Security fix:

This version contains a security fix, which is also breaking change if you have an insecure configuration.
We are releasing this breaking change as patch version to protect you from attacks.
Sorry if this breaks your setup, but the fix is easy.

We removed setting Access-Control-Allow-Origin to * be default. This allowed evil websites to access your assets.
Instead we ask you to set Access-Control-Allow-Origin manually to your host if required in your setup.
Use the headers option to do so.

middleware(compiler, {
    headers: {
        "Access-Control-Allow-Origin": "your-host"
    }
})

Read more about CORS here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS

Bugfixes:

• Remove Access-Control-Allow-Origin = * default

The new version differs by 10 commits0.

• 9b03d79 1.10.2
• c59b3b3 Merge remote-tracking branch 'remotes/origin/add-node-7-travis'
• 626a35a remove security risk
• 798b2f1 Avoid setting http status code explicitly (#175)
• 1e01626 adding node 7 to travis config (#185)
• d986c2e Merge pull request #176 from piperchester/patch-1
• 9b9ffee fixing some number typos in the tests
• d3dfe67 adding node 7 to travis config
• 0ce28c7 Fix link to Kees
• bd6a593 use decodeURIComponent for getFilenameFromUrl final output (#173)

false

See the full diff

There is a collection of frequently asked questions and of course you may always ask my humans.