vite 6.4.1 → 6.4.3

package/LICENSE.md

@@ -1345,7 +1345,7 @@ Repository: lydell/js-tokens
 ## launch-editor, launch-editor-middleware
 License: MIT
 By: Evan You
-Repositories: git+https://github.com/yyx990803/launch-editor.git, git+https://github.com/yyx990803/launch-editor.git
+Repositories: git+https://github.com/vitejs/launch-editor.git, git+https://github.com/vitejs/launch-editor.git
 
 > The MIT License (MIT)
 > 

package/dist/node/chunks/{dep-C9BXG1mU.js → dep-CV-fz3CQ.js}

@@ -1,4 +1,4 @@
-import { P as getDefaultExportFromCjs } from './dep-D4NMHUTW.js';
+import { P as getDefaultExportFromCjs } from './dep-Dm0c1Wj2.js';
 import require$$0 from 'path';
 import { l as lib } from './dep-3RmXg9uo.js';
 

package/dist/node/chunks/{dep-DWMUTS1A.js → dep-DDtvSN7_.js}

@@ -1,4 +1,4 @@
-import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-D4NMHUTW.js';
+import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-Dm0c1Wj2.js';
 import require$$0$2 from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/chunks/{dep-D4NMHUTW.js → dep-Dm0c1Wj2.js}

@@ -6984,11 +6984,11 @@ function processSrcSetSync(srcs, replacer) {
     }))
   );
 }
-const windowsDriveRE = /^[A-Z]:/;
+const windowsDriveRE$1 = /^[A-Z]:/;
 const replaceWindowsDriveRE = /^([A-Z]):\//;
 const linuxAbsolutePathRE = /^\/[^/]/;
 function escapeToLinuxLikePath(path2) {
-  if (windowsDriveRE.test(path2)) {
+  if (windowsDriveRE$1.test(path2)) {
     return path2.replace(replaceWindowsDriveRE, "/windows/$1/");
   }
   if (linuxAbsolutePathRE.test(path2)) {
@@ -11177,7 +11177,7 @@ var src$1 = {};
 const path$9 = require$$0$2;
 const fs$7 = require$$0$4;
 const os$2 = require$$2;
-const url$4 = require$$0$5;
+const url$3 = require$$0$5;
 
 const fsReadFileAsync = fs$7.promises.readFile;
 
@@ -11230,7 +11230,7 @@ src$1.defaultLoadersSync = defaultLoadersSync;
 /** @type {import('./index').Loader} */
 const dynamicImport = async id => {
 	try {
-		const fileUrl = url$4.pathToFileURL(id).href;
+		const fileUrl = url$3.pathToFileURL(id).href;
 		const mod = await import(/* webpackIgnore: true */ fileUrl);
 
 		return mod.default;
@@ -18175,9 +18175,9 @@ var parseurl$1 = {exports: {}};
  * @private
  */
 
-var url$3 = require$$0$5;
-var parse$a = url$3.parse;
-var Url = url$3.Url;
+var url$2 = require$$0$5;
+var parse$a = url$2.parse;
+var Url = url$2.Url;
 
 /**
  * Module exports.
@@ -24221,18 +24221,62 @@ const watch = (paths, options) => {
 
 chokidar.watch = watch;
 
+var guess = {exports: {}};
+
 var shellQuote$1 = {};
 
