vite 6.3.2 → 6.3.4

package/dist/node/chunks/{dep-DG3BLbPj.js → dep-Bn81Esdm.js}

@@ -10559,7 +10559,7 @@ async function fileToBuiltUrl(pluginContext, id, skipPublicCheck = false, forceI
   if (cached) {
     return cached;
   }
-  const { file, postfix } = splitFileAndPostfix(id);
+  let { file, postfix } = splitFileAndPostfix(id);
   const content = await fsp.readFile(file);
   let url;
   if (shouldInline(environment, file, id, content, pluginContext, forceInline)) {
@@ -10575,6 +10575,9 @@ async function fileToBuiltUrl(pluginContext, id, skipPublicCheck = false, forceI
       originalFileName,
       source: content
     });
+    if (environment.config.command === "build" && noInlineRE.test(postfix)) {
+      postfix = postfix.replace(noInlineRE, "").replace(/^&/, "?");
+    }
     url = `__VITE_ASSET__${referenceId}__${postfix ? `$_${postfix}__` : ``}`;
   }
   cache.set(id, url);
@@ -13023,7 +13026,7 @@ function esbuildCjsExternalPlugin(externals, platform) {
         (args) => ({
           contents: `import * as m from ${JSON.stringify(
             nonFacadePrefix + args.path
-          )};module.exports = m;`
+          )};module.exports = { ...m };`
         })
       );
     }
@@ -25653,14 +25656,40 @@ async function ssrTransformScript(code, inMap, url, originalCode) {
   }
   const imports = [];
   const exports = [];
+  const reExportImportIdMap = /* @__PURE__ */ new Map();
   for (const node of ast.body) {
     if (node.type === "ImportDeclaration") {
       imports.push(node);
-    } else if (node.type === "ExportNamedDeclaration" || node.type === "ExportDefaultDeclaration" || node.type === "ExportAllDeclaration") {
+    } else if (node.type === "ExportDefaultDeclaration") {
+      exports.push(node);
+    } else if (node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration") {
+      imports.push(node);
       exports.push(node);
     }
   }
   for (const node of imports) {
+    if (node.type === "ExportNamedDeclaration") {
+      if (node.source) {
+        const importId2 = defineImport(
+          hoistIndex,
+          node,
+          {
+            importedNames: node.specifiers.map(
+              (s2) => getIdentifierNameOrLiteralValue$1(s2.local)
+            )
+          }
+        );
+        reExportImportIdMap.set(node, importId2);
+      }
+      continue;
+    }
+    if (node.type === "ExportAllDeclaration") {
+      if (node.source) {
+        const importId2 = defineImport(hoistIndex, node);
+        reExportImportIdMap.set(node, importId2);
+      }
+      continue;
+    }
     const importId = defineImport(hoistIndex, node, {
       importedNames: node.specifiers.map((s2) => {
         if (s2.type === "ImportSpecifier")
@@ -25703,17 +25732,8 @@ async function ssrTransformScript(code, inMap, url, originalCode) {
         }
         s.remove(node.start, node.declaration.start);
       } else {
-        s.remove(node.start, node.end);
         if (node.source) {
-          const importId = defineImport(
-            node.start,
-            node,
-            {
-              importedNames: node.specifiers.map(
-                (s2) => getIdentifierNameOrLiteralValue$1(s2.local)
-              )
-            }
-          );
+          const importId = reExportImportIdMap.get(node);
           for (const spec of node.specifiers) {
             const exportedAs = getIdentifierNameOrLiteralValue$1(
               spec.exported
@@ -25728,6 +25748,7 @@ async function ssrTransformScript(code, inMap, url, originalCode) {
             }
           }
         } else {
+          s.remove(node.start, node.end);
           for (const spec of node.specifiers) {
             const local = spec.local.name;
             const binding = idToImportMap.get(local);
@@ -25748,20 +25769,19 @@ async function ssrTransformScript(code, inMap, url, originalCode) {
           node.start + 15
           /* 'export default '.length */
         );
-        s.append(
-          `
-Object.defineProperty(${ssrModuleExportsKey}, "default", { enumerable: true, configurable: true, value: ${name} });`
-        );
+        defineExport("default", name);
       } else {
+        const name = `__vite_ssr_export_default__`;
         s.update(
           node.start,
           node.start + 14,
-          `${ssrModuleExportsKey}.default =`
+          `const ${name} =`
         );
+        defineExport("default", name);
       }
     }
     if (node.type === "ExportAllDeclaration") {
-      const importId = defineImport(node.start, node);
+      const importId = reExportImportIdMap.get(node);
       if (node.exported) {
         const exportedAs = getIdentifierNameOrLiteralValue$1(
           node.exported
@@ -35328,8 +35348,11 @@ function sirv (dir, opts={}) {
 }
 
