vite 5.4.13 → 5.4.15

package/dist/node/chunks/{dep-CT-NxJFJ.js → dep-Bhfdk6-y.js}

@@ -1,4 +1,4 @@
-import { B as getDefaultExportFromCjs } from './dep-Cjmyj91f.js';
+import { B as getDefaultExportFromCjs } from './dep-CevzF2vT.js';
 import require$$0 from 'path';
 import require$$0__default from 'fs';
 import { l as lib } from './dep-IQS-Za7F.js';

package/dist/node/chunks/{dep-Cjmyj91f.js → dep-CevzF2vT.js}

@@ -10,7 +10,7 @@ import crypto$2, { createHash as createHash$2 } from 'node:crypto';
 import require$$0$3 from 'tty';
 import require$$0$4, { win32, posix, isAbsolute, resolve as resolve$3, relative as relative$1, basename as basename$1, extname, dirname as dirname$1, join as join$1, sep as sep$1, normalize as normalize$1 } from 'path';
 import esbuild, { transform as transform$1, formatMessages, build as build$3 } from 'esbuild';
-import { CLIENT_ENTRY, OPTIMIZABLE_ENTRY_RE, wildcardHosts, loopbackHosts, FS_PREFIX, CLIENT_PUBLIC_PATH, ENV_PUBLIC_PATH, DEFAULT_ASSETS_INLINE_LIMIT, CSS_LANGS_RE, ESBUILD_MODULES_TARGET, SPECIAL_QUERY_RE, ENV_ENTRY, DEP_VERSION_RE, DEFAULT_MAIN_FIELDS, DEFAULT_EXTENSIONS, KNOWN_ASSET_TYPES, JS_TYPES_RE, METADATA_FILENAME, VITE_PACKAGE_DIR, DEFAULT_DEV_PORT, CLIENT_DIR, VERSION, DEFAULT_PREVIEW_PORT, DEFAULT_ASSETS_RE, DEFAULT_CONFIG_FILES } from '../constants.js';
+import { CLIENT_ENTRY, OPTIMIZABLE_ENTRY_RE, wildcardHosts, loopbackHosts, FS_PREFIX, CLIENT_PUBLIC_PATH, ENV_PUBLIC_PATH, DEFAULT_ASSETS_INLINE_LIMIT, CSS_LANGS_RE, ESBUILD_MODULES_TARGET, SPECIAL_QUERY_RE, ENV_ENTRY, DEP_VERSION_RE, DEFAULT_MAIN_FIELDS, DEFAULT_EXTENSIONS, KNOWN_ASSET_TYPES, JS_TYPES_RE, METADATA_FILENAME, VITE_PACKAGE_DIR, defaultAllowedOrigins, DEFAULT_DEV_PORT, CLIENT_DIR, VERSION, DEFAULT_PREVIEW_PORT, DEFAULT_ASSETS_RE, DEFAULT_CONFIG_FILES } from '../constants.js';
 import * as require$$0$2 from 'fs';
 import require$$0__default, { lstatSync, readdir as readdir$4, readdirSync, readlinkSync, realpathSync as realpathSync$1, existsSync, readFileSync, statSync as statSync$1 } from 'fs';
 import { EventEmitter as EventEmitter$4 } from 'node:events';
@@ -36991,8 +36991,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-CT-NxJFJ.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-Dzr4bp1s.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-Bhfdk6-y.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-DzdyzNcV.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -59177,7 +59177,8 @@ function abortHandshakeOrEmitwsClientError(server, req, socket, code, message) {
 
 var WebSocketServerRaw_ = /*@__PURE__*/getDefaultExportFromCjs(websocketServer);
 