+var OPS = [
+	'||',
+	'&&',
+	';;',
+	'|&',
+	'<(',
+	'<<<',
+	'>>',
+	'>&',
+	'<&',
+	'&',
+	';',
+	'(',
+	')',
+	'|',
+	'<',
+	'>'
+];
+var LINE_TERMINATORS = /[\n\r\u2028\u2029]/;
+var GLOB_SHELL_SPECIAL = /[\s#!"$&'():;<=>@\\^`|]/g;
+
 var quote = function quote(xs) {
 	return xs.map(function (s) {
 		if (s === '') {
 			return '\'\'';
 		}
 		if (s && typeof s === 'object') {
-			return s.op.replace(/(.)/g, '\\$1');
+			if (s.op === 'glob') {
+				if (typeof s.pattern !== 'string') {
+					throw new TypeError('glob token requires a string `pattern`');
+				}
+				if (LINE_TERMINATORS.test(s.pattern)) {
+					throw new TypeError('glob `pattern` must not contain line terminators');
+				}
+				return s.pattern.replace(GLOB_SHELL_SPECIAL, '\\$&');
+			}
+			if (typeof s.op === 'string') {
+				if (OPS.indexOf(s.op) < 0) {
+					throw new TypeError('invalid `op` value: ' + JSON.stringify(s.op));
+				}
+				return s.op.replace(/[\s\S]/g, '\\$&');
+			}
+			if (typeof s.comment === 'string') {
+				if (LINE_TERMINATORS.test(s.comment)) {
+					throw new TypeError('`comment` must not contain line terminators');
+				}
+				return '#' + s.comment;
+			}
+			throw new TypeError('unrecognized object token shape');
 		}
-		if ((/["\s]/).test(s) && !(/'/).test(s)) {
-			return "'" + s.replace(/(['\\])/g, '\\$1') + "'";
+		if ((/["\s\\]/).test(s) && !(/'/).test(s)) {
+			return "'" + s.replace(/(['])/g, '\\$1') + "'";
 		}
 		if ((/["'\s]/).test(s)) {
 			return '"' + s.replace(/(["\\$`!])/g, '\\$1') + '"';
@@ -24482,15 +24526,17 @@ var macos = {
     '/Applications/Sublime Text 2.app/Contents/SharedSupport/bin/subl',
   '/Applications/Sublime Text Dev.app/Contents/MacOS/Sublime Text':
     '/Applications/Sublime Text Dev.app/Contents/SharedSupport/bin/subl',
+  '/Applications/Visual Studio Code.app/Contents/MacOS/Code': 'code',
   '/Applications/Visual Studio Code.app/Contents/MacOS/Electron': 'code',
-  '/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Electron':
-    'code-insiders',
+  '/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Code - Insiders': 'code-insiders',
+  '/Applications/Visual Studio Code - Insiders.app/Contents/MacOS/Electron': 'code-insiders',
   '/Applications/VSCodium.app/Contents/MacOS/Electron': 'codium',
   '/Applications/Cursor.app/Contents/MacOS/Cursor': 'cursor',
+  '/Applications/Trae.app/Contents/MacOS/Electron': 'trae',
+  '/Applications/Antigravity.app/Contents/MacOS/Electron': 'antigravity',
   '/Applications/AppCode.app/Contents/MacOS/appcode':
     '/Applications/AppCode.app/Contents/MacOS/appcode',
-  '/Applications/CLion.app/Contents/MacOS/clion':
-    '/Applications/CLion.app/Contents/MacOS/clion',
+  '/Applications/CLion.app/Contents/MacOS/clion': '/Applications/CLion.app/Contents/MacOS/clion',
   '/Applications/IntelliJ IDEA.app/Contents/MacOS/idea':
     '/Applications/IntelliJ IDEA.app/Contents/MacOS/idea',
   '/Applications/IntelliJ IDEA Ultimate.app/Contents/MacOS/idea':
@@ -24510,9 +24556,8 @@ var macos = {
   '/Applications/MacVim.app/Contents/MacOS/MacVim': 'mvim',
   '/Applications/GoLand.app/Contents/MacOS/goland':
     '/Applications/GoLand.app/Contents/MacOS/goland',
-  '/Applications/Rider.app/Contents/MacOS/rider':
-    '/Applications/Rider.app/Contents/MacOS/rider',
-  '/Applications/Zed.app/Contents/MacOS/zed': 'zed'
+  '/Applications/Rider.app/Contents/MacOS/rider': '/Applications/Rider.app/Contents/MacOS/rider',
+  '/Applications/Zed.app/Contents/MacOS/zed': 'zed',
 };
 
 var linux = {
@@ -24522,6 +24567,9 @@ var linux = {
   code: 'code',
   vscodium: 'vscodium',
   codium: 'codium',
+  cursor: 'cursor',
+  trae: 'trae',
+  antigravity: 'antigravity',
   emacs: 'emacs',
   gvim: 'gvim',
   idea: 'idea',
@@ -24539,7 +24587,8 @@ var linux = {
   goland: 'goland',
   'goland.sh': 'goland',
   rider: 'rider',
-  'rider.sh': 'rider'
+  'rider.sh': 'rider',
+  zed: 'zed',
 };
 
 var windows$1 = [
@@ -24566,7 +24615,10 @@ var windows$1 = [
   'goland.exe',
   'goland64.exe',
   'rider.exe',
-  'rider64.exe'
+  'rider64.exe',
+  'Trae.exe',
+  'zed.exe',
+  'Antigravity.exe',
 ];
 
 const path$6 = require$$0$2;
@@ -24580,7 +24632,60 @@ const COMMON_EDITORS_MACOS = macos;
 const COMMON_EDITORS_LINUX = linux;
 const COMMON_EDITORS_WIN = windows$1;
 
