vite 5.1.1 → 5.1.3

package/dist/node/chunks/{dep-XbJJvsnO.js → dep-PB-S7R_m.js}

@@ -1,4 +1,4 @@
-import { C as commonjsGlobal, B as getDefaultExportFromCjs } from './dep-94_H5fT6.js';
+import { C as commonjsGlobal, B as getDefaultExportFromCjs } from './dep-stQc5rCc.js';
 import require$$0__default from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/chunks/{dep-xESY8DUV.js → dep-ZEDYRkoC.js}

@@ -1,4 +1,4 @@
-import { B as getDefaultExportFromCjs } from './dep-94_H5fT6.js';
+import { B as getDefaultExportFromCjs } from './dep-stQc5rCc.js';
 import require$$0 from 'path';
 import require$$0__default from 'fs';
 import { l as lib } from './dep-8a-6Quh6.js';

package/dist/node/chunks/{dep-94_H5fT6.js → dep-stQc5rCc.js}

@@ -13077,6 +13077,21 @@ function sortObjectKeys(obj) {
     }
     return sorted;
 }
+function displayTime(time) {
+    // display: {X}ms
+    if (time < 1000) {
+        return `${time}ms`;
+    }
+    time = time / 1000;
+    // display: {X}s
+    if (time < 60) {
+        return `${time.toFixed(2)}s`;
+    }
+    const mins = parseInt((time / 60).toString());
+    const seconds = time % 60;
+    // display: {X}m {Y}s
+    return `${mins}m${seconds < 1 ? '' : ` ${seconds.toFixed(0)}s`}`;
+}
 
 /* eslint no-console: 0 */
 const LogLevels = {
@@ -13226,8 +13241,6 @@ function buildReporterPlugin(config) {
     let transformedCount = 0;
     let chunkCount = 0;
     let compressedCount = 0;
-    let startTime = Date.now();
-    let buildFailed = false;
     async function getCompressedSize(code) {
         if (config.build.ssr || !config.build.reportCompressedSize) {
             return null;
@@ -13270,14 +13283,10 @@ function buildReporterPlugin(config) {
             }
             return null;
         },
-        options() {
-            startTime = Date.now();
-        },
         buildStart() {
             transformedCount = 0;
         },
-        buildEnd(error) {
-            buildFailed = !!error;
+        buildEnd() {
             if (shouldLogInfo) {
                 if (tty) {
                     clearLine$1();
@@ -13424,11 +13433,6 @@ function buildReporterPlugin(config) {
                     `- Adjust chunk size limit for this warning via build.chunkSizeWarningLimit.`));
             }
         },
-        closeBundle() {
-            if (shouldLogInfo && !config.build.watch && !buildFailed) {
-                config.logger.info(`${colors$1.green(`✓ built in ${displayTime(Date.now() - startTime)}`)}`);
-            }
-        },
     };
 }
 function writeLine(output) {
@@ -13455,21 +13459,6 @@ function throttle(fn) {
         }, 100);
     };
 }
-function displayTime(time) {
-    // display: {X}ms
-    if (time < 1000) {
-        return `${time}ms`;
-    }
-    time = time / 1000;
-    // display: {X}s
-    if (time < 60) {
-        return `${time.toFixed(2)}s`;
-    }
-    const mins = parseInt((time / 60).toString());
-    const seconds = time % 60;
-    // display: {X}m {Y}s
-    return `${mins}m${seconds < 1 ? '' : ` ${seconds.toFixed(0)}s`}`;
-}
 
 const POSIX_SEP_RE = new RegExp('\\' + path$o.posix.sep, 'g');
 const NATIVE_SEP_RE = new RegExp('\\' + path$o.sep, 'g');
@@ -29603,7 +29592,7 @@ function stripLiteralDetailed(code, options) {
 var main$1 = {exports: {}};
 
 var name = "dotenv";
-var version$2 = "16.4.1";
+var version$2 = "16.4.2";
 var description = "Loads environment variables from .env file";
 var main = "lib/main.js";
 var types$2 = "lib/main.d.ts";
@@ -29634,7 +29623,7 @@ var repository = {
 	type: "git",
 	url: "git://github.com/motdotla/dotenv.git"
 };
-var funding = "https://github.com/motdotla/dotenv?sponsor=1";
+var funding = "https://dotenvx.com";
 var keywords$2 = [
 	"dotenv",
 	"env",
@@ -29743,7 +29732,7 @@ function _parseVault (options) {
   }
 
