[dependabot]

Bumps webpack-dev-middleware to 8.3.0 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates webpack-dev-middleware from 7.4.6 to 8.3.0

Release notes

Sourced from webpack-dev-middleware's releases.

v8.3.0

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @​bjohansebas in #2370)

• Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @​alexander-akait in #2392)

Patch Changes

• Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @​bjohansebas in #2378)

• Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @​bjohansebas in #2404)

• Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @​alexander-akait in #2396)

• Update dependencies. (by @​alexander-akait in #2394)

v8.2.0

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @​bjohansebas in #2322)

v8.1.1

Patch Changes

• Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @​bjohansebas in #2347)

v8.1.0

Minor Changes

• Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @​bjohansebas in #2371)

v8.0.4

Patch Changes

• Replace the on-finished dependency with Node.js built-in stream.finished. (by @​bjohansebas in #2346)

v8.0.3

Patch Changes

• Respect req.url when modified by middleware such as connect-history-api-fallback. (by @​bjohansebas in #2304)

v8.0.2

Patch Changes

• Fixed compatibility with rspack. (by @​alexander-akait in #2295)

v8.0.1

Patch Changes

... (truncated)

Changelog

Sourced from webpack-dev-middleware's changelog.

8.3.0

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime is served by the middleware itself. (by @​bjohansebas in #2370)

• Take the diagnostics a hot payload carries from the stats option, so one setting governs what a build reports in the terminal and in the browser: stats: "errors-only" keeps warnings out of both, and stats: false keeps errors and warnings out of both, the client's error overlay included — reach for the client's ?logging= or ?overlay= to quiet the browser alone. hot.statsOptions is deprecated and will be removed in the next major release; its hash, timings and children keys are now ignored, because they could leave a payload without the hash the client compares, or carry a child compilation's hash instead, which stopped updates applying and forced a full page reload on every rebuild. (by @​alexander-akait in #2392)

Patch Changes

• Fixed a crash when calling invalidate() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware now invalidates the host's watching instead (each child compiler's one for a MultiCompiler on webpack < 5.109). When nothing is watching it logs a warning and completes the callback, as close() does, rather than leaving invalidate(callback) waiting on a build that never runs. (by @​bjohansebas in #2378)

• Reject with 403 Forbidden the requests whose resolved filename falls outside outputPath (GHSA-g84c-rxfj-3j2c). With a publicPath without a trailing slash, a sibling path sharing its prefix (/assets../secret) escaped the output root once the prefix was stripped and joined. (by @​bjohansebas in #2404)

• Update the changelog generator to the @changesets/get-github-info 1.0 API. (by @​alexander-akait in #2396)

• Update dependencies. (by @​alexander-akait in #2394)

8.2.0

Minor Changes

• Added a hot option that enables hot module replacement, replacing the need for webpack-hot-middleware. Pass hot: true to enable with defaults, or hot: { path, heartbeat, progress, statsOptions } to customize. The client runtime ships with the package and is added as a webpack entry. (by @​bjohansebas in #2322)

8.1.1

Patch Changes

• Fixed a crash when calling close() in plugin mode (isPlugin = true). Since the host (webpack-cli, webpack-dev-server, etc.) owns compiler.watch(), the middleware has no watching of its own to close, so close() now just calls the callback instead of throwing. (by @​bjohansebas in #2347)

8.1.0

Minor Changes

• Reuse an already active MultiCompiler watching session instead of starting a duplicate one (requires webpack >= 5.109). (by @​bjohansebas in #2371)

8.0.4

Patch Changes

• Replace the on-finished dependency with Node.js built-in stream.finished. (by @​bjohansebas in #2346)

8.0.3

Patch Changes

• Respect req.url when modified by middleware such as connect-history-api-fallback. (by @​bjohansebas in #2304)

8.0.2

... (truncated)

Commits

• 1abbf08 chore(release): new release (#2393)
• ef479c9 feat: add missing changelog (#2404)
• 13344e7 Merge commit from fork
• e58a70b test(hot): reach 100% of the client, off the deprecated statsOptions (#2402)
• 17e689e chore(deps): bump the dependencies group across 1 directory with 2 updates (#...
• d816818 fix(plugin): resolve crash on invalidate() in plugin mode (#2378)
• 09a9095 chore(deps): bump changesets/action (#2384)
• 4c1dcfc test: rewrite to e2e (#2370)
• 9133f47 build: update changesets tooling (#2396)
• a337174 build: update dependencies (#2394)
• Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 22.1.9 to 22.2.4

Release notes

Sourced from @​angular-devkit/build-angular's releases.