-var guess = function guessEditor (specifiedEditor) {
+function getEditorFromMacProcesses(output) {
+  const processNames = Object.keys(COMMON_EDITORS_MACOS);
+  const processList = output.split('\n');
+  for (let i = 0; i < processNames.length; i++) {
+    const processName = processNames[i];
+    // Find editor by exact match.
+    if (processList.includes(processName)) {
+      return COMMON_EDITORS_MACOS[processName]
+    }
+    const processNameWithoutApplications = processName.replace('/Applications', '');
+    // Find editor installation not in /Applications.
+    if (output.indexOf(processNameWithoutApplications) !== -1) {
+      // Use the CLI command if one is specified
+      if (processName !== COMMON_EDITORS_MACOS[processName]) {
+        return COMMON_EDITORS_MACOS[processName]
+      }
+      // Use a partial match to find the running process path.  If one is found, use the
+      // existing path since it can be running from anywhere.
+      const runningProcess = processList.find((procName) =>
+        procName.endsWith(processNameWithoutApplications),
+      );
+      if (runningProcess !== undefined) {
+        return runningProcess
+      }
+    }
+  }
+  return undefined
+}
+
+function getEditorFromWindowsProcesses(output) {
+  const runningProcesses = output.split('\r\n');
+  for (let i = 0; i < runningProcesses.length; i++) {
+    const fullProcessPath = runningProcesses[i].trim();
+    const shortProcessName = path$6.win32.basename(fullProcessPath);
+
+    if (COMMON_EDITORS_WIN.indexOf(shortProcessName) !== -1) {
+      return fullProcessPath
+    }
+  }
+  return undefined
+}
+
+function getEditorFromLinuxProcesses(output) {
+  const processNames = Object.keys(COMMON_EDITORS_LINUX);
+  for (let i = 0; i < processNames.length; i++) {
+    const processName = processNames[i];
+    if (output.indexOf(processName) !== -1) {
+      return COMMON_EDITORS_LINUX[processName]
+    }
+  }
+  return undefined
+}
+
+function guessEditor$1(specifiedEditor) {
   if (specifiedEditor) {
     return shellQuote.parse(specifiedEditor)
   }
@@ -24600,31 +24705,12 @@ var guess = function guessEditor (specifiedEditor) {
     if (process.platform === 'darwin') {
       const output = childProcess$1
         .execSync('ps x -o comm=', {
-          stdio: ['pipe', 'pipe', 'ignore']
+          stdio: ['pipe', 'pipe', 'ignore'],
         })
         .toString();
-      const processNames = Object.keys(COMMON_EDITORS_MACOS);
-      const processList = output.split('\n');
-      for (let i = 0; i < processNames.length; i++) {
-        const processName = processNames[i];
-        // Find editor by exact match.
-        if (processList.includes(processName)) {
-          return [COMMON_EDITORS_MACOS[processName]]
-        }
-        const processNameWithoutApplications = processName.replace('/Applications', '');
-        // Find editor installation not in /Applications.
-        if (output.indexOf(processNameWithoutApplications) !== -1) {
-          // Use the CLI command if one is specified
-          if (processName !== COMMON_EDITORS_MACOS[processName]) {
-            return [COMMON_EDITORS_MACOS[processName]]
-          }
-          // Use a partial match to find the running process path.  If one is found, use the
-          // existing path since it can be running from anywhere.
-          const runningProcess = processList.find((procName) => procName.endsWith(processNameWithoutApplications));
-          if (runningProcess !== undefined) {
-            return [runningProcess]
-          }
-        }
+      const editor = getEditorFromMacProcesses(output);
+      if (editor !== undefined) {
+        return [editor]
       }
     } else if (process.platform === 'win32') {
       const output = childProcess$1
@@ -24634,18 +24720,13 @@ var guess = function guessEditor (specifiedEditor) {
             'Get-CimInstance -Query \\"select executablepath from win32_process where executablepath is not null\\" | % { $_.ExecutablePath }' +
             '"',
           {
-            stdio: ['pipe', 'pipe', 'ignore']
-          }
+            stdio: ['pipe', 'pipe', 'ignore'],
+          },
         )
         .toString();
-      const runningProcesses = output.split('\r\n');
-      for (let i = 0; i < runningProcesses.length; i++) {
-        const fullProcessPath = runningProcesses[i].trim();
-        const shortProcessName = path$6.basename(fullProcessPath);
-
-        if (COMMON_EDITORS_WIN.indexOf(shortProcessName) !== -1) {
-          return [fullProcessPath]
-        }
+      const editor = getEditorFromWindowsProcesses(output);
+      if (editor !== undefined) {
+        return [editor]
       }
     } else if (process.platform === 'linux') {
       // --no-heading No header line
@@ -24653,15 +24734,12 @@ var guess = function guessEditor (specifiedEditor) {
       // -o comm Need only names column
       const output = childProcess$1
         .execSync('ps x --no-heading -o comm --sort=comm', {
-          stdio: ['pipe', 'pipe', 'ignore']
+          stdio: ['pipe', 'pipe', 'ignore'],
         })
         .toString();
-      const processNames = Object.keys(COMMON_EDITORS_LINUX);
-      for (let i = 0; i < processNames.length; i++) {
-        const processName = processNames[i];
-        if (output.indexOf(processName) !== -1) {
-          return [COMMON_EDITORS_LINUX[processName]]
-        }
+      const editor = getEditorFromLinuxProcesses(output);
+      if (editor !== undefined) {
+        return [editor]
       }
     }
   } catch (ignoreError) {
@@ -24676,17 +24754,19 @@ var guess = function guessEditor (specifiedEditor) {
   }
 
