From cec6078bbe1d4ef9ff7d9f09b446e88b2ffc13a2 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 20 Oct 2026 10:59:05 +0000
Subject: [PATCH] chore(release): new release

---
 .changeset/independent-origin-authorization.md |  9 ---------
 CHANGELOG.md                                   | 10 ++++++++++
 package.json                                   |  2 +-
 3 files changed, 11 insertions(+), 10 deletions(-)
 delete mode 100644 .changeset/independent-origin-authorization.md

diff --git a/.changeset/independent-origin-authorization.md b/.changeset/independent-origin-authorization.md
deleted file mode 100644
index 1abba02cea..0000000000
--- a/.changeset/independent-origin-authorization.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-"webpack-dev-server": minor
----
-
-Add `allowedOrigins` to say which pages may use the server — its HTTP endpoints, hot module replacement and proxied WebSockets — independently of `allowedHosts`, which goes back to checking `Host`. Nothing changes until it is set: the default, `"auto"`, keeps the rules derived from `allowedHosts`. A list allows the listed origins plus the page's own hostname (any port, loopback names counted as one, as before), answering them with CORS headers and allowing a plain `<script>` they load by its `Referer`; `"all"` allows every origin without turning off the `Host` check. Under `"auto"`, `allowedHosts: "all"` and an `Access-Control-Allow-Origin: *` entry in `headers` still open the server to every origin, and are deprecated for doing so.
-
-Once `allowedOrigins` is set, the injected hot client is also handed a per-run token, and a client carrying it may connect from an origin the server does not otherwise know, such as a proxy's; the `Host` check still applies. webpack-dev-middleware is now required at `^8.5.0`, the first release that hands over a token without requiring it.
-
-Add `static.deny`: `true` refuses `.env`, `.env.*`, keys and certificates, `.npmrc`, `.yarnrc.yml` and `.git` in a static directory with `403` and leaves them out of directory listings, or give patterns of your own. Off by default for now.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2fd2b9ede6..52eb9f9bc8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 6.2.0
+
+### Minor Changes
+
+- Add `allowedOrigins` to say which pages may use the server — its HTTP endpoints, hot module replacement and proxied WebSockets — independently of `allowedHosts`, which goes back to checking `Host`. Nothing changes until it is set: the default, `"auto"`, keeps the rules derived from `allowedHosts`. A list allows the listed origins plus the page's own hostname (any port, loopback names counted as one, as before), answering them with CORS headers and allowing a plain `<script>` they load by its `Referer`; `"all"` allows every origin without turning off the `Host` check. Under `"auto"`, `allowedHosts: "all"` and an `Access-Control-Allow-Origin: *` entry in `headers` still open the server to every origin, and are deprecated for doing so. (by [@bjohansebas](https://github.com/bjohansebas) in [#5770](https://github.com/webpack/webpack-dev-server/pull/5770))
+  
+  Once `allowedOrigins` is set, the injected hot client is also handed a per-run token, and a client carrying it may connect from an origin the server does not otherwise know, such as a proxy's; the `Host` check still applies. webpack-dev-middleware is now required at `^8.5.0`, the first release that hands over a token without requiring it.
+  
+  Add `static.deny`: `true` refuses `.env`, `.env.*`, keys and certificates, `.npmrc`, `.yarnrc.yml` and `.git` in a static directory with `403` and leaves them out of directory listings, or give patterns of your own. Off by default for now.
+
 ## 6.1.0
 
 ### Minor Changes
diff --git a/package.json b/package.json
index b62c579036..59a6adffc6 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "webpack-dev-server",
-  "version": "6.1.0",
+  "version": "6.2.0",
   "description": "Serves a webpack app. Updates the browser on changes.",
   "homepage": "https://github.com/webpack/webpack-dev-server#readme",
   "bugs": "https://github.com/webpack/webpack-dev-server/issues",