Upgrading webpack-dev-server 2 to 3
Breaking2.11.5 → 3.11.3Breaking2Security8Platform3New29Changed11Fixed79Other1
BreakingUpgrade verdict
2 breaking changes and 2 platform requirement changes and 8 security fixes.
In plain terms
- This version only works with webpack 4; projects on webpack 1, 2 or 3 must upgrade webpack first.
- If you use serverMode or clientMode, you must switch to the new transportMode setting.
- The package now declares webpack-cli as an optional peer dependency, so you may need to install it alongside webpack-dev-server.
- You need Node.js 6 or newer to run this version; Node.js 4 is no longer supported.
Must act Top 5 of 12 that need code or config changes
Node.js requirement changed in 3.1.6: >=4.7 → >= 6.11.5.
Adds ansi-html-community 0.0.8, is-absolute-url ^3.0.3, p-retry ^3.0.1, schema-utils ^1.0.0, semver ^6.3.0, url ^0.11.0, webpack-log ^2.0.0, ws ^6.2.1.
Drops ansi-html, array-includes.
Installs 397 packages in all (was 456).
What you must change
Breaking2
Adds support for webpack v4 and drops support for older webpack versions.
Migrates serverMode and clientMode to the experimental transportMode option.
serverModeclientModetransportModeSecurity8
Updates vulnerable dependencies.
Fixes a security vulnerability in yargs-parser.
yargs-parserUpdates the
selfsigned package.selfsignedMakes the headers security check stricter.
Checks the origin header for websocket connections.
Missing Origin Validation in webpack-dev-server
High · CVSS 7.5Updates sockjs-client from v1.1.5 to 1.3.0 to address a url-parse vulnerability.
sockjs-clienturl-parseUpdates the yargs dependency to fix a security vulnerability.
yargsPlatform2
Adds an optional peer dependency on webpack-cli.
webpack-cliDrops support for Node.js v4 and now requires Node.js v6 or later, matching webpack.