vite 6.1.3 → 6.1.5

package/dist/node/chunks/{dep-DsKUDpAA.js → dep-C6Xcw3Ji.js}

@@ -13593,8 +13593,9 @@ async function fileToDevUrl(environment, id, skipBase = false) {
     const content = await fsp.readFile(file);
     return assetToDataURL(environment, file, content);
   }
-  if (svgExtRE.test(id)) {
-    const file = publicFile || cleanUrl(id);
+  const cleanedId = cleanUrl(id);
+  if (svgExtRE.test(cleanedId)) {
+    const file = publicFile || cleanedId;
     const content = await fsp.readFile(file);
     if (shouldInline(environment, file, id, content, undefined, undefined)) {
       return assetToDataURL(environment, file, content);
@@ -41995,6 +41996,7 @@ function renderRestrictedErrorHTML(msg) {
 
 const ERR_LOAD_URL = "ERR_LOAD_URL";
 const ERR_LOAD_PUBLIC_URL = "ERR_LOAD_PUBLIC_URL";
+const ERR_DENIED_ID = "ERR_DENIED_ID";
 const debugLoad = createDebugger("vite:load");
 const debugTransform = createDebugger("vite:transform");
 const debugCache$1 = createDebugger("vite:cache");
@@ -42094,6 +42096,11 @@ async function loadAndTransform(environment, id, url, options, timestamp, mod, r
   const { config, pluginContainer, logger } = environment;
   const prettyUrl = debugLoad || debugTransform ? prettifyUrl(url, config.root) : "";
   const moduleGraph = environment.moduleGraph;
+  if (options.allowId && !options.allowId(id)) {
+    const err = new Error(`Denied ID ${id}`);
+    err.code = ERR_DENIED_ID;
+    throw err;
+  }
   let code = null;
   let map = null;
   const loadStart = debugLoad ? performance.now() : 0;
@@ -43528,6 +43535,10 @@ const trailingQuerySeparatorsRE = /[?&]+$/;
 const urlRE = /[?&]url\b/;
 const rawRE = /[?&]raw\b/;
 const inlineRE$2 = /[?&]inline\b/;
+const svgRE = /\.svg\b/;
+function deniedServingAccessForTransform(url, server, res, next) {
+  return (rawRE.test(url) || urlRE.test(url) || inlineRE$2.test(url) || svgRE.test(url)) && !ensureServingAccess(url, server, res, next);
+}
 function cachedTransformMiddleware(server) {
   return function viteCachedTransformMiddleware(req, res, next) {
     const environment = server.environments.client;
@@ -43617,7 +43628,7 @@ function transformMiddleware(server) {
         trailingQuerySeparatorsRE,
         ""
       );
-      if ((rawRE.test(urlWithoutTrailingQuerySeparators) || urlRE.test(urlWithoutTrailingQuerySeparators) || inlineRE$2.test(urlWithoutTrailingQuerySeparators)) && !ensureServingAccess(
+      if (deniedServingAccessForTransform(
         urlWithoutTrailingQuerySeparators,
         server,
         res,
@@ -43640,7 +43651,10 @@ function transformMiddleware(server) {
           }
         }
         const result = await transformRequest(environment, url, {
-          html: req.headers.accept?.includes("text/html")
+          html: req.headers.accept?.includes("text/html"),
+          allowId(id) {
+            return !deniedServingAccessForTransform(id, server, res, next);
+          }
         });
         if (result) {
           const depsOptimizer = environment.depsOptimizer;
@@ -43692,6 +43706,9 @@ function transformMiddleware(server) {
       if (e?.code === ERR_LOAD_URL) {
         return next();
       }
+      if (e?.code === ERR_DENIED_ID) {
+        return;
+      }
       return next(e);
     }
     next();
@@ -44695,6 +44712,17 @@ function searchForWorkspaceRoot(current, root = searchForPackageRoot(current)) {
   return searchForWorkspaceRoot(dir, root);
 }
 
