-
Added a
hotoption that enables hot module replacement, replacing the need forwebpack-hot-middleware. Passhot: trueto enable with defaults, orhot: { path, heartbeat, progress, statsOptions }to customize. The client runtime is served by the middleware itself. (by @bjohansebas in #2370) -
Take the diagnostics a hot payload carries from the
statsoption, so one setting governs what a build reports in the terminal and in the browser:stats: "errors-only"keeps warnings out of both, andstats: falsekeeps errors and warnings out of both, the client's error overlay included — reach for the client's?logging=or?overlay=to quiet the browser alone.hot.statsOptionsis deprecated and will be removed in the next major release; itshash,timingsandchildrenkeys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @alexander-akait in #2392)
-
Fixed a crash when calling
invalidate()in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) ownscompiler.watch(), the middleware now invalidates the host'swatchinginstead (each child compiler's one for aMultiCompileron webpack < 5.109). When nothing is watching it logs a warning and completes the callback, asclose()does, rather than leavinginvalidate(callback)waiting on a build that never runs. (by @bjohansebas in #2378) -
Reject with
403 Forbiddenthe requests whose resolved filename falls outsideoutputPath(GHSA-g84c-rxfj-3j2c). With apublicPathwithout a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @bjohansebas in #2404) -
Update the changelog generator to the
@changesets/get-github-info1.0 API. (by @alexander-akait in #2396) -
Update dependencies. (by @alexander-akait in #2394)
- Added a
hotoption that enables hot module replacement, replacing the need forwebpack-hot-middleware. Passhot: trueto enable with defaults, orhot: { path, heartbeat, progress, statsOptions }to customize. The client runtime ships with the package and is added as a webpack entry. (by @bjohansebas in #2322)
- Fixed a crash when calling
close()in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) ownscompiler.watch(), the middleware has nowatchingof its own to close, soclose()now just calls the callback instead of throwing. (by @bjohansebas in #2347)
- Reuse an already active
MultiCompilerwatching session instead of starting a duplicate one (requires webpack >= 5.109). (by @bjohansebas in #2371)
- Replace the
on-finisheddependency with Node.js built-instream.finished. (by @bjohansebas in #2346)
- Respect
req.urlwhen modified by middleware such asconnect-history-api-fallback. (by @bjohansebas in #2304)
- Fixed compatibility with rspack. (by @alexander-akait in #2295)
- Fixed compatibility with rspack. (by @alexander-akait in
0b40cfd)
-
The
getFilenameFromUrlfunction is now asynchronous, returning a Promise that resolves to the object with the foundfilename(orundefinedif the file was not found) or throws an error if the URL cannot be processed. Additionally, the object contains theextraproperty withstats(file system stats) andoutputFileSystem(output file system where file was found) properties. (by @alexander-akait in #2284) -
Minimum supported
Node.jsversion is20.9.0. (by @alexander-akait in #2284) -
Minimum supported
webpackversion is5.101.0. (by @alexander-akait in #2284)
-
Added support for plugin usage, useful when the middleware will be used as a webpack plugin (no stats output, no extra actions). (by @alexander-akait in #2284)
-
Added the
forwardErroroption to enable error forwarding to next middleware. (by @alexander-akait in #2284) -
Enable
cacheImmutableby default for immutable assets. (by @alexander-akait in #2284)
-
Improved initial loading module time. (by @alexander-akait in #2284)
-
Removed outdated code and improved performance by avoiding extra loops. (by @alexander-akait in #2284)
All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
7.4.5 (2025-09-24)
7.4.4 (2025-09-23)
7.4.3 (2025-09-05)
- do not call the next middleware for 304 responses (#2155) (c26a326)
- do not call the next middleware when request is finished or errored (#2156) (116c680)
7.4.2 (2024-08-21)
7.4.1 (2024-08-20)
7.4.0 (2024-08-15)
- added the cacheImmutable option to cache immutable assets (assets with a hash in file name like
image.e12ab567.jpg) (5ed629d) - allow to configure the
Cache-Controlheader (#1923) (f7529c3)
- support
devServer: false(b443f4d)
7.3.0 (2024-07-18)
7.2.1 (2024-04-02)
- avoid extra log
7.2.0 (2024-03-29)
- hapi support (b3f9126)
