vite 4.5.10 → 4.5.12

package/dist/node/chunks/{dep-413616b5.js → dep-5215c85e.js}

@@ -1,4 +1,4 @@
-import { F as commonjsGlobal, E as getDefaultExportFromCjs } from './dep-add429cd.js';
+import { F as commonjsGlobal, E as getDefaultExportFromCjs } from './dep-845e3752.js';
 import require$$0__default from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/chunks/{dep-add429cd.js → dep-845e3752.js}

@@ -16068,8 +16068,8 @@ class MagicString {
 }
 
 const assetUrlRE = /__VITE_ASSET__([a-z\d]+)__(?:\$_(.*?)__)?/g;
-const rawRE = /(?:\?|&)raw(?:&|$)/;
-const urlRE = /(\?|&)url(?:&|$)/;
+const rawRE$1 = /(?:\?|&)raw(?:&|$)/;
+const urlRE$1 = /(\?|&)url(?:&|$)/;
 const jsSourceMapRE = /\.[cm]?js\.map$/;
 const unnededFinalQueryCharRE = /[?&]$/;
 const assetCache = new WeakMap();
@@ -16136,7 +16136,7 @@ function assetPlugin(config) {
             generatedAssets.set(config, new Map());
         },
         resolveId(id) {
-            if (!config.assetsInclude(cleanUrl(id)) && !urlRE.test(id)) {
+            if (!config.assetsInclude(cleanUrl(id)) && !urlRE$1.test(id)) {
                 return;
             }
             // imports to absolute urls pointing to files in /public
@@ -16153,15 +16153,15 @@ function assetPlugin(config) {
                 return;
             }
             // raw requests, read from disk
-            if (rawRE.test(id)) {
+            if (rawRE$1.test(id)) {
                 const file = checkPublicFile(id, config) || cleanUrl(id);
                 // raw query, read file and return as string
                 return `export default ${JSON.stringify(await fsp.readFile(file, 'utf-8'))}`;
             }
-            if (!config.assetsInclude(cleanUrl(id)) && !urlRE.test(id)) {
+            if (!config.assetsInclude(cleanUrl(id)) && !urlRE$1.test(id)) {
                 return;
             }
-            id = id.replace(urlRE, '$1').replace(unnededFinalQueryCharRE, '');
+            id = id.replace(urlRE$1, '$1').replace(unnededFinalQueryCharRE, '');
             const url = await fileToUrl(id, config, this);
             return `export default ${JSON.stringify(url)}`;
         },
@@ -38224,7 +38224,7 @@ const cssModuleRE = new RegExp(`\\.module${CSS_LANGS_RE.source}`);
 const directRequestRE = /[?&]direct\b/;
 const htmlProxyRE = /[?&]html-proxy\b/;
 const commonjsProxyRE = /\?commonjs-proxy/;
-const inlineRE = /[?&]inline\b/;
+const inlineRE$1 = /[?&]inline\b/;
 const inlineCSSRE = /[?&]inline-css\b/;
 const styleAttrRE = /[?&]style-attr\b/;
 const usedRE = /[?&]used\b/;
@@ -38315,7 +38315,7 @@ function cssPlugin(config) {
                 const thisModule = moduleGraph.getModuleById(id);
                 if (thisModule) {
                     // CSS modules cannot self-accept since it exports values
-                    const isSelfAccepting = !modules && !inlineRE.test(id) && !htmlProxyRE.test(id);
+                    const isSelfAccepting = !modules && !inlineRE$1.test(id) && !htmlProxyRE.test(id);
                     if (deps) {
                         // record deps in the module graph so edits to @import css can trigger
                         // main import to hot update
@@ -38394,7 +38394,7 @@ function cssPostPlugin(config) {
                 return;
             }
             css = stripBomTag(css);
-            const inlined = inlineRE.test(id);
+            const inlined = inlineRE$1.test(id);
             const modules = cssModulesCache.get(config).get(id);
             // #6984, #7552
             // `foo.module.css` => modulesCode
@@ -38995,8 +38995,8 @@ function createCachedImport(imp) {
         return cached;
     };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-f75a2f53.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-413616b5.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-faa9987b.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-5215c85e.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 /**
  * @experimental
@@ -41988,7 +41988,7 @@ function importAnalysisPlugin(config) {
                     // warn imports to non-asset /public files
                     if (specifier[0] === '/' &&
                         !(config.assetsInclude(cleanUrl(specifier)) ||
-                            urlRE.test(specifier)) &&
+                            urlRE$1.test(specifier)) &&
                         checkPublicFile(specifier, config)) {
                         throw new Error(`Cannot import non-asset file ${specifier} which is inside /public. ` +
                             `JS/CSS files inside /public are copied as-is on build and ` +
@@ -42412,6 +42412,7 @@ function serializeDefine(define) {
 }
 