+function rejectInvalidRequestMiddleware() {
+  return function viteRejectInvalidRequestMiddleware(req, res, next) {
+    if (req.url?.includes("#")) {
+      res.writeHead(400);
+      res.end();
+      return;
+    }
+    return next();
+  };
+}
+
 function createServer(inlineConfig = {}) {
   return _createServer(inlineConfig, { listen: true });
 }
@@ -45032,6 +45060,7 @@ async function _createServer(inlineConfig = {}, options) {
   if (process.env.DEBUG) {
     middlewares.use(timeMiddleware(root));
   }
+  middlewares.use(rejectInvalidRequestMiddleware());
   const { cors } = serverConfig;
   if (cors !== false) {
     middlewares.use(corsMiddleware(typeof cors === "boolean" ? {} : cors));
@@ -47391,6 +47420,7 @@ function escapeReplacement(value) {
 }
 
 const wasmHelperId = "\0vite/wasm-helper.js";
+const wasmInitRE = /(?<![?#].*)\.wasm\?init/;
 const wasmHelper = async (opts = {}, url) => {
   let result;
   if (url.startsWith("data:")) {
@@ -47435,7 +47465,7 @@ const wasmHelperPlugin = () => {
       if (id === wasmHelperId) {
         return `export default ${wasmHelperCode}`;
       }
-      if (!id.endsWith(".wasm?init")) {
+      if (!wasmInitRE.test(id)) {
         return;
       }
       const url = await fileToUrl$1(this, id);
@@ -50001,8 +50031,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-BSgDXZup.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-DxUYic98.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-CwTNmu7W.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-DWaGFX-v.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;

package/dist/node/chunks/{dep-BSgDXZup.js → dep-CwTNmu7W.js}

@@ -1,4 +1,4 @@
-import { P as getDefaultExportFromCjs } from './dep-DsKUDpAA.js';
+import { P as getDefaultExportFromCjs } from './dep-C6Xcw3Ji.js';
 import require$$0 from 'path';
 import { l as lib } from './dep-3RmXg9uo.js';
 

package/dist/node/chunks/{dep-DxUYic98.js → dep-DWaGFX-v.js}

@@ -1,4 +1,4 @@
-import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-DsKUDpAA.js';
+import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-C6Xcw3Ji.js';
 import require$$0$2 from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-DsKUDpAA.js';
+import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-C6Xcw3Ji.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -745,7 +745,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-DsKUDpAA.js').then(function (n) { return n.S; });
+  const { createServer } = await import('./chunks/dep-C6Xcw3Ji.js').then(function (n) { return n.S; });
   try {
     const server = await createServer({
       root,
@@ -839,7 +839,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).option("--app", `[boolean] same as \`builder: {}\``).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { createBuilder } = await import('./chunks/dep-DsKUDpAA.js').then(function (n) { return n.T; });
+    const { createBuilder } = await import('./chunks/dep-C6Xcw3Ji.js').then(function (n) { return n.T; });
     const buildOptions = cleanGlobalCLIOptions(
       cleanBuilderCLIOptions(options)
     );
@@ -878,7 +878,7 @@ cli.command(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-DsKUDpAA.js').then(function (n) { return n.R; });
+    const { optimizeDeps } = await import('./chunks/dep-C6Xcw3Ji.js').then(function (n) { return n.R; });
     try {
       const config = await resolveConfig(
         {
@@ -905,7 +905,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-DsKUDpAA.js').then(function (n) { return n.U; });
+    const { preview } = await import('./chunks/dep-C6Xcw3Ji.js').then(function (n) { return n.U; });
     try {
       const server = await preview({
         root,

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { i as isInNodeModules, a as arraify } from './chunks/dep-DsKUDpAA.js';
-export { B as BuildEnvironment, D as DevEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-DsKUDpAA.js';
+import { i as isInNodeModules, a as arraify } from './chunks/dep-C6Xcw3Ji.js';
+export { B as BuildEnvironment, D as DevEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-C6Xcw3Ji.js';
 export { defaultAllowedOrigins, DEFAULT_CLIENT_CONDITIONS as defaultClientConditions, DEFAULT_CLIENT_MAIN_FIELDS as defaultClientMainFields, DEFAULT_SERVER_CONDITIONS as defaultServerConditions, DEFAULT_SERVER_MAIN_FIELDS as defaultServerMainFields, VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import 'node:fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "6.1.3",
+  "version": "6.1.5",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",