@svelte-vitals/vite 0.36.2 → 0.36.3

package/dist/hooks/index.js

@@ -1,4 +1,4 @@
-import { a as parseHtmlHead, r as toOccurrenceMap, t as isLoopbackOrigin } from "../loopback-OZjFnUGp.js";
+import { i as toOccurrenceMap, o as parseHtmlHead, t as isLoopbackOrigin } from "../loopback-CE47i4VD.js";
 import { defineConfig } from "@svelte-vitals/core";
 import { allRules, defaultProject, effectiveSeverity, formatFailedRuleWarning, isPenalized, runAnalysis, selectRules, terminalSafe } from "@svelte-vitals/core/internal";
 import { DEV } from "esm-env";

package/dist/index.js

@@ -1,4 +1,4 @@
-import { i as globFiles, n as collectRenderedHeads, t as isLoopbackOrigin } from "./loopback-OZjFnUGp.js";
+import { a as globFiles, n as isSameOrigin, r as collectRenderedHeads, t as isLoopbackOrigin } from "./loopback-CE47i4VD.js";
 import { existsSync, readFileSync } from "node:fs";
 import { access, mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
@@ -304,6 +304,7 @@ const SEVERITIES = /* @__PURE__ */ new Set([
 	"info"
 ]);
 const CATEGORY_SET = new Set(CATEGORIES);
+const INGEST_BODY_LIMIT = 4194304;
 function isOptionalString(v) {
 	return v === void 0 || typeof v === "string";
 }
@@ -344,7 +345,8 @@ function installUiMiddleware(server, config, version, store, coreVersion, getSta
 		const url = req.url ?? "/";
 		const origin = req.headers.origin;
 		const host = req.headers.host;
-		if (typeof origin === "string" && !isLoopbackOrigin(origin) || host === void 0 || !isLoopbackOrigin(`http://${host}`)) {
+		const isTls = Boolean(req.socket?.encrypted);
+		if (host === void 0 || !isLoopbackOrigin(`http://${host}`) || typeof origin === "string" && !isSameOrigin(origin, host, isTls)) {
 			req.resume();
 			res.statusCode = 403;
 			res.end("svelte-vitals dev UI is only available from localhost");
@@ -352,8 +354,23 @@ function installUiMiddleware(server, config, version, store, coreVersion, getSta
 		}
 		if (req.method === "POST" && url.startsWith("/ingest")) {
 			const chunks = [];
-			req.on("data", (c) => chunks.push(c));
+			let received = 0;
+			let tooLarge = false;
+			req.on("data", (c) => {
+				if (tooLarge) return;
+				received += c.length;
+				if (received > INGEST_BODY_LIMIT) {
+					tooLarge = true;
+					chunks.length = 0;
+					res.statusCode = 413;
+					res.end();
+					req.destroy();
+					return;
+				}
+				chunks.push(c);
+			});
 			req.on("end", () => {
+				if (tooLarge) return;
 				try {
 					const { route, results, failedRuleIds } = JSON.parse(Buffer.concat(chunks).toString("utf8"));
 					if (typeof route === "string" && Array.isArray(results)) {

package/dist/{loopback-OZjFnUGp.js → loopback-CE47i4VD.js}

@@ -303,5 +303,26 @@ function isLoopbackOrigin(origin) {
 		return false;
 	}
 }
+/**
+* Whether `origin` (an Origin header value) names exactly the server this request reached —
+* `host` is the Host header, `hostname[:port]`, and `secure` is whether the connection is TLS.
+* Compared as hostname + effective port: each side's omitted port resolves to its own scheme's
+* default (the Origin's from its URL scheme, the Host's from `secure`), so `https://localhost`
+* never matches a plain-http server on :80 and `https://localhost:443` does match a TLS server
+* whose Host is `localhost:443`. The Origin's scheme is otherwise not compared: under
+* `server.https` the Origin is https while the Host header is unchanged.
+*/
+function isSameOrigin(origin, host, secure = false) {
+	try {
+		const o = new URL(origin);
+		const h = new URL(`${secure ? "https" : "http"}://${host}`);
+		return o.hostname === h.hostname && effectivePort(o) === effectivePort(h);
+	} catch {
+		return false;
+	}
+}
+function effectivePort(url) {
+	return url.port || (url.protocol === "https:" ? "443" : "80");
+}
 //#endregion
-export { parseHtmlHead as a, globFiles as i, collectRenderedHeads as n, toOccurrenceMap as r, isLoopbackOrigin as t };
+export { globFiles as a, toOccurrenceMap as i, isSameOrigin as n, parseHtmlHead as o, collectRenderedHeads as r, isLoopbackOrigin as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svelte-vitals/vite",
-  "version": "0.36.2",
+  "version": "0.36.3",
   "description": "Vite/SvelteKit plugin for svelte-vitals — analyzes prerendered HTML during vite build, plus a live dev dashboard.",
   "type": "module",
   "license": "MIT",
@@ -43,9 +43,9 @@
     "node-html-parser": "^9.0.2"
   },
   "peerDependencies": {
-    "@svelte-vitals/core": "^0.51.0",
+    "@svelte-vitals/core": "^0.51.1",
     "@sveltejs/kit": "^2.70.3",
-    "svelte-vitals": "^0.54.2",
+    "svelte-vitals": "^0.54.3",
     "vite": "^8.2.2"
   },
   "peerDependenciesMeta": {
@@ -54,12 +54,12 @@
     }
   },
   "devDependencies": {
-    "@svelte-vitals/core": "0.51.0",
+    "@svelte-vitals/core": "0.51.1",
     "@sveltejs/kit": "^2.70.3",
     "@types/node": "^24.13.3",
-    "happy-dom": "^20.11.15",
+    "happy-dom": "^20.12.0",
     "svelte": "^5.57.0",
-    "svelte-vitals": "0.54.2",
+    "svelte-vitals": "0.54.3",
     "vite": "^8.2.2"
   },
   "scripts": {