vite 5.4.15 → 5.4.17

package/dist/node/chunks/{dep-Bhfdk6-y.js → dep-Bg3it0Nb.js}

@@ -1,4 +1,4 @@
-import { B as getDefaultExportFromCjs } from './dep-CevzF2vT.js';
+import { B as getDefaultExportFromCjs } from './dep-Dyl6b77n.js';
 import require$$0 from 'path';
 import require$$0__default from 'fs';
 import { l as lib } from './dep-IQS-Za7F.js';

package/dist/node/chunks/{dep-DzdyzNcV.js → dep-DeS6hsO7.js}

@@ -1,4 +1,4 @@
-import { C as commonjsGlobal, B as getDefaultExportFromCjs } from './dep-CevzF2vT.js';
+import { C as commonjsGlobal, B as getDefaultExportFromCjs } from './dep-Dyl6b77n.js';
 import require$$0__default from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/chunks/{dep-CevzF2vT.js → dep-Dyl6b77n.js}

@@ -16865,10 +16865,10 @@ function removeImportQuery(url) {
 function removeDirectQuery(url) {
   return url.replace(directRequestRE$1, "$1").replace(trailingSeparatorRE, "");
 }
-const urlRE = /(\?|&)url(?:&|$)/;
-const rawRE = /(\?|&)raw(?:&|$)/;
+const urlRE$1 = /(\?|&)url(?:&|$)/;
+const rawRE$1 = /(\?|&)raw(?:&|$)/;
 function removeUrlQuery(url) {
-  return url.replace(urlRE, "$1").replace(trailingSeparatorRE, "");
+  return url.replace(urlRE$1, "$1").replace(trailingSeparatorRE, "");
 }
 const replacePercentageRE = /%/g;
 function injectQuery(url, queryToInject) {
@@ -20302,7 +20302,7 @@ function assetPlugin(config) {
       moduleGraph = server.moduleGraph;
     },
     resolveId(id) {
-      if (!config.assetsInclude(cleanUrl(id)) && !urlRE.test(id)) {
+      if (!config.assetsInclude(cleanUrl(id)) && !urlRE$1.test(id)) {
         return;
       }
       const publicFile = checkPublicFile(id, config);
@@ -20314,14 +20314,14 @@ function assetPlugin(config) {
       if (id[0] === "\0") {
         return;
       }
-      if (rawRE.test(id)) {
+      if (rawRE$1.test(id)) {
         const file = checkPublicFile(id, config) || cleanUrl(id);
         this.addWatchFile(file);
         return `export default ${JSON.stringify(
           await fsp.readFile(file, "utf-8")
         )}`;
       }
-      if (!urlRE.test(id) && !config.assetsInclude(cleanUrl(id))) {
+      if (!urlRE$1.test(id) && !config.assetsInclude(cleanUrl(id))) {
         return;
       }
       id = removeUrlQuery(id);
@@ -36062,7 +36062,7 @@ const directRequestRE = /[?&]direct\b/;
 const htmlProxyRE = /[?&]html-proxy\b/;
 const htmlProxyIndexRE = /&index=(\d+)/;
 const commonjsProxyRE = /\?commonjs-proxy/;
-const inlineRE$1 = /[?&]inline\b/;
+const inlineRE$2 = /[?&]inline\b/;
 const inlineCSSRE = /[?&]inline-css\b/;
 const styleAttrRE = /[?&]style-attr\b/;
 const functionCallRE = /^[A-Z_][\w-]*\(/i;
@@ -36111,7 +36111,7 @@ function cssPlugin(config) {
     },
     async load(id) {
       if (!isCSSRequest(id)) return;
-      if (urlRE.test(id)) {
+      if (urlRE$1.test(id)) {
         if (isModuleCSSRequest(id)) {
           throw new Error(
             `?url is not supported with CSS modules. (tried to import ${JSON.stringify(
@@ -36245,7 +36245,7 @@ function cssPostPlugin(config) {
         );
         return `export default ''`;
       }
-      const inlined = inlineRE$1.test(id);
+      const inlined = inlineRE$2.test(id);
       const modules = cssModulesCache.get(config).get(id);
       const modulesCode = modules && !inlined && dataToEsm(modules, { namedExports: true, preferConst: true });
       if (config.command === "serve") {
@@ -36620,7 +36620,7 @@ function cssAnalysisPlugin(config) {
       const { moduleGraph } = server;
       const thisModule = moduleGraph.getModuleById(id);
       if (thisModule) {
-        const isSelfAccepting = !cssModulesCache.get(config)?.get(id) && !inlineRE$1.test(id) && !htmlProxyRE.test(id);
+        const isSelfAccepting = !cssModulesCache.get(config)?.get(id) && !inlineRE$2.test(id) && !htmlProxyRE.test(id);
         const pluginImports = this._addedImports;
         if (pluginImports) {
           const depModules = /* @__PURE__ */ new Set();
@@ -36991,8 +36991,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-Bhfdk6-y.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-DzdyzNcV.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-Bg3it0Nb.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-DeS6hsO7.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -47527,6 +47527,7 @@ function escapeReplacement(value) {
 }
 
