Are there any known Vite breaking changes between 5.1.6 and 5.1.8? | Astro Lounge | Page 1

wild wren Jan 22, 2025, 12:11 PM

#

I started to get an error message after an upgrade from 5.1.6 to 5.1.8.

Blocked request. This host (".............") is not allowed. To allow this host, add "................" to server.allowedHosts in vite.config.js.

Is it expected? What configuration should I add to allow any hostname for my Astro website?

lone canyon Jan 23, 2025, 1:57 PM

#

Same. Did you figure it out? @wild wren

timber glen Jan 23, 2025, 2:03 PM

#

Solution are documented on the vulnerability report https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6

GitHub

Any websites were able to send any requests to the development serv...

Summary

Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket co...

rigid marsh Jan 27, 2025, 9:08 AM

#

Hi @timber glen! I am having a follow up issue to this one: Seems like setting the allowedHosts only works for the server configuration but not for preview. Other people seem to encounter this issue as well (e.g. https://github.com/withastro/astro/issues/13060). Any ideas?

GitHub

Issues · withastro/astro

The web framework for content-driven websites. ⭐️ Star to support our work! - Issues · withastro/astro

#Are there any known Vite breaking changes between 5.1.6 and 5.1.8?

Summary