Bumps the npm_and_yarn group with 2 updates in the /apps/docs directory: [@nuxt/vite-builder](https://github.com/nuxt/nuxt/tree/HEAD/packages/vite) and [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt). Bumps the npm_and_yarn group with 1 update in the /apps/www directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@nuxt/vite-builder` from 3.13.2 to 3.15.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nuxt/nuxt/releases"><code>@nuxt/vite-builder</code>'s releases</a>.</em></p> <blockquote> <h2>v3.15.4</h2> <blockquote> <p>3.15.4 is the next patch release.</p> </blockquote> <h2>✅ Upgrading</h2> <p>As usual, our recommendation for upgrading is to run:</p> <pre lang="sh"><code>npx nuxi@latest upgrade --force </code></pre> <p>This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.</p> <h2>👉 Changelog</h2> <p><a href="https://github.com/nuxt/nuxt/compare/v3.15.3...v3.15.4">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li><strong>nuxt:</strong> Improve error logging when parsing with <code>acorn</code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/30754">#30754</a>)</li> <li><strong>nuxt:</strong> Clear island uid before saving into the payload (<a href="https://redirect.github.com/nuxt/nuxt/pull/30767">#30767</a>)</li> <li><strong>kit:</strong> Load <code>@nuxt/schema</code> from <code>nuxt</code> package dir (<a href="https://redirect.github.com/nuxt/nuxt/pull/30774">#30774</a>)</li> <li><strong>nuxt:</strong> Allow restarting nuxt on paths outside <code>srcDir</code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/30771">#30771</a>)</li> <li><strong>nuxt:</strong> Don't warn about calling <code>useRoute</code> in SFC setup (<a href="https://redirect.github.com/nuxt/nuxt/pull/30788">#30788</a>)</li> <li><strong>webpack:</strong> Disallow cross-site requests in no-cors mode (<a href="https://redirect.github.com/nuxt/nuxt/pull/30757">#30757</a>)</li> <li><strong>vite:</strong> Restore <code>externality</code> for dev server externals (<a href="https://redirect.github.com/nuxt/nuxt/pull/30802">#30802</a>)</li> </ul> <h3>💅 Refactors</h3> <ul> <li><strong>vite:</strong> Use new rollup <code>chunk.names</code> for asset names (<a href="https://redirect.github.com/nuxt/nuxt/pull/30780">#30780</a>)</li> </ul> <h3>❤️ Contributors</h3> <ul> <li>Daniel Roe (<a href="https://github.com/danielroe"><code>@danielroe</code></a>)</li> <li>Peter Radko (<a href="https://github.com/Gwynerva"><code>@Gwynerva</code></a>)</li> <li>Lansi (<a href="https://github.com/lansi951"><code>@lansi951</code></a>)</li> <li>Julien Huang (<a href="https://github.com/huang-julien"><code>@huang-julien</code></a>)</li> <li>Norbiros (<a href="https://github.com/Norbiros"><code>@Norbiros</code></a>)</li> </ul> <h2>v3.15.3</h2> <blockquote> <p>3.15.3 is the next regularly scheduled patch release.</p> </blockquote> <h2>👀 Highlights</h2> <h3>CORS configuration for dev server</h3> <p>Alongside a range of improvements, we've also shipped a significant fix to impose <a href="https://github.com/nuxt/nuxt/commit/406db5b4d">CORS origin restrictions on the dev server</a>. This applies to your Vite or Webpack/Rspack dev middleware only.</p> <p>This is a significant/breaking change we would not normally ship in a patch but it is a security fix (see <a href="https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99">https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99</a> and <a href="https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47">https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47</a>) and we urge you to update ASAP.</p> <p>You can configure the allowed origins and other CORS options via the <code>devServer.cors</code> options in your <code>nuxt.config</code>, which may be relevant if you are developing with a custom hostname:</p> <pre lang="ts"><code>export default defineNuxtConfig({ </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="244da170dd"><code>244da17</code></a> v3.15.4</li> <li><a href="56d889ebb0"><code>56d889e</code></a> fix(vite): restore <code>externality</code> for dev server externals (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/vite/issues/30802">#30802</a>)</li> <li><a href="325ed41a40"><code>325ed41</code></a> refactor(vite): use new rollup <code>chunk.names</code> for asset names (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/vite/issues/30780">#30780</a>)</li> <li><a href="940bcb8c4e"><code>940bcb8</code></a> chore(deps): update all non-major dependencies (3.x) (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/vite/issues/30747">#30747</a>)</li> <li><a href="048f974eba"><code>048f974</code></a> v3.15.3</li> <li><a href="c6056bd07d"><code>c6056bd</code></a> chore(deps): update all non-major dependencies (3.x) (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/vite/issues/30733">#30733</a>)</li> <li><a href="406db5b4d2"><code>406db5b</code></a> fix(vite,webpack): restrict access via cors to local origins + allow configur...