 const knownJavascriptExtensionRE = /\.(?:[tj]sx?|[cm][tj]s)$/;
+const ERR_DENIED_FILE = "ERR_DENIED_FILE";
 const sirvOptions = ({
-  getHeaders
+  config,
+  getHeaders,
+  disableFsServeCheck
 }) => {
   return {
     dev: true,
@@ -35345,6 +35368,19 @@ const sirvOptions = ({
           res.setHeader(name, headers[name]);
         }
       }
+    },
+    shouldServe: disableFsServeCheck ? void 0 : (filePath) => {
+      const servingAccessResult = checkLoadingAccess(config, filePath);
+      if (servingAccessResult === "denied") {
+        const error = new Error("denied access");
+        error.code = ERR_DENIED_FILE;
+        error.path = filePath;
+        throw error;
+      }
+      if (servingAccessResult === "fallback") {
+        return false;
+      }
+      return true;
     }
   };
 };
@@ -35353,7 +35389,9 @@ function servePublicMiddleware(server, publicFiles) {
   const serve = sirv(
     dir,
     sirvOptions({
-      getHeaders: () => server.config.server.headers
+      config: server.config,
+      getHeaders: () => server.config.server.headers,
+      disableFsServeCheck: true
     })
   );
   const toFilePath = (url) => {
@@ -35379,6 +35417,7 @@ function serveStaticMiddleware(server) {
   const serve = sirv(
     dir,
     sirvOptions({
+      config: server.config,
       getHeaders: () => server.config.server.headers
     })
   );
@@ -35409,38 +35448,46 @@ function serveStaticMiddleware(server) {
     if (resolvedPathname.endsWith("/") && fileUrl[fileUrl.length - 1] !== "/") {
       fileUrl = withTrailingSlash(fileUrl);
     }
-    if (!ensureServingAccess(fileUrl, server, res, next)) {
-      return;
-    }
     if (redirectedPathname) {
       url.pathname = encodeURI(redirectedPathname);
       req.url = url.href.slice(url.origin.length);
     }
-    serve(req, res, next);
+    try {
+      serve(req, res, next);
+    } catch (e) {
+      if (e && "code" in e && e.code === ERR_DENIED_FILE) {
+        respondWithAccessDenied(e.path, server, res);
+        return;
+      }
+      throw e;
+    }
   };
 }
 function serveRawFsMiddleware(server) {
   const serveFromRoot = sirv(
     "/",
-    sirvOptions({ getHeaders: () => server.config.server.headers })
+    sirvOptions({
+      config: server.config,
+      getHeaders: () => server.config.server.headers
+    })
   );
   return function viteServeRawFsMiddleware(req, res, next) {
     if (req.url.startsWith(FS_PREFIX)) {
       const url = new URL(req.url, "http://example.com");
       const pathname = decodeURI(url.pathname);
-      if (!ensureServingAccess(
-        slash$1(path$b.resolve(fsPathFromId(pathname))),
-        server,
-        res,
-        next
-      )) {
-        return;
-      }
       let newPathname = pathname.slice(FS_PREFIX.length);
       if (isWindows$3) newPathname = newPathname.replace(/^[A-Z]:/i, "");
       url.pathname = encodeURI(newPathname);
       req.url = url.href.slice(url.origin.length);
-      serveFromRoot(req, res, next);
+      try {
+        serveFromRoot(req, res, next);
+      } catch (e) {
+        if (e && "code" in e && e.code === ERR_DENIED_FILE) {
+          respondWithAccessDenied(e.path, server, res);
+          return;
+        }
+        throw e;
+      }
     } else {
       next();
     }
@@ -35464,25 +35511,35 @@ function isFileLoadingAllowed(config, filePath) {
   if (fs.allow.some((uri) => isUriInFilePath(uri, filePath))) return true;
   return false;
 }
-function ensureServingAccess(url, server, res, next) {
+function checkLoadingAccess(config, path2) {
+  if (isFileLoadingAllowed(config, slash$1(path2))) {
+    return "allowed";
+  }
+  if (isFileReadable(path2)) {
+    return "denied";
+  }
+  return "fallback";
+}
+function checkServingAccess(url, server) {
   if (isFileServingAllowed(url, server)) {
-    return true;
+    return "allowed";
   }
   if (isFileReadable(cleanUrl(url))) {
-    const urlMessage = `The request url "${url}" is outside of Vite serving allow list.`;
-    const hintMessage = `
+    return "denied";
+  }
+  return "fallback";
+}
+function respondWithAccessDenied(url, server, res) {
+  const urlMessage = `The request url "${url}" is outside of Vite serving allow list.`;
+  const hintMessage = `
 ${server.config.server.fs.allow.map((i) => `- ${i}`).join("\n")}
 
