vite 5.4.19 → 5.4.21

package/dist/node/chunks/{dep-COdkJwUb.js → dep-BB45zftN.js}

@@ -1,4 +1,4 @@
-import { C as getDefaultExportFromCjs } from './dep-C6uTJdX2.js';
+import { C as getDefaultExportFromCjs } from './dep-BK3b2jBa.js';
 import require$$0 from 'path';
 import require$$0__default from 'fs';
 import { l as lib } from './dep-IQS-Za7F.js';

package/dist/node/chunks/{dep-C6uTJdX2.js → dep-BK3b2jBa.js}

@@ -36991,8 +36991,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-COdkJwUb.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-CEGXe0Sr.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-BB45zftN.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-Dnp7gl8U.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -51568,7 +51568,7 @@ function sirv (dir, opts={}) {
 		});
 	}
 
-	let lookup = opts.dev ? viaLocal.bind(0, dir, isEtag) : viaCache.bind(0, FILES);
+	let lookup = opts.dev ? viaLocal.bind(0, dir.endsWith(sep$1) ? dir : dir + sep$1, isEtag) : viaCache.bind(0, FILES);
 
 	return function (req, res, next) {
 		let extns = [''];
@@ -51752,7 +51752,8 @@ function isUriInFilePath(uri, filePath) {
 function isFileLoadingAllowed(server, filePath) {
   const { fs } = server.config.server;
   if (!fs.strict) return true;
-  if (server._fsDenyGlob(filePath)) return false;
+  const filePathWithoutTrailingSlash = filePath.endsWith("/") ? filePath.slice(0, -1) : filePath;
+  if (server._fsDenyGlob(filePathWithoutTrailingSlash)) return false;
   if (server.moduleGraph.safeModulesPath.has(filePath)) return true;
   if (fs.allow.some((uri) => isUriInFilePath(uri, filePath))) return true;
   return false;
@@ -62470,7 +62471,22 @@ function indexHtmlMiddleware(root, server) {
       if (isDev && url.startsWith(FS_PREFIX)) {
         filePath = decodeURIComponent(fsPathFromId(url));
       } else {
-        filePath = path$n.join(root, decodeURIComponent(url));
+        filePath = normalizePath$3(
+          path$n.resolve(path$n.join(root, decodeURIComponent(url)))
+        );
+      }
+      if (isDev) {
+        const servingAccessResult = checkLoadingAccess(server, filePath);
+        if (servingAccessResult === "denied") {
+          return respondWithAccessDenied(filePath, server, res);
+        }
+        if (servingAccessResult === "fallback") {
+          return next();
+        }
+      } else {
+        if (!isParentDirectory(root, filePath)) {
+          return next();
+        }
       }
       if (fsUtils.existsSync(filePath)) {
         const headers = isDev ? server.config.server.headers : server.config.preview.headers;
@@ -66303,7 +66319,8 @@ async function preview(inlineConfig = {}) {
   }
   postHooks.forEach((fn) => fn && fn());
   if (config.appType === "spa" || config.appType === "mpa") {
-    app.use(indexHtmlMiddleware(distDir, server));
+    const normalizedDistDir = normalizePath$3(distDir);
+    app.use(indexHtmlMiddleware(normalizedDistDir, server));
     app.use(notFoundMiddleware());
   }
   const hostname = await resolveHostname(options.host);

package/dist/node/chunks/{dep-CEGXe0Sr.js → dep-Dnp7gl8U.js}

@@ -1,4 +1,4 @@
-import { D as commonjsGlobal, C as getDefaultExportFromCjs } from './dep-C6uTJdX2.js';
+import { D as commonjsGlobal, C as getDefaultExportFromCjs } from './dep-BK3b2jBa.js';
 import require$$0__default from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { B as colors, v as createLogger, r as resolveConfig } from './chunks/dep-C6uTJdX2.js';
+import { B as colors, v as createLogger, r as resolveConfig } from './chunks/dep-BK3b2jBa.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -731,7 +731,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-C6uTJdX2.js').then(function (n) { return n.F; });
+  const { createServer } = await import('./chunks/dep-BK3b2jBa.js').then(function (n) { return n.F; });
   try {
     const server = await createServer({
       root,
@@ -823,7 +823,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
   `[boolean] force empty outDir when it's outside of root`
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { build } = await import('./chunks/dep-C6uTJdX2.js').then(function (n) { return n.G; });
+  const { build } = await import('./chunks/dep-BK3b2jBa.js').then(function (n) { return n.G; });
   const buildOptions = cleanOptions(options);
   try {
     await build({
@@ -852,7 +852,7 @@ cli.command("optimize [root]", "pre-bundle dependencies").option(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-C6uTJdX2.js').then(function (n) { return n.E; });
+    const { optimizeDeps } = await import('./chunks/dep-BK3b2jBa.js').then(function (n) { return n.E; });
     try {
       const config = await resolveConfig(
         {
@@ -878,7 +878,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-C6uTJdX2.js').then(function (n) { return n.H; });
+    const { preview } = await import('./chunks/dep-BK3b2jBa.js').then(function (n) { return n.H; });
     try {
       const server = await preview({
         root,

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { i as isInNodeModules, a as arraify } from './chunks/dep-C6uTJdX2.js';
-export { b as build, g as buildErrorMessage, k as createFilter, v as createLogger, c as createServer, d as defineConfig, h as fetchModule, f as formatPostcssSourceMap, y as isFileLoadingAllowed, x as isFileServingAllowed, l as loadConfigFromFile, z as loadEnv, j as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, e as preprocessCSS, p as preview, r as resolveConfig, A as resolveEnvPrefix, q as rollupVersion, w as searchForWorkspaceRoot, u as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-C6uTJdX2.js';
+import { i as isInNodeModules, a as arraify } from './chunks/dep-BK3b2jBa.js';
+export { b as build, g as buildErrorMessage, k as createFilter, v as createLogger, c as createServer, d as defineConfig, h as fetchModule, f as formatPostcssSourceMap, y as isFileLoadingAllowed, x as isFileServingAllowed, l as loadConfigFromFile, z as loadEnv, j as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, e as preprocessCSS, p as preview, r as resolveConfig, A as resolveEnvPrefix, q as rollupVersion, w as searchForWorkspaceRoot, u as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-BK3b2jBa.js';
 export { VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import { existsSync, readFileSync } from 'node:fs';

package/dist/node-cjs/publicUtils.cjs

@@ -5552,7 +5552,8 @@ function isUriInFilePath(uri, filePath) {
 function isFileLoadingAllowed(server, filePath) {
   const { fs } = server.config.server;
   if (!fs.strict) return true;
-  if (server._fsDenyGlob(filePath)) return false;
+  const filePathWithoutTrailingSlash = filePath.endsWith("/") ? filePath.slice(0, -1) : filePath;
+  if (server._fsDenyGlob(filePathWithoutTrailingSlash)) return false;
   if (server.moduleGraph.safeModulesPath.has(filePath)) return true;
   if (fs.allow.some((uri) => isUriInFilePath(uri, filePath))) return true;
   return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "5.4.19",
+  "version": "5.4.21",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",