vite 6.4.0 → 6.4.2

package/dist/node/chunks/{dep-BgXtUGwv.js → dep-4-IQbZQm.js}

@@ -1,4 +1,4 @@
-import { P as getDefaultExportFromCjs } from './dep-N2lvmi1C.js';
+import { P as getDefaultExportFromCjs } from './dep-Dq2t6Dq0.js';
 import require$$0 from 'path';
 import { l as lib } from './dep-3RmXg9uo.js';
 

package/dist/node/chunks/{dep-N2lvmi1C.js → dep-Dq2t6Dq0.js}

@@ -35509,7 +35509,8 @@ function isUriInFilePath(uri, filePath) {
 function isFileLoadingAllowed(config, filePath) {
   const { fs } = config.server;
   if (!fs.strict) return true;
-  if (config.fsDenyGlob(filePath)) return false;
+  const filePathWithoutTrailingSlash = filePath.endsWith("/") ? filePath.slice(0, -1) : filePath;
+  if (config.fsDenyGlob(filePathWithoutTrailingSlash)) return false;
   if (config.safeModulePaths.has(filePath)) return true;
   if (fs.allow.some((uri) => isUriInFilePath(uri, filePath))) return true;
   return false;
@@ -35661,8 +35662,9 @@ async function loadAndTransform(environment, id, url, options, timestamp, mod, r
   const { config, pluginContainer, logger } = environment;
   const prettyUrl = debugLoad || debugTransform ? prettifyUrl(url, config.root) : "";
   const moduleGraph = environment.moduleGraph;
-  if (options.allowId && !options.allowId(id)) {
+  if (!options.skipFsCheck && id[0] !== "\0" && isServerAccessDeniedForTransform(config, id)) {
     const err = new Error(`Denied ID ${id}`);
+    err.id = id;
     err.code = ERR_DENIED_ID;
     throw err;
   }
@@ -35675,7 +35677,7 @@ async function loadAndTransform(environment, id, url, options, timestamp, mod, r
     if (options.html && !id.endsWith(".html")) {
       return null;
     }
-    if (environment.config.consumer === "server" || isFileLoadingAllowed(environment.getTopLevelConfig(), file)) {
+    if (options.skipFsCheck || isFileLoadingAllowed(environment.getTopLevelConfig(), slash$1(file))) {
       try {
         code = await fsp.readFile(file, "utf-8");
         debugLoad?.(`${timeFrom(loadStart)} [fs] ${prettyUrl}`);
@@ -37133,6 +37135,12 @@ function deniedServingAccessForTransform(url, server, res, next) {
   }
   return false;
 }
+function isServerAccessDeniedForTransform(config, id) {
+  if (rawRE.test(id) || urlRE.test(id) || inlineRE$2.test(id) || svgRE.test(id)) {
+    return checkLoadingAccess(config, id) !== "allowed";
+  }
+  return false;
+}
 function cachedTransformMiddleware(server) {
   return function viteCachedTransformMiddleware(req, res, next) {
     const environment = server.environments.client;
@@ -37182,6 +37190,9 @@ function transformMiddleware(server) {
         const depsOptimizer = environment.depsOptimizer;
         if (depsOptimizer?.isOptimizedDepUrl(url)) {
           const sourcemapPath = url.startsWith(FS_PREFIX) ? fsPathFromId(url) : normalizePath$3(path$b.resolve(server.config.root, url.slice(1)));
+          if (!depsOptimizer.isOptimizedDepFile(sourcemapPath)) {
+            return next();
+          }
           try {
             const map = JSON.parse(
               await fsp.readFile(sourcemapPath, "utf-8")
@@ -37252,9 +37263,7 @@ function transformMiddleware(server) {
         }
         const result = await transformRequest(environment, url, {
           html: req.headers.accept?.includes("text/html"),
-          allowId(id) {
-            return !deniedServingAccessForTransform(id, server, res, next);
-          }
+          skipFsCheck: environment._skipFsCheck
         });
         if (result) {
           const depsOptimizer = environment.depsOptimizer;
@@ -37307,7 +37316,23 @@ function transformMiddleware(server) {
         return next();
       }
       if (e?.code === ERR_DENIED_ID) {
-        return;
+        const id = e.id;
+        let servingAccessResult = checkLoadingAccess(
+          server.config,
+          cleanUrl(id)
+        );
+        if (servingAccessResult === "allowed") {
+          servingAccessResult = checkLoadingAccess(server.config, id);
+        }
+        if (servingAccessResult === "denied") {
+          respondWithAccessDenied(id, server, res);
+          return true;
+        }
+        if (servingAccessResult === "fallback") {
+          next();
+          return true;
+        }
+        throw new Error(`Unexpected access result for id ${id}`);
       }
       return next(e);
     }
@@ -39655,6 +39680,7 @@ function createServerHotChannel() {
   const innerEmitter = new EventEmitter$4();
   const outsideEmitter = new EventEmitter$4();
   return {
+    skipFsCheck: true,
     send(payload) {
       outsideEmitter.emit("send", payload);
     },
@@ -43940,8 +43966,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-BgXtUGwv.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-DpdbJjFS.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-4-IQbZQm.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-lpEPC2f9.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -47833,6 +47859,10 @@ class DevEnvironment extends BaseEnvironment {
    * @internal
    */
   _remoteRunnerOptions;
+  /**
+   * @internal
+   */
+  _skipFsCheck;
   get pluginContainer() {
     if (!this._pluginContainer)
       throw new Error(
@@ -47880,9 +47910,13 @@ class DevEnvironment extends BaseEnvironment {
     );
     this._crawlEndFinder = setupOnCrawlEnd();
     this._remoteRunnerOptions = context.remoteRunner ?? {};
+    this._skipFsCheck = !!(context.transport && !(isWebSocketServer in context.transport) && context.transport.skipFsCheck);
     this.hot = context.transport ? isWebSocketServer in context.transport ? context.transport : normalizeHotChannel(context.transport, context.hot) : normalizeHotChannel({}, context.hot);
     this.hot.setInvokeHandler({
       fetchModule: (id, importer, options2) => {
+        if (context.disableFetchModule) {
+          throw new Error("fetchModule is disabled in this environment");
+        }
         return this.fetchModule(id, importer, options2);
       }
     });
@@ -47940,11 +47974,11 @@ class DevEnvironment extends BaseEnvironment {
     }
   }
   transformRequest(url) {
-    return transformRequest(this, url);
+    return transformRequest(this, url, { skipFsCheck: this._skipFsCheck });
   }
   async warmupRequest(url) {
     try {
-      await this.transformRequest(url);
+      await transformRequest(this, url, { skipFsCheck: true });
     } catch (e) {
       if (e?.code === ERR_OUTDATED_OPTIMIZED_DEP || e?.code === ERR_CLOSED_SERVER) {
         return;
@@ -48444,7 +48478,8 @@ function defineConfig(config) {
 function defaultCreateClientDevEnvironment(name, config, context) {
   return new DevEnvironment(name, config, {
     hot: true,
-    transport: context.ws
+    transport: context.ws,
+    disableFetchModule: true
   });
 }
 function defaultCreateDevEnvironment(name, config) {

