chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates

[dependabot]

Bumps the dev-dependencies group with 12 updates in the / directory:

Package	From	To
@eslint-react/eslint-plugin	5.10.4	5.17.1
conventional-changelog-conventionalcommits	10.2.0	10.2.1
eslint	10.6.0	10.7.0
prettier	3.9.4	3.9.5
semantic-release	25.0.5	25.0.7
typescript	6.0.3	7.0.2
typescript-eslint	8.62.1	8.64.0
webpack-cli	7.1.0	7.2.1
webpack-dev-server	5.2.6	6.0.0
@types/node	26.1.0	26.1.1
@docusaurus/core	3.10.1	3.10.2
@docusaurus/preset-classic	3.10.1	3.10.2

Updates @eslint-react/eslint-plugin from 5.10.4 to 5.17.1

Release notes

Sourced from @​eslint-react/eslint-plugin's releases.

v5.17.1 (2026-07-17)

What's Changed

🏗️ Internal

• react-jsx/no-key-after-spread: reworked the attribute scan to a pipeline style using dropWhile and not from @local/eff, Check.is from @eslint-react/ast, and the new isAttribute helper from @eslint-react/jsx. (#1912)
• @eslint-react/jsx: added isAttribute for matching JSX attributes by name.
• @local/eff: added dropWhile and takeWhile.
• Bumped tsdown to 0.22.8, tsl-dx to 0.13.3, import-integrity-lint to 1.1.4, fumadocs to 16.11.5, and fumadocs-mdx to 15.2.0.

Full Changelog: Rel1cx/eslint-react@v5.17.0...v5.17.1

Attestation

https://github.com/Rel1cx/eslint-react/attestations/35804801

v5.17.0 (2026-07-17)

What's Changed

🐞 Fixes

• react-jsx/no-leaked-dollar: the intentional-$ exemption (e.g. <div>${price}</div>) is no longer defeated by surrounding whitespace or empty siblings — a lone $ before a single expression is now allowed whenever all other siblings are non-substantive. (#1911)
• react-jsx/no-leaked-semicolon: consecutive leaked semicolons (e.g. ;;) at the start of a JSX text node are now detected. (#1911)

📝 Documentation

• react-x/no-unnecessary-use-prefix: reorganized the rule examples.

🏗️ Internal

• react-jsx: extracted the shared find-create-element-children-prop and remove-jsx-attribute rule helpers, removed dead Literal visitors from no-comment-textnodes and no-leaked-semicolon, simplified the no-key-after-spread attribute scan, and hoisted no-useless-fragment detection and fix helpers to module level. (#1911)
• @local/eff: synced the Function module with effect and added missing @category tags.
• Unified JSDoc comment style across packages.

Full Changelog: Rel1cx/eslint-react@v5.16.1...v5.17.0

Attestation

https://github.com/Rel1cx/eslint-react/attestations/35743201

v5.16.1 (2026-07-16)

What's Changed

🐞 Fixes

... (truncated)

Changelog

Sourced from @​eslint-react/eslint-plugin's changelog.

v5.17.1 (2026-07-17)

🏗️ Internal

• react-jsx/no-key-after-spread: reworked the attribute scan to a pipeline style using dropWhile and not from @local/eff, Check.is from @eslint-react/ast, and the new isAttribute helper from @eslint-react/jsx. (#1912)
• @eslint-react/jsx: added isAttribute for matching JSX attributes by name.
• @local/eff: added dropWhile and takeWhile.
• Bumped tsdown to 0.22.8, tsl-dx to 0.13.3, import-integrity-lint to 1.1.4, fumadocs to 16.11.5, and fumadocs-mdx to 15.2.0.

Full Changelog: Rel1cx/eslint-react@v5.17.0...v5.17.1

v5.17.0 (2026-07-17)

🐞 Fixes

• react-jsx/no-leaked-dollar: the intentional-$ exemption (e.g. <div>${price}</div>) is no longer defeated by surrounding whitespace or empty siblings — a lone $ before a single expression is now allowed whenever all other siblings are non-substantive. (#1911)
• react-jsx/no-leaked-semicolon: consecutive leaked semicolons (e.g. ;;) at the start of a JSX text node are now detected. (#1911)

📝 Documentation

• react-x/no-unnecessary-use-prefix: reorganized the rule examples.

