vite 6.0.10 → 6.0.12

package/dist/node/chunks/{dep-BgKqB7IO.js → dep-B_t-fquM.js}

@@ -1,4 +1,4 @@
-import { O as commonjsGlobal, N as getDefaultExportFromCjs } from './dep-DP_yvx5y.js';
+import { O as commonjsGlobal, N as getDefaultExportFromCjs } from './dep-BzsM_vHB.js';
 import require$$0$2 from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/chunks/{dep-DP_yvx5y.js → dep-BzsM_vHB.js}

@@ -8,7 +8,7 @@ import { performance } from 'node:perf_hooks';
 import require$$0$6, { createRequire as createRequire$1, builtinModules } from 'node:module';
 import crypto$2 from 'node:crypto';
 import esbuild, { transform as transform$1, formatMessages, build as build$b } from 'esbuild';
-import { CLIENT_ENTRY, OPTIMIZABLE_ENTRY_RE, wildcardHosts, loopbackHosts, FS_PREFIX, CLIENT_PUBLIC_PATH, ENV_PUBLIC_PATH, DEFAULT_ASSETS_INLINE_LIMIT, ENV_ENTRY, DEP_VERSION_RE, SPECIAL_QUERY_RE, DEV_PROD_CONDITION, JS_TYPES_RE, KNOWN_ASSET_TYPES, CSS_LANGS_RE, METADATA_FILENAME, ESBUILD_MODULES_TARGET, ERR_OPTIMIZE_DEPS_PROCESSING_ERROR, ERR_FILE_NOT_FOUND_IN_OPTIMIZED_DEP_DIR, VITE_PACKAGE_DIR, DEFAULT_DEV_PORT, CLIENT_DIR, VERSION, ROLLUP_HOOKS, DEFAULT_PREVIEW_PORT, DEFAULT_ASSETS_RE, DEFAULT_CONFIG_FILES, DEFAULT_CLIENT_MAIN_FIELDS, DEFAULT_SERVER_MAIN_FIELDS, DEFAULT_CLIENT_CONDITIONS, DEFAULT_SERVER_CONDITIONS } from '../constants.js';
+import { CLIENT_ENTRY, OPTIMIZABLE_ENTRY_RE, wildcardHosts, loopbackHosts, FS_PREFIX, CLIENT_PUBLIC_PATH, ENV_PUBLIC_PATH, DEFAULT_ASSETS_INLINE_LIMIT, ENV_ENTRY, DEP_VERSION_RE, SPECIAL_QUERY_RE, DEV_PROD_CONDITION, JS_TYPES_RE, KNOWN_ASSET_TYPES, CSS_LANGS_RE, METADATA_FILENAME, ESBUILD_MODULES_TARGET, ERR_OPTIMIZE_DEPS_PROCESSING_ERROR, ERR_FILE_NOT_FOUND_IN_OPTIMIZED_DEP_DIR, VITE_PACKAGE_DIR, DEFAULT_DEV_PORT, defaultAllowedOrigins, CLIENT_DIR, VERSION, ROLLUP_HOOKS, DEFAULT_PREVIEW_PORT, DEFAULT_ASSETS_RE, DEFAULT_CONFIG_FILES, DEFAULT_CLIENT_MAIN_FIELDS, DEFAULT_SERVER_MAIN_FIELDS, DEFAULT_CLIENT_CONDITIONS, DEFAULT_SERVER_CONDITIONS } from '../constants.js';
 import require$$0$2, { posix, win32, isAbsolute, resolve as resolve$3, relative as relative$1, basename as basename$1, extname, dirname as dirname$1, join, sep } from 'path';
 import require$$0$3, { existsSync, readFileSync, statSync, readdirSync } from 'fs';
 import childProcess$2, { exec, execFile, execSync } from 'node:child_process';
@@ -37670,7 +37670,8 @@ function abortHandshakeOrEmitwsClientError(server, req, socket, code, message) {
 
 var WebSocketServerRaw_ = /*@__PURE__*/getDefaultExportFromCjs(websocketServer);
 