   // handle scenario for comma separated keys - for use with key rotation
-  // example: DOTENV_KEY="dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=prod,dotenv://:key_7890@dotenv.org/vault/.env.vault?environment=prod"
+  // example: DOTENV_KEY="dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=prod,dotenv://:key_7890@dotenvx.com/vault/.env.vault?environment=prod"
   const keys = _dotenvKey(options).split(',');
   const length = keys.length;
 
@@ -29807,7 +29796,7 @@ function _instructions (result, dotenvKey) {
     uri = new URL(dotenvKey);
   } catch (error) {
     if (error.code === 'ERR_INVALID_URL') {
-      const err = new Error('INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=development');
+      const err = new Error('INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development');
       err.code = 'INVALID_DOTENV_KEY';
       throw err
     }
@@ -30037,81 +30026,80 @@ main$1.exports.populate = DotenvModule.populate;
 
 main$1.exports = DotenvModule;
 
-// like String.prototype.search but returns the last index
-function _searchLast (str, rgx) {
-  const matches = Array.from(str.matchAll(rgx));
-  return matches.length > 0 ? matches.slice(-1)[0].index : -1
-}
+// * /
+// *   (\\)?            # is it escaped with a backslash?
+// *   (\$)             # literal $
+// *   (?!\()           # shouldnt be followed by parenthesis
+// *   (\{?)            # first brace wrap opening
+// *   ([\w.]+)         # key
+// *   (?::-((?:\$\{(?:\$\{(?:\$\{[^}]*\}|[^}])*}|[^}])*}|[^}])+))? # optional default nested 3 times
+// *   (\}?)            # last brace warp closing
+// * /xi
 
-function _interpolate (envValue, environment, config) {
-  // find the last unescaped dollar sign in the
-  // value so that we can evaluate it
-  const lastUnescapedDollarSignIndex = _searchLast(envValue, /(?!(?<=\\))\$/g);
+const DOTENV_SUBSTITUTION_REGEX = /(\\)?(\$)(?!\()(\{?)([\w.]+)(?::?-((?:\$\{(?:\$\{(?:\$\{[^}]*\}|[^}])*}|[^}])*}|[^}])+))?(\}?)/gi;
 
-  // If we couldn't match any unescaped dollar sign
-  // let's return the string as is
-  if (lastUnescapedDollarSignIndex === -1) return envValue
+function _resolveEscapeSequences (value) {
+  return value.replace(/\\\$/g, '$')
+}
 
-  // This is the right-most group of variables in the string
-  const rightMostGroup = envValue.slice(lastUnescapedDollarSignIndex);
+function interpolate (value, processEnv, parsed) {
+  return value.replace(DOTENV_SUBSTITUTION_REGEX, (match, escaped, dollarSign, openBrace, key, defaultValue, closeBrace) => {
+    if (escaped === '\\') {
+      return match.slice(1)
+    } else {
+      if (processEnv[key]) {
+        return processEnv[key]
+      }
 
-  /**
-   * This finds the inner most variable/group divided
-   * by variable name and default value (if present)
-   * (
-   *   (?!(?<=\\))\$        // only match dollar signs that are not escaped
-   *   {?                   // optional opening curly brace
-   *     ([\w]+)            // match the variable name
-   *     (?::-([^}\\]*))?   // match an optional default value
-   *   }?                   // optional closing curly brace
-   * )
-   */
-  const matchGroup = /((?!(?<=\\))\${?([\w]+)(?::-([^}\\]*))?}?)/;
-  const match = rightMostGroup.match(matchGroup);
-
-  if (match != null) {
-    const [, group, variableName, defaultValue] = match;
-
-    return _interpolate(
-      envValue.replace(
-        group,
-        environment[variableName] ||
-          defaultValue ||
-          config.parsed[variableName] ||
-          ''
-      ),
-      environment,
-      config
-    )
-  }
+      if (parsed[key]) {
+        return parsed[key]
+      }
 