 const wasmHelperId = "\0vite/wasm-helper.js";
+const wasmInitRE = /(?<![?#].*)\.wasm\?init/;
 const wasmHelper = async (opts = {}, url) => {
   let result;
   if (url.startsWith("data:")) {
@@ -47571,7 +47572,7 @@ const wasmHelperPlugin = (config) => {
       if (id === wasmHelperId) {
         return `export default ${wasmHelperCode}`;
       }
-      if (!id.endsWith(".wasm?init")) {
+      if (!wasmInitRE.test(id)) {
         return;
       }
       const url = await fileToUrl$1(id, config, this);
@@ -47598,7 +47599,7 @@ const wasmFallbackPlugin = () => {
 
 const workerOrSharedWorkerRE = /(?:\?|&)(worker|sharedworker)(?:&|$)/;
 const workerFileRE = /(?:\?|&)worker_file&type=(\w+)(?:&|$)/;
-const inlineRE = /[?&]inline\b/;
+const inlineRE$1 = /[?&]inline\b/;
 const WORKER_FILE_ID = "worker_file";
 const workerCache = /* @__PURE__ */ new WeakMap();
 function saveEmitWorkerAsset(config, asset) {
@@ -47796,7 +47797,7 @@ function webWorkerPlugin(config) {
       if (isBuild) {
         if (isWorker && config.bundleChain.at(-1) === cleanUrl(id)) {
           urlCode = "self.location.href";
-        } else if (inlineRE.test(id)) {
+        } else if (inlineRE$1.test(id)) {
           const chunk = await bundleWorkerEntry(config, id);
           const encodedJs = `const encodedJs = "${Buffer.from(
             chunk.code
@@ -47851,7 +47852,7 @@ function webWorkerPlugin(config) {
         url = injectQuery(url, `${WORKER_FILE_ID}&type=${workerType}`);
         urlCode = JSON.stringify(url);
       }
-      if (urlRE.test(id)) {
+      if (urlRE$1.test(id)) {
         return {
           code: `export default ${urlCode}`,
           map: { mappings: "" }
@@ -48488,7 +48489,7 @@ function parseDynamicImportPattern(strings) {
   let globParams = null;
   if (search) {
     search = "?" + search;
-    if (workerOrSharedWorkerRE.test(search) || urlRE.test(search) || rawRE.test(search)) {
+    if (workerOrSharedWorkerRE.test(search) || urlRE$1.test(search) || rawRE$1.test(search)) {
       globParams = {
         query: search,
         import: "*"
@@ -51640,7 +51641,7 @@ function servePublicMiddleware(server, publicFiles) {
   };
   return function viteServePublicMiddleware(req, res, next) {
     if (publicFiles && !publicFiles.has(toFilePath(req.url)) || isImportRequest(req.url) || isInternalRequest(req.url) || // for `/public-file.js?url` to be transformed
-    urlRE.test(req.url)) {
+    urlRE$1.test(req.url)) {
       return next();
     }
     serve(req, res, next);
@@ -51764,6 +51765,7 @@ function renderRestrictedErrorHTML(msg) {
 
