Vite 8.3.3 patch release (fea5b21)
The repo cuts a new patch release, 8.3.3, bundling the day’s bug fixes into the changelog and package version bump.
Fix safe-module tracking to store resolved ids, not URLs (
c3e06f9)
Vite now records resolved module ids in safeModulePaths instead of URL-derived paths, which avoids incorrectly marking unresolved SSR imports as safe. The accompanying tests cover the regression and the fs-serve playground validates that filesystem-safe and root-relative paths stay separated.
Block ?vite-wasm-instance from fs-serve access checks (ba8b7ab)
The transform middleware now treats vite-wasm-instance like other sensitive resource-query flags when deciding whether a request is allowed through fs.serve. This closes an access-control gap and extends the playground matrix with denial cases for both regular files and .env targets.
Normalize HTML filenames and protocol-relative proxy URLs (7dafd8e)
transformIndexHtml now strips query strings before deriving the HTML filename, and it normalizes protocol-relative HTML paths so inline proxy URLs are generated safely. The new tests verify that //-prefixed requests don’t leak through as scheme-relative proxy URLs.