Bump webpack-dev-middleware from 8.0.3 to 8.3.0

[dependabot]

Bumps webpack-dev-middleware from 8.0.3 to 8.3.0.

Release notes

Sourced from webpack-dev-middleware's releases.

v8.3.0

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @​bjohansebas in #2370)

• Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @​alexander-akait in #2392)

Patch Changes

• Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @​bjohansebas in #2378)

• Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @​bjohansebas in #2404)

• Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @​alexander-akait in #2396)

• Update dependencies. (by @​alexander-akait in #2394)

v8.2.0

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @​bjohansebas in #2322)

v8.1.1

Patch Changes

• Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @​bjohansebas in #2347)

v8.1.0

Minor Changes

• Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @​bjohansebas in #2371)

v8.0.4

Patch Changes

• Replace the on-finished dependency with Node.js built-in stream.finished. (by @​bjohansebas in #2346)

Changelog

Sourced from webpack-dev-middleware's changelog.

8.3.0

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @​bjohansebas in #2370)

• Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @​alexander-akait in #2392)

Patch Changes

• Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @​bjohansebas in #2378)

• Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @​bjohansebas in #2404)

• Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @​alexander-akait in #2396)

• Update dependencies. (by @​alexander-akait in #2394)

8.2.0

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @​bjohansebas in #2322)

8.1.1

Patch Changes

• Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @​bjohansebas in #2347)

8.1.0

Minor Changes

• Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @​bjohansebas in #2371)

8.0.4

Patch Changes

• Replace the on-finished dependency with Node.js built-in stream.finished. (by @​bjohansebas in #2346)

Commits

• 1abbf08 chore(release): new release (#2393)
• ef479c9 feat: add missing changelog (#2404)
• 13344e7 Merge commit from fork
• e58a70b test(hot): reach 100% of the client, off the deprecated statsOptions (#2402)
• 17e689e chore(deps): bump the dependencies group across 1 directory with 2 updates (#...
• d816818 fix(plugin): resolve crash on invalidate() in plugin mode (#2378)
• 09a9095 chore(deps): bump changesets/action (#2384)
• 4c1dcfc test: rewrite to e2e (#2370)
• 9133f47 build: update changesets tooling (#2396)
• a337174 build: update dependencies (#2394)
• Additional commits viewable in compare view

[netlify]

✅ Deploy Preview for firefox-devtools-react-contextmenu ready!

Name	Link
🔨 Latest commit	73be4f7
🔍 Latest deploy log	https://app.netlify.com/projects/firefox-devtools-react-contextmenu/deploys/6abc1f4df5bfc30007577ac7
😎 Deploy Preview	https://deploy-preview-451--firefox-devtools-react-contextmenu.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.