</li> <li><a href="09d8db5f2f"><code>09d8db5</code></a> chore(deps): update vitest to v3.0.4 (3.x) (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/vite/issues/30724">#30724</a>)</li> <li><a href="10a54958d3"><code>10a5495</code></a> fix(vite): inline shared folder in dev mode (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/vite/issues/30690">#30690</a>)</li> <li><a href="f1c2948cd0"><code>f1c2948</code></a> chore(deps): update all non-major dependencies (3.x) (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/vite/issues/30694">#30694</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nuxt/nuxt/commits/v3.15.4/packages/vite">compare view</a></li> </ul> </details> <br /> Updates `nuxt` from 3.13.2 to 3.15.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nuxt/nuxt/releases">nuxt's releases</a>.</em></p> <blockquote> <h2>v3.15.4</h2> <blockquote> <p>3.15.4 is the next patch release.</p> </blockquote> <h2>✅ Upgrading</h2> <p>As usual, our recommendation for upgrading is to run:</p> <pre lang="sh"><code>npx nuxi@latest upgrade --force </code></pre> <p>This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.</p> <h2>👉 Changelog</h2> <p><a href="https://github.com/nuxt/nuxt/compare/v3.15.3...v3.15.4">compare changes</a></p> <h3>🩹 Fixes</h3> <ul> <li><strong>nuxt:</strong> Improve error logging when parsing with <code>acorn</code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/30754">#30754</a>)</li> <li><strong>nuxt:</strong> Clear island uid before saving into the payload (<a href="https://redirect.github.com/nuxt/nuxt/pull/30767">#30767</a>)</li> <li><strong>kit:</strong> Load <code>@nuxt/schema</code> from <code>nuxt</code> package dir (<a href="https://redirect.github.com/nuxt/nuxt/pull/30774">#30774</a>)</li> <li><strong>nuxt:</strong> Allow restarting nuxt on paths outside <code>srcDir</code> (<a href="https://redirect.github.com/nuxt/nuxt/pull/30771">#30771</a>)</li> <li><strong>nuxt:</strong> Don't warn about calling <code>useRoute</code> in SFC setup (<a href="https://redirect.github.com/nuxt/nuxt/pull/30788">#30788</a>)</li> <li><strong>webpack:</strong> Disallow cross-site requests in no-cors mode (<a href="https://redirect.github.com/nuxt/nuxt/pull/30757">#30757</a>)</li> <li><strong>vite:</strong> Restore <code>externality</code> for dev server externals (<a href="https://redirect.github.com/nuxt/nuxt/pull/30802">#30802</a>)</li> </ul> <h3>💅 Refactors</h3> <ul> <li><strong>vite:</strong> Use new rollup <code>chunk.names</code> for asset names (<a href="https://redirect.github.com/nuxt/nuxt/pull/30780">#30780</a>)</li> </ul> <h3>❤️ Contributors</h3> <ul> <li>Daniel Roe (<a href="https://github.com/danielroe"><code>@danielroe</code></a>)</li> <li>Peter Radko (<a href="https://github.com/Gwynerva"><code>@Gwynerva</code></a>)</li> <li>Lansi (<a href="https://github.com/lansi951"><code>@lansi951</code></a>)</li> <li>Julien Huang (<a href="https://github.com/huang-julien"><code>@huang-julien</code></a>)</li> <li>Norbiros (<a href="https://github.com/Norbiros"><code>@Norbiros</code></a>)</li> </ul> <h2>v3.15.3</h2> <blockquote> <p>3.15.3 is the next regularly scheduled patch release.</p> </blockquote> <h2>👀 Highlights</h2> <h3>CORS configuration for dev server</h3> <p>Alongside a range of improvements, we've also shipped a significant fix to impose <a href="https://github.com/nuxt/nuxt/commit/406db5b4d">CORS origin restrictions on the dev server</a>. This applies to your Vite or Webpack/Rspack dev middleware only.</p> <p>This is a significant/breaking change we would not normally ship in a patch but it is a security fix (see <a href="https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99">https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99</a> and <a href="https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47">https://github.com/nuxt/nuxt/security/advisories/GHSA-2452-6xj8-jh47</a>) and we urge you to update ASAP.</p> <p>You can configure the allowed origins and other CORS options via the <code>devServer.cors</code> options in your <code>nuxt.config</code>, which may be relevant if you are developing with a custom hostname:</p> <pre lang="ts"><code>export default defineNuxtConfig({ </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="244da170dd"><code>244da17</code></a> v3.15.4</li> <li><a href="ceaf0f5aea"><code>ceaf0f5</code></a> chore(deps): update all non-major dependencies (3.x) (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/30804">#30804</a>)</li> <li><a href="626eba06cc"><code>626eba0</code></a> fix(nuxt): don't warn about calling <code>useRoute</code> in SFC setup (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/30788">#30788</a>)</li> <li><a href="7a1e5c818b"><code>7a1e5c8</code></a> fix(nuxt): allow restarting nuxt on paths outside <code>srcDir</code> (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/30771">#30771</a>)</li> <li><a href="ca2d91f8e0"><code>ca2d91f</code></a> fix(kit): load <code>@nuxt/schema</code> from <code>nuxt</code> package dir (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/30774">#30774</a>)</li> <li><a href="b78da56dd7"><code>b78da56</code></a> fix(nuxt): clear island uid before saving into the payload (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/30767">#30767</a>)</li> <li><a href="e0c47f9bf3"><code>e0c47f9</code></a> fix(nuxt): improve error logging when parsing with <code>acorn</code> (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/30754">#30754</a>)</li> <li><a href="940bcb8c4e"><code>940bcb8</code></a> chore(deps): update all non-major dependencies (3.x) (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/30747">#30747</a>)</li> <li><a href="048f974eba"><code>048f974</code></a> v3.15.3</li> <li><a href="e96a96dbd9"><code>e96a96d</code></a> perf(nuxt): enable <code>Transition</code> component only on client side (<a href="https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt/issues/30720">#30720</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nuxt/nuxt/commits/v3.15.4/packages/nuxt">compare view</a></li> </ul> </details> <br /> Updates `vite` from 5.4.8 to 6.