diff --git a/.changeset/fix-proxied-websocket-origin.md b/.changeset/fix-proxied-websocket-origin.md deleted file mode 100644 index ade201f3f0..0000000000 --- a/.changeset/fix-proxied-websocket-origin.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": patch ---- - -Validate the `Host` and `Origin` headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with `ws: true`. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. diff --git a/.changeset/tidy-host-headers.md b/.changeset/tidy-host-headers.md deleted file mode 100644 index 0f3562e27e..0000000000 --- a/.changeset/tidy-host-headers.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"webpack-dev-server": patch ---- - -Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when `allowedHosts` is `"all"`. Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. diff --git a/CHANGELOG.md b/CHANGELOG.md index 55088d6eb0..d729f1c689 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## 5.2.7 + +### Patch Changes + +- Validate the `Host` and `Origin` headers and enforce same-origin checks on WebSocket upgrade requests handled by proxies with `ws: true`. This prevents cross-origin pages from connecting to proxied WebSocket services through the development server. (by [@github-actions](https://github.com/apps/github-actions) in [#5766](https://github.com/webpack/webpack-dev-server/pull/5766)) + +- Validate Host and HTTP/2 authority headers independently of Origin protocol exceptions, including when `allowedHosts` is `"all"`. Handle malformed open-editor URLs with a controlled response and parse their query without relying on the Host header. (by [@bjohansebas](https://github.com/bjohansebas) in [#5772](https://github.com/webpack/webpack-dev-server/pull/5772)) + ## 5.2.6 ### Patch Changes diff --git a/package.json b/package.json index 4a2e376db1..e23b69dd97 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "webpack-dev-server", - "version": "5.2.6", + "version": "5.2.7", "description": "Serves a webpack app. Updates the browser on changes.", "homepage": "https://github.com/webpack/webpack-dev-server#readme", "bugs": "https://github.com/webpack/webpack-dev-server/issues",