vite 6.3.5 → 6.3.6

package/dist/node/chunks/{dep-SgSik2vo.js → dep-B63J_9ss.js}

@@ -1,4 +1,4 @@
-import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-DBxKXgDP.js';
+import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-Bu492Fnd.js';
 import require$$0$2 from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/chunks/{dep-DBxKXgDP.js → dep-Bu492Fnd.js}

@@ -1,6 +1,6 @@
 import * as fs$8 from 'node:fs';
 import fs__default, { promises as promises$1, existsSync as existsSync$1, readFileSync as readFileSync$1 } from 'node:fs';
-import path$b, { posix as posix$1, isAbsolute as isAbsolute$1, join as join$1, resolve as resolve$4, normalize, dirname as dirname$2, relative as relative$2, basename as basename$2, extname as extname$1 } from 'node:path';
+import path$b, { posix as posix$1, isAbsolute as isAbsolute$1, join as join$1, resolve as resolve$4, sep as sep$1, normalize, dirname as dirname$2, relative as relative$2, basename as basename$2, extname as extname$1 } from 'node:path';
 import fsp, { constants as constants$3 } from 'node:fs/promises';
 import require$$1$1, { fileURLToPath as fileURLToPath$1, URL as URL$3, pathToFileURL as pathToFileURL$1 } from 'node:url';
 import { promisify as promisify$4, format as format$2, inspect, stripVTControlCharacters } from 'node:util';
@@ -35192,7 +35192,10 @@ function viaLocal(dir, isEtag, uri, extns, shouldServe) {
 	let i=0, arr=toAssume(uri, extns);
 	let abs, stats, name, headers;
 	for (; i < arr.length; i++) {
-		abs = normalize(join$1(dir, name=arr[i]));
+		abs = normalize(
+			join$1(dir, name=arr[i])
+		);
+
 		if (abs.startsWith(dir) && fs$8.existsSync(abs)) {
 			stats = fs$8.statSync(abs);
 			if (stats.isDirectory()) continue;
@@ -35315,7 +35318,7 @@ function sirv (dir, opts={}) {
 		});
 	}
 
-	let lookup = opts.dev ? viaLocal.bind(0, dir, isEtag) : viaCache.bind(0, FILES);
+	let lookup = opts.dev ? viaLocal.bind(0, dir.endsWith(sep$1) ? dir : dir + sep$1, isEtag) : viaCache.bind(0, FILES);
 
 	return function (req, res, next) {
 		let extns = [''];
@@ -37626,7 +37629,22 @@ function indexHtmlMiddleware(root, server) {
       if (isDev && url.startsWith(FS_PREFIX)) {
         filePath = decodeURIComponent(fsPathFromId(url));
       } else {
-        filePath = path$b.join(root, decodeURIComponent(url));
+        filePath = normalizePath$3(
+          path$b.resolve(path$b.join(root, decodeURIComponent(url)))
+        );
+      }
+      if (isDev) {
+        const servingAccessResult = checkLoadingAccess(server.config, filePath);
+        if (servingAccessResult === "denied") {
+          return respondWithAccessDenied(filePath, server, res);
+        }
+        if (servingAccessResult === "fallback") {
+          return next();
+        }
+      } else {
+        if (!isParentDirectory(root, filePath)) {
+          return next();
+        }
       }
       if (fs__default.existsSync(filePath)) {
         const headers = isDev ? server.config.server.headers : server.config.preview.headers;
@@ -43912,8 +43930,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-AiMcmC_f.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-SgSik2vo.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-D67CHC8_.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-B63J_9ss.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -48305,7 +48323,8 @@ async function preview(inlineConfig = {}) {
   }
   postHooks.forEach((fn) => fn && fn());
   if (config.appType === "spa" || config.appType === "mpa") {
-    app.use(indexHtmlMiddleware(distDir, server));
+    const normalizedDistDir = normalizePath$3(distDir);
+    app.use(indexHtmlMiddleware(normalizedDistDir, server));
     app.use(notFoundMiddleware());
   }
   const hostname = await resolveHostname(options.host);

package/dist/node/chunks/{dep-AiMcmC_f.js → dep-D67CHC8_.js}

@@ -1,4 +1,4 @@
-import { P as getDefaultExportFromCjs } from './dep-DBxKXgDP.js';
+import { P as getDefaultExportFromCjs } from './dep-Bu492Fnd.js';
 import require$$0 from 'path';
 import { l as lib } from './dep-3RmXg9uo.js';
 

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-DBxKXgDP.js';
+import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-Bu492Fnd.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -748,7 +748,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-DBxKXgDP.js').then(function (n) { return n.S; });
+  const { createServer } = await import('./chunks/dep-Bu492Fnd.js').then(function (n) { return n.S; });
   try {
     const server = await createServer({
       root,
@@ -843,7 +843,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).option("--app", `[boolean] same as \`builder: {}\``).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { createBuilder } = await import('./chunks/dep-DBxKXgDP.js').then(function (n) { return n.T; });
+    const { createBuilder } = await import('./chunks/dep-Bu492Fnd.js').then(function (n) { return n.T; });
     const buildOptions = cleanGlobalCLIOptions(
       cleanBuilderCLIOptions(options)
     );
@@ -882,7 +882,7 @@ cli.command(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-DBxKXgDP.js').then(function (n) { return n.R; });
+    const { optimizeDeps } = await import('./chunks/dep-Bu492Fnd.js').then(function (n) { return n.R; });
     try {
       const config = await resolveConfig(
         {
@@ -909,7 +909,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-DBxKXgDP.js').then(function (n) { return n.U; });
+    const { preview } = await import('./chunks/dep-Bu492Fnd.js').then(function (n) { return n.U; });
     try {
       const server = await preview({
         root,

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { a as arraify, i as isInNodeModules, D as DevEnvironment } from './chunks/dep-DBxKXgDP.js';
-export { B as BuildEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-DBxKXgDP.js';
+import { a as arraify, i as isInNodeModules, D as DevEnvironment } from './chunks/dep-Bu492Fnd.js';
+export { B as BuildEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-Bu492Fnd.js';
 export { defaultAllowedOrigins, DEFAULT_CLIENT_CONDITIONS as defaultClientConditions, DEFAULT_CLIENT_MAIN_FIELDS as defaultClientMainFields, DEFAULT_SERVER_CONDITIONS as defaultServerConditions, DEFAULT_SERVER_MAIN_FIELDS as defaultServerMainFields, VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import 'node:fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "6.3.5",
+  "version": "6.3.6",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",
@@ -131,7 +131,7 @@
     "rollup-plugin-license": "^3.6.0",
     "sass": "^1.86.3",
     "sass-embedded": "^1.86.3",
-    "sirv": "^3.0.1",
+    "sirv": "^3.0.2",
     "source-map-support": "^0.5.21",
     "strip-literal": "^3.0.0",
     "terser": "^5.39.0",