From 5b04c49d6f951a5749d113d7ee5a997c01c131df Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Fri, 1 May 2026 16:55:05 -0500 Subject: [PATCH 1/4] chore: update http-proxy-middleware --- package-lock.json | 44 +++++++++++++++++--------------------------- package.json | 2 +- 2 files changed, 18 insertions(+), 28 deletions(-) diff --git a/package-lock.json b/package-lock.json index 232b1596ec..950aacc8bb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -23,7 +23,7 @@ "connect-history-api-fallback": "^2.0.0", "express": "^5.2.1", "graceful-fs": "^4.2.11", - "http-proxy-middleware": "^3.0.5", + "http-proxy-middleware": "^4.0.0-beta.5", "ipaddr.js": "^2.3.0", "launch-editor": "^2.13.2", "open": "^11.0.0", @@ -4290,15 +4290,6 @@ "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==", "license": "MIT" }, - "node_modules/@types/http-proxy": { - "version": "1.17.16", - "resolved": "https://registry.npmjs.org/@types/http-proxy/-/http-proxy-1.17.16.tgz", - "integrity": "sha512-sdWoUajOB1cd0A8cRRQ1cfyWNbmFKLAqBB89Y8x5iYyG/mkJHc0YUH8pdWBy2omi9qtCpiIgGjuwO0dQST2l5w==", - "license": "MIT", - "dependencies": { - "@types/node": "*" - } - }, "node_modules/@types/istanbul-lib-coverage": { "version": "2.0.6", "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz", @@ -10433,6 +10424,7 @@ "version": "4.0.7", "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz", "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==", + "dev": true, "license": "MIT" }, "node_modules/events": { @@ -11154,6 +11146,7 @@ "version": "1.16.0", "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", + "dev": true, "funding": [ { "type": "individual", @@ -12550,6 +12543,7 @@ "version": "1.18.1", "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz", "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==", + "dev": true, "license": "MIT", "dependencies": { "eventemitter3": "^4.0.0", @@ -12561,30 +12555,26 @@ } }, "node_modules/http-proxy-middleware": { - "version": "3.0.5", - "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-3.0.5.tgz", - "integrity": "sha512-GLZZm1X38BPY4lkXA01jhwxvDoOkkXqjgVyUzVxiEK4iuRu03PZoYHhHRwxnfhQMDuaxi3vVri0YgSro/1oWqg==", + "version": "4.0.0", + "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-4.0.0.tgz", + "integrity": "sha512-wuHwaUtmC0XzJNHqRp41zXtt5ojpHbusXGhq6781VvnjWUYPu7opmOF3eomGNujT07kEOnHWZyV9UZzKimVCKA==", "license": "MIT", "dependencies": { - "@types/http-proxy": "^1.17.15", - "debug": "^4.3.6", - "http-proxy": "^1.18.1", + "debug": "^4.4.3", + "httpxy": "^0.5.1", "is-glob": "^4.0.3", - "is-plain-object": "^5.0.0", + "is-plain-obj": "^4.1.0", "micromatch": "^4.0.8" }, "engines": { - "node": "^14.15.0 || ^16.10.0 || >=18.0.0" + "node": "^22.15.0 || ^24.0.0 || >=26.0.0" } }, - "node_modules/http-proxy-middleware/node_modules/is-plain-object": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz", - "integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==", - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } + "node_modules/httpxy": { + "version": "0.5.1", + "resolved": "https://registry.npmjs.org/httpxy/-/httpxy-0.5.1.tgz", + "integrity": "sha512-JPhqYiixe1A1I+MXDewWDZqeudBGU8Q9jCHYN8ML+779RQzLjTi78HBvWz4jMxUD6h2/vUL12g4q/mFM0OUw1A==", + "license": "MIT" }, "node_modules/human-signals": { "version": "2.1.0", @@ -13235,7 +13225,6 @@ "version": "4.1.0", "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz", "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==", - "dev": true, "license": "MIT", "engines": { "node": ">=12" @@ -17875,6 +17864,7 @@ "version": "1.0.0", "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz", "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==", + "dev": true, "license": "MIT" }, "node_modules/reserved-identifiers": { diff --git a/package.json b/package.json index aaff3cd758..f9e1419d14 100644 --- a/package.json +++ b/package.json @@ -59,7 +59,7 @@ "connect-history-api-fallback": "^2.0.0", "express": "^5.2.1", "graceful-fs": "^4.2.11", - "http-proxy-middleware": "^3.0.5", + "http-proxy-middleware": "^4.0.0-beta.5", "ipaddr.js": "^2.3.0", "launch-editor": "^2.13.2", "open": "^11.0.0", From 4de0d6dd22f134795fee017c111e966d1b1c8ee7 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sun, 10 May 2026 17:53:59 -0500 Subject: [PATCH 2/4] chore: update migration guide for Node.js version and spdy server support --- .cspell.json | 1 + lib/Server.js | 8 ++++++++ migration-v6.md | 4 ++-- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.cspell.json b/.cspell.json index 4a7bc2be12..274c196af0 100644 --- a/.cspell.json +++ b/.cspell.json @@ -10,6 +10,7 @@ "memfs", "execa", "networkidle", + "bracketless", "ipaddr", "pageerror", "unmock", diff --git a/lib/Server.js b/lib/Server.js index 1e693d097c..3defa18611 100644 --- a/lib/Server.js +++ b/lib/Server.js @@ -3003,6 +3003,14 @@ class Server { */ #parseHostnameFromHeader = function (header) { if (!header) return null; + + // Some proxies forward bracketless IPv6 literals (e.g. "::1") in the Host + // header. `new URL` cannot parse them, so when the header is itself a + // valid IPv6 literal we treat the whole header as the hostname. + if (ipaddr.IPv6.isValid(header)) { + return header; + } + try { // If the header does not have a scheme, prepend // so URL can parse it const parseUrl = new URL( diff --git a/migration-v6.md b/migration-v6.md index 5c768ab123..e441c93257 100644 --- a/migration-v6.md +++ b/migration-v6.md @@ -4,11 +4,11 @@ This document serves as a migration guide for `webpack-dev-server@6.0.0`. ## ⚠ Breaking Changes -- Minimum supported `Node.js` version is `20.9.0`. +- Minimum supported `Node.js` version is `22.15.0`. - Minimum supported `webpack` version is `5.101.0`. - Support for **SockJS** in the WebSocket transport has been removed. Now, only **native WebSocket** is supported, or **custom** client and server implementations can be used. - The options for passing to the `proxy` have changed. Please refer to the [http-proxy-middleware migration guide](https://github.com/chimurai/http-proxy-middleware/blob/master/MIGRATION.md) for details. -- Remove support for the spdy server type. Use the http2 server type instead; however, since Express does not work correctly with it, a custom server (e.g., Connect or Hono) should be used. +- Remove support for the spdy server type.Use the http2 server type instead; however, since Express does not work correctly with it, a custom server (e.g., Connect or Hono) should be used. v4: From 2d4bd923186c4ee332f825f30c89fb451d5f18ce Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sun, 10 May 2026 18:09:23 -0500 Subject: [PATCH 3/4] chore: replace http-proxy with httpxy in package.json and ipc.test.js --- .cspell.json | 1 + package-lock.json | 52 +------------------------------------------- package.json | 2 +- test/e2e/ipc.test.js | 2 +- 4 files changed, 4 insertions(+), 53 deletions(-) diff --git a/.cspell.json b/.cspell.json index 274c196af0..74d4c22a44 100644 --- a/.cspell.json +++ b/.cspell.json @@ -38,6 +38,7 @@ "FACCA", "darkgrey", "Consolas", + "httpxy", "peerigon", "Ichigo", "Kurosaki", diff --git a/package-lock.json b/package-lock.json index 950aacc8bb..954889d525 100644 --- a/package-lock.json +++ b/package-lock.json @@ -72,7 +72,7 @@ "expect": "^30.4.1", "hono": "^4.12.9", "html-webpack-plugin": "^5.6.3", - "http-proxy": "^1.18.1", + "httpxy": "^0.5.1", "husky": "^9.1.6", "jest-mock": "^30.4.1", "jsdom": "^29.1.1", @@ -10420,13 +10420,6 @@ "node": ">=6" } }, - "node_modules/eventemitter3": { - "version": "4.0.7", - "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz", - "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==", - "dev": true, - "license": "MIT" - }, "node_modules/events": { "version": "3.3.0", "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz", @@ -11142,27 +11135,6 @@ "dev": true, "license": "ISC" }, - "node_modules/follow-redirects": { - "version": "1.16.0", - "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz", - "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==", - "dev": true, - "funding": [ - { - "type": "individual", - "url": "https://github.com/sponsors/RubenVerborgh" - } - ], - "license": "MIT", - "engines": { - "node": ">=4.0" - }, - "peerDependenciesMeta": { - "debug": { - "optional": true - } - } - }, "node_modules/for-each": { "version": "0.3.5", "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.5.tgz", @@ -12539,21 +12511,6 @@ "url": "https://opencollective.com/express" } }, - "node_modules/http-proxy": { - "version": "1.18.1", - "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz", - "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==", - "dev": true, - "license": "MIT", - "dependencies": { - "eventemitter3": "^4.0.0", - "follow-redirects": "^1.0.0", - "requires-port": "^1.0.0" - }, - "engines": { - "node": ">=8.0.0" - } - }, "node_modules/http-proxy-middleware": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-4.0.0.tgz", @@ -17860,13 +17817,6 @@ "node": ">=0.10.0" } }, - "node_modules/requires-port": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz", - "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==", - "dev": true, - "license": "MIT" - }, "node_modules/reserved-identifiers": { "version": "1.2.0", "resolved": "https://registry.npmjs.org/reserved-identifiers/-/reserved-identifiers-1.2.0.tgz", diff --git a/package.json b/package.json index f9e1419d14..5453de9938 100644 --- a/package.json +++ b/package.json @@ -105,7 +105,7 @@ "expect": "^30.4.1", "hono": "^4.12.9", "html-webpack-plugin": "^5.6.3", - "http-proxy": "^1.18.1", + "httpxy": "^0.5.1", "husky": "^9.1.6", "jest-mock": "^30.4.1", "jsdom": "^29.1.1", diff --git a/test/e2e/ipc.test.js b/test/e2e/ipc.test.js index 553db82a84..2364b95a02 100644 --- a/test/e2e/ipc.test.js +++ b/test/e2e/ipc.test.js @@ -4,7 +4,7 @@ import os from "node:os"; import path from "node:path"; import { describe, it } from "node:test"; import { expect } from "expect"; -import httpProxy from "http-proxy"; +import httpProxy from "httpxy"; import webpack from "webpack"; import Server from "../../lib/Server.js"; import config from "../fixtures/client-config/webpack.config.js"; From 3bf42c9960a58ea31091e757e1fbf6cec6780995 Mon Sep 17 00:00:00 2001 From: Sebastian Beltran Date: Sat, 16 May 2026 13:25:22 -0500 Subject: [PATCH 4/4] fixup! --- test/e2e/ipc.test.js | 1 + 1 file changed, 1 insertion(+) diff --git a/test/e2e/ipc.test.js b/test/e2e/ipc.test.js index 2364b95a02..edc982009e 100644 --- a/test/e2e/ipc.test.js +++ b/test/e2e/ipc.test.js @@ -4,6 +4,7 @@ import os from "node:os"; import path from "node:path"; import { describe, it } from "node:test"; import { expect } from "expect"; +// eslint-disable-next-line import/no-unresolved import httpProxy from "httpxy"; import webpack from "webpack"; import Server from "../../lib/Server.js";