 Refer to docs https://vite.dev/config/server-options.html#server-fs-allow for configurations and more details.`;
-    server.config.logger.error(urlMessage);
-    server.config.logger.warnOnce(hintMessage + "\n");
-    res.statusCode = 403;
-    res.write(renderRestrictedErrorHTML(urlMessage + "\n" + hintMessage));
-    res.end();
-  } else {
-    next();
-  }
-  return false;
+  server.config.logger.error(urlMessage);
+  server.config.logger.warnOnce(hintMessage + "\n");
+  res.statusCode = 403;
+  res.write(renderRestrictedErrorHTML(urlMessage + "\n" + hintMessage));
+  res.end();
 }
 function renderRestrictedErrorHTML(msg) {
   const html = String.raw;
@@ -37060,7 +37117,18 @@ const rawRE = /[?&]raw\b/;
 const inlineRE$2 = /[?&]inline\b/;
 const svgRE = /\.svg\b/;
 function deniedServingAccessForTransform(url, server, res, next) {
-  return (rawRE.test(url) || urlRE.test(url) || inlineRE$2.test(url) || svgRE.test(url)) && !ensureServingAccess(url, server, res, next);
+  if (rawRE.test(url) || urlRE.test(url) || inlineRE$2.test(url) || svgRE.test(url)) {
+    const servingAccessResult = checkServingAccess(url, server);
+    if (servingAccessResult === "denied") {
+      respondWithAccessDenied(url, server, res);
+      return true;
+    }
+    if (servingAccessResult === "fallback") {
+      next();
+      return true;
+    }
+  }
+  return false;
 }
 function cachedTransformMiddleware(server) {
   return function viteCachedTransformMiddleware(req, res, next) {
@@ -37096,6 +37164,12 @@ function transformMiddleware(server) {
         "\0"
       );
     } catch (e) {
+      if (e instanceof URIError) {
+        server.config.logger.warn(
+          colors$1.yellow("Malformed URI sequence in request URL")
+        );
+        return next();
+      }
       return next(e);
     }
     const withoutQuery = cleanUrl(url);
@@ -43446,6 +43520,7 @@ function getEmptyChunkReplacer(pureCssChunkNames, outputFormat) {
     }
   );
 }
+const fileURLWithWindowsDriveRE = /^file:\/\/\/[a-zA-Z]:\//;
 function createCSSResolvers(config) {
   let cssResolve;
   let sassResolve;
@@ -43475,7 +43550,7 @@ function createCSSResolvers(config) {
             args[1] = fileURLToPath$1(args[1], {
               windows: (
                 // file:///foo cannot be converted to path with windows mode
-                isWindows$3 && args[1].startsWith("file:///") ? false : void 0
+                isWindows$3 && !fileURLWithWindowsDriveRE.test(args[1]) ? false : void 0
               )
             });
           }
@@ -43837,8 +43912,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-Cjqet4Sp.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-C8joxBaX.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-SOJpRpBL.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-D5ITTxnT.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -45392,19 +45467,11 @@ function buildImportAnalysisPlugin(config) {
       if (code.indexOf(isModernFlag) > -1) {
         const re = new RegExp(isModernFlag, "g");
         const isModern = String(format === "es");
-        if (this.environment.config.build.sourcemap) {
-          const s = new MagicString(code);
-          let match;
-          while (match = re.exec(code)) {
-            s.update(match.index, match.index + isModernFlag.length, isModern);
-          }
-          return {
-            code: s.toString(),
-            map: s.generateMap({ hires: "boundary" })
-          };
-        } else {
-          return code.replace(re, isModern);
-        }
+        const isModernWithPadding = isModern + " ".repeat(isModernFlag.length - isModern.length);
+        return {
+          code: code.replace(re, isModernWithPadding),
+          map: null
+        };
       }
       return null;
     },