-  return envValue
-}
+      if (defaultValue) {
+        if (defaultValue.startsWith('$')) {
+          return interpolate(defaultValue, processEnv, parsed)
+        } else {
+          return defaultValue
+        }
+      }
 
-function _resolveEscapeSequences (value) {
-  return value.replace(/\\\$/g, '$')
+      return ''
+    }
+  })
 }
 
-function expand (config) {
-  // if ignoring process.env, use a blank object
-  const environment = config.ignoreProcessEnv ? {} : process.env;
+function expand (options) {
+  let processEnv = process.env;
+  if (options && options.processEnv != null) {
+    processEnv = options.processEnv;
+  }
 
-  for (const configKey in config.parsed) {
-    const value = Object.prototype.hasOwnProperty.call(environment, configKey)
-      ? environment[configKey]
-      : config.parsed[configKey];
+  for (const key in options.parsed) {
+    let value = options.parsed[key];
 
-    config.parsed[configKey] = _resolveEscapeSequences(
-      _interpolate(value, environment, config)
-    );
+    const inProcessEnv = Object.prototype.hasOwnProperty.call(processEnv, key);
+
+    if (inProcessEnv) {
+      if (processEnv[key] === options.parsed[key]) {
+        // assume was set to processEnv from the .env file if the values match and therefore interpolate
+        value = interpolate(value, processEnv, options.parsed);
+      } else {
+        // do not interpolate - assume processEnv had the intended value even if containing a $.
+        value = processEnv[key];
+      }
+    } else {
+      // not inProcessEnv so assume interpolation for this .env key
+      value = interpolate(value, processEnv, options.parsed);
+    }
+
+    options.parsed[key] = _resolveEscapeSequences(value);
   }
 
-  // PATCH: don't write to process.env
-  // for (const processKey in config.parsed) {
-  //   environment[processKey] = config.parsed[processKey]
-  // }
+  for (const processKey in options.parsed) {
+    processEnv[processKey] = options.parsed[processKey];
+  }
 