   return [null]
-};
+}
+
+guess.exports = guessEditor$1;
+guess.exports.getEditorFromMacProcesses = getEditorFromMacProcesses;
+guess.exports.getEditorFromWindowsProcesses = getEditorFromWindowsProcesses;
+guess.exports.getEditorFromLinuxProcesses = getEditorFromLinuxProcesses;
+
+var guessExports = guess.exports;
 
 const path$5 = require$$0$2;
 
 // normalize file/line numbers into command line args for specific editors
-var getArgs = function getArgumentsForPosition (
-  editor,
-  fileName,
-  lineNumber,
-  columnNumber = 1
-) {
+var getArgs = function getArgumentsForPosition(editor, fileName, lineNumber, columnNumber = 1) {
   const editorBasename = path$5.basename(editor).replace(/\.(exe|cmd|bat)$/i, '');
   switch (editorBasename) {
     case 'atom':
@@ -24706,7 +24786,7 @@ var getArgs = function getArgumentsForPosition (
       return [`+call cursor(${lineNumber}, ${columnNumber})`, fileName]
     case 'joe':
     case 'gvim':
-      return ['+' + `${lineNumber}`, fileName]
+      return [`+${lineNumber}`, fileName]
     case 'emacs':
     case 'emacsclient':
       return [`+${lineNumber}:${columnNumber}`, fileName]
@@ -24719,6 +24799,8 @@ var getArgs = function getArgumentsForPosition (
     case 'code-insiders':
     case 'Code - Insiders':
     case 'codium':
+    case 'trae':
+    case 'antigravity':
     case 'cursor':
     case 'vscodium':
     case 'VSCodium':
@@ -24769,29 +24851,25 @@ const path$4 = require$$0$2;
 const colors = picocolorsExports;
 const childProcess = require$$2$1;
 
-const guessEditor = guess;
+const guessEditor = guessExports;
 const getArgumentsForPosition = getArgs;
 
-function wrapErrorCallback (cb) {
+function wrapErrorCallback(cb) {
   return (fileName, errorMessage) => {
     console.log();
-    console.log(
-      colors.red('Could not open ' + path$4.basename(fileName) + ' in the editor.')
-    );
+    console.log(colors.red('Could not open ' + path$4.basename(fileName) + ' in the editor.'));
     if (errorMessage) {
       if (errorMessage[errorMessage.length - 1] !== '.') {
         errorMessage += '.';
       }
-      console.log(
-        colors.red('The editor process exited with an error: ' + errorMessage)
-      );
+      console.log(colors.red('The editor process exited with an error: ' + errorMessage));
     }
     console.log();
     if (cb) cb(fileName, errorMessage);
   }
 }
 