🏗️ Internal

• react-jsx: extracted the shared find-create-element-children-prop and remove-jsx-attribute rule helpers, removed dead Literal visitors from no-comment-textnodes and no-leaked-semicolon, simplified the no-key-after-spread attribute scan, and hoisted no-useless-fragment detection and fix helpers to module level. (#1911)
• @local/eff: synced the Function module with effect and added missing @category tags.
• Unified JSDoc comment style across packages.

Full Changelog: Rel1cx/eslint-react@v5.16.1...v5.17.0

v5.16.1 (2026-07-16)

🐞 Fixes

• react-jsx/no-children-prop: React.createElement calls whose props argument is wrapped in a TypeScript type assertion (e.g. { children: "x" } as Props) are now reported; computed property keys written as template literals (e.g. { [children]: "x" }) are now recognized as the children prop; fixed a false positive where a computed identifier key in a createElement props object (e.g. { [propName]: "Children" }) was treated as the static children prop; the suggestion fix now escapes JSX-sensitive characters (<, >, {, }, &) when moving a string children prop value into element content. (#1910)
• react-jsx/no-children-prop-with-children: same createElement edge-case fixes as no-children-prop. (#1910)
• react-jsx/no-useless-fragment: allowExpressions: false now only flags fragments with a single expression child, matching the option's documented behavior, instead of flagging any fragment inside a JSX element; fragments with spread attributes (e.g. <Fragment {...props}>) are no longer auto-fixed; the auto-fixer now removes leading indentation when collapsing whitespace-only fragments. (#1910)
• react-jsx/no-leaked-dollar: $ character references (&[#36](https://github.com/Rel1cx/eslint-react/tree/HEAD/plugins/eslint-plugin/issues/36);, $) are no longer treated as leaked dollar signs; only a literal $ in the source is reported. (#1910)
• react-jsx/no-leaked-semicolon: leaked semicolons followed by spaces or tabs before a newline, including CRLF line endings, are now detected. (#1910)
• react-x/immutability: added useHistory to known navigation hooks, so navigation methods such as .push() are not treated as in-place mutations inside frozen callbacks.

🏗️ Internal

• @eslint-react/ast: added Extract.getStaticPropertyName for resolving static property names from object properties. (#1910)

Full Changelog: Rel1cx/eslint-react@v5.16.0...v5.16.1

v5.16.0 (2026-07-16)

✨ New

... (truncated)

Commits

• b421bfa release: 5.17.1
• 1364c9e chore(deps): bump tsdown to 0.22.8, tsl-dx to 0.13.3, import-integrity-lint t...
• 8107145 release: 5.17.0
• 3ebb026 release: 5.16.1
• dcf2d39 release: 5.16.0
• 631ea24 release: 5.15.0
• 479970c release: 5.14.10
• 8f1107b release: 5.14.9
• 8644320 chore(deps): bump dependencies
• 7f6d874 release: 5.14.8
• Additional commits viewable in compare view

Updates conventional-changelog-conventionalcommits from 10.2.0 to 10.2.1

Release notes

Sourced from conventional-changelog-conventionalcommits's releases.

conventional-changelog-conventionalcommits: v10.2.1

Bug Fixes

• point package homepages and docs to documentation website (04796e2)

Changelog

Sourced from conventional-changelog-conventionalcommits's changelog.

