[dependabot]

Bumps webpack-dev-middleware to 8.6.0 and updates ancestor dependency @wordpress/scripts. These dependencies need to be updated together.

Updates webpack-dev-middleware from 5.3.4 to 8.6.0

Release notes

Sourced from webpack-dev-middleware's releases.

v8.6.0

Minor Changes

• Answer a Range header with more than one range with 206 Partial Content and a multipart/byteranges body, instead of the whole file. Each part carries its own Content-Type and Content-Range; ranges that overlap or touch are merged first, and the parts come in the order the ranges were asked for. When the output file system can stream, each range is read on its own, so asking for a few slices of a large asset reads only those; without createReadStream, or when a strong ETag has already read the file, the parts are cut from the whole file. A request for more than 200 ranges gets the whole file, as before. modifyResponseData receives that body as a Readable, so its data (and the data it returns) is typed Buffer | Readable, which still includes a ReadStream. (by @​alexander-akait in #2496)

• The overlay sends the client's token along when it asks openEditorEndpoint to open a file, so a server can tell the overlay's request from one another page made. Only to an endpoint on the page's own server (a rooted path), never to an absolute url, and only when the client was given a token. (by @​alexander-akait in #2488)

Patch Changes

• Read the page's own url parameters without writing a property named after each one. A parameter such as __proto__ or constructor is now looked through like any other instead of becoming a property name to write; behavior is otherwise unchanged. (by @​alexander-akait in #2494)

• Fix initialization with rspack, whose compiler.hooks throws when reading the validate hook it doesn't implement. (by @​Cherry in #2503)

• Expose the existing devMiddleware property in the Koa and Hono wrapper return types, preserving custom request and response types. (by @​MehdiZare in #2489)

v8.5.0

Minor Changes

• hot.token also takes { value, required }. With required: false a token is minted (or value used) and handed to the injected client as usual, but the endpoint does not refuse a client without it, so a server with policy of its own can compare it in onConnect alongside, say, the origins it already allows. The instance's new hot.tokenRequired says which applies. (by @​alexander-akait in #2486)

v8.4.0

Minor Changes

• The client posts build events to the page the way webpack-dev-server's does (webpackOk, webpackErrors, webpackClose and the rest), logs Disconnected! when the connection drops and clears the build's problems from the overlay until it is back. progress accepts "circular" or "linear". Reloads skip a page that is already navigating away, use the nearest ancestor with a url of its own inside an about:blank iframe, and in apply: "reload" follow a sibling compilation's build too. (by @​alexander-akait in #2425)

• HotModuleReplacementPlugin now goes to every compilation the middleware serves, including server bundles that hot-reload through webpack/hot/poll. hot.client.transport also accepts a module exporting a client class of your own, and the new hot.ws option is passed to the ws server (compression, verifyClient, or a port or server of its own), with hot.cors and hot.token still checked. The connection the runtime holds is exported as webpack-dev-middleware/client/socket for tooling that listens alongside it. (by @​alexander-akait in #2472)

• Grouped etag, lastModified, cacheControl and cacheImmutable into cache.*, and mimeTypes and mimeTypeDefault into mime.*; the old names warn and keep working until the next major release, and the grouped name wins when both are set. Media types now resolve through mime-db directly, and mime.types belongs to its own middleware instead of being written into the table mime-types shares with the whole process. instance.context.options is a copy of the options passed, cache.control included. (by @​alexander-akait in #2455)

• hot.client.apply ("hmr", "hmr-only", "reload" or "nothing") says what a build does to the page, so a project without HMR still reloads on a change; a single page can choose its own mode with ?webpack-dev-middleware-apply=, and publishing { action: "reload" } reloads every page. hot.client.connect (false, or { retries, timeout }) controls connecting and reconnecting, with retries honoured on both transports. The hot, liveReload, reload, autoConnect, reconnect and timeout query parameters they replace are still read until the next major release, with a deprecation warning for this package's own three. (by @​alexander-akait in #2458)

• Added hot.client, which sets the browser runtime's options on the middleware under the same names the entry query takes, so a configuration no longer needs a hand-written query string. url accepts a url or its parts ({ port: 8080 }) and resolves the rest in the page, pageParamPrefix renames the per-page ?webpack-dev-middleware-apply= parameter, and logging accepts { level, name } so an embedding package can label the console with its own name. (by @​alexander-akait in #2436)

• Added hot.cors to choose which origins may reach the hot endpoint: Server-Sent Events still allow every origin until the next major release, while the new WebSocket transport allows only local origins and refuses others with 403 before the handshake. Added hot.token, a secret the injected client carries and the endpoint requires, for the case where a browser sends no Origin; it is off by default. (by @​alexander-akait in #2444)

