vite 5.4.6 → 5.4.18

package/dist/node/index.d.ts

@@ -669,6 +669,18 @@ interface CommonServerOptions {
      * Set to 0.0.0.0 to listen on all addresses, including LAN and public addresses.
      */
     host?: string | boolean;
+    /**
+     * The hostnames that Vite is allowed to respond to.
+     * `localhost` and subdomains under `.localhost` and all IP addresses are allowed by default.
+     * When using HTTPS, this check is skipped.
+     *
+     * If a string starts with `.`, it will allow that hostname without the `.` and all subdomains under the hostname.
+     * For example, `.example.com` will allow `example.com`, `foo.example.com`, and `foo.bar.example.com`.
+     *
+     * If set to `true`, the server is allowed to respond to requests for any hosts.
+     * This is not recommended as it will be vulnerable to DNS rebinding attacks.
+     */
+    allowedHosts?: string[] | true;
     /**
      * Enable TLS + HTTP/2.
      * Note: this downgrades to TLS only when the proxy option is also used.
@@ -704,8 +716,14 @@ interface CommonServerOptions {
     /**
      * Configure CORS for the dev server.
      * Uses https://github.com/expressjs/cors.
+     *
+     * When enabling this option, **we recommend setting a specific value
+     * rather than `true`** to avoid exposing the source code to untrusted origins.
+     *
      * Set to `true` to allow all methods from any origin, or configure separately
      * using an object.
+     *
+     * @default false
      */
     cors?: CorsOptions | boolean;
     /**
@@ -717,6 +735,12 @@ interface CommonServerOptions {
  * https://github.com/expressjs/cors#configuration-options
  */
 interface CorsOptions {
+    /**
+     * Configures the Access-Control-Allow-Origin CORS header.
+     *
+     * **We recommend setting a specific value rather than
+     * `true`** to avoid exposing the source code to untrusted origins.
+     */
     origin?: CorsOrigin | ((origin: string | undefined, cb: (err: Error, origins: CorsOrigin) => void) => void);
     methods?: string | string[];
     allowedHeaders?: string | string[];
@@ -3402,6 +3426,18 @@ interface LegacyOptions {
      * https://github.com/vitejs/vite/discussions/14697.
      */
     proxySsrExternalModules?: boolean;
+    /**
+     * In Vite 6.0.8 / 5.4.11 and below, WebSocket server was able to connect from any web pages. However,
+     * that could be exploited by a malicious web page.
+     *
+     * In Vite 6.0.9+ / 5.4.12+, the WebSocket server now requires a token to connect from a web page.
+     * But this may break some plugins and frameworks that connects to the WebSocket server
+     * on their own. Enabling this option will make Vite skip the token check.
+     *
+     * **We do not recommend enabling this option unless you are sure that you are fine with
+     * that security weakness.**
+     */
+    skipWebSocketTokenCheck?: boolean;
 }
 interface ResolvedWorkerOptions {
     format: 'es' | 'iife';
@@ -3443,6 +3479,17 @@ type ResolvedConfig = Readonly<Omit<UserConfig, 'plugins' | 'css' | 'assetsInclu
     worker: ResolvedWorkerOptions;
     appType: AppType;
     experimental: ExperimentalOptions;
+    /**
+     * The token to connect to the WebSocket server from browsers.
+     *
+     * We recommend using `import.meta.hot` rather than connecting
+     * to the WebSocket server directly.
+     * If you have a usecase that requires connecting to the WebSocket
+     * server, please create an issue so that we can discuss.
+     *
+     * @deprecated
+     */
+    webSocketToken: string;
 } & PluginHookUtils>;
 interface PluginHookUtils {
     getSortedPlugins: <K extends keyof Plugin>(hookName: K) => PluginWithRequiredHook<K>[];