10.2.1 (2026-07-04)

Bug Fixes

• point package homepages and docs to documentation website (04796e2)

Commits

• b82a462 chore(release): monorepo release (#1500)
• 04796e2 fix: point package homepages and docs to documentation website
• See full diff in compare view

Updates eslint from 10.6.0 to 10.7.0

Release notes

Sourced from eslint's releases.

v10.7.0

Features

• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032) (sethamus)
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063) (fnx)
• 557fde8 feat: support computed Number.parseInt member access in radix rule (#21041) (Pixel)
• 0b4a73b feat: add suggestions to no-compare-neg-zero (#21034) (den$)
• 96cdd42 feat: report invalid signed numeric radix values in radix rule (#21030) (Pixel)

Bug Fixes

• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069) (Pixel)
• 0d7d70c fix: insert cause outside wrapping parens in preserve-caught-error (#21062) (Mahin Anowar)
• 75ec753 fix: handle static template literals in eqeqeq rule (#21058) (Pixel)
• b717a22 fix: prevent eqeqeq null option from reporting non-equality operators (#21057) (Pixel)
• e35b05f fix: avoid no-invalid-regexp false positive for shadowed RegExp (#21051) (Pixel)
• a3172b6 fix: avoid no-control-regex false positive for shadowed RegExp (#21050) (Pixel)
• d1f637e fix: parenthesize sequence expression operands in no-implicit-coercion (#21045) (spokodev)
• 8859baf fix: avoid prefer-numeric-literals false positive for shadowed globals (#21047) (한국)
• a9e5961 fix: use-isnan false positive on shadowed NaN/Number (#20958) (sethamus)
• 8a240a7 fix: avoid false positives in radix rule for spread arguments (#21044) (Pixel)

Documentation

• c30d808 docs: Update README (GitHub Actions Bot)
• 5139800 docs: document ESLint migration codemods in v9 and v10 guides (#20980) (Alex Bit)
• 04174cb docs: Update README (GitHub Actions Bot)
• 026e130 docs: update semver policy for bug fixes (#21048) (Milos Djermanovic)
• 9d42fef docs: Update README (GitHub Actions Bot)
• b230159 docs: Update README (GitHub Actions Bot)
• 0129972 docs: correct **/.js glob to **/*.js in config files guide (#21036) (EduardF1)

Chores

• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076) (renovate[bot])
• 81a4774 chore: updates for v9.39.5 release (Jenkins)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071) (Francesco Trotta)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067) (lumir)
• 833ec10 chore: update dependency prettier to v3.9.4 (#21061) (renovate[bot])
• 7ea106d chore: update ecosystem plugins (#21059) (ESLint Bot)
• 8fb550e chore: add prettier update commit to .git-blame-ignore-revs (#21056) (lumir)
• e4e1166 chore: update dependency prettier to v3.9.1 (#21055) (renovate[bot])
• 0493f53 chore: update prettier to v3.9.0 (#21054) (Pixel)
• 1056a99 chore: update dependency prettier to v3.8.5 (#21049) (renovate[bot])
• 4d4155d ci: run ecosystem tests on pull requests (#21027) (sethamus)
• 993539f chore: update dependency @​eslint/json to ^2.0.1 (#21042) (renovate[bot])
• 53f8b69 test: add error locations to no-constant-binary-expression (#21039) (lumir)
• 5ab71d5 refactor: clean up radix rule internals (#21015) (Pixel)
• a80a9a4 chore: update ecosystem plugins (#21035) (ESLint Bot)
• 7c9a029 ci: add Node.js 26 to CI (#20847) (lumir)

Commits

• fabd99b 10.7.0
• 37c5e75 Build: changelog update for 10.7.0
• 9489379 chore: update dependency @​eslint/eslintrc to ^3.3.6 (#21076)
• 81a4774 chore: updates for v9.39.5 release
• 3e7bf15 fix: apply ignoreClassesWithImplements to class expressions (#21069)
• 9835414 chore: enable $ExpectType annotations in all TypeScript files (#21071)
• cf2a9bf feat: add errorClassNames option to preserve-caught-error rule (#21032)
• c30d808 docs: Update README
• f8b873a feat: max-nested-callbacks option for constructor callbacks (#21063)
• 72adf6b chore: restrict markdownlint-cli2 updates in renovate (#21067)
• Additional commits viewable in compare view

Updates prettier from 3.9.4 to 3.9.5

Release notes

Sourced from prettier's releases.

