath has no trailing slash.
Security 3
Adds an optional secret carried by the injected client and required by the endpoint, including when a browser sends no Origin.
Checks the path remainder after stripping publicPath for .. before joining it to the output root, refusing traversal paths that leave and re-enter the root.
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
Deprecations 7
The replaced autoConnect query parameter is still read until the next major release.
The replaced hot query parameter is still read until the next major release.
Deprecated because applying ProgressPlugin on the server could add it twice to a compiler; apply the plugin yourself and publish its ticks instead.
The replaced liveReload query parameter is still read until the next major release.
The replaced reconnect query parameter is still read until the next major release.
The replaced reload query parameter is still read until the next major release.
The replaced timeout query parameter is still read until the next major release.
New APIs and options 23
hot.token accepts an object with value and required; setting required to false lets the endpoint accept clients without a token.
The instance exposes hot.tokenRequired to indicate which token requirement applies.
Lets a server attach to the middleware's hot connection handling.
Lets a server handle the WebSocket upgrade through the middleware instance.
Sets browser runtime options on the middleware using the same names as the entry query, removing the need for a hand-written query string.
Controls what a build does to the page with hmr, hmr-only, reload, or nothing; a project without HMR can still reload on changes.
Controls connecting and reconnecting with false or retries and timeout settings; retries apply to both transports.
Accepts a module exporting a custom client class.
Controls whether hot adds all, the plugin, the client, or neither to the compilation; browser workers receive a client, non-browser targets do not, and reload or nothing omits the HMR plugin.
Selects Server-Sent Events, WebSocket, or a custom transport implementing onConnect, publish, publishTo, and close.
Configures the ws server, including compression, verifyClient, and its own port or server; hot.cors and hot.token are still checked.
Accepts level and name settings so an embedding package can label the console with its own name.
Sets the overlay element ID so an embedding package can preserve an ID its users already query.
The browser client accepts circular or linear progress indicators.
Publishes custom payloads on the stream, such as ProgressPlugin ticks.
Publishes a custom payload to a selected client.
A page can select its own apply mode using the webpack-dev-middleware-apply query parameter.
Exports formatProblem for formatting webpack errors or warnings.
A module re-exporting the client can pass its options through this property.
Exports the connection held by the runtime for tooling that listens alongside it.
Exports the built-in Server-Sent Events client transport.
Exports the built-in WebSocket client transport.
Added the hot option to enable hot module replacement without webpack-hot-middleware; configure it with true or with path, heartbeat, progress, and statsOptions.
Behavior and default changes 10
Publishing a payload with action reload reloads every page.
The middleware applies the plugin to every compilation it serves, including server bundles using webpack/hot/poll.
The options exposed on the instance are a copy of the passed options, including cache.control.
Media types resolve through mime-db directly, and this middleware's MIME types no longer mutate the process-shared mime-types table.
The callback now receives the request as well as the client.
Accepts webpack error and warning objects as well as strings.
Accepts a URL or its parts and resolves the remaining parts in the page.
The client logs a server refusal reason and posts it to the page as webpackError.
The client posts build events to the page using webpack-dev-server's event names, logs disconnection, and clears overlay problems until the connection returns.
Hot payload diagnostics now follow stats, so the setting governs reports in both the terminal and browser, including the client's error overlay.
Tooling 1
File references in absolute, Windows, and file:// stack frames are clickable.
Fixes and other changes 12
Reload mode reloads a reconnected page whose build is out of date.
Works without Shadow DOM and is announced as a progress bar.
A page URL with a malformed escape no longer stops every update.
No longer displays an empty card or leaves the building indicator visible.
The overlay is placed at the highest z-index and closes on Escape.
Takes focus when opened and restores it when closed; uncaught runtime errors persist through a successful build.
Reloads skip pages already navigating away, resolve about:blank iframe pages through the nearest ancestor with its own URL, and follow sibling compilations in reload mode.
Rejected values are passed to runtimeErrors filters as error.cause.
Bounds internal URL and Range header caches so they no longer grow for the process lifetime or persist after close.
Client logging no longer pulls in a Node builtin for universal and web/node bundles, and pages enforcing Trusted Types no longer need a guard.
Build warnings are logged and posted along with build errors.
In plugin mode, invalidation now targets the host's watching; when nothing is watching, it logs a warning and completes the callback instead of waiting for a build that never runs.