 const wasmHelperId = '\0vite/wasm-helper';
+const wasmInitRE = /(?<![?#].*)\.wasm\?init/;
 const wasmHelper = async (opts = {}, url) => {
     let result;
     if (url.startsWith('data:')) {
@@ -42464,7 +42465,7 @@ const wasmHelperPlugin = (config) => {
             if (id === wasmHelperId) {
                 return `export default ${wasmHelperCode}`;
             }
-            if (!id.endsWith('.wasm?init')) {
+            if (!wasmInitRE.test(id)) {
                 return;
             }
             const url = await fileToUrl(id, config, this);
@@ -54853,6 +54854,7 @@ function setClientErrorHandler(server, logger) {
 
 const ERR_LOAD_URL = 'ERR_LOAD_URL';
 const ERR_LOAD_PUBLIC_URL = 'ERR_LOAD_PUBLIC_URL';
+const ERR_DENIED_ID = 'ERR_DENIED_ID';
 const debugLoad = createDebugger('vite:load');
 const debugTransform = createDebugger('vite:transform');
 const debugCache$1 = createDebugger('vite:cache');
@@ -54950,6 +54952,11 @@ async function loadAndTransform(id, url, server, options, timestamp, mod, resolv
     const prettyUrl = debugLoad || debugTransform ? prettifyUrl(url, config.root) : '';
     const ssr = !!options.ssr;
     const file = cleanUrl(id);
+    if (options.allowId && !options.allowId(id)) {
+        const err = new Error(`Denied ID ${id}`);
+        err.code = ERR_DENIED_ID;
+        throw err;
+    }
     let code = null;
     let map = null;
     // load
@@ -64490,6 +64497,18 @@ function htmlFallbackMiddleware(root, spaFallback) {
 const debugCache = createDebugger('vite:cache');
 const knownIgnoreList = new Set(['/', '/favicon.ico']);
 const trailingQuerySeparatorsRE = /[?&]+$/;
+// TODO: consolidate this regex pattern with the url, raw, and inline checks in plugins
+const urlRE = /[?&]url\b/;
+const rawRE = /[?&]raw\b/;
+const inlineRE = /[?&]inline\b/;
+const svgRE = /\.svg\b/;
+function deniedServingAccessForTransform(url, server, res, next) {
+    return ((rawRE.test(url) ||
+        urlRE.test(url) ||
+        inlineRE.test(url) ||
+        svgRE.test(url)) &&
+        !ensureServingAccess(url, server, res, next));
+}
 function transformMiddleware(server) {
     const { config: { root, logger }, moduleGraph, } = server;
     // Keep the named function. The name is visible in debug logs via `DEBUG=connect:dispatcher ...`
@@ -64586,9 +64605,7 @@ function transformMiddleware(server) {
                 }
             }
             const urlWithoutTrailingQuerySeparators = url.replace(trailingQuerySeparatorsRE, '');
-            if ((rawRE.test(urlWithoutTrailingQuerySeparators) ||
-                urlRE.test(urlWithoutTrailingQuerySeparators)) &&
-                !ensureServingAccess(urlWithoutTrailingQuerySeparators, server, res, next)) {
+            if (deniedServingAccessForTransform(urlWithoutTrailingQuerySeparators, server, res, next)) {
                 return;
             }
             if (isJSRequest(url) ||
@@ -64619,6 +64636,9 @@ function transformMiddleware(server) {
                 // resolve, load and transform using the plugin container
                 const result = await transformRequest(url, server, {
                     html: req.headers.accept?.includes('text/html'),
+                    allowId(id) {
+                        return !deniedServingAccessForTransform(id, server, res, next);
+                    },
                 });
                 if (result) {
                     const depsOptimizer = getDepsOptimizer(server.config, false); // non-ssr
@@ -64680,6 +64700,10 @@ function transformMiddleware(server) {
                 // Let other middleware handle if we can't load the url via transformRequest
                 return next();
             }
+            if (e?.code === ERR_DENIED_ID) {
+                // next() is called in ensureServingAccess
+                return;
+            }
             return next(e);
         }
         next();