3.9.5

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.5

diff

Markdown: Cap ordered list mark at 999,999,999 (#19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text
1234567890123456789012) text
<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text
1234567890123456789012) text
<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text
1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](https://github.com/prettier/prettier/blob/main/<> "title")
<!-- Prettier 3.9.4 -->
[link](https://github.com/prettier/prettier/blob/main/ "title")
<!-- Prettier 3.9.5 -->
</tr></table>

... (truncated)

Commits

• b6c7d18 Release 3.9.5
• cd54ccc Avoid corrupting empty Markdown link with title (#19487)
• 2bb67ce Preserving comments' placement property (#19567)
• 91bcac8 Add more tests for comment-only object type (#19587)
• cbee737 Remove space in empty object type (#19583)
• 6394c73 Align empty module declaration with TS (#19568)
• a4e6f7a Prevent the addition of space in type() with + (#19516)
• 3d063b5 Ignore dangling comments when checking type parameter comments (#19572)
• 908503e Handle dangling comments in SwitchStatement (#19581)
• 943a475 Angular: Support expression for exhaustive typechecking (#19571)
• Additional commits viewable in compare view

Updates semantic-release from 25.0.5 to 25.0.7

Release notes

Sourced from semantic-release's releases.

v25.0.7

25.0.7 (2026-07-13)

Bug Fixes

• argument Injection via repositoryUrl in package.json (#4245) (c46dbda)

v25.0.6

25.0.6 (2026-07-10)

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

Commits

• c46dbda fix: argument Injection via repositoryUrl in package.json (#4245)
• 7abb562 chore(deps): update npm to v12 (#4244)
• 8b15865 chore(deps): update dependency @​types/node to v24.13.3 (#4243)
• 8e28dd3 fix: ensure encoded secrets get masked
• f293647 Merge commit from fork
• a973d20 ci(action): update github/codeql-action action to v4.37.0 (#4241)
• c62136f chore(deps): update dependency mockserver-client to v7.4.0 (#4240)
• 9be3e6c chore(deps): lock file maintenance (#4239)
• 3259ebb chore(deps): update dependency got to v15.1.0 (#4238)
• 1c17eb5 chore(deps): update dependency mockserver-client to v7.3.0 (#4237)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates typescript-eslint from 8.62.1 to 8.64.0

Release notes

Sourced from typescript-eslint's releases.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

• support parsing import defer (#12513)
• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.63.0

8.63.0 (2026-07-06)

🚀 Features

• eslint-plugin: [no-misused-promises] detect async usage of a sync dispose usage (#12426)

🩹 Fixes

• eslint-plugin: [method-signature-style] suggest converting readonly function properties instead of emitting invalid syntax (#12447, #12446)
• eslint-plugin: [no-unnecessary-type-assertion] handle optional-chained calls to overloaded functions (#12491, #12485)
• eslint-plugin: [no-base-to-string] don't flag a shadowed String() call (#12492)
• scope-manager: export ClassStaticBlockScope (#12460)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Kristjan @​KristjanTammekivi
• Michael Naumov @​mnaoumov
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.64.0 (2026-07-13)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 414d9ab chore(release): publish 8.64.0
• 290cf6c chore(release): publish 8.63.0
• See full diff in compare view

Updates webpack-cli from 7.1.0 to 7.2.1

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.2.1

Patch Changes

• fix: CLIPlugin dynamic import interop under Bun (by @​alexander-akait in #4799)

webpack-cli@7.2.0

Minor Changes

• feat: allow webpack-dev-server v6 as an optional peer dependency (^5.0.0 || ^6.0.0) (by @​bjohansebas in #4793)

• Support tsx as a fallback loader for TypeScript and JSX configuration files (.ts, .tsx, .cts, .mts and .jsx), used when none of the loaders known to interpret (such as ts-node) are installed. (by @​alexander-akait in #4796)

Changelog

Sourced from webpack-cli's changelog.

