Merge branch 'webpack:master' into feat/overlay-ui

Author: negimox

.cspell.json

@@ -70,7 +70,8 @@
     "commitlint",
     "eslintcache",
     "hono",
-    "privkey"
+    "privkey",
+    "geomanist"
   ],
   "ignorePaths": [
     "CHANGELOG.md",

.github/workflows/dependency-review.yml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout Repository"
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: "Dependency Review"
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v4

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [5.2.1](https://github.com/webpack/webpack-dev-server/compare/v5.2.0...v6.0.0) (2025-03-26)
+
+### Security
+
+* cross-origin requests are not allowed unless allowed by `Access-Control-Allow-Origin` header
+* requests with an IP addresses in the `Origin` header are not allowed to connect to WebSocket server unless configured by `allowedHosts` or it different from the `Host` header
+
+The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.
+
+### Bug Fixes
+
+* prevent overlay for errors caught by React error boundaries ([#5431](https://github.com/webpack/webpack-dev-server/issues/5431)) ([8c1abc9](https://github.com/webpack/webpack-dev-server/commit/8c1abc903ab444d9ce99e567b9a6c603e1ec06be))
+* take the first network found instead of the last one, this restores the same behavior as 5.0.4 ([#5411](https://github.com/webpack/webpack-dev-server/issues/5411)) ([ffd0b86](https://github.com/webpack/webpack-dev-server/commit/ffd0b86b790d372f90e17aea92cfd9def83fee96))
+
 ## [5.2.0](https://github.com/webpack/webpack-dev-server/compare/v5.1.0...v5.2.0) (2024-12-11)
 
 

client-src/overlay.js

@@ -898,6 +898,7 @@ const createOverlay = (options) => {
       if (!error && !message) {
         return;
       }
+
       // if error stack indicates a React error boundary caught the error, do not show overlay.
       if (
         error &&

client-src/socket.js

@@ -22,6 +22,8 @@ let maxRetries = 10;
 // eslint-disable-next-line import/no-mutable-exports
 export let client = null;
 
+let timeout;
+
 /**
  * @param {string} url
  * @param {{ [handler: string]: (data?: any, params?: any) => any }} handlers
@@ -33,6 +35,10 @@ const socket = function initSocket(url, handlers, reconnect) {
   client.onOpen(() => {
     retries = 0;
 
+    if (timeout) {
+      clearTimeout(timeout);
+    }
+
     if (typeof reconnect !== "undefined") {
       maxRetries = reconnect;
     }
@@ -57,7 +63,7 @@ const socket = function initSocket(url, handlers, reconnect) {
 
       log.info("Trying to reconnect...");
 
-      setTimeout(() => {
+      timeout = setTimeout(() => {
         socket(url, handlers, reconnect);
       }, retryInMs);
     }

examples/.assets/style.css

@@ -74,8 +74,8 @@ table {
 code {
   background-color: rgba(70, 94, 105, 0.06);
   border-radius: 3px;
-  font-family: "Source Code Pro", Consolas, "Liberation Mono", Menlo, Courier,
-    monospace;
+  font-family:
+    "Source Code Pro", Consolas, "Liberation Mono", Menlo, Courier, monospace;
   font-size: 1.44rem;
   margin: 0;
   max-width: 100%;