fix(hot): require a leading slash in the hot path and serialize publishes once

A path without a leading slash validated but could never match a
request, since URL pathnames always start with one — the schema now
enforces it. publish() also serializes the payload once per event
instead of once per connected client.

Author: bjohansebas

src/hot.js

@@ -146,8 +146,10 @@ function createEventStream(heartbeat, logger) {
       });
     },
     publish(payload) {
+      const frame = `data: ${JSON.stringify(payload)}\n\n`;
+
       everyClient((client) => {
-        client.write(`data: ${JSON.stringify(payload)}\n\n`);
+        client.write(frame);
       });
     },
     publishTo(res, payload) {

src/options.json

@@ -190,9 +190,9 @@
           "additionalProperties": false,
           "properties": {
             "path": {
-              "description": "The path the SSE endpoint is served at.",
+              "description": "The path the SSE endpoint is served at. Must start with a slash.",
               "type": "string",
-              "minLength": 1
+              "pattern": "^/"
             },
             "heartbeat": {
               "description": "Heartbeat interval (in milliseconds) used to keep the SSE connection alive.",

test/__snapshots__/validation-options.test.js.snap.webpack5

@@ -89,8 +89,14 @@ exports[`validation should throw an error on the "hot" option with "{"heartbeat"
 
 exports[`validation should throw an error on the "hot" option with "{"path":""}" value 1`] = `
 "Invalid options object. Dev Middleware has been initialized using an options object that does not match the API schema.
- - options.hot.path should be a non-empty string.
-   -> The path the SSE endpoint is served at."
+ - options.hot.path should match pattern "^/".
+   -> The path the SSE endpoint is served at. Must start with a slash."
+`;
+
+exports[`validation should throw an error on the "hot" option with "{"path":"hmr"}" value 1`] = `
+"Invalid options object. Dev Middleware has been initialized using an options object that does not match the API schema.
+ - options.hot.path should match pattern "^/".
+   -> The path the SSE endpoint is served at. Must start with a slash."
 `;
 
 exports[`validation should throw an error on the "hot" option with "{"statsOptions":"errors-only"}" value 1`] = `

test/hot.test.js

@@ -110,6 +110,23 @@ describe("hot middleware (unit)", () => {
       expect(pathMatch("/__webpack_hmr/extra", "/__webpack_hmr")).toBe(false);
     });
 
+    it("strips a fragment", () => {
+      expect(pathMatch("/__webpack_hmr#section", "/__webpack_hmr")).toBe(true);
+    });
+
+    it("matches absolute urls by pathname", () => {
+      expect(
+        pathMatch(
+          "http://localhost:3000/__webpack_hmr?name=app",
+          "/__webpack_hmr",
+        ),
+      ).toBe(true);
+    });
+
+    it("does not mistake a protocol-relative host for a pathname", () => {
+      expect(pathMatch("//__webpack_hmr", "/__webpack_hmr")).toBe(false);
+    });
+
     it("returns false when url is undefined", () => {
       expect(pathMatch(undefined, "/__webpack_hmr")).toBe(false);
     });

test/validation-options.test.js

@@ -98,6 +98,9 @@ describe("validation", () => {
         "foo",
         0,
         { path: "" },
+        // Would validate but never match a request: pathnames always start
+        // with a slash.
+        { path: "hmr" },
         { heartbeat: -1 },
         // 0 would silently fall back to the default interval — reject it.
         { heartbeat: 0 },