nitropack-nightly 2.11.1-20250305-104627.47febf5c → 2.11.1-20250305-120920.c9d10320

package/dist/core/index.mjs

@@ -40,7 +40,7 @@ import { gzipSize } from 'gzip-size';
 import prettyBytes from 'pretty-bytes';
 import zlib from 'node:zlib';
 import { walk, parse } from 'ultrahtml';
-import { createError, setResponseHeaders, getRequestURL, sendRedirect, setResponseStatus, getResponseHeader, setResponseHeader, send, getRequestHeader, getRequestHeaders, eventHandler, toNodeListener, createApp, fromNodeMiddleware } from 'h3';
+import { createError, setResponseHeaders, getRequestURL, sendRedirect, setResponseStatus, getResponseHeader, setResponseHeader, send, getRequestHeader, getRequestHeaders, eventHandler, getRequestIP, toNodeListener, createApp, fromNodeMiddleware } from 'h3';
 import { Worker } from 'node:worker_threads';
 import { createProxyServer } from 'httpxy';
 import { resolve as resolve$1, dirname as dirname$1 } from 'node:path';
@@ -2436,6 +2436,14 @@ function fmtFrame(frame) {
 
 function createVFSHandler(nitro) {
   return eventHandler(async (event) => {
+    const ip = getRequestIP(event, { xForwardedFor: false });
+    const isLocalRequest = ip && /^::1$|^127\.\d+\.\d+\.\d+$/.test(ip);
+    if (!isLocalRequest) {
+      throw createError({
+        message: `Forbidden IP: "${ip || "?"}"`,
+        statusCode: 403
+      });
+    }
     const vfsEntries = {
       ...nitro.vfs,
       ...nitro.options.virtual

package/dist/meta/index.d.mts

@@ -1,3 +1,3 @@
-const version = "2.11.1-20250305-104627.47febf5c";
+const version = "2.11.1-20250305-120920.c9d10320";
 
 export { version };

package/dist/meta/index.d.ts

@@ -1,3 +1,3 @@
-const version = "2.11.1-20250305-104627.47febf5c";
+const version = "2.11.1-20250305-120920.c9d10320";
 
 export { version };

package/dist/meta/index.mjs

@@ -1,3 +1,3 @@
-const version = "2.11.1-20250305-104627.47febf5c";
+const version = "2.11.1-20250305-120920.c9d10320";
 
 export { version };

package/dist/runtime/internal/app.mjs

@@ -2,7 +2,6 @@ import destr from "destr";
 import {
   createApp,
   createRouter,
-  eventHandler,
   fetchWithEvent,
   isEvent,
   lazyEventHandler,
@@ -46,6 +45,27 @@ function createNitroApp() {
       return errorHandler(error, event);
     },
     onRequest: async (event) => {
+      event.context.nitro = event.context.nitro || { errors: [] };
+      const envContext = event.node.req?.__unenv__;
+      if (envContext) {
+        Object.assign(event.context, envContext);
+      }
+      event.fetch = (req, init) => fetchWithEvent(event, req, init, { fetch: localFetch });
+      event.$fetch = (req, init) => fetchWithEvent(event, req, init, {
+        fetch: $fetch
+      });
+      event.waitUntil = (promise) => {
+        if (!event.context.nitro._waitUntilPromises) {
+          event.context.nitro._waitUntilPromises = [];
+        }
+        event.context.nitro._waitUntilPromises.push(promise);
+        if (envContext?.waitUntil) {
+          envContext.waitUntil(promise);
+        }
+      };
+      event.captureError = (error, context) => {
+        captureError(error, { event, ...context });
+      };
       await nitroApp.hooks.callHook("request", event).catch((error) => {
         captureError(error, { event, tags: ["request"] });
       });
@@ -83,31 +103,6 @@ function createNitroApp() {
   });
   globalThis.$fetch = $fetch;
   h3App.use(createRouteRulesHandler({ localFetch }));
-  h3App.use(
-    eventHandler((event) => {
-      event.context.nitro = event.context.nitro || { errors: [] };
-      const envContext = event.node.req?.__unenv__;
-      if (envContext) {
-        Object.assign(event.context, envContext);
-      }
-      event.fetch = (req, init) => fetchWithEvent(event, req, init, { fetch: localFetch });
-      event.$fetch = (req, init) => fetchWithEvent(event, req, init, {
-        fetch: $fetch
-      });
-      event.waitUntil = (promise) => {
-        if (!event.context.nitro._waitUntilPromises) {
-          event.context.nitro._waitUntilPromises = [];
-        }
-        event.context.nitro._waitUntilPromises.push(promise);
-        if (envContext?.waitUntil) {
-          envContext.waitUntil(promise);
-        }
-      };
-      event.captureError = (error, context) => {
-        captureError(error, { event, ...context });
-      };
-    })
-  );
   for (const h of handlers) {
     let handler = h.lazy ? lazyEventHandler(h.handler) : h.handler;
     if (h.middleware || !h.route) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nitropack-nightly",
-  "version": "2.11.1-20250305-104627.47febf5c",
+  "version": "2.11.1-20250305-120920.c9d10320",
   "description": "Build and Deploy Universal JavaScript Servers",
   "repository": "nitrojs/nitro",
   "license": "MIT",