• hot now adds the client and HotModuleReplacementPlugin to the compilation itself, so enabling it is all a webpack configuration needs. hot.inject says what is added: "all" (the default), "plugin" for a page with a client of its own, "client" for a configuration that applies the plugin itself, or "none". Web workers get a client too, nothing is injected into a non-browser target, and the HMR plugin is left out when hot.client.apply is reload or nothing. (by @​alexander-akait in #2430)

• The instance gains attach(server), handleUpgrade(req, socket, head), onConnect(fn) (now given the request as well as the client), publish(payload) and publishTo(client, payload), so a server can own the upgrade, decide who may listen and put payloads of its own on the stream, such as ProgressPlugin ticks. The client understands { action: "error", message }, logging the reason a server refused it and posting it to the page as webpackError. (by @​alexander-akait in #2431)

• hot.transport chooses how events reach the browser: Server-Sent Events (the default), "ws" for a WebSocket, or a transport of your own, which only needs onConnect, publish, publishTo and close. The client speaks both built-in wires, also exported as webpack-dev-middleware/client/sse and webpack-dev-middleware/client/ws, and behaves the same on either. (by @​alexander-akait in #2420)

• overlay.id names the overlay element, so a package embedding it can keep the id its users already query. The new webpack-dev-middleware/client/problem export formats one of webpack's errors or warnings with formatProblem, and showProblems accepts webpack's objects as well as strings. (by @​alexander-akait in #2438)

Patch Changes

• Bound the internal url and Range header caches, which grew for the life of the process and were never released, even by close(). (by @​alexander-akait in #2405)

• The client exports ship type declarations and are marked as the ES modules they are. The client logs through webpack's Logger without webpack/lib/logging/runtime.js, so universal and ["web", "node"] bundles no longer pull in a node builtin and a page enforcing Trusted Types needs no guard. A module that re-exports the client can hand it its options through __webpack_dev_middleware_client_query__, and ?autoConnect is read like every other boolean. (by @​alexander-akait in #2428)

• Deprecated hot.progress, which keeps working until the next major release: a server that applies ProgressPlugin itself ended up with two on one compiler. Remove it, apply the plugin yourself and hand its ticks to publish; the browser-side hot.client.progress is unaffected. (by @​alexander-akait in #2451)

... (truncated)

Changelog

Sourced from webpack-dev-middleware's changelog.

8.6.0

Minor Changes

• Answer a Range header with more than one range with 206 Partial Content and a multipart/byteranges body, instead of the whole file. Each part carries its own Content-Type and Content-Range; ranges that overlap or touch are merged first, and the parts come in the order the ranges were asked for. When the output file system can stream, each range is read on its own, so asking for a few slices of a large asset reads only those; without createReadStream, or when a strong ETag has already read the file, the parts are cut from the whole file. A request for more than 200 ranges gets the whole file, as before. modifyResponseData receives that body as a Readable, so its data (and the data it returns) is typed Buffer | Readable, which still includes a ReadStream. (by @​alexander-akait in #2496)

• The overlay sends the client's token along when it asks openEditorEndpoint to open a file, so a server can tell the overlay's request from one another page made. Only to an endpoint on the page's own server (a rooted path), never to an absolute url, and only when the client was given a token. (by @​alexander-akait in #2488)

Patch Changes

• Read the page's own url parameters without writing a property named after each one. A parameter such as __proto__ or constructor is now looked through like any other instead of becoming a property name to write; behavior is otherwise unchanged. (by @​alexander-akait in #2494)

• Fix initialization with rspack, whose compiler.hooks throws when reading the validate hook it doesn't implement. (by @​Cherry in #2503)

• Expose the existing devMiddleware property in the Koa and Hono wrapper return types, preserving custom request and response types. (by @​MehdiZare in #2489)

8.5.0

Minor Changes

• hot.token also takes { value, required }. With required: false a token is minted (or value used) and handed to the injected client as usual, but the endpoint does not refuse a client without it, so a server with policy of its own can compare it in onConnect alongside, say, the origins it already allows. The instance's new hot.tokenRequired says which applies. (by @​alexander-akait in #2486)

8.4.0

Minor Changes

• The client posts build events to the page the way webpack-dev-server's does (webpackOk, webpackErrors, webpackClose and the rest), logs Disconnected! when the connection drops and clears the build's problems from the overlay until it is back. progress accepts "circular" or "linear". Reloads skip a page that is already navigating away, use the nearest ancestor with a url of its own inside an about:blank iframe, and in apply: "reload" follow a sibling compilation's build too. (by @​alexander-akait in #2425)