-  return config
+  return options
 }
 
 var expand_1 = expand;
@@ -30148,9 +30136,10 @@ function loadEnv(mode, envDir, prefixes = 'VITE_') {
     if (parsed.BROWSER_ARGS && process.env.BROWSER_ARGS === undefined) {
         process.env.BROWSER_ARGS = parsed.BROWSER_ARGS;
     }
-    // let environment variables use each other
-    // `expand` patched in patches/dotenv-expand@9.0.0.patch
-    expand_1({ parsed });
+    // let environment variables use each other. make a copy of `process.env` so that `dotenv-expand`
+    // doesn't re-assign the expanded values to the global `process.env`.
+    const processEnv = { ...process.env };
+    expand_1({ parsed, processEnv });
     // only keys that start with prefix are exposed to client
     for (const [key, value] of Object.entries(parsed)) {
         if (prefixes.some((prefix) => key.startsWith(prefix))) {
@@ -32082,8 +32071,8 @@ function createCachedImport(imp) {
         return cached;
     };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-xESY8DUV.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-XbJJvsnO.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-ZEDYRkoC.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-PB-S7R_m.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -49247,10 +49236,11 @@ function webWorkerPlugin(config) {
                     // Using blob URL for SharedWorker results in multiple instances of a same worker
                     workerConstructor === 'Worker'
                         ? `${encodedJs}
+          const decodeBase64 = (base64) => Uint8Array.from(atob(base64), c => c.charCodeAt(0));
           const blob = typeof window !== "undefined" && window.Blob && new Blob([${workerType === 'classic'
                             ? ''
                             : // `URL` is always available, in `Worker[type="module"]`
-                                `'URL.revokeObjectURL(import.meta.url);'+`}atob(encodedJs)], { type: "text/javascript;charset=utf-8" });
+                                `'URL.revokeObjectURL(import.meta.url);',`}decodeBase64(encodedJs)], { type: "text/javascript;charset=utf-8" });
           export default function WorkerWrapper(options) {
             let objURL;
             try {
@@ -56180,7 +56170,7 @@ async function fetchModule(server, url, importer, options = {}) {
             throw err;
         }
         const file = pathToFileURL(resolved.id).toString();
-        const type = isFilePathESM(file, server.config.packageCache)
+        const type = isFilePathESM(resolved.id, server.config.packageCache)
             ? 'module'
             : 'commonjs';
         return { externalize: file, type };
@@ -56207,6 +56197,7 @@ let SOURCEMAPPING_URL = 'sourceMa';
 SOURCEMAPPING_URL += 'ppingURL';
 const VITE_RUNTIME_SOURCEMAPPING_SOURCE = '//# sourceMappingSource=vite-runtime';
 const VITE_RUNTIME_SOURCEMAPPING_URL = `${SOURCEMAPPING_URL}=data:application/json;charset=utf-8`;
+const OTHER_SOURCE_MAP_REGEXP = new RegExp(`//# ${SOURCEMAPPING_URL}=data:application/json[^,]+base64,([A-Za-z0-9+/=]+)$`, 'gm');
 function inlineSourceMap(mod, result, processSourceMap) {
     const map = result.map;
     let code = result.code;
@@ -56215,8 +56206,8 @@ function inlineSourceMap(mod, result, processSourceMap) {
         code.includes(VITE_RUNTIME_SOURCEMAPPING_SOURCE))
         return result;
     // to reduce the payload size, we only inline vite node source map, because it's also the only one we use
-    const OTHER_SOURCE_MAP_REGEXP = new RegExp(`//# ${SOURCEMAPPING_URL}=data:application/json[^,]+base64,([A-Za-z0-9+/=]+)$`, 'gm');
-    while (OTHER_SOURCE_MAP_REGEXP.test(code))
+    OTHER_SOURCE_MAP_REGEXP.lastIndex = 0;
+    if (OTHER_SOURCE_MAP_REGEXP.test(code))
         code = code.replace(OTHER_SOURCE_MAP_REGEXP, '');
     const sourceMap = Buffer.from(JSON.stringify(processSourceMap?.(map) || map), 'utf-8').toString('base64');
     result.code = `${code.trimEnd()}\n//# sourceURL=${mod.id}\n${VITE_RUNTIME_SOURCEMAPPING_SOURCE}\n//# ${VITE_RUNTIME_SOURCEMAPPING_URL};base64,${sourceMap}\n`;
@@ -63271,12 +63262,11 @@ function cachedTransformMiddleware(server) {
         if (ifNoneMatch) {
             const moduleByEtag = server.moduleGraph.getModuleByEtag(ifNoneMatch);
             if (moduleByEtag?.transformResult?.etag === ifNoneMatch) {
-                // For direct CSS requests, if the same CSS file is imported in a module,
+                // For CSS requests, if the same CSS file is imported in a module,
                 // the browser sends the request for the direct CSS request with the etag
                 // from the imported CSS module. We ignore the etag in this case.
-                const mixedEtag = !req.headers.accept?.includes('text/css') &&
-                    isDirectRequest(moduleByEtag.url);
-                if (!mixedEtag) {
+                const maybeMixedEtag = isCSSRequest(req.url);
+                if (!maybeMixedEtag) {
                     debugCache?.(`[304] ${prettifyUrl(req.url, server.config.root)}`);
                     res.statusCode = 304;
                     return res.end();
@@ -63365,12 +63355,23 @@ function transformMiddleware(server) {
                 // Strip valid id prefix. This is prepended to resolved Ids that are
                 // not valid browser import specifiers by the importAnalysis plugin.
                 url = unwrapId(url);
-                // for CSS, we need to differentiate between normal CSS requests and
-                // imports
-                if (isCSSRequest(url) &&
-                    !isDirectRequest(url) &&
-                    req.headers.accept?.includes('text/css')) {
-                    url = injectQuery(url, 'direct');
+                // for CSS, we differentiate between normal CSS requests and imports
+                if (isCSSRequest(url)) {
+                    if (req.headers.accept?.includes('text/css') &&
+                        !isDirectRequest(url)) {
+                        url = injectQuery(url, 'direct');
+                    }
+                    // check if we can return 304 early for CSS requests. These aren't handled
+                    // by the cachedTransformMiddleware due to the browser possibly mixing the
+                    // etags of direct and imported CSS
+                    const ifNoneMatch = req.headers['if-none-match'];
+                    if (ifNoneMatch &&
+                        (await server.moduleGraph.getModuleByUrl(url, false))
+                            ?.transformResult?.etag === ifNoneMatch) {
+                        debugCache?.(`[304] ${prettifyUrl(url, server.config.root)}`);
+                        res.statusCode = 304;
+                        return res.end();
+                    }
                 }
                 // resolve, load and transform using the plugin container
                 const result = await transformRequest(url, server, {
@@ -65558,7 +65559,7 @@ function importAnalysisPlugin(config) {
                     }
                     // fix#9534, prevent the importerModuleNode being stopped from propagating updates
                     importerModule.isSelfAccepting = false;
-                    return this.error(`Failed to resolve import "${url}" from "${path$o.relative(process.cwd(), importerFile)}". Does the file exist?`, pos);
+                    return this.error(`Failed to resolve import "${url}" from "${normalizePath$3(path$o.relative(process.cwd(), importerFile))}". Does the file exist?`, pos);
                 }
                 if (isExternalUrl(resolved.id)) {
                     return [resolved.id, resolved.id];
@@ -66793,6 +66794,7 @@ async function build(inlineConfig = {}) {
         config.logger.error(msg, { error: e });
     };
     let bundle;
+    let startTime;
     try {
         const buildOutputOptions = (output = {}) => {
             // @ts-expect-error See https://github.com/vitejs/vite/issues/5812#issuecomment-984345618
@@ -66890,6 +66892,7 @@ async function build(inlineConfig = {}) {
         }
         // write or generate files with rollup
         const { rollup } = await import('rollup');
+        startTime = Date.now();
         bundle = await rollup(rollupOptions);
         if (options.write) {
             prepareOutDir(outDirs, options.emptyOutDir, config);
@@ -66898,11 +66901,16 @@ async function build(inlineConfig = {}) {
         for (const output of normalizedOutputs) {
             res.push(await bundle[options.write ? 'write' : 'generate'](output));
         }
+        config.logger.info(`${colors$1.green(`✓ built in ${displayTime(Date.now() - startTime)}`)}`);
         return Array.isArray(outputs) ? res : res[0];
     }
     catch (e) {
         e.message = mergeRollupError(e);
         clearLine();
+        if (startTime) {
+            config.logger.error(`${colors$1.red('x')} Build failed in ${displayTime(Date.now() - startTime)}`);
+            startTime = undefined;
+        }
         throw e;
     }
     finally {

