Codex- and OpenCode-assisted changes in Vitest 5 replaced Vite's default file deny list with a token-only list, so a running UI, API or Browser Mode server could serve .env files, keys and .git contents.

@@ -7,6 +7,7 @@ import { basename, dirname, relative, resolve } from 'pathe' import * as vite from 'vite' import { configDefaults } from '../../defaults' import { generateScopedClassName } from '../../integrations/css/css-modules'

+import { API_TOKEN_FS_DENY } from '../config/apiToken'

 import { VitestFilteredOutProjectError } from '../errors' import { createViteLogger, silenceImportViteIgnoreWarning } from '../viteLogger' import { CoverageTransform } from './coverageTransform'@@ -175,6 +176,7 @@ export function WorkspaceVitestPlugin(                 project.vitest.config.root,                 project.vitest.vite.config.configFile,               ),

+              deny: [...(viteConfig.server?.fs?.deny ?? []), API_TOKEN_FS_DENY],             },           },           // eslint-disable-next-line ts/ban-ts-comment

@@ -6,6 +6,7 @@ import * as vite from 'vite' import { defaultPort } from '../../constants' import { configDefaults } from '../../defaults' import { generateScopedClassName } from '../../integrations/css/css-modules'

+import { API_TOKEN_FS_DENY } from '../config/apiToken'

 import { resolveApiServerConfig } from '../config/resolveConfig' import { Vitest } from '../core' import { createViteLogger, silenceImportViteIgnoreWarning } from '../viteLogger'@@ -67,12 +68,6 @@ export async function VitestPlugin(         ;(options as unknown as ResolvedConfig).defines = defines         ;(options as unknown as ResolvedConfig).viteDefine = originalDefine 

-        let open: string | boolean | undefined = false--        if (testConfig.ui && testConfig.open) {-          open = testConfig.uiBase ?? '/__vitest__/'-        }-

         const resolveOptions = getDefaultResolveOptions()          let config: ViteConfig = {@@ -88,12 +83,13 @@ export async function VitestPlugin(           },           server: {             ...testConfig.api,

-            open,+            open: false,             hmr: false,             ws: testConfig.api?.middlewareMode ? false : undefined,             preTransformRequests: false,             fs: {               allow: resolveFsAllow(options.root || process.cwd(), testConfig.config),+              deny: [...(viteConfig.server?.fs?.deny ?? []), API_TOKEN_FS_DENY],             },           },           build: {

@@ -5,6 +5,7 @@ import { dirname, resolve } from 'pathe' import { searchForWorkspaceRoot, version as viteVersion } from 'vite' import * as vite from 'vite' import { rootDir } from '../../paths'

+import { API_TOKEN_FILE } from '../config/apiToken' import { hash } from '../hash'  export function resolveTestCacheDir(@@ -127,6 +128,28 @@ export function deleteDefineConfig(viteConfig: ViteConfig): DefineConfigResult {   return { defines, scriptDefines } } +// TODO: use Vite's own defaults once they are exported (request upstream)+// copied from Vite 8.3 https://github.com/vitejs/vite/blob/v8.3.4/packages/vite/src/node/server/index.ts#L1254-L1261+const VITE_DEFAULT_FS_DENY = [+  '.env',

+  '.env.*',+  '*.{crt,pem,key,p12,pfx,cer,der}',+  '.npmrc',+  '.yarnrc.yml',+  '**/.git/**',+]++// Vite drops its default `server.fs.deny` once any value is set,+// so the defaults are kept explicitly when the user didn't set one.+export function appendApiTokenFsDeny(viteConfig: ViteConfig): void {+  viteConfig.server ??= {}+  viteConfig.server.fs ??= {}+  viteConfig.server.fs.deny = [

+    ...(viteConfig.server.fs.deny ?? VITE_DEFAULT_FS_DENY),+    API_TOKEN_FILE,+  ]+}+ export function resolveFsAllow(   projectRoot: string,   rootConfigFile: string | false | undefined,

@@ -34,7 +34,7 @@ import { resolveProjectEntries } from '../projects/resolveProjects' import { withLabel } from '../reporters/renderers/utils' import { BaseSequencer } from '../sequencers/BaseSequencer' import { RandomSequencer } from '../sequencers/RandomSequencer'-import { API_TOKEN_FILE, resolveApiToken } from './apiToken'+import { resolveApiToken } from './apiToken' import { PluginHarness } from './pluginHarness' 

 function resolvePath(path: string, root: string) {@@ -1169,7 +1169,6 @@ export async function resolveConfig(   rootViteConfig.server.fs.allow.push(     ...resolveFsAllow(rootViteConfig.root, rootViteConfig.configFile),   )-  rootViteConfig.server.fs.deny.push(API_TOKEN_FILE)    // the server has been created, we don't need to override vite.server options   const { token, tokenCreated } = resolveApiToken(rootViteConfig.root)

@@ -2,15 +2,14 @@ import type * as vite from 'vite' import type { UserConfig as ViteConfig, Plugin as VitePlugin } from 'vite' import type { PluginHarness } from '../config/pluginHarness' import { resolve } from 'pathe'

-import { API_TOKEN_FILE } from '../config/apiToken' import { ViteConfigPlugin } from './config' import { CoverageTransform } from './coverageTransform' import { CSSEnablerPlugin } from './cssEnabler' import { MetaEnvReplacerPlugin } from './metaEnvReplacer' import { MocksPlugins } from './mocks'

 import { NormalizeURLPlugin } from './normalizeURL' import { SsrRunnerFixerPlugin } from './ssrRunnerFixer'-import { resolveTestCacheDir } from './utils'+import { appendApiTokenFsDeny, resolveTestCacheDir } from './utils' import { VitestProjectResolver } from './vitestResolver'  export function ProjectRootPlugin(projectRoot: string): VitePlugin {

@@ -44,6 +43,7 @@ export function WorkspaceVitestPlugin(

       config(viteConfig) {         const testConfig = viteConfig.test || {}         const root = testConfig.root || viteConfig.root+        appendApiTokenFsDeny(viteConfig)          const config: ViteConfig = {           base: '/',

@@ -57,7 +57,6 @@ export function WorkspaceVitestPlugin(             open: false,             fs: {               allow: globalViteConfig.server.fs.allow,-              deny: [API_TOKEN_FILE],             },           },         }