• HotModuleReplacementPlugin now goes to every compilation the middleware serves, including server bundles that hot-reload through webpack/hot/poll. hot.client.transport also accepts a module exporting a client class of your own, and the new hot.ws option is passed to the ws server (compression, verifyClient, or a port or server of its own), with hot.cors and hot.token still checked. The connection the runtime holds is exported as webpack-dev-middleware/client/socket for tooling that listens alongside it. (by @​alexander-akait in #2472)

• Grouped etag, lastModified, cacheControl and cacheImmutable into cache.*, and mimeTypes and mimeTypeDefault into mime.*; the old names warn and keep working until the next major release, and the grouped name wins when both are set. Media types now resolve through mime-db directly, and mime.types belongs to its own middleware instead of being written into the table mime-types shares with the whole process. instance.context.options is a copy of the options passed, cache.control included. (by @​alexander-akait in #2455)

• hot.client.apply ("hmr", "hmr-only", "reload" or "nothing") says what a build does to the page, so a project without HMR still reloads on a change; a single page can choose its own mode with ?webpack-dev-middleware-apply=, and publishing { action: "reload" } reloads every page. hot.client.connect (false, or { retries, timeout }) controls connecting and reconnecting, with retries honoured on both transports. The hot, liveReload, reload, autoConnect, reconnect and timeout query parameters they replace are still read until the next major release, with a deprecation warning for this package's own three. (by @​alexander-akait in #2458)

• Added hot.client, which sets the browser runtime's options on the middleware under the same names the entry query takes, so a configuration no longer needs a hand-written query string. url accepts a url or its parts ({ port: 8080 }) and resolves the rest in the page, pageParamPrefix renames the per-page ?webpack-dev-middleware-apply= parameter, and logging accepts { level, name } so an embedding package can label the console with its own name. (by @​alexander-akait in #2436)

• Added hot.cors to choose which origins may reach the hot endpoint: Server-Sent Events still allow every origin until the next major release, while the new WebSocket transport allows only local origins and refuses others with 403 before the handshake. Added hot.token, a secret the injected client carries and the endpoint requires, for the case where a browser sends no Origin; it is off by default. (by @​alexander-akait in #2444)

• hot now adds the client and HotModuleReplacementPlugin to the compilation itself, so enabling it is all a webpack configuration needs. hot.inject says what is added: "all" (the default), "plugin" for a page with a client of its own, "client" for a configuration that applies the plugin itself, or "none". Web workers get a client too, nothing is injected into a non-browser target, and the HMR plugin is left out when hot.client.apply is reload or nothing. (by @​alexander-akait in #2430)

• The instance gains attach(server), handleUpgrade(req, socket, head), onConnect(fn) (now given the request as well as the client), publish(payload) and publishTo(client, payload), so a server can own the upgrade, decide who may listen and put payloads of its own on the stream, such as ProgressPlugin ticks. The client understands { action: "error", message }, logging the reason a server refused it and posting it to the page as webpackError. (by @​alexander-akait in #2431)

• hot.transport chooses how events reach the browser: Server-Sent Events (the default), "ws" for a WebSocket, or a transport of your own, which only needs onConnect, publish, publishTo and close. The client speaks both built-in wires, also exported as webpack-dev-middleware/client/sse and webpack-dev-middleware/client/ws, and behaves the same on either. (by @​alexander-akait in #2420)

• overlay.id names the overlay element, so a package embedding it can keep the id its users already query. The new webpack-dev-middleware/client/problem export formats one of webpack's errors or warnings with formatProblem, and showProblems accepts webpack's objects as well as strings. (by @​alexander-akait in #2438)

Patch Changes

• Bound the internal url and Range header caches, which grew for the life of the process and were never released, even by close(). (by @​alexander-akait in #2405)

... (truncated)

Commits

• ad83f02 chore(release): new release (#2495)
• 8a42686 fix: probe the validate hook with in so rspack compilers don't throw (#2503)
• b3f448d chore(deps): bump the dependencies group with 6 updates (#2498)
• 7c28912 feat: answer multiple ranges with a multipart/byteranges body (#2496)
• 93127dc fix(types): expose middleware on koa and hono wrappers (#2489)
• 3c38a7f feat: send the client's token with the overlay's open-editor request (#2488)
• f775c4a fix: read the page's url parameters without writing properties named by them ...
• 0527989 chore(deps): bump the dependencies group across 1 directory with 8 updates (#...
• 6737ca8 chore(deps-dev): bump launch-editor from 2.14.1 to 2.14.2 (#2493)
• 21527de chore(deps): bump the dependencies group with 3 updates (#2492)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for webpack-dev-middleware since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @wordpress/scripts from 33.0.0 to 37.0.0

Changelog

Sourced from @​wordpress/scripts's changelog.

