packages/vite/src/plugins/analyze.ts (1)

25-50: Optional: reduce noise in size stats

Consider adding legalComments: 'none' to the esbuild transform to avoid emitted licence comments skewing minified size comparisons.

-                  transform(module.code || '', { minify: true })
+                  transform(module.code || '', { minify: true, legalComments: 'none' })

packages/vite/src/plugins/dev-server.ts (3)

91-101: Safer route matching for dev handlers

Dynamic regex from variable input can be fragile and expose ReDoS risks. Prefer compiling routes with a safe library (e.g. path-to-regexp) or, at minimum, pre-validate patterns and avoid .*.

Example:

// import { pathToRegexp } from 'path-to-regexp'
devHandlerRegexes.push(pathToRegexp(handler.route))

Note: You already escape meta characters and anchor the pattern, which helps; this is a robustness suggestion. Based on static analysis hints.

---

77-83: Middleware insertion relies on function name

Detecting viteTransformMiddleware by Function.name is brittle across versions/minification. Keep the current fallback (append), but consider a more robust heuristic (e.g. insert before first stack entry whose route is '' and handles transform, or expose a hook upstream).

---

104-112: Micro-optimisation: cache Vite routes

You rebuild viteRoutes on each request. Cache once after server start and invalidate only if the stack changes (rare).

packages/vite/src/plugins/ssr-styles.ts (2)

45-46: Remove unused idRefMap

idRefMap is written but not read anywhere in this file. Drop it to reduce noise.

-  const idRefMap: Record<string, string> = {}
...
-            idRefMap[relativeToSrcDir(file)] = ref
...
-            idRefMap[relativeToSrcDir(resolved.id)] = ref

Also applies to: 263-265, 290-291

---

188-191: Clarify inBundle check

!!relativeToSrcDir(moduleId) is always truthy for valid paths, so inBundle becomes effectively isVue(moduleId) || isEntry. If that’s intentional, add a short comment; otherwise refine the condition.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: GalacticHypernova
PR: nuxt/nuxt#26468
File: packages/nuxt/src/components/plugins/loader.ts:24-24
Timestamp: 2024-11-05T15:22:54.759Z
Learning: In `packages/nuxt/src/components/plugins/loader.ts`, the references to `resolve` and `distDir` are legacy code from before Nuxt used the new unplugin VFS and will be removed.

packages/vite/src/plugins/vite-node.ts (2)

221-232: Deduplicate socket cleanup logic in buildEnd

buildEnd repeats cleanupSocket. Call the helper to keep behaviour consistent.

-    async buildEnd () {
-      if (socketServer && socketServer.listening) {
-        await new Promise<void>(resolveClose => socketServer!.close(() => resolveClose()))
-      }
-      if (socketPath && !socketPath.startsWith('\\\\.\\pipe\\')) {
-        try {
-          await unlink(socketPath)
-        } catch {
-          // Error is ignored if the file doesn't exist or cannot be unlinked
-        }
-      }
-    },
+    async buildEnd () {
+      await cleanupSocket()
+    },

---

416-424: Skip unlink for Linux abstract sockets and avoid sync FS call (optional)

currentSocketPath may be an abstract socket ('\0…'), which isn’t a filesystem entry. Guard for that (and consider using async unlink for non-blocking IO).

-  // Clean up existing socket file (Unix only)
-  if (!currentSocketPath.startsWith('\\\\.\\pipe\\')) {
+  // Clean up existing socket file (Unix only; skip Windows pipes and Linux abstract sockets)
+  if (!currentSocketPath.startsWith('\\\\.\\pipe\\') && currentSocketPath.charCodeAt(0) !== 0) {
     try {
-      fs.unlinkSync(currentSocketPath)
+      fs.unlinkSync(currentSocketPath)
     } catch (unlinkError: any) {
       if (unlinkError.code !== 'ENOENT') {
         // Socket cleanup failed, but continue anyway
       }
     }
   }

packages/vite/src/plugins/replace.ts (2)

9-20: Micro-optimisation: return early if there’s nothing to replace

Avoid adding a no-op plugin when no import.meta.* defines exist.

       const replaceOptions: Record<string, string> = Object.create(null)
@@
-      for (const define of [config.define || {}, environment.config.define || {}]) {
+      for (const define of [config.define || {}, environment.config.define || {}]) {
         // ...
       }
+      if (Object.keys(replaceOptions).length === 0) {
+        return false
+      }

---

22-29: Avoid identifier shadowing between rollup and rolldown replace plugins

Shadowing replacePlugin can be confusing. Rename for clarity and ensure option shape matches rolldown’s expected API.