-const allowedHostsCache = /* @__PURE__ */ new WeakMap();
+const allowedHostsServerCache = /* @__PURE__ */ new WeakMap();
+const allowedHostsPreviewCache = /* @__PURE__ */ new WeakMap();
 const isFileOrExtensionProtocolRE = /^(?:file|.+-extension):/i;
 function getAdditionalAllowedHosts(resolvedServerOptions, resolvedPreviewOptions) {
   const list = [];
@@ -37727,39 +37728,42 @@ function isHostAllowedWithoutCache(allowedHosts, additionalAllowedHosts, host) {
   }
   return false;
 }
-function isHostAllowed(config, host) {
-  if (config.server.allowedHosts === true) {
+function isHostAllowed(config, isPreview, host) {
+  const allowedHosts = isPreview ? config.preview.allowedHosts : config.server.allowedHosts;
+  if (allowedHosts === true) {
     return true;
   }
-  if (!allowedHostsCache.has(config)) {
-    allowedHostsCache.set(config, /* @__PURE__ */ new Set());
+  const cache = isPreview ? allowedHostsPreviewCache : allowedHostsServerCache;
+  if (!cache.has(config)) {
+    cache.set(config, /* @__PURE__ */ new Set());
   }
-  const allowedHosts = allowedHostsCache.get(config);
-  if (allowedHosts.has(host)) {
+  const cachedAllowedHosts = cache.get(config);
+  if (cachedAllowedHosts.has(host)) {
     return true;
   }
   const result = isHostAllowedWithoutCache(
-    config.server.allowedHosts,
+    allowedHosts,
     config.additionalAllowedHosts,
     host
   );
   if (result) {
-    allowedHosts.add(host);
+    cachedAllowedHosts.add(host);
   }
   return result;
 }
-function hostCheckMiddleware(config) {
+function hostCheckMiddleware(config, isPreview) {
   return function viteHostCheckMiddleware(req, res, next) {
     const hostHeader = req.headers.host;
-    if (!hostHeader || !isHostAllowed(config, hostHeader)) {
+    if (!hostHeader || !isHostAllowed(config, isPreview, hostHeader)) {
       const hostname = hostHeader?.replace(/:\d+$/, "");
       const hostnameWithQuotes = JSON.stringify(hostname);
+      const optionName = `${isPreview ? "preview" : "server"}.allowedHosts`;
       res.writeHead(403, {
         "Content-Type": "text/plain"
       });
       res.end(
         `Blocked request. This host (${hostnameWithQuotes}) is not allowed.
-To allow this host, add ${hostnameWithQuotes} to \`server.allowedHosts\` in vite.config.js.`
+To allow this host, add ${hostnameWithQuotes} to \`${optionName}\` in vite.config.js.`
       );
       return;
     }
@@ -37833,7 +37837,7 @@ function createWebSocketServer(server, config, httpsOptions) {
     const protocol = req.headers["sec-websocket-protocol"];
     if (protocol === "vite-ping") return true;
     const hostHeader = req.headers.host;
-    if (!hostHeader || !isHostAllowed(config, hostHeader)) {
+    if (!hostHeader || !isHostAllowed(config, false, hostHeader)) {
       return false;
     }
     if (config.legacy?.skipWebSocketTokenCheck) {
@@ -42533,6 +42537,7 @@ function incrementIndent(indent = "") {
 