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { c as colors, a as createLogger, r as resolveConfig } from './chunks/dep-94_H5fT6.js';
+import { c as colors, a as createLogger, r as resolveConfig } from './chunks/dep-stQc5rCc.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -757,7 +757,7 @@ cli
     filterDuplicateOptions(options);
     // output structure is preserved even after bundling so require()
     // is ok here
-    const { createServer } = await import('./chunks/dep-94_H5fT6.js').then(function (n) { return n.E; });
+    const { createServer } = await import('./chunks/dep-stQc5rCc.js').then(function (n) { return n.E; });
     try {
         const server = await createServer({
             root,
@@ -836,7 +836,7 @@ cli
     .option('-w, --watch', `[boolean] rebuilds when modules have changed on disk`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { build } = await import('./chunks/dep-94_H5fT6.js').then(function (n) { return n.F; });
+    const { build } = await import('./chunks/dep-stQc5rCc.js').then(function (n) { return n.F; });
     const buildOptions = cleanOptions(options);
     try {
         await build({
@@ -863,7 +863,7 @@ cli
     .option('--force', `[boolean] force the optimizer to ignore the cache and re-bundle`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-94_H5fT6.js').then(function (n) { return n.D; });
+    const { optimizeDeps } = await import('./chunks/dep-stQc5rCc.js').then(function (n) { return n.D; });
     try {
         const config = await resolveConfig({
             root,
@@ -889,7 +889,7 @@ cli
     .option('--outDir <dir>', `[string] output directory (default: dist)`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-94_H5fT6.js').then(function (n) { return n.G; });
+    const { preview } = await import('./chunks/dep-stQc5rCc.js').then(function (n) { return n.G; });
     try {
         const server = await preview({
             root,