-const allowedHostsCache = /* @__PURE__ */ new WeakMap();
+const allowedHostsServerCache = /* @__PURE__ */ new WeakMap();
+const allowedHostsPreviewCache = /* @__PURE__ */ new WeakMap();
 const isFileOrExtensionProtocolRE = /^(?:file|.+-extension):/i;
 function getAdditionalAllowedHosts(resolvedServerOptions, resolvedPreviewOptions) {
   const list = [];
@@ -59234,39 +59235,42 @@ function isHostAllowedWithoutCache(allowedHosts, additionalAllowedHosts, host) {
   }
   return false;
 }
-function isHostAllowed(config, host) {
-  if (config.server.allowedHosts === true) {
+function isHostAllowed(config, isPreview, host) {
+  const allowedHosts = isPreview ? config.preview.allowedHosts : config.server.allowedHosts;
+  if (allowedHosts === true) {
     return true;
   }
-  if (!allowedHostsCache.has(config)) {
-    allowedHostsCache.set(config, /* @__PURE__ */ new Set());
+  const cache = isPreview ? allowedHostsPreviewCache : allowedHostsServerCache;
+  if (!cache.has(config)) {
+    cache.set(config, /* @__PURE__ */ new Set());
   }
-  const allowedHosts = allowedHostsCache.get(config);
-  if (allowedHosts.has(host)) {
+  const cachedAllowedHosts = cache.get(config);
+  if (cachedAllowedHosts.has(host)) {
     return true;
   }
   const result = isHostAllowedWithoutCache(
-    config.server.allowedHosts ?? [],
+    allowedHosts ?? [],
     config.additionalAllowedHosts,
     host
   );
   if (result) {
-    allowedHosts.add(host);
+    cachedAllowedHosts.add(host);
   }
   return result;
 }
-function hostCheckMiddleware(config) {
+function hostCheckMiddleware(config, isPreview) {
   return function viteHostCheckMiddleware(req, res, next) {
     const hostHeader = req.headers.host;
-    if (!hostHeader || !isHostAllowed(config, hostHeader)) {
+    if (!hostHeader || !isHostAllowed(config, isPreview, hostHeader)) {
       const hostname = hostHeader?.replace(/:\d+$/, "");
       const hostnameWithQuotes = JSON.stringify(hostname);
+      const optionName = `${isPreview ? "preview" : "server"}.allowedHosts`;
       res.writeHead(403, {
         "Content-Type": "text/plain"
       });
       res.end(
         `Blocked request. This host (${hostnameWithQuotes}) is not allowed.
-To allow this host, add ${hostnameWithQuotes} to \`server.allowedHosts\` in vite.config.js.`
+To allow this host, add ${hostnameWithQuotes} to \`${optionName}\` in vite.config.js.`
       );
       return;
     }
@@ -59329,7 +59333,7 @@ function createWebSocketServer(server, config, httpsOptions) {
   const host = hmr && hmr.host || void 0;
   const shouldHandle = (req) => {
     const hostHeader = req.headers.host;
-    if (!hostHeader || !isHostAllowed(config, hostHeader)) {
+    if (!hostHeader || !isHostAllowed(config, false, hostHeader)) {
       return false;
     }
     if (config.legacy?.skipWebSocketTokenCheck) {
@@ -61924,6 +61928,7 @@ function send(req, res, content, type, options) {
 
 const debugCache = createDebugger("vite:cache");
 const knownIgnoreList = /* @__PURE__ */ new Set(["/", "/favicon.ico"]);
+const trailingQuerySeparatorsRE = /[?&]+$/;
 function cachedTransformMiddleware(server) {
   return function viteCachedTransformMiddleware(req, res, next) {
     const ifNoneMatch = req.headers["if-none-match"];
@@ -62007,7 +62012,16 @@ function transformMiddleware(server) {
       if (publicDirInRoot && url.startsWith(publicPath)) {
         warnAboutExplicitPublicPathInUrl(url);
       }
-      if ((rawRE.test(url) || urlRE.test(url)) && !ensureServingAccess(url, server, res, next)) {
+      const urlWithoutTrailingQuerySeparators = url.replace(
+        trailingQuerySeparatorsRE,
+        ""
+      );
+      if ((rawRE.test(urlWithoutTrailingQuerySeparators) || urlRE.test(urlWithoutTrailingQuerySeparators)) && !ensureServingAccess(
+        urlWithoutTrailingQuerySeparators,
+        server,
+        res,
+        next
+      )) {
         return;
       }
       if (isJSRequest(url) || isImportRequest(url) || isCSSRequest(url) || isHTMLProxy(url)) {
@@ -63229,12 +63243,16 @@ async function _createServer(inlineConfig = {}, options) {
     middlewares.use(timeMiddleware(root));
   }
   const { cors } = serverConfig;
-  if (cors !== void 0 && cors !== false) {
-    middlewares.use(corsMiddleware(typeof cors === "boolean" ? {} : cors));
+  if (cors !== false) {
+    middlewares.use(
+      corsMiddleware(
+        typeof cors === "boolean" ? {} : cors ?? { origin: defaultAllowedOrigins }
+      )
+    );
   }
   const { allowedHosts } = serverConfig;
   if (allowedHosts !== true && !serverConfig.https) {
-    middlewares.use(hostCheckMiddleware(config));
+    middlewares.use(hostCheckMiddleware(config, false));
   }
   middlewares.use(cachedTransformMiddleware(server));
   const { proxy } = serverConfig;
@@ -66161,12 +66179,16 @@ async function preview(inlineConfig = {}) {
     postHooks.push(await hook(server));
   }
   const { cors } = config.preview;
-  if (cors !== void 0 && cors !== false) {
-    app.use(corsMiddleware(typeof cors === "boolean" ? {} : cors));
+  if (cors !== false) {
+    app.use(
+      corsMiddleware(
+        typeof cors === "boolean" ? {} : cors ?? { origin: defaultAllowedOrigins }
+      )
+    );
   }
   const { allowedHosts } = config.preview;
   if (allowedHosts !== true && !config.preview.https) {
-    app.use(hostCheckMiddleware(config));
+    app.use(hostCheckMiddleware(config, true));
   }
   const { proxy } = config.preview;
   if (proxy) {