7.2.1

Patch Changes

• fix: CLIPlugin dynamic import interop under Bun (by @​alexander-akait in #4799)

7.2.0

Minor Changes

• feat: allow webpack-dev-server v6 as an optional peer dependency (^5.0.0 || ^6.0.0) (by @​bjohansebas in #4793)

• Support tsx as a fallback loader for TypeScript and JSX configuration files (.ts, .tsx, .cts, .mts and .jsx), used when none of the loaders known to interpret (such as ts-node) are installed. (by @​alexander-akait in #4796)

Commits

• 71e34db chore(release): new release (#4800)
• 97c5541 fix: CLIPlugin dynamic import interop under Bun (#4799)
• 40b631f chore(release): new release (#4794)
• f896a9c chore(deps-dev): bump the dependencies group across 1 directory with 4 update...
• b4ea5a7 test: update target flag tests for webpack 5.108 (#4797)
• 9a5fef9 feat: support tsx as a fallback loader for TypeScript and JSX configs (#4796)
• 6cafa00 chore(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 (#4795)
• 3bfa81c docs: update (#4789)
• d122911 chore: update webpack-dev-server peer dependency version (#4793)
• See full diff in compare view

Updates webpack-dev-server from 5.2.6 to 6.0.0

Release notes

Sourced from webpack-dev-server's releases.

v6.0.0

Major Changes

• Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @​bjohansebas in #5674)

• Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0. (by @​bjohansebas in #5674)

• Drop support for Node.js < 22.15.0. (by @​bjohansebas in #5674)

• Convert the source to native ES modules. The package keeps "type": "module" and now exposes both an ESM and a CommonJS build via the exports field: ESM consumers import the native lib/, while CommonJS consumers require() a transpiled dist/ build, allowing the package to be consumed from both ESM and CommonJS without relying on require(ESM) for CommonJS consumers. (by @​bjohansebas in #5674)

• Remove CLI flags. Use the serve command from webpack-cli together with a configuration file or the programmatic API instead. (by @​bjohansebas in #5674)

• Remove the internalIP and internalIPSync static methods from Server. Resolve the local IP yourself if you need it. (by @​bjohansebas in #5674)

• Remove the bypass option from proxy configuration. Use the router or context options provided by http-proxy-middleware instead. (by @​bjohansebas in #5674)

• Remove SockJS support. The webSocketServer option no longer accepts "sockjs"; use the default "ws" transport instead. (by @​bjohansebas in #5674)

• Remove the spdy dependency. Use the built-in node:http2 module via the server option for HTTP/2 support. (by @​bjohansebas in #5674)

• Update http-proxy-middleware to v4. See the http-proxy-middleware v3 release notes and v4 release notes for the full list of breaking changes. (by @​bjohansebas in #5674)

• Update webpack-dev-middleware to v8 and sync originalUrl for middleware compatibility. server.middleware.getFilenameFromUrl() is now asynchronous and resolves to { filename, extra: { stats, outputFileSystem } }. See the webpack-dev-middleware v8 release notes for details. (by @​bjohansebas in #5674)

Minor Changes

• Add plugin support. webpack-dev-server can now be used as a webpack plugin, integrating with the compiler lifecycle without explicitly passing a compiler, preventing multiple server starts on recompilation, ensuring clean shutdown, and supporting MultiCompiler setups with multiple independent plugin servers. (by @​bjohansebas in #5674)

• Enable the compression middleware for HTTP/2 connections. (by @​bjohansebas in #5674)

• Remove the colorette dependency in favor of native ANSI styling. (by @​bjohansebas in #5674)

• Update chokidar to v5 and extend watchFiles.options.ignored to support glob string patterns via tinyglobby. (by @​bjohansebas in #5674)

• Use compiler.platform to determine the target environment instead of inspecting the resolved target string. Universal targets ("universal" or ["web", "node"], where compiler.platform.universal is true since webpack 5.108.0) are treated as web targets so the client runtime is injected. (by @​bjohansebas in #5674)

• Use the WHATWG URL API instead of the deprecated url.parse. (by @​bjohansebas in #5674)

Patch Changes

• Bump production dependencies, notably open to v11 and p-retry to v8. (by @​bjohansebas in #5674)

• Reject cross-site requests to the internal open-editor and invalidate endpoints. They performed state-changing actions (opening a file in the editor, forcing a recompilation) on any GET request, so a page the developer visited could trigger them. They now require a same-origin request, validated via Sec-Fetch-Site with an Origin/Host fallback. (by @​bjohansebas in #5691)

