# What changed in webpack-dev-middleware

> 61 changes in webpack-dev-middleware 8 from its official release notes, upgrade guides and advisories: 5 breaking, 7 deprecations, 3 security, 23 new APIs and options. Each one cited. Sources checked 2026-10-28. HTML: https://unstale.sh/npm/webpack-dev-middleware/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## webpack-dev-middleware 8

### Breaking changes

- The conversion is built in and handles combined, short, and unbalanced sequences. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Chooses which origins may reach the hot endpoint; WebSocket transport allows only local origins and refuses others with 403 before the handshake. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Renames the per-page webpack-dev-middleware-apply query parameter. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Deprecated and slated for removal in the next major release; its hash, timings, and children keys are ignored. (8.3.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0)
- Requests whose resolved filename falls outside outputPath are rejected with 403 Forbidden, preventing sibling paths from escaping the output root when publicPath has no trailing slash. (8.3.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0)

### Security

- Adds an optional secret carried by the injected client and required by the endpoint, including when a browser sends no Origin. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Checks the path remainder after stripping publicPath for .. before joining it to the output root, refusing traversal paths that leave and re-enter the root. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath (7.4.6, 8.3.0) — [security advisory](https://github.com/advisories/GHSA-G84C-RXFJ-3J2C)

### Deprecations

- The replaced autoConnect query parameter is still read until the next major release. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The replaced hot query parameter is still read until the next major release. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Deprecated because applying ProgressPlugin on the server could add it twice to a compiler; apply the plugin yourself and publish its ticks instead. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The replaced liveReload query parameter is still read until the next major release. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The replaced reconnect query parameter is still read until the next major release. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The replaced reload query parameter is still read until the next major release. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The replaced timeout query parameter is still read until the next major release. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)

### New APIs and options

- hot.token accepts an object with value and required; setting required to false lets the endpoint accept clients without a token. (8.5.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.5.0)
- The instance exposes hot.tokenRequired to indicate which token requirement applies. (8.5.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.5.0)
- Lets a server attach to the middleware's hot connection handling. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Lets a server handle the WebSocket upgrade through the middleware instance. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Sets browser runtime options on the middleware using the same names as the entry query, removing the need for a hand-written query string. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Controls what a build does to the page with hmr, hmr-only, reload, or nothing; a project without HMR can still reload on changes. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Controls connecting and reconnecting with false or retries and timeout settings; retries apply to both transports. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Accepts a module exporting a custom client class. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Controls whether hot adds all, the plugin, the client, or neither to the compilation; browser workers receive a client, non-browser targets do not, and reload or nothing omits the HMR plugin. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Selects Server-Sent Events, WebSocket, or a custom transport implementing onConnect, publish, publishTo, and close. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Configures the ws server, including compression, verifyClient, and its own port or server; hot.cors and hot.token are still checked. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Accepts level and name settings so an embedding package can label the console with its own name. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Sets the overlay element ID so an embedding package can preserve an ID its users already query. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The browser client accepts circular or linear progress indicators. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Publishes custom payloads on the stream, such as ProgressPlugin ticks. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Publishes a custom payload to a selected client. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- A page can select its own apply mode using the webpack-dev-middleware-apply query parameter. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Exports formatProblem for formatting webpack errors or warnings. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- A module re-exporting the client can pass its options through this property. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Exports the connection held by the runtime for tooling that listens alongside it. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Exports the built-in Server-Sent Events client transport. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Exports the built-in WebSocket client transport. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Added the hot option to enable hot module replacement without webpack-hot-middleware; configure it with true or with path, heartbeat, progress, and statsOptions. (8.3.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0)

### Behavior and default changes

- Publishing a payload with action reload reloads every page. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The middleware applies the plugin to every compilation it serves, including server bundles using webpack/hot/poll. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The options exposed on the instance are a copy of the passed options, including cache.control. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Media types resolve through mime-db directly, and this middleware's MIME types no longer mutate the process-shared mime-types table. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The callback now receives the request as well as the client. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Accepts webpack error and warning objects as well as strings. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Accepts a URL or its parts and resolves the remaining parts in the page. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The client logs a server refusal reason and posts it to the page as webpackError. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The client posts build events to the page using webpack-dev-server's event names, logs disconnection, and clears overlay problems until the connection returns. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Hot payload diagnostics now follow stats, so the setting governs reports in both the terminal and browser, including the client's error overlay. (8.3.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0)

### Tooling

- File references in absolute, Windows, and file:// stack frames are clickable. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)

### Fixes and other changes

- Reload mode reloads a reconnected page whose build is out of date. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Works without Shadow DOM and is announced as a progress bar. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- A page URL with a malformed escape no longer stops every update. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- No longer displays an empty card or leaves the building indicator visible. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- The overlay is placed at the highest z-index and closes on Escape. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Takes focus when opened and restores it when closed; uncaught runtime errors persist through a successful build. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Reloads skip pages already navigating away, resolve about:blank iframe pages through the nearest ancestor with its own URL, and follow sibling compilations in reload mode. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Rejected values are passed to runtimeErrors filters as error.cause. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Bounds internal URL and Range header caches so they no longer grow for the process lifetime or persist after close. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Client logging no longer pulls in a Node builtin for universal and web/node bundles, and pages enforcing Trusted Types no longer need a guard. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- Build warnings are logged and posted along with build errors. (8.4.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.4.0)
- In plugin mode, invalidation now targets the host's watching; when nothing is watching, it logs a warning and completes the callback instead of waiting for a build that never runs. (8.3.0) — [release notes](https://github.com/webpack/webpack-dev-middleware/releases/tag/v8.3.0)