22.2.4

@​schematics/angular

Commit	Description
	apply viewEncapsulation to generated application components
	correct error and warning messages in environments schematic
	show routing module suffixes in findModule error
	skip webWorkerTsConfig for unit-test builder test targets
	use the generated class name when declaring in an NgModule

@​angular/cli

Commit	Description
	keep schematic positional arguments in index order
	only load autocompletion in interactive shells

@​angular/build

Commit	Description
	add integrity metadata for all initial chunks beyond the module preload limit
	align lazy route entry names with workspace root for SSR modulepreload
	attach location to Sass errors and guard stack parsing
	correct typos and spacing in error and warning messages
	invalidate Vite module cache for removed dev server output files
	match proxy glob patterns against URL pathname only
	name the provider packages in the unit-test browsers error
	preserve diagnostic locations at offset 0 and guard empty files
	support quotes in styles and polyfills paths
	use component file path in inline stylesheet diagnostic locations
	use distinct chunk naming for web worker bundles
	watch only explicitly added paths in chokidar watcher
	avoid reading external component stylesheets twice

@​angular/ssr

Commit	Description
	resolve query parameter placeholders in redirect targets (#34321)
	resolve route parameters in redirect targets (#34321)
	use only the first value of the X-Forwarded-Prefix header

22.2.3

@​schematics/angular

Commit	Description
	keep the workspace build version in the use-application-builder migration

@​angular/cli

Commit	Description
	accept multi-digit array indices in ng config
	keep ng version working when the package manager is not installed
	resolve package name in npm workspace members

@​angular-devkit/schematics

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

22.2.4 (2026-10-22)

@​angular/cli

Commit	Type	Description
63e45bcfe	fix	keep schematic positional arguments in index order
6053771cb	fix	only load autocompletion in interactive shells

@​schematics/angular

Commit	Type	Description
eec8dc049	fix	apply viewEncapsulation to generated application components
3a549925e	fix	correct error and warning messages in environments schematic
fe119a7c7	fix	show routing module suffixes in findModule error
36d988001	fix	skip webWorkerTsConfig for unit-test builder test targets
460167cd3	fix	use the generated class name when declaring in an NgModule

@​angular/build

Commit	Type	Description
c235a9554	fix	add integrity metadata for all initial chunks beyond the module preload limit
80c7480b4	fix	align lazy route entry names with workspace root for SSR modulepreload
b94627706	fix	attach location to Sass errors and guard stack parsing
0dc103735	fix	correct typos and spacing in error and warning messages
3e464c3f5	fix	invalidate Vite module cache for removed dev server output files
7d9ba6280	fix	match proxy glob patterns against URL pathname only
3aa7e93cc	fix	name the provider packages in the unit-test browsers error
e78cf0ae9	fix	preserve diagnostic locations at offset 0 and guard empty files
b3baa20c6	fix	support quotes in styles and polyfills paths
648aff9eb	fix	use component file path in inline stylesheet diagnostic locations
a9bec13b5	fix	use distinct chunk naming for web worker bundles
a05723948	fix	watch only explicitly added paths in chokidar watcher
35702a598	perf	avoid reading external component stylesheets twice

@​angular/ssr

Commit	Type	Description
3beb2551c	fix	resolve query parameter placeholders in redirect targets (#34321)
ff3f3727a	fix	resolve route parameters in redirect targets (#34321)
d365b0008	fix	use only the first value of the X-Forwarded-Prefix header

22.2.3 (2026-10-15)

... (truncated)

Commits

• 8acfd85 release: cut the v22.2.4 release
• 35702a5 perf(@​angular/build): avoid reading external component stylesheets twice
• 648aff9 fix(@​angular/build): use component file path in inline stylesheet diagnostic ...
• 3aa7e93 fix(@​angular/build): name the provider packages in the unit-test browsers e...
• 460167c fix(@​schematics/angular): use the generated class name when declaring in an N...
• 3beb255 fix(@​angular/ssr): resolve query parameter placeholders in redirect targets (...
• ff3f372 fix(@​angular/ssr): resolve route parameters in redirect targets (#34321)
• b946277 fix(@​angular/build): attach location to Sass errors and guard stack parsing
• 85b4d06 build: update cross-repo angular dependencies
• 9ab3df4 docs(@​angular/cli): generalize project argument description for architect c...
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​angular-devkit/​build-angular@​22.1.9 ⏵ 22.2.4			+1	+2

View full report