unplugin-version-injector 2.2.1 → 2.3.0

package/dist/rspack.js

@@ -131,6 +131,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -138,11 +139,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -157,7 +164,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -183,13 +190,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -245,14 +260,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -268,6 +283,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -322,6 +338,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/rspack.mjs

@@ -124,6 +124,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -131,11 +132,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -150,7 +157,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -176,13 +183,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -238,14 +253,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -261,6 +276,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -315,6 +331,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/{types-Cc-nzIS0.d.mts → types-CLRw9rBI.d.mts}

@@ -21,6 +21,11 @@ interface VersionInjectorOptions {
      * 便于在后端日志中定位客户端版本。默认关闭；true 使用默认配置（仅同源）。
      */
     requestHeaders?: boolean | RequestHeadersOptions;
+    /**
+     * 给注入的内联 <script> 加上 CSP nonce（渲染为 `nonce="..."`）。
+     * 站点使用严格 CSP（script-src 带 nonce）时需设置，否则注入脚本会被 CSP 拦截。
+     */
+    nonce?: string;
 }
 
 export type { RequestHeadersOptions as R, VersionInjectorOptions as V };

package/dist/{types-Cc-nzIS0.d.ts → types-CLRw9rBI.d.ts}

@@ -21,6 +21,11 @@ interface VersionInjectorOptions {
      * 便于在后端日志中定位客户端版本。默认关闭；true 使用默认配置（仅同源）。
      */
     requestHeaders?: boolean | RequestHeadersOptions;
+    /**
+     * 给注入的内联 <script> 加上 CSP nonce（渲染为 `nonce="..."`）。
+     * 站点使用严格 CSP（script-src 带 nonce）时需设置，否则注入脚本会被 CSP 拦截。
+     */
+    nonce?: string;
 }
 
 export type { RequestHeadersOptions as R, VersionInjectorOptions as V };

package/dist/vite.d.mts

@@ -1,5 +1,5 @@
 import * as vite from 'vite';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.mjs';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.mjs';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => vite.Plugin<any> | vite.Plugin<any>[];
 

package/dist/vite.d.ts

@@ -1,5 +1,5 @@
 import * as vite from 'vite';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.js';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.js';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => vite.Plugin<any> | vite.Plugin<any>[];
 

package/dist/vite.js

@@ -131,6 +131,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -138,11 +139,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -157,7 +164,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -183,13 +190,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -245,14 +260,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -268,6 +283,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -322,6 +338,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/vite.mjs

@@ -124,6 +124,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -131,11 +132,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -150,7 +157,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -176,13 +183,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -238,14 +253,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -261,6 +276,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -315,6 +331,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/webpack.d.mts

@@ -1,5 +1,5 @@
 import * as webpack from 'webpack';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.mjs';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.mjs';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => webpack.WebpackPluginInstance;
 

package/dist/webpack.d.ts

@@ -1,5 +1,5 @@
 import * as webpack from 'webpack';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.js';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.js';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => webpack.WebpackPluginInstance;
 

package/dist/webpack.js

@@ -131,6 +131,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -138,11 +139,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -157,7 +164,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -183,13 +190,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -245,14 +260,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -268,6 +283,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -322,6 +338,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/webpack.mjs

@@ -124,6 +124,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -131,11 +132,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -150,7 +157,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -176,13 +183,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -238,14 +253,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -261,6 +276,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -315,6 +331,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unplugin-version-injector",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "author": "Nian Yi <nianyi778@gmail.com>",
   "license": "MIT",
   "description": "A universal plugin to inject version and build time into HTML (supports Vite, Webpack, Rspack, Rollup, Rolldown)",