 const ERR_LOAD_URL = "ERR_LOAD_URL";
 const ERR_LOAD_PUBLIC_URL = "ERR_LOAD_PUBLIC_URL";
+const ERR_DENIED_ID = "ERR_DENIED_ID";
 const debugLoad = createDebugger("vite:load");
 const debugTransform = createDebugger("vite:transform");
 const debugCache$1 = createDebugger("vite:cache");
@@ -51865,6 +51867,11 @@ async function loadAndTransform(id, url, server, options, timestamp, mod, resolv
   const prettyUrl = debugLoad || debugTransform ? prettifyUrl(url, config.root) : "";
   const ssr = !!options.ssr;
   const file = cleanUrl(id);
+  if (options.allowId && !options.allowId(id)) {
+    const err = new Error(`Denied ID ${id}`);
+    err.code = ERR_DENIED_ID;
+    throw err;
+  }
   let code = null;
   let map = null;
   const loadStart = debugLoad ? performance$1.now() : 0;
@@ -61929,6 +61936,13 @@ function send(req, res, content, type, options) {
 const debugCache = createDebugger("vite:cache");
 const knownIgnoreList = /* @__PURE__ */ new Set(["/", "/favicon.ico"]);
 const trailingQuerySeparatorsRE = /[?&]+$/;
+const urlRE = /[?&]url\b/;
+const rawRE = /[?&]raw\b/;
+const inlineRE = /[?&]inline\b/;
+const svgRE = /\.svg\b/;
+function deniedServingAccessForTransform(url, server, res, next) {
+  return (rawRE.test(url) || urlRE.test(url) || inlineRE.test(url) || svgRE.test(url)) && !ensureServingAccess(url, server, res, next);
+}
 function cachedTransformMiddleware(server) {
   return function viteCachedTransformMiddleware(req, res, next) {
     const ifNoneMatch = req.headers["if-none-match"];
@@ -62016,7 +62030,7 @@ function transformMiddleware(server) {
         trailingQuerySeparatorsRE,
         ""
       );
-      if ((rawRE.test(urlWithoutTrailingQuerySeparators) || urlRE.test(urlWithoutTrailingQuerySeparators)) && !ensureServingAccess(
+      if (deniedServingAccessForTransform(
         urlWithoutTrailingQuerySeparators,
         server,
         res,
@@ -62039,7 +62053,10 @@ function transformMiddleware(server) {
           }
         }
         const result = await transformRequest(url, server, {
-          html: req.headers.accept?.includes("text/html")
+          html: req.headers.accept?.includes("text/html"),
+          allowId(id) {
+            return !deniedServingAccessForTransform(id, server, res, next);
+          }
         });
         if (result) {
           const depsOptimizer = getDepsOptimizer(server.config, false);
@@ -62091,6 +62108,9 @@ function transformMiddleware(server) {
       if (e?.code === ERR_LOAD_URL) {
         return next();
       }
+      if (e?.code === ERR_DENIED_ID) {
+        return;
+      }
       return next(e);
     }
     next();
@@ -64330,7 +64350,7 @@ function importAnalysisPlugin(config) {
             if (specifier === clientPublicPath) {
               return;
             }
-            if (specifier[0] === "/" && !(config.assetsInclude(cleanUrl(specifier)) || urlRE.test(specifier)) && checkPublicFile(specifier, config)) {
+            if (specifier[0] === "/" && !(config.assetsInclude(cleanUrl(specifier)) || urlRE$1.test(specifier)) && checkPublicFile(specifier, config)) {
               throw new Error(
                 `Cannot import non-asset file ${specifier} which is inside /public. JS/CSS files inside /public are copied as-is on build and can only be referenced via <script src> or <link href> in html. If you want to get the URL of that file, use ${injectQuery(
                   specifier,

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { A as colors, v as createLogger, r as resolveConfig } from './chunks/dep-CevzF2vT.js';
+import { A as colors, v as createLogger, r as resolveConfig } from './chunks/dep-Dyl6b77n.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -731,7 +731,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-CevzF2vT.js').then(function (n) { return n.E; });
+  const { createServer } = await import('./chunks/dep-Dyl6b77n.js').then(function (n) { return n.E; });
   try {
     const server = await createServer({
       root,
@@ -823,7 +823,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
   `[boolean] force empty outDir when it's outside of root`
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { build } = await import('./chunks/dep-CevzF2vT.js').then(function (n) { return n.F; });
+  const { build } = await import('./chunks/dep-Dyl6b77n.js').then(function (n) { return n.F; });
   const buildOptions = cleanOptions(options);
   try {
     await build({
@@ -852,7 +852,7 @@ cli.command("optimize [root]", "pre-bundle dependencies").option(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-CevzF2vT.js').then(function (n) { return n.D; });
+    const { optimizeDeps } = await import('./chunks/dep-Dyl6b77n.js').then(function (n) { return n.D; });
     try {
       const config = await resolveConfig(
         {
@@ -878,7 +878,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-CevzF2vT.js').then(function (n) { return n.G; });
+    const { preview } = await import('./chunks/dep-Dyl6b77n.js').then(function (n) { return n.G; });
     try {
       const server = await preview({
         root,

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { i as isInNodeModules, a as arraify } from './chunks/dep-CevzF2vT.js';
-export { b as build, g as buildErrorMessage, k as createFilter, v as createLogger, c as createServer, d as defineConfig, h as fetchModule, f as formatPostcssSourceMap, x as isFileServingAllowed, l as loadConfigFromFile, y as loadEnv, j as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, e as preprocessCSS, p as preview, r as resolveConfig, z as resolveEnvPrefix, q as rollupVersion, w as searchForWorkspaceRoot, u as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-CevzF2vT.js';
+import { i as isInNodeModules, a as arraify } from './chunks/dep-Dyl6b77n.js';
+export { b as build, g as buildErrorMessage, k as createFilter, v as createLogger, c as createServer, d as defineConfig, h as fetchModule, f as formatPostcssSourceMap, x as isFileServingAllowed, l as loadConfigFromFile, y as loadEnv, j as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, e as preprocessCSS, p as preview, r as resolveConfig, z as resolveEnvPrefix, q as rollupVersion, w as searchForWorkspaceRoot, u as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-Dyl6b77n.js';
 export { VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import { existsSync, readFileSync } from 'node:fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "5.4.15",
+  "version": "5.4.17",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",