-import replacePlugin from '@rollup/plugin-replace'
+import rollupReplacePlugin from '@rollup/plugin-replace'
@@
-      if (vite.rolldownVersion) {
-        const { replacePlugin } = await import('rolldown/experimental')
-        return replacePlugin(replaceOptions)
+      if (vite.rolldownVersion) {
+        const { replacePlugin: rolldownReplacePlugin } = await import('rolldown/experimental')
+        return rolldownReplacePlugin(replaceOptions)
       } else {
-        return replacePlugin({ ...replaceOptions, preventAssignment: true })
+        return rollupReplacePlugin({ ...replaceOptions, preventAssignment: true })
       }

packages/vite/src/plugins/stable-entry.ts (1)

67-71: Stale TODO comment

You’ve adopted the environment API here already. Consider removing or updating the TODO to reflect remaining gaps (if any).

packages/vite/src/plugins/ssr-styles.ts (3)

96-160: Avoid shadowing and clarify variable names in generateBundle (optional)

Inner const file shadows the outer loop variable file. It’s correct due to block scope, but renaming improves readability.

-            for (const css of files) {
-              const file = this.getFileName(css)
+            for (const css of files) {
+              const outFile = this.getFileName(css)
               if (cssImports.has(file)) {
                 continue
               }
-              cssImports.add(file)
+              cssImports.add(outFile)
               const name = `style_${i++}`
-              importStatements.add(genImport(`./${relative(baseDir, file)}`, name))
+              importStatements.add(genImport(`./${relative(baseDir, outFile)}`, name))
               exportNames.add(name)
             }

---

196-226: Global CSS handling: warn path is good; also import as side-effect when unresolved (optional)

When a global CSS entry can’t be resolved for inlining, you prepend an import — good fallback. Consider normalising nuxt.options.css to string[] earlier to handle objects like { src } consistently.

---

228-246: Early-return condition may skip static CSS import scanning for non-island modules

transform() returns early when !(id in clientCSSMap) and not an island, which skips the later static import scan. If that’s intentional (teleport only client-observed CSS), ignore. Otherwise, consider moving the static import scan before this guard.

packages/vite/src/plugins/layer-dep-optimize.ts (1)

15-19: Normalise both paths to avoid Windows mismatches

Normalise layer directories too (and rootDir) before startsWith checks; currently only the importer is normalised.

-  const delimitedRootDir = nuxt.options.rootDir + '/'
+  const root = normalize(nuxt.options.rootDir)
+  const delimitedRootDir = root.endsWith('/') ? root : root + '/'

-    if (dirs.app !== nuxt.options.srcDir && !dirs.app.startsWith(delimitedRootDir)) {
-      layerDirs.push(dirs.app)
+    if (dirs.app !== nuxt.options.srcDir) {
+      const appDir = normalize(dirs.app)
+      if (!appDir.startsWith(delimitedRootDir)) {
+        layerDirs.push(appDir)
+      }
     }

Also applies to: 29-36

packages/vite/src/plugins/analyze.ts (1)

19-51: Optionally gate analyse to build mode.

Visualizer and generateBundle are no-ops in dev but still add plugin overhead. Consider enabling only when !nuxt.options.dev.

packages/vite/src/plugins/environments.ts (1)

23-31: Consider scoping base override to the client environment.

Setting base: './' globally may affect SSR tooling unintentionally. If only the client build needs a relative base, move this into configEnvironment('client').

packages/vite/src/plugins/dev-server.ts (1)

91-101: Dynamic regex from routes: safe but consider path-to-regexp for robustness.

You escape and normalise well; still, using a proven router pattern compiler (e.g. path-to-regexp) reduces future maintenance and ReDoS risks.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Learnt from: GalacticHypernova
PR: nuxt/nuxt#26468
File: packages/nuxt/src/components/plugins/loader.ts:24-24
Timestamp: 2024-11-05T15:22:54.759Z
Learning: In `packages/nuxt/src/components/plugins/loader.ts`, the references to `resolve` and `distDir` are legacy code from before Nuxt used the new unplugin VFS and will be removed.

packages/vite/src/plugins/dev-server.ts (2)

21-23: Good fix: safe Set construction from possibly undefined exclude

Using item.exclude ?? [] avoids runtime errors. This resolves earlier feedback.

---

33-36: Good fix: guard config.server before writing cors

Initialising config.server prevents TypeError when setting cors.

packages/vite/src/plugins/analyze.ts (1)

12-15: Fix boolean build.analyse semantics: true should enable plugin

defu({}, true) → {} so .enabled is undefined and the plugin exits. Normalise boolean to enabled.

-  const analyzeOptions = defu({}, nuxt.options.build.analyze) as Exclude<NuxtOptions['build']['analyze'], boolean>
-  if (!analyzeOptions.enabled) {
-    return
-  }
+  const analyze = nuxt.options.build.analyze
+  if (!analyze) {
+    return
+  }
+  const analyzeOptions = typeof analyze === 'boolean'
+    ? { enabled: true }
+    : defu({ enabled: true }, analyze as Exclude<NuxtOptions['build']['analyze'], boolean>)
+  if (analyzeOptions.enabled === false) {
+    return
+  }

packages/vite/src/plugins/dev-server.ts (3)

79-84: Insert skip-transform middleware before transform deterministically

If viteTransformMiddleware is not found, pushing to the end may place mw after transform. Unshift to guarantee it runs before transform.