package/dist/node/chunks/{dep-f75a2f53.js → dep-faa9987b.js}

@@ -1,4 +1,4 @@
-import { E as getDefaultExportFromCjs } from './dep-add429cd.js';
+import { E as getDefaultExportFromCjs } from './dep-845e3752.js';
 import require$$0 from 'path';
 import require$$0__default from 'fs';
 import { l as lib } from './dep-c423598f.js';

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { C as colors, D as bindShortcuts, x as createLogger, h as resolveConfig } from './chunks/dep-add429cd.js';
+import { C as colors, D as bindShortcuts, x as createLogger, h as resolveConfig } from './chunks/dep-845e3752.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -759,7 +759,7 @@ cli
     filterDuplicateOptions(options);
     // output structure is preserved even after bundling so require()
     // is ok here
-    const { createServer } = await import('./chunks/dep-add429cd.js').then(function (n) { return n.I; });
+    const { createServer } = await import('./chunks/dep-845e3752.js').then(function (n) { return n.I; });
     try {
         const server = await createServer({
             root,
@@ -837,7 +837,7 @@ cli
     .option('-w, --watch', `[boolean] rebuilds when modules have changed on disk`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { build } = await import('./chunks/dep-add429cd.js').then(function (n) { return n.H; });
+    const { build } = await import('./chunks/dep-845e3752.js').then(function (n) { return n.H; });
     const buildOptions = cleanOptions(options);
     try {
         await build({
@@ -865,7 +865,7 @@ cli
     .option('--force', `[boolean] force the optimizer to ignore the cache and re-bundle`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-add429cd.js').then(function (n) { return n.G; });
+    const { optimizeDeps } = await import('./chunks/dep-845e3752.js').then(function (n) { return n.G; });
     try {
         const config = await resolveConfig({
             root,
@@ -892,7 +892,7 @@ cli
     .option('--outDir <dir>', `[string] output directory (default: dist)`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-add429cd.js').then(function (n) { return n.J; });
+    const { preview } = await import('./chunks/dep-845e3752.js').then(function (n) { return n.J; });
     try {
         const server = await preview({
             root,

package/dist/node/index.d.ts

@@ -2567,6 +2567,7 @@ export declare namespace Terser {
 export declare interface TransformOptions {
     ssr?: boolean;
     html?: boolean;
+    /* Excluded from this release type: allowId */
 }
 
 export declare interface TransformResult {

package/dist/node/index.js

@@ -1,5 +1,5 @@
-import { i as isInNodeModules } from './chunks/dep-add429cd.js';
-export { b as build, e as buildErrorMessage, v as createFilter, x as createLogger, c as createServer, g as defineConfig, f as formatPostcssSourceMap, k as getDepOptimizationConfig, m as isDepsOptimizerEnabled, z as isFileServingAllowed, l as loadConfigFromFile, A as loadEnv, u as mergeAlias, q as mergeConfig, n as normalizePath, o as optimizeDeps, a as preprocessCSS, p as preview, j as resolveBaseUrl, h as resolveConfig, B as resolveEnvPrefix, d as resolvePackageData, r as resolvePackageEntry, y as searchForWorkspaceRoot, w as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-add429cd.js';
+import { i as isInNodeModules } from './chunks/dep-845e3752.js';
+export { b as build, e as buildErrorMessage, v as createFilter, x as createLogger, c as createServer, g as defineConfig, f as formatPostcssSourceMap, k as getDepOptimizationConfig, m as isDepsOptimizerEnabled, z as isFileServingAllowed, l as loadConfigFromFile, A as loadEnv, u as mergeAlias, q as mergeConfig, n as normalizePath, o as optimizeDeps, a as preprocessCSS, p as preview, j as resolveBaseUrl, h as resolveConfig, B as resolveEnvPrefix, d as resolvePackageData, r as resolvePackageEntry, y as searchForWorkspaceRoot, w as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-845e3752.js';
 export { VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 export { VERSION as rollupVersion } from 'rollup';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "4.5.10",
+  "version": "4.5.12",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",