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v5.4.12</h2> <p>This version contains a breaking change due to security fixes. See <a href="https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6">https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6</a> for more details.</p> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.11</h2> <p>Please refer to <a href="ecd2375460/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.10</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.10/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.9</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.8</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.8/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@5.4.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@5.4.3/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@5.4.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@5.4.2/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@5.4.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@5.4.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@5.4.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@5.4.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v5.4.12/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted -->5.4.12 (2025-01-20)<!-- raw HTML omitted --></h2> <ul> <li>fix!: check host header to prevent DNS rebinding attacks and introduce <code>server.allowedHosts</code> (<a href="9da4abc8dd">9da4abc</a>)</li> <li>fix!: default <code>server.cors: false</code> to disallow fetching from untrusted origins (<a href="dfea38f1ff">dfea38f</a>)</li> <li>fix: verify token for HMR WebSocket connection (<a href="b71a5c89a1">b71a5c8</a>)</li> <li>chore: add deps update changelog (<a href="ecd2375460">ecd2375</a>)</li> </ul> <h2><!-- raw HTML omitted -->5.4.11 (2024-11-11)<!-- raw HTML omitted --></h2> <ul> <li>fix(deps): update dependencies of postcss-modules (<a href="ceb15db613">ceb15db</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18617">#18617</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.10 (2024-10-23)<!-- raw HTML omitted --></h2> <ul> <li>fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18367">#18367</a>,augment hash for CSS files to prevent chromium erroring by loading previous fil (<a href="7d1a3bcc43">7d1a3bc</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18367">#18367</a> <a href="https://redirect.github.com/vitejs/vite/issues/18412">#18412</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.9 (2024-10-14)<!-- raw HTML omitted --></h2> <ul> <li>fix: bump launch-editor-middleware to v2.9.1 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18348">#18348</a>) (<a href="508d9ab834">508d9ab</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18348">#18348</a></li> <li>fix(css): fix lightningcss dep url resolution with custom root (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18125">#18125</a>) (<a href="eae00b561e">eae00b5</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18125">#18125</a></li> <li>fix(data-uri): only match ids starting with <code>data:</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18241">#18241</a>) (<a href="96084d6e75">96084d6</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18241">#18241</a></li> <li>fix(deps): bump tsconfck (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18322">#18322</a>) (<a href="dc5434ce87">dc5434c</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18322">#18322</a></li> <li>fix(hmr): don't try to rewrite imports for direct CSS soft invalidation (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18252">#18252</a>) (<a href="851b258c34">851b258</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18252">#18252</a></li> <li>fix(ssr): (backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18150">#18150</a>) fix source map remapping with multiple sources (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18204">#18204</a>) (<a href="262a8796d4">262a879</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18204">#18204</a></li> <li>chore: update all url references of vitejs.dev to vite.dev (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18276">#18276</a>) (<a href="c23558a7af">c23558a</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18276">#18276</a></li> <li>chore: update license copyright (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18278">#18278</a>) (<a href="1864eb17b2">1864eb1</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18278">#18278</a></li> <li>docs: update homepage (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18274">#18274</a>) (<a href="ae4416349e">ae44163</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18274">#18274</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.8 (2024-09-25)<!