 const debugCache = createDebugger("vite:cache");
 const knownIgnoreList = /* @__PURE__ */ new Set(["/", "/favicon.ico"]);
+const trailingQuerySeparatorsRE = /[?&]+$/;
 function cachedTransformMiddleware(server) {
   return function viteCachedTransformMiddleware(req, res, next) {
     const environment = server.environments.client;
@@ -42618,7 +42623,16 @@ function transformMiddleware(server) {
       if (publicDirInRoot && url.startsWith(publicPath)) {
         warnAboutExplicitPublicPathInUrl(url);
       }
-      if ((rawRE.test(url) || urlRE.test(url)) && !ensureServingAccess(url, server, res, next)) {
+      const urlWithoutTrailingQuerySeparators = url.replace(
+        trailingQuerySeparatorsRE,
+        ""
+      );
+      if ((rawRE.test(urlWithoutTrailingQuerySeparators) || urlRE.test(urlWithoutTrailingQuerySeparators)) && !ensureServingAccess(
+        urlWithoutTrailingQuerySeparators,
+        server,
+        res,
+        next
+      )) {
         return;
       }
       if (req.headers["sec-fetch-dest"] === "script" || isJSRequest(url) || isImportRequest(url) || isCSSRequest(url) || isHTMLProxy(url)) {
@@ -44033,7 +44047,7 @@ async function _createServer(inlineConfig = {}, options) {
   }
   const { allowedHosts } = serverConfig;
   if (allowedHosts !== true && !serverConfig.https) {
-    middlewares.use(hostCheckMiddleware(config));
+    middlewares.use(hostCheckMiddleware(config, false));
   }
   middlewares.use(cachedTransformMiddleware(server));
   const { proxy } = serverConfig;
@@ -44159,7 +44173,7 @@ const serverConfigDefaults = Object.freeze({
   https: undefined,
   open: false,
   proxy: undefined,
-  cors: false,
+  cors: { origin: defaultAllowedOrigins },
   headers: {},
   // hmr
   // ws
@@ -48875,8 +48889,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-a6F3bn0a.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-BgKqB7IO.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-C1bPwvxG.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-B_t-fquM.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -53102,7 +53116,7 @@ async function preview(inlineConfig = {}) {
   }
   const { allowedHosts } = config.preview;
   if (allowedHosts !== true && !config.preview.https) {
-    app.use(hostCheckMiddleware(config));
+    app.use(hostCheckMiddleware(config, true));
   }
   const { proxy } = config.preview;
   if (proxy) {

package/dist/node/chunks/{dep-a6F3bn0a.js → dep-C1bPwvxG.js}

@@ -1,4 +1,4 @@
-import { N as getDefaultExportFromCjs } from './dep-DP_yvx5y.js';
+import { N as getDefaultExportFromCjs } from './dep-BzsM_vHB.js';
 import require$$0 from 'path';
 import { l as lib } from './dep-3RmXg9uo.js';
 

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { M as colors, G as createLogger, r as resolveConfig } from './chunks/dep-DP_yvx5y.js';
+import { M as colors, G as createLogger, r as resolveConfig } from './chunks/dep-BzsM_vHB.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -741,7 +741,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-DP_yvx5y.js').then(function (n) { return n.Q; });
+  const { createServer } = await import('./chunks/dep-BzsM_vHB.js').then(function (n) { return n.Q; });
   try {
     const server = await createServer({
       root,
@@ -834,7 +834,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).option("--app", `[boolean] same as \`builder: {}\``).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { createBuilder } = await import('./chunks/dep-DP_yvx5y.js').then(function (n) { return n.R; });
+    const { createBuilder } = await import('./chunks/dep-BzsM_vHB.js').then(function (n) { return n.R; });
     const buildOptions = cleanGlobalCLIOptions(
       cleanBuilderCLIOptions(options)
     );
@@ -869,7 +869,7 @@ cli.command("optimize [root]", "pre-bundle dependencies").option(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-DP_yvx5y.js').then(function (n) { return n.P; });
+    const { optimizeDeps } = await import('./chunks/dep-BzsM_vHB.js').then(function (n) { return n.P; });
     try {
       const config = await resolveConfig(
         {
@@ -895,7 +895,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-DP_yvx5y.js').then(function (n) { return n.S; });
+    const { preview } = await import('./chunks/dep-BzsM_vHB.js').then(function (n) { return n.S; });
     try {
       const server = await preview({
         root,

package/dist/node/constants.js

@@ -140,8 +140,9 @@ const wildcardHosts = /* @__PURE__ */ new Set([
 const DEFAULT_DEV_PORT = 5173;
 const DEFAULT_PREVIEW_PORT = 4173;
 const DEFAULT_ASSETS_INLINE_LIMIT = 4096;
+const defaultAllowedOrigins = /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/;
 const METADATA_FILENAME = "_metadata.json";
 const ERR_OPTIMIZE_DEPS_PROCESSING_ERROR = "ERR_OPTIMIZE_DEPS_PROCESSING_ERROR";
 const ERR_FILE_NOT_FOUND_IN_OPTIMIZED_DEP_DIR = "ERR_FILE_NOT_FOUND_IN_OPTIMIZED_DEP_DIR";
 