package/dist/node/chunks/{dep-DpdbJjFS.js → dep-lpEPC2f9.js}

@@ -1,4 +1,4 @@
-import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-N2lvmi1C.js';
+import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-Dq2t6Dq0.js';
 import require$$0$2 from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-N2lvmi1C.js';
+import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-Dq2t6Dq0.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -748,7 +748,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-N2lvmi1C.js').then(function (n) { return n.S; });
+  const { createServer } = await import('./chunks/dep-Dq2t6Dq0.js').then(function (n) { return n.S; });
   try {
     const server = await createServer({
       root,
@@ -843,7 +843,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).option("--app", `[boolean] same as \`builder: {}\``).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { createBuilder } = await import('./chunks/dep-N2lvmi1C.js').then(function (n) { return n.T; });
+    const { createBuilder } = await import('./chunks/dep-Dq2t6Dq0.js').then(function (n) { return n.T; });
     const buildOptions = cleanGlobalCLIOptions(
       cleanBuilderCLIOptions(options)
     );
@@ -882,7 +882,7 @@ cli.command(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-N2lvmi1C.js').then(function (n) { return n.R; });
+    const { optimizeDeps } = await import('./chunks/dep-Dq2t6Dq0.js').then(function (n) { return n.R; });
     try {
       const config = await resolveConfig(
         {
@@ -909,7 +909,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-N2lvmi1C.js').then(function (n) { return n.U; });
+    const { preview } = await import('./chunks/dep-Dq2t6Dq0.js').then(function (n) { return n.U; });
     try {
       const server = await preview({
         root,

package/dist/node/index.d.ts

@@ -1220,6 +1220,11 @@ interface HotChannelClient {
 type HMRBroadcasterClient = HotChannelClient;
 type HotChannelListener<T extends string = string> = (data: InferCustomEventPayload<T>, client: HotChannelClient) => void;
 interface HotChannel<Api = any> {
+    /**
+     * When true, the fs access check is skipped in fetchModule.
+     * Set this for transports that is not exposed over the network.
+     */
+    skipFsCheck?: boolean;
     /**
      * Broadcast events to all clients
      */

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { a as arraify, i as isInNodeModules, D as DevEnvironment } from './chunks/dep-N2lvmi1C.js';
-export { B as BuildEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-N2lvmi1C.js';
+import { a as arraify, i as isInNodeModules, D as DevEnvironment } from './chunks/dep-Dq2t6Dq0.js';
+export { B as BuildEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-Dq2t6Dq0.js';
 export { defaultAllowedOrigins, DEFAULT_CLIENT_CONDITIONS as defaultClientConditions, DEFAULT_CLIENT_MAIN_FIELDS as defaultClientMainFields, DEFAULT_SERVER_CONDITIONS as defaultServerConditions, DEFAULT_SERVER_MAIN_FIELDS as defaultServerMainFields, VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import 'node:fs';

package/dist/node-cjs/publicUtils.cjs

@@ -3417,7 +3417,8 @@ function isUriInFilePath(uri, filePath) {
 function isFileLoadingAllowed(config, filePath) {
   const { fs } = config.server;
   if (!fs.strict) return true;
-  if (config.fsDenyGlob(filePath)) return false;
+  const filePathWithoutTrailingSlash = filePath.endsWith("/") ? filePath.slice(0, -1) : filePath;
+  if (config.fsDenyGlob(filePathWithoutTrailingSlash)) return false;
   if (config.safeModulePaths.has(filePath)) return true;
   if (fs.allow.some((uri) => isUriInFilePath(uri, filePath))) return true;
   return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "6.4.0",
+  "version": "6.4.2",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",