-function isTerminalEditor (editor) {
+function isTerminalEditor(editor) {
   switch (editor) {
     case 'vim':
     case 'emacs':
@@ -24802,7 +24880,7 @@ function isTerminalEditor (editor) {
 }
 
 const positionRE = /:(\d+)(:(\d+))?$/;
-function parseFile (file) {
+function parseFile(file) {
   // support `file://` protocol
   if (file.startsWith('file://')) {
     file = require$$0$5.fileURLToPath(file);
@@ -24815,17 +24893,25 @@ function parseFile (file) {
   return {
     fileName,
     lineNumber,
-    columnNumber
+    columnNumber,
   }
 }
 
-let _childProcess = null;
+let currentChildProcess = null;
 
-function launchEditor (file, specifiedEditor, onErrorCallback) {
+function launchEditor(file, specifiedEditor, onErrorCallback) {
   const parsed = parseFile(file);
   let { fileName } = parsed;
   const { lineNumber, columnNumber } = parsed;
 
+  if (process.platform === 'win32' && path$4.resolve(fileName).startsWith('\\\\')) {
+    return onErrorCallback(
+      fileName,
+      'UNC paths are not supported on Windows to avoid security issues. ' +
+        'See https://github.com/vitejs/launch-editor/tree/main/packages/launch-editor#unc-paths-on-windows for details.',
+    )
+  }
+
   if (!fs$1.existsSync(fileName)) {
     return
   }
@@ -24864,11 +24950,11 @@ function launchEditor (file, specifiedEditor, onErrorCallback) {
     args.push(fileName);
   }
 
-  if (_childProcess && isTerminalEditor(editor)) {
+  if (currentChildProcess && isTerminalEditor(editor)) {
     // There's an existing editor process already and it's attached
     // to the terminal, so go kill it. Otherwise two separate editor
     // instances attach to the stdin/stdout which gets confusing.
-    _childProcess.kill('SIGKILL');
+    currentChildProcess.kill('SIGKILL');
   }
 
   if (process.platform === 'win32') {
@@ -24894,7 +24980,7 @@ function launchEditor (file, specifiedEditor, onErrorCallback) {
     // According to https://ss64.com/nt/syntax-esc.html,
     // we can use `^` to escape `&`, `<`, `>`, `|`, `%`, and `^`
     // I'm not sure if we have to escape all of these, but let's do it anyway
-    function escapeCmdArgs (cmdArgs) {
+    function escapeCmdArgs(cmdArgs) {
       return cmdArgs.replace(/([&|<>,;=^])/g, '^$1')
     }
 
@@ -24910,29 +24996,27 @@ function launchEditor (file, specifiedEditor, onErrorCallback) {
         return `^"${str}^"`
       } else if (str.includes(' ')) {
         return `"${str}"`
-      } 
+      }
       return str
     }
-    const launchCommand = [editor, ...args.map(escapeCmdArgs)]
-      .map(doubleQuoteIfNeeded)
-      .join(' ');
+    const launchCommand = [editor, ...args.map(escapeCmdArgs)].map(doubleQuoteIfNeeded).join(' ');
 
-    _childProcess = childProcess.exec(launchCommand, {
+    currentChildProcess = childProcess.exec(launchCommand, {
       stdio: 'inherit',
-      shell: true
+      shell: true,
     });
   } else {
-    _childProcess = childProcess.spawn(editor, args, { stdio: 'inherit' });
+    currentChildProcess = childProcess.spawn(editor, args, { stdio: 'inherit' });
   }
-  _childProcess.on('exit', function (errorCode) {
-    _childProcess = null;
+  currentChildProcess.on('exit', function (errorCode) {
+    currentChildProcess = null;
 
     if (errorCode) {
       onErrorCallback(fileName, '(code ' + errorCode + ')');
     }
   });
 
