Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @bjohansebas in #2370)

• Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @alexander-akait in #2392)

Patch Changes

• Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @bjohansebas in #2378)

• Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @bjohansebas in #2404)

• Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @alexander-akait in #2396)

• Update dependencies. (by @alexander-akait in #2394)

7.4.6 (2026-09-03)

Bug Fixes

• reject requests that resolve outside the output directory

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @bjohansebas in #2322)

Patch Changes

• Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @bjohansebas in #2347)

Minor Changes

• Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @bjohansebas in #2371)

Patch Changes

• Replace the on-finished dependency with Node.js built-in stream.finished. (by @bjohansebas in #2346)

Patch Changes

• Respect req.url when modified by middleware such as connect-history-api-fallback. (by @bjohansebas in #2304)

Patch Changes

• Fixed compatibility with rspack. (by @alexander-akait in #2295)

Patch Changes

• Fixed compatibility with rspack. (by @alexander-akait in 0b40cfd)

Major Changes

• The getFilenameFromUrl function is now asynchronous, returning a Promise that resolves to the object with the found filename (or undefined if the file was not found) or throws an error if the URL cannot be processed. Additionally, the object contains the extra property with stats (file system stats) and outputFileSystem (output file system where file was found) properties. (by @alexander-akait in #2284)

• Minimum supported Node.js version is 20.9.0. (by @alexander-akait in #2284)

• Minimum supported webpack version is 5.101.0. (by @alexander-akait in #2284)

Minor Changes

• Added support for plugin usage, useful when the middleware will be used as a webpack plugin (no stats output, no extra actions). (by @alexander-akait in #2284)

• Added the forwardError option to enable error forwarding to next middleware. (by @alexander-akait in #2284)

• Enable cacheImmutable by default for immutable assets. (by @alexander-akait in #2284)

Patch Changes

• Improved initial loading module time. (by @alexander-akait in #2284)

• Removed outdated code and improved performance by avoiding extra loops. (by @alexander-akait in #2284)

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

7.4.5 (2025-09-24)

Bug Fixes

• unpin memfs (#2176) (c9a0e68)

7.4.4 (2025-09-23)

Bug Fixes

• pin memfs version (#2174) (044d691)

7.4.3 (2025-09-05)

Bug Fixes

• do not call the next middleware for 304 responses (#2155) (c26a326)
• do not call the next middleware when request is finished or errored (#2156) (116c680)

7.4.2 (2024-08-21)

Bug Fixes

• no crash when headers are already sent (#1929) (c20f1d9)

7.4.1 (2024-08-20)

Bug Fixes

• assetsInfo may be undefined (rspack) (#1927) (21f1797)