package/dist/node/chunks/{dep-Dzr4bp1s.js → dep-DzdyzNcV.js}

@@ -1,4 +1,4 @@
-import { C as commonjsGlobal, B as getDefaultExportFromCjs } from './dep-Cjmyj91f.js';
+import { C as commonjsGlobal, B as getDefaultExportFromCjs } from './dep-CevzF2vT.js';
 import require$$0__default from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { A as colors, v as createLogger, r as resolveConfig } from './chunks/dep-Cjmyj91f.js';
+import { A as colors, v as createLogger, r as resolveConfig } from './chunks/dep-CevzF2vT.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -731,7 +731,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-Cjmyj91f.js').then(function (n) { return n.E; });
+  const { createServer } = await import('./chunks/dep-CevzF2vT.js').then(function (n) { return n.E; });
   try {
     const server = await createServer({
       root,
@@ -823,7 +823,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
   `[boolean] force empty outDir when it's outside of root`
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { build } = await import('./chunks/dep-Cjmyj91f.js').then(function (n) { return n.F; });
+  const { build } = await import('./chunks/dep-CevzF2vT.js').then(function (n) { return n.F; });
   const buildOptions = cleanOptions(options);
   try {
     await build({
@@ -852,7 +852,7 @@ cli.command("optimize [root]", "pre-bundle dependencies").option(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-Cjmyj91f.js').then(function (n) { return n.D; });
+    const { optimizeDeps } = await import('./chunks/dep-CevzF2vT.js').then(function (n) { return n.D; });
     try {
       const config = await resolveConfig(
         {
@@ -878,7 +878,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-Cjmyj91f.js').then(function (n) { return n.G; });
+    const { preview } = await import('./chunks/dep-CevzF2vT.js').then(function (n) { return n.G; });
     try {
       const server = await preview({
         root,

package/dist/node/constants.js

@@ -107,6 +107,7 @@ const wildcardHosts = /* @__PURE__ */ new Set([
 const DEFAULT_DEV_PORT = 5173;
 const DEFAULT_PREVIEW_PORT = 4173;
 const DEFAULT_ASSETS_INLINE_LIMIT = 4096;
+const defaultAllowedOrigins = /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/;
 const METADATA_FILENAME = "_metadata.json";
 
-export { CLIENT_DIR, CLIENT_ENTRY, CLIENT_PUBLIC_PATH, CSS_LANGS_RE, DEFAULT_ASSETS_INLINE_LIMIT, DEFAULT_ASSETS_RE, DEFAULT_CONFIG_FILES, DEFAULT_DEV_PORT, DEFAULT_EXTENSIONS, DEFAULT_MAIN_FIELDS, DEFAULT_PREVIEW_PORT, DEP_VERSION_RE, ENV_ENTRY, ENV_PUBLIC_PATH, ESBUILD_MODULES_TARGET, FS_PREFIX, JS_TYPES_RE, KNOWN_ASSET_TYPES, METADATA_FILENAME, OPTIMIZABLE_ENTRY_RE, SPECIAL_QUERY_RE, VERSION, VITE_PACKAGE_DIR, loopbackHosts, wildcardHosts };
+export { CLIENT_DIR, CLIENT_ENTRY, CLIENT_PUBLIC_PATH, CSS_LANGS_RE, DEFAULT_ASSETS_INLINE_LIMIT, DEFAULT_ASSETS_RE, DEFAULT_CONFIG_FILES, DEFAULT_DEV_PORT, DEFAULT_EXTENSIONS, DEFAULT_MAIN_FIELDS, DEFAULT_PREVIEW_PORT, DEP_VERSION_RE, ENV_ENTRY, ENV_PUBLIC_PATH, ESBUILD_MODULES_TARGET, FS_PREFIX, JS_TYPES_RE, KNOWN_ASSET_TYPES, METADATA_FILENAME, OPTIMIZABLE_ENTRY_RE, SPECIAL_QUERY_RE, VERSION, VITE_PACKAGE_DIR, defaultAllowedOrigins, loopbackHosts, wildcardHosts };

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { i as isInNodeModules, a as arraify } from './chunks/dep-Cjmyj91f.js';
-export { b as build, g as buildErrorMessage, k as createFilter, v as createLogger, c as createServer, d as defineConfig, h as fetchModule, f as formatPostcssSourceMap, x as isFileServingAllowed, l as loadConfigFromFile, y as loadEnv, j as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, e as preprocessCSS, p as preview, r as resolveConfig, z as resolveEnvPrefix, q as rollupVersion, w as searchForWorkspaceRoot, u as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-Cjmyj91f.js';
+import { i as isInNodeModules, a as arraify } from './chunks/dep-CevzF2vT.js';
+export { b as build, g as buildErrorMessage, k as createFilter, v as createLogger, c as createServer, d as defineConfig, h as fetchModule, f as formatPostcssSourceMap, x as isFileServingAllowed, l as loadConfigFromFile, y as loadEnv, j as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, e as preprocessCSS, p as preview, r as resolveConfig, z as resolveEnvPrefix, q as rollupVersion, w as searchForWorkspaceRoot, u as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-CevzF2vT.js';
 export { VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import { existsSync, readFileSync } from 'node:fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "5.4.13",
+  "version": "5.4.15",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",