-  _childProcess.on('error', function (error) {
+  currentChildProcess.on('error', function (error) {
     let { code, message } = error;
     if ('ENOENT' === code) {
       message = `${message} ('${editor}' command does not exist in 'PATH')`;
@@ -24943,7 +25027,6 @@ function launchEditor (file, specifiedEditor, onErrorCallback) {
 
 var launchEditor_1 = launchEditor;
 
-const url$2 = require$$0$5;
 const path$3 = require$$0$2;
 const launch = launchEditor_1;
 
@@ -24960,13 +25043,26 @@ var launchEditorMiddleware = (specifiedEditor, srcRoot, onErrorCallback) => {
 
   srcRoot = srcRoot || process.cwd();
 
-  return function launchEditorMiddleware (req, res) {
-    const { file } = url$2.parse(req.url, true).query || {};
+  return function launchEditorMiddleware(req, res) {
+    let url;
+
+    try {
+      const fullUrl = req.url.startsWith('http') ? req.url : `http://localhost${req.url}`;
+      url = new URL(fullUrl);
+      // eslint-disable-next-line no-unused-vars
+    } catch (_err) {
+      res.statusCode = 500;
+      res.end(`launch-editor-middleware: invalid URL.`);
+      return
+    }
+
+    const file = url.searchParams.get('file');
     if (!file) {
       res.statusCode = 500;
       res.end(`launch-editor-middleware: required query param "file" is missing.`);
     } else {
-      launch(path$3.resolve(srcRoot, file), specifiedEditor, onErrorCallback);
+      const resolved = file.startsWith('file://') ? file : path$3.resolve(srcRoot, file);
+      launch(resolved, specifiedEditor, onErrorCallback);
       res.end();
     }
   }
@@ -35506,9 +35602,18 @@ function isFileServingAllowed(configOrUrl, urlOrServer) {
 function isUriInFilePath(uri, filePath) {
   return isSameFileUri(uri, filePath) || isParentDirectory(uri, filePath);
 }
+const windowsDriveRE = /^[A-Z]:/i;
 function isFileLoadingAllowed(config, filePath) {
   const { fs } = config.server;
   if (!fs.strict) return true;
+  if (isWindows$3 && filePath.includes("~")) {
+    return false;
+  }
+  const hasDriveLetter = isWindows$3 && windowsDriveRE.test(filePath);
+  const hasColon = (hasDriveLetter ? filePath.slice(2) : filePath).includes(":");
+  if (hasColon) {
+    return false;
+  }
   const filePathWithoutTrailingSlash = filePath.endsWith("/") ? filePath.slice(0, -1) : filePath;
   if (config.fsDenyGlob(filePathWithoutTrailingSlash)) return false;
   if (config.safeModulePaths.has(filePath)) return true;
@@ -35662,8 +35767,9 @@ async function loadAndTransform(environment, id, url, options, timestamp, mod, r
   const { config, pluginContainer, logger } = environment;
   const prettyUrl = debugLoad || debugTransform ? prettifyUrl(url, config.root) : "";
   const moduleGraph = environment.moduleGraph;
-  if (options.allowId && !options.allowId(id)) {
+  if (!options.skipFsCheck && id[0] !== "\0" && isServerAccessDeniedForTransform(config, id)) {
     const err = new Error(`Denied ID ${id}`);
+    err.id = id;
     err.code = ERR_DENIED_ID;
     throw err;
   }
@@ -35676,7 +35782,7 @@ async function loadAndTransform(environment, id, url, options, timestamp, mod, r
     if (options.html && !id.endsWith(".html")) {
       return null;
     }
-    if (environment.config.consumer === "server" || isFileLoadingAllowed(environment.getTopLevelConfig(), file)) {
+    if (options.skipFsCheck || isFileLoadingAllowed(environment.getTopLevelConfig(), slash$1(file))) {
       try {
         code = await fsp.readFile(file, "utf-8");
         debugLoad?.(`${timeFrom(loadStart)} [fs] ${prettyUrl}`);
@@ -37134,6 +37240,12 @@ function deniedServingAccessForTransform(url, server, res, next) {
   }
   return false;
 }
+function isServerAccessDeniedForTransform(config, id) {
+  if (rawRE.test(id) || urlRE.test(id) || inlineRE$2.test(id) || svgRE.test(id)) {
+    return checkLoadingAccess(config, id) !== "allowed";
+  }
+  return false;
+}
 function cachedTransformMiddleware(server) {
   return function viteCachedTransformMiddleware(req, res, next) {
     const environment = server.environments.client;
@@ -37183,6 +37295,9 @@ function transformMiddleware(server) {
         const depsOptimizer = environment.depsOptimizer;