-      if (transformHandler === -1) {
-        viteServer.middlewares.stack.push(mw)
-      } else {
+      if (transformHandler === -1) {
+        viteServer.middlewares.stack.unshift(mw)
+      } else {
         viteServer.middlewares.stack.splice(transformHandler, 0, mw)
       }

---

93-104: Route regex construction from variable input: consider safer, faster approach

Dynamic RegExp can still be error-prone and potentially expensive. Prefer a battle-tested router pattern utility (e.g. path-to-regexp) to compile handler.route safely with anchors and segment semantics, or at least cap greedy patterns.

Based on static analysis hints

---

114-118: Skip-transform condition likely never triggers when base is "/" (unnecessary base check)

With base "/" the first predicate is always false, so _skip_transform is never set; transform won’t be bypassed for non‑Vite routes. Rely solely on discovered viteRoutes.

-        if (!event.path.startsWith(viteServer.config.base!) && !viteRoutes.some(route => event.path.startsWith(route))) {
+        if (!viteRoutes.some(route => event.path.startsWith(route))) {
           // @ts-expect-error _skip_transform is a private property
           event.node.req._skip_transform = true
         } else if (!useViteCors) {

packages/vite/src/vite.ts (1)

150-154: Filter optional plugins to avoid undefined entries

LayerDepOptimizePlugin and SSRStylesPlugin may return undefined. Filter falsy to keep Vite’s plugin array clean.

-        plugins: [
+        plugins: ([
           // add resolver for files in public assets directories
           PublicDirsPlugin({
             dev: nuxt.options.dev,
             baseURL: nuxt.options.app.baseURL,
           }),
           ReplacePlugin(),
           LayerDepOptimizePlugin(nuxt),
           SSRStylesPlugin(nuxt),
           EnvironmentsPlugin(nuxt),
-        ],
+        ] as (vite.Plugin | undefined)[]).filter(Boolean) as vite.Plugin[],

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

packages/vite/src/plugins/analyze.ts (1)

12-15: Preserve build.analyze boolean semantics (true should enable plugin)

defu({}, true) => {} so analyzeOptions.enabled is undefined and the plugin exits; build.analyze: true should enable defaults. This is a regression already noted earlier.

-  const analyzeOptions = defu({}, nuxt.options.build.analyze) as Exclude<NuxtOptions['build']['analyze'], boolean>
-  if (!analyzeOptions.enabled) {
-    return
-  }
+  const analyze = nuxt.options.build.analyze
+  if (!analyze) {
+    return
+  }
+  const analyzeOptions = typeof analyze === 'boolean'
+    ? { enabled: true }
+    : defu({ enabled: true }, analyze as Exclude<NuxtOptions['build']['analyze'], boolean>)
+  if (analyzeOptions.enabled === false) {
+    return
+  }

packages/vite/src/vite.ts (1)

123-131: Avoid possible undefined access in assetFileNames

chunk.names[0]! can be undefined for some assets. Use a safe fallback (names[0], then name, then a default).

-              assetFileNames: nuxt.options.dev
-                ? undefined
-                : chunk => withoutLeadingSlash(join(nuxt.options.app.buildAssetsDir, `${sanitizeFilePath(filename(chunk.names[0]!))}.[hash].[ext]`)),
+              assetFileNames: nuxt.options.dev
+                ? undefined
+                : (chunk) => {
+                    const primaryName =
+                      (Array.isArray((chunk as any).names) && (chunk as any).names[0]) ||
+                      (chunk as any).name ||
+                      'asset'
+                    return withoutLeadingSlash(
+                      join(nuxt.options.app.buildAssetsDir, `${sanitizeFilePath(filename(primaryName))}.[hash].[ext]`),
+                    )
+                  },

packages/vite/src/plugins/dev-server.ts (1)

95-103: Harden dynamic route-to-RegExp conversion (ReDoS/perf risk)

Routes are user-configurable. Even with escaping/anchoring, constructing RegExp from variable input risks catastrophic backtracking.

• Prefer using a proven router/compilator (e.g. path-to-regexp) to compile patterns safely.
• If staying with strings:
  • Keep anchors (^ $) and escape as you do.
  • Replace patterns with atomic/possessive equivalents where supported, or simplify:
    • Use [^/]+ for :param
    • Use non-greedy segments for */** with explicit path boundaries
  • Consider bounding input length or pre-validating allowed tokens.

Example with path-to-regexp:

import { pathToRegexp } from 'path-to-regexp'
// ...
devHandlerRegexes.push(pathToRegexp(handler.route))

Based on static analysis hints.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro