@nuxt/nitro-server-nightly 4.4.7-29652037.eb785fd0 → 4.4.7-29673425.78b1e698

package/dist/index.mjs

@@ -15,13 +15,13 @@ import { build, copyPublicAssets, createDevServer, createNitro, prepare, prerend
 import { addPlugin, addTemplate, addVitePlugin, createIsIgnored, findPath, getDirectory, getLayerDirectories, logger, resolveAlias, resolveIgnorePatterns, resolveNuxtModule } from "@nuxt/kit";
 import escapeRE from "escape-string-regexp";
 import { defu } from "defu";
-import { defineEventHandler, dynamicEventHandler, handleCors, setHeader } from "h3";
+import { defineEventHandler, dynamicEventHandler, getRequestHeader, handleCors, setHeader, setResponseStatus } from "h3";
 import { addDependency } from "nypm";
 import { hasTTY, isCI, isWindows } from "std-env";
 import { ImpoundPlugin } from "impound";
 import { resolveModulePath } from "exsolve";
 import { runtimeDependencies } from "nitropack/runtime/meta";
-var version = "4.4.7-29652037.eb785fd0";
+var version = "4.4.7-29673425.78b1e698";
 function toArray(value) {
 	return Array.isArray(value) ? value : [value];
 }
@@ -455,7 +455,7 @@ async function bundle(nuxt) {
 					}).join(",")}}`;
 				}
 			})}
-      export default (path) => defu({}, ...matcher('', path).map(r => r.data).reverse())
+      export default (path) => defu({}, ...matcher('', typeof path === 'string' ? path.toLowerCase() : path).map(r => r.data).reverse())
       `;
 		}
 	});
@@ -794,10 +794,16 @@ async function bundle(nuxt) {
 		}
 		nitro.options.devHandlers.push({
 			route: "/.well-known/appspecific/com.chrome.devtools.json",
-			handler: defineEventHandler(() => ({ workspace: {
-				...projectConfiguration,
-				root: nuxt.options.rootDir
-			} }))
+			handler: defineEventHandler((event) => {
+				if (!isLocalDevRequest(event, getDevHandlerAllowedHosts(nuxt))) {
+					setResponseStatus(event, 403);
+					return "Forbidden";
+				}
+				return { workspace: {
+					...projectConfiguration,
+					root: nuxt.options.rootDir
+				} };
+			})
 		});
 	}
 	if (!nuxt.options.dev && nuxt.options.experimental.noVueServer) nitro.hooks.hook("rollup:before", (nitro) => {
@@ -901,6 +907,37 @@ async function spaLoadingTemplatePath(nuxt) {
 	if (typeof nuxt.options.spaLoadingTemplate === "string") return resolve(nuxt.options.srcDir, nuxt.options.spaLoadingTemplate);
 	return await findPath(nuxt.options._layers.map((layer) => resolve(layer.config.srcDir, layer.config.dir?.app || "app", "spa-loading-template.html"))) ?? resolve(nuxt.options.srcDir, nuxt.options.dir?.app || "app", "spa-loading-template.html");
 }
+const LOOPBACK_HOSTS = new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+function getDevHandlerAllowedHosts(nuxt) {
+	const allowedHosts = nuxt.options.vite?.server?.allowedHosts;
+	if (allowedHosts === true) return true;
+	const hosts = new Set(LOOPBACK_HOSTS);
+	if (Array.isArray(allowedHosts)) {
+		for (const host of allowedHosts) if (typeof host === "string" && host) hosts.add(host);
+	}
+	return hosts;
+}
+function isLocalDevRequest(event, allowedHosts) {
+	const hostHeader = getRequestHeader(event, "host");
+	if (allowedHosts !== true) {
+		const host = hostHeader?.split(":")[0];
+		if (!host || !allowedHosts.has(host)) return false;
+	}
+	const site = getRequestHeader(event, "sec-fetch-site");
+	if (site !== void 0) return site === "same-origin" || site === "none";
+	const initiator = getRequestHeader(event, "origin") || getRequestHeader(event, "referer");
+	if (!initiator) return true;
+	try {
+		return new URL(initiator).host === hostHeader;
+	} catch {
+		return false;
+	}
+}
 async function spaLoadingTemplate(nuxt) {
 	if (nuxt.options.spaLoadingTemplate === false) return "";
 	const spaLoadingTemplate = await spaLoadingTemplatePath(nuxt);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt/nitro-server-nightly",
-  "version": "4.4.7-29652037.eb785fd0",
+  "version": "4.4.7-29673425.78b1e698",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nuxt/nuxt.git",
@@ -27,9 +27,9 @@
   ],
   "dependencies": {
     "@nuxt/devalue": "^2.0.2",
-    "@nuxt/kit": "npm:@nuxt/kit-nightly@4.4.7-29652037.eb785fd0",
+    "@nuxt/kit": "npm:@nuxt/kit-nightly@4.4.7-29673425.78b1e698",
     "@unhead/vue": "^2.1.15",
-    "@vue/shared": "^3.5.34",
+    "@vue/shared": "^3.5.35",
     "consola": "^3.4.2",
     "defu": "^6.1.7",
     "destr": "^2.0.5",
@@ -50,7 +50,7 @@
     "ufo": "^1.6.4",
     "unctx": "^2.5.0",
     "unstorage": "^1.17.5",
-    "vue": "^3.5.34",
+    "vue": "^3.5.35",
     "vue-bundle-renderer": "^2.2.0",
     "vue-devtools-stub": "^0.1.0"
   },
@@ -58,7 +58,7 @@
     "@babel/plugin-proposal-decorators": "^7.25.0",
     "@babel/plugin-syntax-typescript": "^7.25.0",
     "@rollup/plugin-babel": "^6.0.0 || ^7.0.0",
-    "nuxt": "npm:nuxt-nightly@4.4.7-29652037.eb785fd0"
+    "nuxt": "npm:nuxt-nightly@4.4.7-29673425.78b1e698"
   },
   "peerDependenciesMeta": {
     "@babel/plugin-proposal-decorators": {
@@ -72,13 +72,13 @@
     }
   },
   "devDependencies": {
-    "@babel/plugin-proposal-decorators": "7.29.0",
-    "@babel/plugin-syntax-typescript": "7.28.6",
-    "@nuxt/schema": "npm:@nuxt/schema-nightly@4.4.7-29652037.eb785fd0",
-    "@rollup/plugin-babel": "7.0.0",
-    "nuxt": "npm:nuxt-nightly@4.4.7-29652037.eb785fd0",
-    "obuild": "0.4.35",
-    "vitest": "4.1.6"
+    "@babel/plugin-proposal-decorators": "7.29.7",
+    "@babel/plugin-syntax-typescript": "7.29.7",
+    "@nuxt/schema": "npm:@nuxt/schema-nightly@4.4.7-29673425.78b1e698",
+    "@rollup/plugin-babel": "7.1.0",
+    "nuxt": "npm:nuxt-nightly@4.4.7-29673425.78b1e698",
+    "obuild": "0.4.36",
+    "vitest": "4.1.7"
   },
   "engines": {
     "node": "^22.12.0 || ^24.11.0 || >=26.0.0"