         if (depsOptimizer?.isOptimizedDepUrl(url)) {
           const sourcemapPath = url.startsWith(FS_PREFIX) ? fsPathFromId(url) : normalizePath$3(path$b.resolve(server.config.root, url.slice(1)));
+          if (!depsOptimizer.isOptimizedDepFile(sourcemapPath)) {
+            return next();
+          }
           try {
             const map = JSON.parse(
               await fsp.readFile(sourcemapPath, "utf-8")
@@ -37253,9 +37368,7 @@ function transformMiddleware(server) {
         }
         const result = await transformRequest(environment, url, {
           html: req.headers.accept?.includes("text/html"),
-          allowId(id) {
-            return !deniedServingAccessForTransform(id, server, res, next);
-          }
+          skipFsCheck: environment._skipFsCheck
         });
         if (result) {
           const depsOptimizer = environment.depsOptimizer;
@@ -37308,7 +37421,23 @@ function transformMiddleware(server) {
         return next();
       }
       if (e?.code === ERR_DENIED_ID) {
-        return;
+        const id = e.id;
+        let servingAccessResult = checkLoadingAccess(
+          server.config,
+          cleanUrl(id)
+        );
+        if (servingAccessResult === "allowed") {
+          servingAccessResult = checkLoadingAccess(server.config, id);
+        }
+        if (servingAccessResult === "denied") {
+          respondWithAccessDenied(id, server, res);
+          return true;
+        }
+        if (servingAccessResult === "fallback") {
+          next();
+          return true;
+        }
+        throw new Error(`Unexpected access result for id ${id}`);
       }
       return next(e);
     }
@@ -39656,6 +39785,7 @@ function createServerHotChannel() {
   const innerEmitter = new EventEmitter$4();
   const outsideEmitter = new EventEmitter$4();
   return {
+    skipFsCheck: true,
     send(payload) {
       outsideEmitter.emit("send", payload);
     },
@@ -43941,8 +44071,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-C9BXG1mU.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-DWMUTS1A.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-CV-fz3CQ.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-DDtvSN7_.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;
@@ -47834,6 +47964,10 @@ class DevEnvironment extends BaseEnvironment {
    * @internal
    */
   _remoteRunnerOptions;
+  /**
+   * @internal
+   */
+  _skipFsCheck;
   get pluginContainer() {
     if (!this._pluginContainer)
       throw new Error(
@@ -47881,9 +48015,13 @@ class DevEnvironment extends BaseEnvironment {
     );
     this._crawlEndFinder = setupOnCrawlEnd();
     this._remoteRunnerOptions = context.remoteRunner ?? {};
+    this._skipFsCheck = !!(context.transport && !(isWebSocketServer in context.transport) && context.transport.skipFsCheck);
     this.hot = context.transport ? isWebSocketServer in context.transport ? context.transport : normalizeHotChannel(context.transport, context.hot) : normalizeHotChannel({}, context.hot);
     this.hot.setInvokeHandler({
       fetchModule: (id, importer, options2) => {
+        if (context.disableFetchModule) {
+          throw new Error("fetchModule is disabled in this environment");
+        }
         return this.fetchModule(id, importer, options2);
       }
     });
@@ -47941,11 +48079,11 @@ class DevEnvironment extends BaseEnvironment {
     }
   }
   transformRequest(url) {
-    return transformRequest(this, url);
+    return transformRequest(this, url, { skipFsCheck: this._skipFsCheck });
   }
   async warmupRequest(url) {
     try {
-      await this.transformRequest(url);
+      await transformRequest(this, url, { skipFsCheck: true });
     } catch (e) {
       if (e?.code === ERR_OUTDATED_OPTIMIZED_DEP || e?.code === ERR_CLOSED_SERVER) {
         return;
@@ -48445,7 +48583,8 @@ function defineConfig(config) {
 function defaultCreateClientDevEnvironment(name, config, context) {
   return new DevEnvironment(name, config, {
     hot: true,
-    transport: context.ws
+    transport: context.ws,
+    disableFetchModule: true
   });
 }
 function defaultCreateDevEnvironment(name, config) {