package/dist/node/chunks/{dep-C8joxBaX.js → dep-D5ITTxnT.js}

@@ -1,4 +1,4 @@
-import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-DG3BLbPj.js';
+import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-Bn81Esdm.js';
 import require$$0$2 from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/chunks/{dep-Cjqet4Sp.js → dep-SOJpRpBL.js}

@@ -1,4 +1,4 @@
-import { P as getDefaultExportFromCjs } from './dep-DG3BLbPj.js';
+import { P as getDefaultExportFromCjs } from './dep-Bn81Esdm.js';
 import require$$0 from 'path';
 import { l as lib } from './dep-3RmXg9uo.js';
 

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-DG3BLbPj.js';
+import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-Bn81Esdm.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -748,7 +748,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-DG3BLbPj.js').then(function (n) { return n.S; });
+  const { createServer } = await import('./chunks/dep-Bn81Esdm.js').then(function (n) { return n.S; });
   try {
     const server = await createServer({
       root,
@@ -843,7 +843,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).option("--app", `[boolean] same as \`builder: {}\``).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { createBuilder } = await import('./chunks/dep-DG3BLbPj.js').then(function (n) { return n.T; });
+    const { createBuilder } = await import('./chunks/dep-Bn81Esdm.js').then(function (n) { return n.T; });
     const buildOptions = cleanGlobalCLIOptions(
       cleanBuilderCLIOptions(options)
     );
@@ -882,7 +882,7 @@ cli.command(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-DG3BLbPj.js').then(function (n) { return n.R; });
+    const { optimizeDeps } = await import('./chunks/dep-Bn81Esdm.js').then(function (n) { return n.R; });
     try {
       const config = await resolveConfig(
         {
@@ -909,7 +909,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-DG3BLbPj.js').then(function (n) { return n.U; });
+    const { preview } = await import('./chunks/dep-Bn81Esdm.js').then(function (n) { return n.U; });
     try {
       const server = await preview({
         root,