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { i as isInNodeModules, b as arraify } from './chunks/dep-94_H5fT6.js';
-export { f as build, j as buildErrorMessage, u as createFilter, a as createLogger, e as createServer, d as defineConfig, k as fetchModule, g as formatPostcssSourceMap, y as isFileServingAllowed, l as loadConfigFromFile, z as loadEnv, q as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, h as preprocessCSS, p as preview, r as resolveConfig, A as resolveEnvPrefix, v as rollupVersion, x as searchForWorkspaceRoot, w as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-94_H5fT6.js';
+import { i as isInNodeModules, b as arraify } from './chunks/dep-stQc5rCc.js';
+export { f as build, j as buildErrorMessage, u as createFilter, a as createLogger, e as createServer, d as defineConfig, k as fetchModule, g as formatPostcssSourceMap, y as isFileServingAllowed, l as loadConfigFromFile, z as loadEnv, q as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, h as preprocessCSS, p as preview, r as resolveConfig, A as resolveEnvPrefix, v as rollupVersion, x as searchForWorkspaceRoot, w as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-stQc5rCc.js';
 export { VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import { existsSync, readFileSync } from 'node:fs';

package/dist/node/runtime.js

@@ -1381,13 +1381,16 @@ class ViteRuntime {
             if (mod.exports)
                 return this.processImport(mod.exports, fetchedModule, metadata);
         }
-        const getStack = () => `stack:\n${[...callstack, moduleId]
-            .reverse()
-            .map((p) => `  - ${p}`)
-            .join('\n')}`;
         let debugTimer;
-        if (this.debug)
-            debugTimer = setTimeout(() => this.debug(`[vite-runtime] module ${moduleId} takes over 2s to load.\n${getStack()}`), 2000);
+        if (this.debug) {
+            debugTimer = setTimeout(() => {
+                const getStack = () => `stack:\n${[...callstack, moduleId]
+                    .reverse()
+                    .map((p) => `  - ${p}`)
+                    .join('\n')}`;
+                this.debug(`[vite-runtime] module ${moduleId} takes over 2s to load.\n${getStack()}`);
+            }, 2000);
+        }
         try {
             // cached module
             if (mod.promise)
@@ -1417,7 +1420,7 @@ class ViteRuntime {
         this.debug?.('[vite-runtime] fetching', id);
         // fast return for established externalized patterns
         const fetchedModule = id.startsWith('data:')
-            ? { externalize: id, type: 'builtin' }
+            ? ({ externalize: id, type: 'builtin' })
             : await this.options.fetchModule(id, importer);
         // base moduleId on "file" and not on id
         // if `import(variable)` is called it's possible that it doesn't have an extension for example
@@ -1604,7 +1607,7 @@ class ESModulesRunner {
         // source map should already be inlined by Vite
         '"use strict";' + code);
         await initModule(context[ssrModuleExportsKey], context[ssrImportMetaKey], context[ssrImportKey], context[ssrDynamicImportKey], context[ssrExportAllKey]);
-        Object.freeze(context[ssrModuleExportsKey]);
+        Object.seal(context[ssrModuleExportsKey]);
     }
     runExternalModule(filepath) {
         return import(filepath);

package/dist/node-cjs/publicUtils.cjs

@@ -5577,7 +5577,7 @@ function isFileServingAllowed(url, server) {
 var main$1 = {exports: {}};
 