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-D4NMHUTW.js';
+import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-Dm0c1Wj2.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -748,7 +748,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-D4NMHUTW.js').then(function (n) { return n.S; });
+  const { createServer } = await import('./chunks/dep-Dm0c1Wj2.js').then(function (n) { return n.S; });
   try {
     const server = await createServer({
       root,
@@ -843,7 +843,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).option("--app", `[boolean] same as \`builder: {}\``).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { createBuilder } = await import('./chunks/dep-D4NMHUTW.js').then(function (n) { return n.T; });
+    const { createBuilder } = await import('./chunks/dep-Dm0c1Wj2.js').then(function (n) { return n.T; });
     const buildOptions = cleanGlobalCLIOptions(
       cleanBuilderCLIOptions(options)
     );
@@ -882,7 +882,7 @@ cli.command(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-D4NMHUTW.js').then(function (n) { return n.R; });
+    const { optimizeDeps } = await import('./chunks/dep-Dm0c1Wj2.js').then(function (n) { return n.R; });
     try {
       const config = await resolveConfig(
         {
@@ -909,7 +909,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-D4NMHUTW.js').then(function (n) { return n.U; });
+    const { preview } = await import('./chunks/dep-Dm0c1Wj2.js').then(function (n) { return n.U; });
     try {
       const server = await preview({
         root,

package/dist/node/index.d.ts

@@ -1220,6 +1220,11 @@ interface HotChannelClient {
 type HMRBroadcasterClient = HotChannelClient;
 type HotChannelListener<T extends string = string> = (data: InferCustomEventPayload<T>, client: HotChannelClient) => void;
 interface HotChannel<Api = any> {
+    /**
+     * When true, the fs access check is skipped in fetchModule.
+     * Set this for transports that is not exposed over the network.
+     */
+    skipFsCheck?: boolean;
     /**
      * Broadcast events to all clients
      */

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { a as arraify, i as isInNodeModules, D as DevEnvironment } from './chunks/dep-D4NMHUTW.js';
-export { B as BuildEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-D4NMHUTW.js';
+import { a as arraify, i as isInNodeModules, D as DevEnvironment } from './chunks/dep-Dm0c1Wj2.js';
+export { B as BuildEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-Dm0c1Wj2.js';
 export { defaultAllowedOrigins, DEFAULT_CLIENT_CONDITIONS as defaultClientConditions, DEFAULT_CLIENT_MAIN_FIELDS as defaultClientMainFields, DEFAULT_SERVER_CONDITIONS as defaultServerConditions, DEFAULT_SERVER_MAIN_FIELDS as defaultServerMainFields, VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import 'node:fs';

package/dist/node-cjs/publicUtils.cjs

@@ -3414,9 +3414,18 @@ function isFileServingAllowed(configOrUrl, urlOrServer) {
 function isUriInFilePath(uri, filePath) {
   return isSameFileUri(uri, filePath) || isParentDirectory(uri, filePath);
 }
+const windowsDriveRE = /^[A-Z]:/i;
 function isFileLoadingAllowed(config, filePath) {
   const { fs } = config.server;
   if (!fs.strict) return true;
+  if (isWindows && filePath.includes("~")) {
+    return false;
+  }
+  const hasDriveLetter = isWindows && windowsDriveRE.test(filePath);
+  const hasColon = (hasDriveLetter ? filePath.slice(2) : filePath).includes(":");
+  if (hasColon) {
+    return false;
+  }
   const filePathWithoutTrailingSlash = filePath.endsWith("/") ? filePath.slice(0, -1) : filePath;
   if (config.fsDenyGlob(filePathWithoutTrailingSlash)) return false;
   if (config.safeModulePaths.has(filePath)) return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "6.4.1",
+  "version": "6.4.3",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",
@@ -111,7 +111,7 @@
     "estree-walker": "^3.0.3",
     "etag": "^1.8.1",
     "http-proxy": "^1.18.1",
-    "launch-editor-middleware": "^2.10.0",
+    "launch-editor-middleware": "^2.14.1",
     "lightningcss": "^1.29.3",
     "magic-string": "^0.30.17",
     "mlly": "^1.7.4",