chore(release): new release

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 6.2.0
+
+### Minor Changes
+
+- Add `allowedOrigins` to say which pages may use the server — its HTTP endpoints, hot module replacement and proxied WebSockets — independently of `allowedHosts`, which goes back to checking `Host`. Nothing changes until it is set: the default, `"auto"`, keeps the rules derived from `allowedHosts`. A list allows the listed origins plus the page's own hostname (any port, loopback names counted as one, as before), answering them with CORS headers and allowing a plain `<script>` they load by its `Referer`; `"all"` allows every origin without turning off the `Host` check. Under `"auto"`, `allowedHosts: "all"` and an `Access-Control-Allow-Origin: *` entry in `headers` still open the server to every origin, and are deprecated for doing so. (by [@bjohansebas](https://github.com/bjohansebas) in [#5770](https://github.com/webpack/webpack-dev-server/pull/5770))
+
+  Once `allowedOrigins` is set, the injected hot client is also handed a per-run token, and a client carrying it may connect from an origin the server does not otherwise know, such as a proxy's; the `Host` check still applies. webpack-dev-middleware is now required at `^8.5.0`, the first release that hands over a token without requiring it.
+
+  Add `static.deny`: `true` refuses `.env`, `.env.*`, keys and certificates, `.npmrc`, `.yarnrc.yml` and `.git` in a static directory with `403` and leaves them out of directory listings, or give patterns of your own. Off by default for now.
+
 ## 6.1.0
 
 ### Minor Changes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "webpack-dev-server",
-  "version": "6.1.0",
+  "version": "6.2.0",
   "description": "Serves a webpack app. Updates the browser on changes.",
   "homepage": "https://github.com/webpack/webpack-dev-server#readme",
   "bugs": "https://github.com/webpack/webpack-dev-server/issues",