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { i as isInNodeModules, a as arraify } from './chunks/dep-DyBnyoVI.js';
-export { b as build, g as buildErrorMessage, k as createFilter, v as createLogger, c as createServer, d as defineConfig, h as fetchModule, f as formatPostcssSourceMap, x as isFileServingAllowed, l as loadConfigFromFile, y as loadEnv, j as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, e as preprocessCSS, p as preview, r as resolveConfig, z as resolveEnvPrefix, q as rollupVersion, w as searchForWorkspaceRoot, u as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-DyBnyoVI.js';
+import { i as isInNodeModules, a as arraify } from './chunks/dep-DbT5NFX0.js';
+export { b as build, g as buildErrorMessage, k as createFilter, v as createLogger, c as createServer, d as defineConfig, h as fetchModule, f as formatPostcssSourceMap, x as isFileServingAllowed, l as loadConfigFromFile, y as loadEnv, j as mergeAlias, m as mergeConfig, n as normalizePath, o as optimizeDeps, e as preprocessCSS, p as preview, r as resolveConfig, z as resolveEnvPrefix, q as rollupVersion, w as searchForWorkspaceRoot, u as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-DbT5NFX0.js';
 export { VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import { existsSync, readFileSync } from 'node:fs';
@@ -11,6 +11,7 @@ import 'node:url';
 import 'node:util';
 import 'node:perf_hooks';
 import 'node:module';
+import 'node:crypto';
 import 'tty';
 import 'path';
 import 'fs';
@@ -29,7 +30,6 @@ import 'stream';
 import 'os';
 import 'child_process';
 import 'node:os';
-import 'node:crypto';
 import 'node:dns';
 import 'crypto';
 import 'module';
@@ -43,6 +43,7 @@ import 'zlib';
 import 'buffer';
 import 'https';
 import 'tls';
+import 'node:net';
 import 'assert';
 import 'node:zlib';
 

package/index.cjs

@@ -40,7 +40,7 @@ function warnCjsUsage() {
   const yellow = (str) => `\u001b[33m${str}\u001b[39m`
   console.warn(
     yellow(
-      `The CJS build of Vite's Node API is deprecated. See https://vitejs.dev/guide/troubleshooting.html#vite-cjs-node-api-deprecated for more details.`,
+      `The CJS build of Vite's Node API is deprecated. See https://vite.dev/guide/troubleshooting.html#vite-cjs-node-api-deprecated for more details.`,
     ),
   )
   if (process.env.VITE_CJS_TRACE) {

package/index.d.cts

@@ -1,5 +1,5 @@
 /**
- * @deprecated The CJS build of Vite's Node API is deprecated. See https://vitejs.dev/guide/troubleshooting.html#vite-cjs-node-api-deprecated for more details.
+ * @deprecated The CJS build of Vite's Node API is deprecated. See https://vite.dev/guide/troubleshooting.html#vite-cjs-node-api-deprecated for more details.
  */
 declare const module: any
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "5.4.6",
+  "version": "5.4.18",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",
@@ -68,7 +68,7 @@
   "bugs": {
     "url": "https://github.com/vitejs/vite/issues"
   },
-  "homepage": "https://vitejs.dev",
+  "homepage": "https://vite.dev",
   "funding": "https://github.com/vitejs/vite?sponsor=1",
   "//": "READ CONTRIBUTING.md to understand what to put under deps vs. devDeps!",
   "dependencies": {
@@ -109,7 +109,7 @@
     "etag": "^1.8.1",
     "fast-glob": "^3.3.2",
     "http-proxy": "^1.18.1",
-    "launch-editor-middleware": "^2.8.1",
+    "launch-editor-middleware": "^2.9.1",
     "lightningcss": "^1.26.0",
     "magic-string": "^0.30.11",
     "micromatch": "^4.0.8",
@@ -134,7 +134,7 @@
     "source-map-support": "^0.5.21",
     "strip-ansi": "^7.1.0",
     "strip-literal": "^2.1.0",
-    "tsconfck": "^3.1.3",
+    "tsconfck": "^3.1.4",
     "tslib": "^2.7.0",
     "types": "link:./types",
     "ufo": "^1.5.4",