package/dist/node/index.d.ts

@@ -1,5 +1,5 @@
 /// <reference types="node" />
-import { PluginHooks, RollupError, SourceMap, ModuleInfo, PartialResolvedId, RollupOptions, InputOption, ModuleFormat, WatcherOptions, RollupOutput, RollupWatcher, InputOptions, CustomPluginOptions, LoadResult, SourceDescription, PluginContextMeta, RollupLog, OutputBundle, OutputChunk, ObjectHook, ResolveIdResult, ExistingRawSourceMap, SourceMapInput, GetManualChunk } from 'rollup';
+import { PluginHooks, RollupError, SourceMap, ModuleInfo, PartialResolvedId, RollupOptions, InputOption, ModuleFormat, WatcherOptions, RollupOutput, RollupWatcher, PluginContext, InputOptions, CustomPluginOptions, LoadResult, SourceDescription, PluginContextMeta, RollupLog, OutputBundle, OutputChunk, ObjectHook, ResolveIdResult, TransformPluginContext, ExistingRawSourceMap, SourceMapInput, GetManualChunk } from 'rollup';
 import * as rollup from 'rollup';
 export { rollup as Rollup };
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
@@ -3240,12 +3240,6 @@ interface PluginContextExtension {
 interface HotUpdatePluginContext {
     environment: DevEnvironment;
 }
-interface PluginContext extends rollup.PluginContext, PluginContextExtension {
-}
-interface ResolveIdPluginContext extends rollup.PluginContext, PluginContextExtension {
-}
-interface TransformPluginContext extends rollup.TransformPluginContext, PluginContextExtension {
-}
 declare module 'rollup' {
     interface MinimalPluginContext extends PluginContextExtension {
     }
@@ -3280,7 +3274,7 @@ interface Plugin<A = any> extends rollup.Plugin<A> {
     /**
      * extend hooks with ssr flag
      */
-    resolveId?: ObjectHook<(this: ResolveIdPluginContext, source: string, importer: string | undefined, options: {
+    resolveId?: ObjectHook<(this: PluginContext, source: string, importer: string | undefined, options: {
         attributes: Record<string, string>;
         custom?: CustomPluginOptions;
         ssr?: boolean;
@@ -4202,11 +4196,9 @@ declare function searchForWorkspaceRoot(current: string, root?: string): string;
 
 /**
  * Check if the url is allowed to be served, via the `server.fs` config.
+ * @deprecated Use the `isFileLoadingAllowed` function instead.
  */
 declare function isFileServingAllowed(config: ResolvedConfig, url: string): boolean;
-/**
- * @deprecated Use the `isFileServingAllowed(config, url)` signature instead.
- */
 declare function isFileServingAllowed(url: string, server: ViteDevServer): boolean;
 declare function isFileLoadingAllowed(config: ResolvedConfig, filePath: string): boolean;
 

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { a as arraify, i as isInNodeModules, D as DevEnvironment } from './chunks/dep-DG3BLbPj.js';
-export { B as BuildEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-DG3BLbPj.js';
+import { a as arraify, i as isInNodeModules, D as DevEnvironment } from './chunks/dep-Bn81Esdm.js';
+export { B as BuildEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-Bn81Esdm.js';
 export { defaultAllowedOrigins, DEFAULT_CLIENT_CONDITIONS as defaultClientConditions, DEFAULT_CLIENT_MAIN_FIELDS as defaultClientMainFields, DEFAULT_SERVER_CONDITIONS as defaultServerConditions, DEFAULT_SERVER_MAIN_FIELDS as defaultServerMainFields, VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import 'node:fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "6.3.2",
+  "version": "6.3.4",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",
@@ -73,11 +73,11 @@
   "//": "READ CONTRIBUTING.md to understand what to put under deps vs. devDeps!",
   "dependencies": {
     "esbuild": "^0.25.0",
-    "fdir": "^6.4.3",
+    "fdir": "^6.4.4",
     "picomatch": "^4.0.2",
     "postcss": "^8.5.3",
     "rollup": "^4.34.9",
-    "tinyglobby": "^0.2.12"
+    "tinyglobby": "^0.2.13"
   },
   "optionalDependencies": {
     "fsevents": "~2.3.3"