• Treat loopback aliases (127.0.0.1, ::1, localhost) as equivalent in isSameOrigin so the WebSocket client does not reject valid same-origin connections. (by @​bjohansebas in #5674)

• Migrate the test suite from Jest to node:test and set up the jsdom environment. (by @​bjohansebas in #5674)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

6.0.0

Major Changes

• Bump Express to v5. See the Express 5 migration guide for the full list of breaking changes. (by @​bjohansebas in #5674)

• Bump the webpack peer dependency range from ^5.0.0 to ^5.101.0. (by @​bjohansebas in #5674)

• Drop support for Node.js < 22.15.0. (by @​bjohansebas in #5674)

• Convert the source to native ES modules. The package keeps "type": "module" and now exposes both an ESM and a CommonJS build via the exports field: ESM consumers import the native lib/, while CommonJS consumers require() a transpiled dist/ build — so the package works from both ESM and CommonJS, including environments where require(ESM) is not supported. (by @​bjohansebas in #5674)

• Remove CLI flags. Use the serve command from webpack-cli together with a configuration file or the programmatic API instead. (by @​bjohansebas in #5674)

• Remove the internalIP and internalIPSync static methods from Server. Resolve the local IP yourself if you need it. (by @​bjohansebas in #5674)

• Remove the bypass option from proxy configuration. Use the router or context options provided by http-proxy-middleware instead. (by @​bjohansebas in #5674)

• Remove SockJS support. The webSocketServer option no longer accepts "sockjs"; use the default "ws" transport instead. (by @​bjohansebas in #5674)

• Remove the spdy dependency. Use the built-in node:http2 module via the server option for HTTP/2 support. (by @​bjohansebas in #5674)

• Update http-proxy-middleware to v4. See the http-proxy-middleware v3 release notes and v4 release notes for the full list of breaking changes. (by @​bjohansebas in #5674)

• Update webpack-dev-middleware to v8 and sync originalUrl for middleware compatibility. server.middleware.getFilenameFromUrl() is now asynchronous and resolves to { filename, extra: { stats, outputFileSystem } }. See the webpack-dev-middleware v8 release notes for details. (by @​bjohansebas in #5674)

Minor Changes

• Add plugin support. webpack-dev-server can now be used as a webpack plugin, integrating with the compiler lifecycle without explicitly passing a compiler, preventing multiple server starts on recompilation, ensuring clean shutdown, and supporting MultiCompiler setups with multiple independent plugin servers. (by @​bjohansebas in #5674)

• Enable the compression middleware for HTTP/2 connections. (by @​bjohansebas in #5674)

• Remove the colorette dependency in favor of native ANSI styling. (by @​bjohansebas in #5674)

• Update chokidar to v5 and extend watchFiles.options.ignored to support glob string patterns via tinyglobby. (by @​bjohansebas in #5674)

• Use compiler.platform to determine the target environment instead of inspecting the resolved target string. Universal targets ("universal" or ["web", "node"], where compiler.platform.universal is true since webpack 5.108.0) are treated as web targets so the client runtime is injected. (by @​bjohansebas in #5674)

• Use the WHATWG URL API instead of the deprecated url.parse. (by @​bjohansebas in #5674)

Patch Changes

• Bump production dependencies, notably open to v11 and p-retry to v8. (by @​bjohansebas in #5674)

• Reject cross-site requests to the internal open-editor and invalidate endpoints. They performed state-changing actions (opening a file in the editor, forcing a recompilation) on any GET request, so a page the developer visited could trigger them. They now require a same-origin request, validated via Sec-Fetch-Site with an Origin/Host fallback. (by @​bjohansebas in #5691)

• Treat loopback aliases (127.0.0.1, ::1, localhost) as equivalent in isSameOrigin so the WebSocket client does not reject valid same-origin connections. (by @​bjohansebas in #5674)

• Migrate the test suite from Jest to node:test and set up the jsdom environment. (by @​bjohansebas in #5674)

... (truncated)

Commits