37.0.0 (2026-10-20)

Breaking Changes

• Update the bundled webpack-dev-server from ^5.2.1 to ^6.0.0 and @pmmmwh/react-refresh-webpack-plugin from ^0.5.11 to ^0.6.3. Custom devServer configs need migrating: SockJS is removed, so drop webSocketServer: 'sockjs' and client.webSocketTransport: 'sockjs' to use the default ws; the proxy bypass option is removed in favor of http-proxy-middleware's context or router; custom middleware runs on Express 5; and getFilenameFromUrl() is now asynchronous. See the webpack-dev-server 6.0.0 release notes (#84674).

Enhancements

• test-e2e and test-playwright: Add a --wp-env-config option for the custom config file that the environment for the tests is started from with wp-env --config, such as .wp-env.test.json. When WP_BASE_URL is not set, the tests run on the port from that file merged with its override file, such as .wp-env.test.override.json, and any WP_ENV_* environment variables (#84654).

Bug Fixes

• test-e2e and test-playwright: When WP_BASE_URL is not set and the wp-env config disables the tests environment with "testsEnvironment": false, run the tests on the port of the development environment instead of falling back to http://localhost:8889, which may belong to another project's environment (#84654).

36.1.0 (2026-10-07)

Enhancements

• lint-js: Allow unit-test titles passed through variables (#83995).

Bug Fixes

• Add the stylelint-scss dependency, a peer of @wordpress/stylelint-config (#83765).
• build, start and lint-pkg-json: Resolve the default browserslist and npm-package-json-lint configs when dependencies are not hoisted to the project root (npm install-strategy=linked, pnpm). lint-pkg-json now defaults to config/npmpackagejsonlint.js; config/npmpackagejsonlint.json stays for projects that reference it (#83902).
• lint-js, lint-style and lint-md-docs: a file passed right after --fix is now treated as a file instead of that flag's value, so only the listed files get processed. Same for --require-pragma in format (#83521).

36.0.0 (2026-09-23)

Breaking Changes

• Switch test-unit-js to consumer-installed Vitest 5 and Vite 7/8 at the 36.0.0 boundary. Run once by default, discover consumer Vitest/Vite config, and use Vitest lint defaults for test/spec files. Keep test-unit-jest as a maintenance-only adapter for consumer-installed Jest, with no scheduled removal. Remove the bundled Jest dependencies, preset config, Babel transformer, and GitHub Actions reporter. Retire the Jest preset and console package source; published versions remain available. Jest projects must install their own dependencies and configure the published preset if needed. See the migration guide. (#82843).

• Require Node.js ^22.22.2 || ^24.15.0 || >=26.0.0 and update the bundled markdownlint-cli from ^0.31.1 to ^0.49.1, which moves markdownlint from 0.25 to 0.41. lint-md-docs now runs the rules added since then (MD051 through MD060) by default, so projects may see new reports. The header rule aliases (for example header-increment) no longer work in configuration files; use the heading names (#81917).

• lint-style: Use stylelint's resolveConfig for config detection instead of a static extension list, supporting all current and future config file formats without manual maintenance overhead. Note that resolveConfig also searches ancestor directories and the global config directory (~/.config/stylelint), so a project with no local config may now pick up an unrelated config found there instead of the bundled default (#79280).

Enhancements

• check-engines: Check only the tools listed in engines, instead of always passing --node and --npm. Without an engines field in the project, it now checks only the Node.js version (#83326).
• lint-md-docs: Detect .markdownlint.jsonc so the bundled default config is not used when one is present (#81917).
• format: Format .cjs and .mjs files when expanding a directory (#82731).
• format: Format .cts and .mts files when expanding a directory (#83071).
• The default ESLint config now lints .jsx, .ts, .tsx, .mts and .cts files, which ESLint's own file discovery skips (#83071).
• build and start: Discover .cjs, .cts and .mts entry points, resolve them from extensionless imports, and transpile .cjs and .cts modules (#83071).
• The bundled wp-prettier dependency has been upgraded from 3.0.3 to 3.9.6 (#82731).

Bug Fixes

• Update the bundled webpack to ^5.111.0, which fixes a code-generation regression in webpack 5.110.3 that can make production bundles fail at startup (#82698).

... (truncated)

Commits

• 8d30f92 chore(release): publish
• e7922b3 Update changelog files
• e4d93b0 Merge changes published in the Gutenberg plugin "release/24.3" branch
• fa4301b Update changelog files
• 5c222d1 Merge changes published in the Gutenberg plugin "release/24.3" branch
• 2555c8d Update changelog files
• 558d1e6 Merge changes published in the Gutenberg plugin "release/24.3" branch
• 12441e2 chore(release): publish
• 36c194f Update changelog files
• 7b99cae Merge changes published in the Gutenberg plugin "release/24.2" branch
• Additional commits viewable in compare view