 var name = "dotenv";
-var version$1 = "16.4.1";
+var version$1 = "16.4.2";
 var description = "Loads environment variables from .env file";
 var main = "lib/main.js";
 var types = "lib/main.d.ts";
@@ -5608,7 +5608,7 @@ var repository = {
 	type: "git",
 	url: "git://github.com/motdotla/dotenv.git"
 };
-var funding = "https://github.com/motdotla/dotenv?sponsor=1";
+var funding = "https://dotenvx.com";
 var keywords = [
 	"dotenv",
 	"env",
@@ -5717,7 +5717,7 @@ function _parseVault (options) {
   }
 
   // handle scenario for comma separated keys - for use with key rotation
-  // example: DOTENV_KEY="dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=prod,dotenv://:key_7890@dotenv.org/vault/.env.vault?environment=prod"
+  // example: DOTENV_KEY="dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=prod,dotenv://:key_7890@dotenvx.com/vault/.env.vault?environment=prod"
   const keys = _dotenvKey(options).split(',');
   const length = keys.length;
 
@@ -5781,7 +5781,7 @@ function _instructions (result, dotenvKey) {
     uri = new URL(dotenvKey);
   } catch (error) {
     if (error.code === 'ERR_INVALID_URL') {
-      const err = new Error('INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=development');
+      const err = new Error('INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development');
       err.code = 'INVALID_DOTENV_KEY';
       throw err
     }
@@ -6011,81 +6011,80 @@ main$1.exports.populate = DotenvModule.populate;
 
 main$1.exports = DotenvModule;
 
-// like String.prototype.search but returns the last index
-function _searchLast (str, rgx) {
-  const matches = Array.from(str.matchAll(rgx));
-  return matches.length > 0 ? matches.slice(-1)[0].index : -1
-}
+// * /
+// *   (\\)?            # is it escaped with a backslash?
+// *   (\$)             # literal $
+// *   (?!\()           # shouldnt be followed by parenthesis
+// *   (\{?)            # first brace wrap opening
+// *   ([\w.]+)         # key
+// *   (?::-((?:\$\{(?:\$\{(?:\$\{[^}]*\}|[^}])*}|[^}])*}|[^}])+))? # optional default nested 3 times
+// *   (\}?)            # last brace warp closing
+// * /xi
 
-function _interpolate (envValue, environment, config) {
-  // find the last unescaped dollar sign in the
-  // value so that we can evaluate it
-  const lastUnescapedDollarSignIndex = _searchLast(envValue, /(?!(?<=\\))\$/g);
+const DOTENV_SUBSTITUTION_REGEX = /(\\)?(\$)(?!\()(\{?)([\w.]+)(?::?-((?:\$\{(?:\$\{(?:\$\{[^}]*\}|[^}])*}|[^}])*}|[^}])+))?(\}?)/gi;
 
-  // If we couldn't match any unescaped dollar sign
-  // let's return the string as is
-  if (lastUnescapedDollarSignIndex === -1) return envValue
+function _resolveEscapeSequences (value) {
+  return value.replace(/\\\$/g, '$')
+}
 
-  // This is the right-most group of variables in the string
-  const rightMostGroup = envValue.slice(lastUnescapedDollarSignIndex);
+function interpolate (value, processEnv, parsed) {
+  return value.replace(DOTENV_SUBSTITUTION_REGEX, (match, escaped, dollarSign, openBrace, key, defaultValue, closeBrace) => {
+    if (escaped === '\\') {
+      return match.slice(1)
+    } else {
+      if (processEnv[key]) {
+        return processEnv[key]
+      }
 
