nitro-nightly 3.0.1-20251116-134446-b005d480 → 3.0.1-20251116-145822-c2b81c72

package/dist/_libs/knitwork.mjs

@@ -1,4 +1,4 @@
-//#region node_modules/.pnpm/knitwork@1.2.0/node_modules/knitwork/dist/index.mjs
+//#region node_modules/.pnpm/knitwork@1.3.0/node_modules/knitwork/dist/index.mjs
 function genString(input, options = {}) {
 	const str = JSON.stringify(input);
 	if (!options.singleQuotes) return str;
@@ -68,6 +68,7 @@ const reservedNames = /* @__PURE__ */ new Set([
 	"with",
 	"yield"
 ]);
+const VALID_IDENTIFIER_RE = /^[$_]?([A-Z_a-z]\w*|\d)$/;
 function _genStatement(type, specifier, names, options = {}) {
 	const specifierString = genString(specifier, options);
 	if (!names) return `${type} ${specifierString};`;
@@ -96,7 +97,6 @@ function wrapInDelimiters(lines, indent = "", delimiters = "{}", withComma = tru
 ` + lines.join(withComma ? ",\n" : "\n") + `
 ${indent}${end}`;
 }
-const VALID_IDENTIFIER_RE = /^[$_]?([A-Z_a-z]\w*|\d)$/;
 function genObjectKey(key) {
 	return VALID_IDENTIFIER_RE.test(key) ? key : genString(key);
 }

package/dist/_presets.mjs

@@ -1420,6 +1420,16 @@ function generateBuildConfig(nitro, o11Routes) {
 				if (routeRules.headers) route = defu(route, { headers: routeRules.headers });
 				return route;
 			}),
+			...nitro.options.vercel?.skewProtection && nitro.options.manifest?.deploymentId ? [{
+				src: "/.*",
+				has: [{
+					type: "header",
+					key: "Sec-Fetch-Dest",
+					value: "document"
+				}],
+				headers: { "Set-Cookie": `__vdpl=${nitro.options.manifest.deploymentId}; Path=${nitro.options.baseURL}; SameSite=Strict; Secure; HttpOnly` },
+				continue: true
+			}] : [],
 			...nitro.options.publicAssets.filter((asset) => !asset.fallthrough).map((asset) => joinURL(nitro.options.baseURL, asset.baseURL || "/")).map((baseURL) => ({
 				src: baseURL + "(.*)",
 				headers: { "cache-control": "public,max-age=31536000,immutable" },
@@ -1548,6 +1558,7 @@ async function writePrerenderConfig(filename, isrConfig, bypassToken) {
 const vercel = defineNitroPreset({
 	entry: "./vercel/runtime/vercel.{format}",
 	manifest: { deploymentId: process.env.VERCEL_DEPLOYMENT_ID },
+	vercel: { skewProtection: !!process.env.VERCEL_SKEW_PROTECTION_ENABLED },
 	output: {
 		dir: "{{ rootDir }}/.vercel/output",
 		serverDir: "{{ output.dir }}/functions/__server.func",
@@ -1582,6 +1593,7 @@ const vercel = defineNitroPreset({
 const vercelStatic = defineNitroPreset({
 	extends: "static",
 	manifest: { deploymentId: process.env.VERCEL_DEPLOYMENT_ID },
+	vercel: { skewProtection: !!process.env.VERCEL_SKEW_PROTECTION_ENABLED },
 	output: {
 		dir: "{{ rootDir }}/.vercel/output",
 		publicDir: "{{ output.dir }}/static/{{ baseURL }}"

package/dist/types/index.d.mts

@@ -1780,6 +1780,13 @@ interface VercelServerlessFunctionConfig {
 }
 interface VercelOptions {
   config: VercelBuildConfigV3;
+  /**
+   * If you have enabled skew protection in the Vercel dashboard, it will
+   * be enabled by default.
+   *
+   * You can disable the Nitro integration by setting this option to `false`.
+   */
+  skewProtection?: boolean;
   /**
    * If you are using `vercel-edge`, you can specify the region(s) for your edge function.
    * @see https://vercel.com/docs/concepts/functions/edge-functions#edge-function-regions

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nitro-nightly",
-  "version": "3.0.1-20251116-134446-b005d480",
+  "version": "3.0.1-20251116-145822-c2b81c72",
   "description": "Build and Deploy Universal JavaScript Servers",
   "homepage": "https://nitro.build",
   "repository": "nitrojs/nitro",
@@ -76,7 +76,7 @@
   "devDependencies": {
     "@azure/functions": "^3.5.1",
     "@azure/static-web-apps-cli": "^2.0.7",
-    "@cloudflare/workers-types": "^4.20251109.0",
+    "@cloudflare/workers-types": "^4.20251115.0",
     "@deno/types": "^0.0.1",
     "rollup": "^4.53.2",
     "@hiogawa/vite-plugin-fullstack": "npm:@pi0/vite-plugin-fullstack@0.0.5-pr-1297",
@@ -98,7 +98,7 @@
     "@types/node-fetch": "^2.6.13",
     "@types/semver": "^7.7.1",
     "@types/xml2js": "^0.4.14",
-    "@vitest/coverage-v8": "^4.0.8",
+    "@vitest/coverage-v8": "^4.0.9",
     "automd": "^0.4.2",
     "c12": "^3.3.1",
     "changelogen": "^0.6.2",
@@ -125,10 +125,10 @@
     "hookable": "6.0.0-rc.1",
     "httpxy": "^0.1.7",
     "klona": "^2.0.6",
-    "knitwork": "^1.2.0",
+    "knitwork": "^1.3.0",
     "magic-string": "^0.30.21",
     "mime": "^4.1.0",
-    "miniflare": "^4.20251105.0",
+    "miniflare": "^4.20251109.1",
     "mlly": "^1.8.0",
     "nypm": "^0.6.2",
     "obuild": "^0.4.1",
@@ -157,7 +157,7 @@
     "unimport": "^5.5.0",
     "untyped": "^2.0.0",
     "unwasm": "^0.5.0",
-    "vitest": "^4.0.8",
+    "vitest": "^4.0.9",
     "wrangler": "^4.46.0",
     "xml2js": "^0.6.2",
     "youch": "^4.1.0-beta.12",