-- raw HTML omitted --></h2> <ul> <li>fix(css): backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18113">#18113</a>, fix missing source file warning with sass modern api custom importer (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18">#18</a> (<a href="7d47fc1c74">7d47fc1</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18183">#18183</a></li> <li>fix(css): backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18128">#18128</a>, ensure sass compiler initialized only once (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18184">#18184</a>) (<a href="8464d976b1">8464d97</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18128">#18128</a> <a href="https://redirect.github.com/vitejs/vite/issues/18184">#18184</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.7 (2024-09-20)<!-- raw HTML omitted --></h2> <ul> <li>fix: treat config file as ESM in Deno (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18158">#18158</a>) (<a href="b5908a24ba">b5908a2</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18158">#18158</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.6 (2024-09-16)<!-- raw HTML omitted --></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="f428aa9af8"><code>f428aa9</code></a> release: v5.4.12</li> <li><a href="9da4abc8dd"><code>9da4abc</code></a> fix!: check host header to prevent DNS rebinding attacks and introduce `serve...</li> <li><a href="b71a5c89a1"><code>b71a5c8</code></a> fix: verify token for HMR WebSocket connection</li> <li><a href="dfea38f1ff"><code>dfea38f</code></a> fix!: default <code>server.cors: false</code> to disallow fetching from untrusted origins</li> <li><a href="ecd2375460"><code>ecd2375</code></a> chore: add deps update changelog</li> <li><a href="c54c860f9d"><code>c54c860</code></a> release: v5.4.11</li> <li><a href="5f52bc8b9e"><code>5f52bc8</code></a> release: v5.4.10</li> <li><a href="7d1a3bcc43"><code>7d1a3bc</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18367">#18367</a>,augment hash for CSS files to prevent chromium erroring ...</li> <li><a href="898d61f94b"><code>898d61f</code></a> release: v5.4.9</li> <li><a href="508d9ab834"><code>508d9ab</code></a> fix: bump launch-editor-middleware to v2.9.1 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18348">#18348</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v5.4.12/packages/vite">compare view</a></li> </ul> </details> <br /> Updates `vite` from 5.3.5 to 5.4.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>v5.4.12</h2> <p>This version contains a breaking change due to security fixes. See <a href="https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6">https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6</a> for more details.</p> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.12/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.11</h2> <p>Please refer to <a href="ecd2375460/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.10</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.10/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.9</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.8</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.8/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.7</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.6</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.5</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.4</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@5.4.3</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@5.4.3/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@5.4.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@5.4.2/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@5.4.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@5.4.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v5.4.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v5.4.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@5.4.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@5.4.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v5.4.12/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted -->5.4.12 (2025-01-20)<!-- raw HTML omitted --></h2> <ul> <li>fix!: check host header to prevent DNS rebinding attacks and introduce <code>server.allowedHosts</code> (<a href="9da4abc8dd">9da4abc</a>)</li> <li>fix!: default <code>server.cors: false</code> to disallow fetching from untrusted origins (<a href="dfea38f1ff">dfea38f</a>)</li> <li>fix: verify token for HMR WebSocket connection (<a href="b71a5c89a1">b71a5c8</a>)</li> <li>chore: add deps update changelog (<a href="ecd2375460">ecd2375</a>)</li> </ul> <h2><!-- raw HTML omitted -->5.4.11 (2024-11-11)<!-- raw HTML omitted --></h2> <ul> <li>fix(deps): update dependencies of postcss-modules (<a href="ceb15db613">ceb15db</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18617">#18617</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.10 (2024-10-23)<!