An in-range update of webpack-dev-server is breaking the build 🚨

[greenkeeper]

Version 2.4.2 of webpack-dev-server just got published.

Branch	Build failing 🚨
Dependency	webpack-dev-server
Current Version	2.4.1
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

As webpack-dev-server is “only” a devDependency of this project it might not break production or downstream projects, but “only” your build or test tools – preventing new deploys or publishes.

I recommend you give this issue a high priority. I’m sure you can resolve this 💪

---

Status Details

• ❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Release Notes

v2.4.2

• Properly close CLI when SIGINT or SIGTERM is called. This should fix some Docker issues (#787).
• Fix for entry not working when it was a function (#802).
• Fix for exception when using webpack-dev-server in a webworker (#813).
• Fix refresh loop that could happen on Firefox (#841).
• contentBase as an array did not work when used via CLI (#832).
• Proxy options were mutated, so this could lead to problems when re-using them (#836).

Commits

The new version differs by 15 commits .

• 60e4727 2.4.2
• 32adae3 Added beforeunload check to index.js (#544) (#841)
• d69559a Handle external upgrade for all websocket proxies (#843)
• 35a44d1 Remove Node.js v7 warning
• d2f579c Support for array of contentBase (#832)
• aabeeaa Remove unnecessary logging of closing the dev-server
• 1dc9461 Fix to share proxy option between proxy settings when the proxy option is a same object (#836)
• 42cd23c Explicitely but gracefully handle SIGINT and SIGTERM signals. (#787)
• 85de417 Use arrow function if it possible and get rid of .bind in server part (#835)
• 234294a Add unit tests for proxy options (#834)
• 8d4b826 add codecov
• d081f01 Update webpack-dev-middleware to 0.17.4 (#827)
• ccc8163 Fix exception when client script is used in webworkers (#813)
• f996bd4 fix typo and add --open (#814)
• 690df60 devClient does not work with dynamic entry. (#802)

See the full diff.

Not sure how things should work exactly?

There is a collection of frequently asked questions and of course you may always ask my humans.

---

Your Greenkeeper Bot 🌴

[greenkeeper]

Version 2.4.3 just got published.

Your tests are passing again with this version. Explicitly upgrade to this version 🚀

Release Notes

v2.4.3

Security fix:

This version contains a security fix, which is also breaking change if you have an insecure configuration.
We are releasing this breaking change as patch version to protect you from attacks.
Sorry if this breaks your setup, but the fix is easy.

We added a check for the correct Host header to the webpack-dev-server.
This allowed evil websites to access your assets.

The Host header of the request have to match the listening adress or the host provided in the public option.
Make sure to provide correct values here.

The response will contain a note when using an incorrect Host header.

For usage behind a Proxy or similar setups we also added a disableHostCheck option to disable this check.
Only use it when you know what you do. Not recommended.

This version also includes this security fix for webpack-dev-middleware: https://github.com/webpack/webpack-dev-middleware/releases/tag/v1.10.2

Note: This only affect the development server and middleware. webpack and built bundles are not affected.

Bugfixes:

• Requests are not blocked when Host doesn't match listening host or public option.
• Requests to localhost or 127.0.0.1 are not blocked.

Features:

• Added disableHostCheck option to disable the host check

Commits

The new version differs by 4 commits0.

• ca93284 2.4.3
• f3a4ac6 Merge branch 'security/host-check'
• 8db5fd5 Require a secure webpack-dev-middleware version
• 2957853 enable Host header check for all requests and sockets

false

See the full diff

[greenkeeper]

Version 2.4.4 just got published.

Your tests are passing again with this version. Explicitly upgrade to this version 🚀

Release Notes

v2.4.4

Bugfixes:

• add disableHostCheck to schema

Commits

The new version differs by 6 commits0.

• 7d08d1e 2.4.4
• 988f9c9 fixes #883
• ca93284 2.4.3
• f3a4ac6 Merge branch 'security/host-check'
• 8db5fd5 Require a secure webpack-dev-middleware version
• 2957853 enable Host header check for all requests and sockets

false

See the full diff

[greenkeeper]

Version 2.4.5 just got published.

Your tests are passing again with this version. Explicitly upgrade to this version 🚀

Commits

The new version differs by 10 commits0.

• 662bc31 2.4.5
• 99b273c Merge pull request #888 from phairoh/fix-incorrect-variable-usage
• f26f985 Added tests for Server.prototype.checkHost
• 9688eea Use idxPublic when extracting hostname from publicHost
• 7d08d1e 2.4.4
• 988f9c9 fixes #883
• ca93284 2.4.3
• f3a4ac6 Merge branch 'security/host-check'
• 8db5fd5 Require a secure webpack-dev-middleware version
• 2957853 enable Host header check for all requests and sockets

false

See the full diff

[greenkeeper]

Version 2.5.0 just got published.

Your tests are passing again with this version. Explicitly upgrade to this version 🚀

Release Notes

v2.5.0

Security

Don't provide a SSL cert, but generate one on demand. Unique for each developer.

https://medium.com/@mikenorth/961572624c54 by Mike North

Bugfixes

• allow port 0 again
• add allowedHosts option
• better check for WebWorker
• add openPage option to open a specific page
• add --bonjour
• add lan option, which listen on lan ip by default

Commits

The new version differs by 21 commits.

• bbcdca7 2.5.0
• 7b3a42a Add 'lan' option (modify the option name to ‘useLocalIp’ for more semantic) (#901)
• 8d5f252 replace console.log with internal log function (#856)
• c9fe53d zeroconf dns (bonjour) service publishing (#930)
• 14d77a5 Adding page argument to the Open option (#917)
• 2ca97dd Strongly check client isn't running on WebWorker for sendMsg (#929)
• ab889c3 Add 'allowedHosts' option (#899)
• 1a26ab4 fix #752: allow --port 0 again (#918)
• 9a7693c Merge pull request #942 from webpack/ssl-path
• 25e1098 updating https docs
• 400b289 generate ssl certs per instance
• 662bc31 2.4.5
• 99b273c Merge pull request #888 from phairoh/fix-incorrect-variable-usage
• f26f985 Added tests for Server.prototype.checkHost
• 9688eea Use idxPublic when extracting hostname from publicHost

There are 21 commits in total.

See the full diff

[greenkeeper]

Version 2.5.1 just got published.

Your tests are passing again with this version. Explicitly upgrade to this version 🚀

Release Notes

v2.5.1

Bugfixes

Fix peer dependencies to support webpack 3 ( #946 ) ( Fixes #932 )

Commits

The new version differs by 24 commits.

• 7c8b1f6 2.5.1
• 047a595 Merge pull request #946 from lencioni/patch-1
• 8978059 Update to webpack 3
• bbcdca7 2.5.0
• 7b3a42a Add 'lan' option (modify the option name to ‘useLocalIp’ for more semantic) (#901)
• 8d5f252 replace console.log with internal log function (#856)
• c9fe53d zeroconf dns (bonjour) service publishing (#930)
• 14d77a5 Adding page argument to the Open option (#917)
• 2ca97dd Strongly check client isn't running on WebWorker for sendMsg (#929)
• ab889c3 Add 'allowedHosts' option (#899)
• 1a26ab4 fix #752: allow --port 0 again (#918)
• 9a7693c Merge pull request #942 from webpack/ssl-path
• 25e1098 updating https docs
• 400b289 generate ssl certs per instance
• 662bc31 2.4.5

There are 24 commits in total.

See the full diff