unstale

npm / webpack-dev-server

webpack-dev-server

What changed in webpack-dev-server 5 to 6, from its official release notes, upgrade guides and advisories. Also covers @types/webpack-dev-server. Sources checked 2026-10-18.

13 breaking7 security2 new APIs and options3 behavior and defaults2 tooling6 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

webpack-dev-server 619 changes

Breaking changes 13

  • CLI flags are removed; use the webpack-cli serve command with a configuration file or the programmatic API instead.

    6.0.0release notes

  • Express is upgraded to v5, which includes breaking changes for developers using the server.

    6.0.0release notes

  • The dependency is updated to v4, including breaking changes for developers using its proxy configuration.

    6.0.0release notes

  • The static method is removed from Server; resolve the local IP yourself if needed.

    6.0.0release notes

  • The static method is removed from Server; resolve the local IP yourself if needed.

    6.0.0release notes

  • Cross-site requests to the internal endpoint are rejected; requests must be same-origin, validated via Sec-Fetch-Site with an Origin/Host fallback.

    6.0.0release notes

  • Node.js versions below 22.15.0 are no longer supported.

    6.0.0release notes

  • Cross-site requests to the internal endpoint are rejected; requests must be same-origin, validated via Sec-Fetch-Site with an Origin/Host fallback.

    6.0.0release notes

  • The bypass option is removed from proxy configuration; use the http-proxy-middleware router or context options instead.

    6.0.0release notes

  • The method is now asynchronous and resolves to an object containing filename and extra stats and outputFileSystem fields.

    6.0.0release notes

  • The spdy dependency is removed; use the built-in node:http2 module via the server option for HTTP/2 support.

    6.0.0release notes

  • The required webpack peer dependency range changes from ^5.0.0 to ^5.101.0.

    6.0.0release notes

  • The option no longer accepts "sockjs"; use the default "ws" transport instead.

    6.0.0release notes

New APIs and options 1

  • The package exports native ESM from lib/ and a transpiled CommonJS build from dist/, allowing consumption from both module systems.

    6.0.0release notes

Behavior and default changes 3

  • The target environment is determined from compiler.platform rather than the resolved target string; universal targets are treated as web targets so the client runtime is injected.

    6.0.0release notes

  • The compression middleware is enabled for HTTP/2 connections.

    6.0.0release notes

  • The ignored option now supports glob string patterns via tinyglobby.

    6.0.0release notes

Tooling 1

  • webpack-dev-server can be used as a webpack plugin, integrating with the compiler lifecycle and supporting MultiCompiler setups with independent plugin servers.

    6.0.0release notes

Fixes and other changes 1

  • Loopback aliases 127.0.0.1, ::1, and localhost are treated as equivalent so the WebSocket client does not reject valid same-origin connections.

    6.0.0release notes

webpack-dev-server 514 changes

Security 7

  • The route checks Sec-Fetch-Site, falling back to an Origin/Host comparison when absent, to prevent cross-site pages from triggering a rebuild.

    5.2.6release notes

  • The route checks Sec-Fetch-Site, falling back to an Origin/Host comparison when absent, to prevent cross-site pages from opening a file in the editor.

    5.2.6release notes

  • webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

    5.2.6security advisory

  • webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

    5.2.6security advisory

  • webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

    5.2.5security advisory

  • Sets the Cross-Origin-Resource-Policy header to prevent source code theft over HTTP.

    5.2.4release notes

  • webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

    5.2.4security advisory

New APIs and options 1

  • Adds cause to errorObject, preserving the underlying error cause.

    5.2.3release notes

Tooling 1

  • The overlay can now be dismissed with the ESC key.

    5.2.3release notes

Fixes and other changes 5

  • Malformed Host and Origin header values are handled gracefully when validating requests.

    5.2.6release notes

  • The Server constructor once again accepts undefined for options, defaulting it to {}, so an optional webpack config devServer field type-checks and works.

    5.2.6release notes

  • The dev server skips the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted.

    5.2.5release notes

  • Fixes compatibility with event target and universal target when using lazy compilation.

    5.2.3release notes

  • Fixes the progress indicator styles.

    5.2.3release notes