-- raw HTML omitted --></h2> <ul> <li>fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18367">#18367</a>,augment hash for CSS files to prevent chromium erroring by loading previous fil (<a href="7d1a3bcc43">7d1a3bc</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18367">#18367</a> <a href="https://redirect.github.com/vitejs/vite/issues/18412">#18412</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.9 (2024-10-14)<!-- raw HTML omitted --></h2> <ul> <li>fix: bump launch-editor-middleware to v2.9.1 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18348">#18348</a>) (<a href="508d9ab834">508d9ab</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18348">#18348</a></li> <li>fix(css): fix lightningcss dep url resolution with custom root (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18125">#18125</a>) (<a href="eae00b561e">eae00b5</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18125">#18125</a></li> <li>fix(data-uri): only match ids starting with <code>data:</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18241">#18241</a>) (<a href="96084d6e75">96084d6</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18241">#18241</a></li> <li>fix(deps): bump tsconfck (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18322">#18322</a>) (<a href="dc5434ce87">dc5434c</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18322">#18322</a></li> <li>fix(hmr): don't try to rewrite imports for direct CSS soft invalidation (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18252">#18252</a>) (<a href="851b258c34">851b258</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18252">#18252</a></li> <li>fix(ssr): (backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18150">#18150</a>) fix source map remapping with multiple sources (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18204">#18204</a>) (<a href="262a8796d4">262a879</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18204">#18204</a></li> <li>chore: update all url references of vitejs.dev to vite.dev (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18276">#18276</a>) (<a href="c23558a7af">c23558a</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18276">#18276</a></li> <li>chore: update license copyright (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18278">#18278</a>) (<a href="1864eb17b2">1864eb1</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18278">#18278</a></li> <li>docs: update homepage (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18274">#18274</a>) (<a href="ae4416349e">ae44163</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18274">#18274</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.8 (2024-09-25)<!-- raw HTML omitted --></h2> <ul> <li>fix(css): backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18113">#18113</a>, fix missing source file warning with sass modern api custom importer (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18">#18</a> (<a href="7d47fc1c74">7d47fc1</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18183">#18183</a></li> <li>fix(css): backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18128">#18128</a>, ensure sass compiler initialized only once (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18184">#18184</a>) (<a href="8464d976b1">8464d97</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18128">#18128</a> <a href="https://redirect.github.com/vitejs/vite/issues/18184">#18184</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.7 (2024-09-20)<!-- raw HTML omitted --></h2> <ul> <li>fix: treat config file as ESM in Deno (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18158">#18158</a>) (<a href="b5908a24ba">b5908a2</a>), closes <a href="https://redirect.github.com/vitejs/vite/issues/18158">#18158</a></li> </ul> <h2><!-- raw HTML omitted -->5.4.6 (2024-09-16)<!-- raw HTML omitted --></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="f428aa9af8"><code>f428aa9</code></a> release: v5.4.12</li> <li><a href="9da4abc8dd"><code>9da4abc</code></a> fix!: check host header to prevent DNS rebinding attacks and introduce `serve...</li> <li><a href="b71a5c89a1"><code>b71a5c8</code></a> fix: verify token for HMR WebSocket connection</li> <li><a href="dfea38f1ff"><code>dfea38f</code></a> fix!: default <code>server.cors: false</code> to disallow fetching from untrusted origins</li> <li><a href="ecd2375460"><code>ecd2375</code></a> chore: add deps update changelog</li> <li><a href="c54c860f9d"><code>c54c860</code></a> release: v5.4.11</li> <li><a href="5f52bc8b9e"><code>5f52bc8</code></a> release: v5.4.10</li> <li><a href="7d1a3bcc43"><code>7d1a3bc</code></a> fix: backport <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18367">#18367</a>,augment hash for CSS files to prevent chromium erroring ...</li> <li><a href="898d61f94b"><code>898d61f</code></a> release: v5.4.9</li> <li><a href="508d9ab834"><code>508d9ab</code></a> fix: bump launch-editor-middleware to v2.9.1 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/18348">#18348</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v5.4.12/packages/vite">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/nestrilabs/nestri/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Qwik City App ⚡️
Project Structure
This project is using Qwik with QwikCity. QwikCity is just an extra set of tools on top of Qwik to make it easier to build a full site, including directory-based routing, layouts, and more.
