# What changed in webpack-dev-server

> 33 changes in webpack-dev-server 5 to 6 from its official release notes, upgrade guides and advisories: 13 breaking, 7 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/webpack-dev-server/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## webpack-dev-server 6

### Breaking changes

- CLI flags are removed; use the webpack-cli serve command with a configuration file or the programmatic API instead. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- Express is upgraded to v5, which includes breaking changes for developers using the server. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The dependency is updated to v4, including breaking changes for developers using its proxy configuration. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The static method is removed from Server; resolve the local IP yourself if needed. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The static method is removed from Server; resolve the local IP yourself if needed. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- Cross-site requests to the internal endpoint are rejected; requests must be same-origin, validated via Sec-Fetch-Site with an Origin/Host fallback. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- Node.js versions below 22.15.0 are no longer supported. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- Cross-site requests to the internal endpoint are rejected; requests must be same-origin, validated via Sec-Fetch-Site with an Origin/Host fallback. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The bypass option is removed from proxy configuration; use the http-proxy-middleware router or context options instead. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The method is now asynchronous and resolves to an object containing filename and extra stats and outputFileSystem fields. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The spdy dependency is removed; use the built-in node:http2 module via the server option for HTTP/2 support. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The required webpack peer dependency range changes from ^5.0.0 to ^5.101.0. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The option no longer accepts "sockjs"; use the default "ws" transport instead. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)

### New APIs and options

- The package exports native ESM from lib/ and a transpiled CommonJS build from dist/, allowing consumption from both module systems. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)

### Behavior and default changes

- The target environment is determined from compiler.platform rather than the resolved target string; universal targets are treated as web targets so the client runtime is injected. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The compression middleware is enabled for HTTP/2 connections. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)
- The ignored option now supports glob string patterns via tinyglobby. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)

### Tooling

- webpack-dev-server can be used as a webpack plugin, integrating with the compiler lifecycle and supporting MultiCompiler setups with independent plugin servers. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)

### Fixes and other changes

- Loopback aliases 127.0.0.1, ::1, and localhost are treated as equivalent so the WebSocket client does not reject valid same-origin connections. (6.0.0) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v6.0.0)

## webpack-dev-server 5

### Security

- The route checks Sec-Fetch-Site, falling back to an Origin/Host comparison when absent, to prevent cross-site pages from triggering a rebuild. (5.2.6) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6)
- The route checks Sec-Fetch-Site, falling back to an Origin/Host comparison when absent, to prevent cross-site pages from opening a file in the editor. (5.2.6) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6)
- webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints (5.2.6) — [security advisory](https://github.com/advisories/GHSA-F5VJ-F2HX-8M93)
- webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header (5.2.6) — [security advisory](https://github.com/advisories/GHSA-M28W-2PQF-7QGJ)
- webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies (5.2.5) — [security advisory](https://github.com/advisories/GHSA-MX8G-39Q3-5C79)
- Sets the Cross-Origin-Resource-Policy header to prevent source code theft over HTTP. (5.2.4) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.4)
- webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins (5.2.4) — [security advisory](https://github.com/advisories/GHSA-79CF-XCQC-C78W)

### New APIs and options

- Adds cause to errorObject, preserving the underlying error cause. (5.2.3) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.3)

### Tooling

- The overlay can now be dismissed with the ESC key. (5.2.3) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.3)

### Fixes and other changes

- Malformed Host and Origin header values are handled gracefully when validating requests. (5.2.6) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6)
- The Server constructor once again accepts undefined for options, defaulting it to {}, so an optional webpack config devServer field type-checks and works. (5.2.6) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6)
- The dev server skips the HMR WebSocket path when forwarding upgrade requests to user-defined proxies, so custom proxy WebSocket upgrades are no longer intercepted. (5.2.5) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.5)
- Fixes compatibility with event target and universal target when using lazy compilation. (5.2.3) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.3)
- Fixes the progress indicator styles. (5.2.3) — [release notes](https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.3)