-export { CLIENT_DIR, CLIENT_ENTRY, CLIENT_PUBLIC_PATH, CSS_LANGS_RE, DEFAULT_ASSETS_INLINE_LIMIT, DEFAULT_ASSETS_RE, DEFAULT_CLIENT_CONDITIONS, DEFAULT_CLIENT_MAIN_FIELDS, DEFAULT_CONFIG_FILES, DEFAULT_DEV_PORT, DEFAULT_PREVIEW_PORT, DEFAULT_SERVER_CONDITIONS, DEFAULT_SERVER_MAIN_FIELDS, DEP_VERSION_RE, DEV_PROD_CONDITION, ENV_ENTRY, ENV_PUBLIC_PATH, ERR_FILE_NOT_FOUND_IN_OPTIMIZED_DEP_DIR, ERR_OPTIMIZE_DEPS_PROCESSING_ERROR, ESBUILD_MODULES_TARGET, FS_PREFIX, JS_TYPES_RE, KNOWN_ASSET_TYPES, METADATA_FILENAME, OPTIMIZABLE_ENTRY_RE, ROLLUP_HOOKS, SPECIAL_QUERY_RE, VERSION, VITE_PACKAGE_DIR, loopbackHosts, wildcardHosts };
+export { CLIENT_DIR, CLIENT_ENTRY, CLIENT_PUBLIC_PATH, CSS_LANGS_RE, DEFAULT_ASSETS_INLINE_LIMIT, DEFAULT_ASSETS_RE, DEFAULT_CLIENT_CONDITIONS, DEFAULT_CLIENT_MAIN_FIELDS, DEFAULT_CONFIG_FILES, DEFAULT_DEV_PORT, DEFAULT_PREVIEW_PORT, DEFAULT_SERVER_CONDITIONS, DEFAULT_SERVER_MAIN_FIELDS, DEP_VERSION_RE, DEV_PROD_CONDITION, ENV_ENTRY, ENV_PUBLIC_PATH, ERR_FILE_NOT_FOUND_IN_OPTIMIZED_DEP_DIR, ERR_OPTIMIZE_DEPS_PROCESSING_ERROR, ESBUILD_MODULES_TARGET, FS_PREFIX, JS_TYPES_RE, KNOWN_ASSET_TYPES, METADATA_FILENAME, OPTIMIZABLE_ENTRY_RE, ROLLUP_HOOKS, SPECIAL_QUERY_RE, VERSION, VITE_PACKAGE_DIR, defaultAllowedOrigins, loopbackHosts, wildcardHosts };

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { i as isInNodeModules, a as arraify } from './chunks/dep-DP_yvx5y.js';
-export { B as BuildEnvironment, D as DevEnvironment, f as build, m as buildErrorMessage, g as createBuilder, C as createFilter, h as createIdResolver, G as createLogger, n as createRunnableDevEnvironment, c as createServer, w as createServerHotChannel, v as createServerModuleRunner, d as defineConfig, u as fetchModule, j as formatPostcssSourceMap, J as isFileLoadingAllowed, I as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, K as loadEnv, A as mergeAlias, z as mergeConfig, x as moduleRunnerTransform, y as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, L as resolveEnvPrefix, E as rollupVersion, H as searchForWorkspaceRoot, F as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-DP_yvx5y.js';
+import { i as isInNodeModules, a as arraify } from './chunks/dep-BzsM_vHB.js';
+export { B as BuildEnvironment, D as DevEnvironment, f as build, m as buildErrorMessage, g as createBuilder, C as createFilter, h as createIdResolver, G as createLogger, n as createRunnableDevEnvironment, c as createServer, w as createServerHotChannel, v as createServerModuleRunner, d as defineConfig, u as fetchModule, j as formatPostcssSourceMap, J as isFileLoadingAllowed, I as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, K as loadEnv, A as mergeAlias, z as mergeConfig, x as moduleRunnerTransform, y as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, L as resolveEnvPrefix, E as rollupVersion, H as searchForWorkspaceRoot, F as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-BzsM_vHB.js';
 export { DEFAULT_CLIENT_CONDITIONS as defaultClientConditions, DEFAULT_CLIENT_MAIN_FIELDS as defaultClientMainFields, DEFAULT_SERVER_CONDITIONS as defaultServerConditions, DEFAULT_SERVER_MAIN_FIELDS as defaultServerMainFields, VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import 'node:fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "6.0.10",
+  "version": "6.0.12",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",