- koa support (#1792) (458c17c)
- support
ETagheader generation (#1797) (b759181) - support
Last-Modifiedheader generation (#1798) (18e5683)
7.1.1 (2024-03-21)
ContentLengthincorrectly set for empty files (#1785) (0f3e25e)- improve perf (#1777) (5b47c92)
- types: make types better (#1786) (e4d183e)
7.1.0 (2024-03-19)
- prefer to use
fs.createReadStreamoverfs.readFileSyncto read files (ab533de)
- cleaup stream and handle errors (#1769) (1258fdd)
- security: do not allow to read files above (#1771) (e10008c)
7.0.0 (2023-12-26)
- minimum supported Node.js version is 18.12.0 (#1694)
- updated memfs@4 (#1693)
6.1.1 (2023-05-16)
6.1.0 (2023-05-03)
6.0.2 (2023-03-19)
6.0.1 (2022-11-28)
6.0.0 (2022-11-20)
- minimum supported webpack version is 5.0.0
- minimum supported Nodejs version is 14.15.0
5.3.3 (2022-05-18)
5.3.2 (2022-05-17)
5.3.1 (2022-02-01)
5.3.0 (2021-12-16)
5.2.2 (2021-11-17)
- update
schema-utilspackage to4.0.0version
5.2.1 (2021-09-25)
- internal release, no visible changes and features
5.2.0 (2021-09-24)
5.1.0 (2021-09-09)
- don't read full file if
Rangeheader is present (e8b21f0) - output more information on errors (#1024) (7df9e44)
5.0.0 (2021-06-02)
4.3.0 (2021-05-19)
4.2.0 (2021-05-10)
4.1.0 (2021-01-15)
- added the
statsoption (376cdba)
4.0.4 (2021-01-13)
4.0.3 (2021-01-12)
- output
statstostdoutinsteadstderr, how doeswebpack-cli, if you need hidestatsfrom output please use{ stats: false }or{ stats: 'none' }(4de0f97) - colors are working for
stats(4de0f97) - schema description (#783) (f9ce2b2)
- skip
Content-type headeron unknown types (#809) (5c9eee5)
4.0.2 (2020-11-10)
4.0.1 (2020-11-09)
- compatibility with
connect(b83a1db)
4.0.0 (2020-10-28)
- export in CommonJS format
- compatibility with new webpack@5 API (#737) (f6054a0)
- handle the
autovalue of thepublicPathoption (9b4c5ec) - support webpack@5 (#702) (9ccc327)
4.0.0-rc.3 (2020-07-14)
- internal improvements
4.0.0-rc.2 (2020-06-30)
4.0.0-rc.1 (2020-02-20)
4.0.0-rc.0 (2020-02-19)
- respect
output.pathandoutput.publicPathoptions from the configuration - respect the
statsoption from the configuration - respect the
watchOptionsoption from the configuration - the
writeToDiskoption now correctly works in multi-compiler mode - the
outputFileSystemoption now correctly works in multi-compiler mode - respect
[hash]/[fullhash]inoutput.pathandoutput.publicPath - handle exceptions for filesystem operations
- the
Content-Typeheader doesn't havecharset=utf-8value for custom MIME types and MIME types which can be nonutf-8
- validate options
- migrate on the
webpacklogger - migrate on the
memfspackage - improve performance
- minimum supported Node.js version is
10.13.0 - the default value of the option
publicPathis taken from the value of theoutput.publicPathoption from the configuration (webpack.config.js) - the
statsoption was removed, the default value of thestatsoption is taken from the value of thestatsoption from the configuration (webpack.config.js) - the
watchOptionswas removed, the default value of thewatchOptionsoption is taken from the value of thewatchOptionsoption from the configuration (webpack.config.js) - the
Content-Typeheader doesn't havecharset=utf-8value for custom MIME types and MIME types which can be nonutf-8 - the
fsoption was renamed to theoutputFileSystemoption - the
lazyoption was removed without replacement - the
logger,logLevelandlogTimeoptions were removed without replacement. You can setup thelevelvalue using{ infrastructureLogging: { level: 'warn' } }, please read https://webpack.js.org/configuration/other-options/#infrastructurelogging. You can use theinfrastructurelog(infrastructureLoginwebpack@5) hook to customize logs. Thelogproperty in the middleware context was renamed tologger - the
mimeTypesoption first requires you to specify an extension and then a content-type -{ mimeTypes: { phtml: 'text/html' } } - the
forceoption from themimeTypesoption was removed without replacement - the
reporteroption was removed without replacement - the
getFilenameFromUrlmethod was removed from the API - the middleware
localsnow underres.locals.webpack- useres.locals.webpack.statsfor accessstatsandres.locals.webpack.outputFileSystemto accessoutputFileSystem
3.7.2 (2019-09-28)
3.7.1 (2019-09-03)
- directly used mkdirp instead of through Webpack (#436) (dff39a1)
- displayStats only logged (#427) (98deaf4)
- the
writeToFileoption has compatibility with webpack@5 (#459) (5c90e1e)