-  /**
-   * This finds the inner most variable/group divided
-   * by variable name and default value (if present)
-   * (
-   *   (?!(?<=\\))\$        // only match dollar signs that are not escaped
-   *   {?                   // optional opening curly brace
-   *     ([\w]+)            // match the variable name
-   *     (?::-([^}\\]*))?   // match an optional default value
-   *   }?                   // optional closing curly brace
-   * )
-   */
-  const matchGroup = /((?!(?<=\\))\${?([\w]+)(?::-([^}\\]*))?}?)/;
-  const match = rightMostGroup.match(matchGroup);
-
-  if (match != null) {
-    const [, group, variableName, defaultValue] = match;
-
-    return _interpolate(
-      envValue.replace(
-        group,
-        environment[variableName] ||
-          defaultValue ||
-          config.parsed[variableName] ||
-          ''
-      ),
-      environment,
-      config
-    )
-  }
+      if (parsed[key]) {
+        return parsed[key]
+      }
 
-  return envValue
-}
+      if (defaultValue) {
+        if (defaultValue.startsWith('$')) {
+          return interpolate(defaultValue, processEnv, parsed)
+        } else {
+          return defaultValue
+        }
+      }
 
-function _resolveEscapeSequences (value) {
-  return value.replace(/\\\$/g, '$')
+      return ''
+    }
+  })
 }
 
-function expand (config) {
-  // if ignoring process.env, use a blank object
-  const environment = config.ignoreProcessEnv ? {} : process.env;
+function expand (options) {
+  let processEnv = process.env;
+  if (options && options.processEnv != null) {
+    processEnv = options.processEnv;
+  }
+
+  for (const key in options.parsed) {
+    let value = options.parsed[key];
 
-  for (const configKey in config.parsed) {
-    const value = Object.prototype.hasOwnProperty.call(environment, configKey)
-      ? environment[configKey]
-      : config.parsed[configKey];
+    const inProcessEnv = Object.prototype.hasOwnProperty.call(processEnv, key);
 
-    config.parsed[configKey] = _resolveEscapeSequences(
-      _interpolate(value, environment, config)
-    );
+    if (inProcessEnv) {
+      if (processEnv[key] === options.parsed[key]) {
+        // assume was set to processEnv from the .env file if the values match and therefore interpolate
+        value = interpolate(value, processEnv, options.parsed);
+      } else {
+        // do not interpolate - assume processEnv had the intended value even if containing a $.
+        value = processEnv[key];
+      }
+    } else {
+      // not inProcessEnv so assume interpolation for this .env key
+      value = interpolate(value, processEnv, options.parsed);
+    }
+
+    options.parsed[key] = _resolveEscapeSequences(value);
   }
 
-  // PATCH: don't write to process.env
-  // for (const processKey in config.parsed) {
-  //   environment[processKey] = config.parsed[processKey]
-  // }
+  for (const processKey in options.parsed) {
+    processEnv[processKey] = options.parsed[processKey];
+  }
 
-  return config
+  return options
 }
 
 var expand_1 = expand;
@@ -6122,9 +6121,10 @@ function loadEnv(mode, envDir, prefixes = 'VITE_') {
     if (parsed.BROWSER_ARGS && process.env.BROWSER_ARGS === undefined) {
         process.env.BROWSER_ARGS = parsed.BROWSER_ARGS;
     }
-    // let environment variables use each other
-    // `expand` patched in patches/dotenv-expand@9.0.0.patch
-    expand_1({ parsed });
+    // let environment variables use each other. make a copy of `process.env` so that `dotenv-expand`
+    // doesn't re-assign the expanded values to the global `process.env`.
+    const processEnv = { ...process.env };
+    expand_1({ parsed, processEnv });
     // only keys that start with prefix are exposed to client
     for (const [key, value] of Object.entries(parsed)) {
         if (prefixes.some((prefix) => key.startsWith(prefix))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "5.1.1",
+  "version": "5.1.3",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",
@@ -103,8 +103,8 @@
     "cross-spawn": "^7.0.3",
     "debug": "^4.3.4",
     "dep-types": "link:./src/types",
-    "dotenv": "^16.4.1",
-    "dotenv-expand": "^10.0.0",
+    "dotenv": "^16.4.2",
+    "dotenv-expand": "^11.0.3",
     "es-module-lexer": "^1.4.1",
     "escape-html": "^1.0.3",
     "estree-walker": "^3.0.3",