Inside your project, you'll see the following directory structure:
├── public/
│ └── ...
└── src/
├── components/
│ └── ...
└── routes/
└── ...
-
src/routes: Provides the directory-based routing, which can include a hierarchy oflayout.tsxlayout files, and anindex.tsxfile as the page. Additionally,index.tsfiles are endpoints. Please see the routing docs for more info. -
src/components: Recommended directory for components. -
public: Any static assets, like images, can be placed in the public directory. Please see the Vite public directory for more info.
Add Integrations and deployment
Use the bun qwik add command to add additional integrations. Some examples of integrations includes: Cloudflare, Netlify or Express Server, and the Static Site Generator (SSG).
bun qwik add # or `bun qwik add`
Development
Development mode uses Vite's development server. The dev command will server-side render (SSR) the output during development.
npm start # or `bun start`
Note: during dev mode, Vite may request a significant number of
.jsfiles. This does not represent a Qwik production build.
Preview
The preview command will create a production build of the client modules, a production build of src/entry.preview.tsx, and run a local server. The preview server is only for convenience to preview a production build locally and should not be used as a production server.
bun preview # or `bun preview`
Production
The production build will generate client and server modules by running both client and server build commands. The build command will use Typescript to run a type check on the source code.
bun build # or `bun build`
Cloudflare Pages
Cloudflare's wrangler CLI can be used to preview a production build locally. To start a local server, run:
bun serve
Then visit http://localhost:8787/
Deployments
Cloudflare Pages are deployable through their Git provider integrations.
If you don't already have an account, then create a Cloudflare account here. Next go to your dashboard and follow the Cloudflare Pages deployment guide.
Within the projects "Settings" for "Build and deployments", the "Build command" should be bun build, and the "Build output directory" should be set to dist.
Function Invocation Routes
Cloudflare Page's function-invocation-routes config can be used to include, or exclude, certain paths to be used by the worker functions. Having a _routes.json file gives developers more granular control over when your Function is invoked.
This is useful to determine if a page response should be Server-Side Rendered (SSR) or if the response should use a static-site generated (SSG) index.html file.
By default, the Cloudflare pages adaptor does not include a public/_routes.json config, but rather it is auto-generated from the build by the Cloudflare adaptor. An example of an auto-generate dist/_routes.json would be:
{
"include": [
"/*"
],
"exclude": [
"/_headers",
"/_redirects",
"/build/*",
"/favicon.ico",
"/manifest.json",
"/service-worker.js",
"/about"
],
"version": 1
}
In the above example, it's saying all pages should be SSR'd. However, the root static files such as /favicon.ico and any static assets in /build/* should be excluded from the Functions, and instead treated as a static file.
In most cases the generated dist/_routes.json file is ideal. However, if you need more granular control over each path, you can instead provide you're own public/_routes.json file. When the project provides its own public/_routes.json file, then the Cloudflare adaptor will not auto-generate the routes config and instead use the committed one within the public directory.