Version 4.0.4

[agarny]

No description provided.

[Copilot]

Pull request overview

This PR bumps the package version to 4.0.4 and hardens the Vite dev-server middleware that serves libopencor assets by properly parsing/decoding request URLs and adding a directory-traversal guard before resolving paths under node_modules/@opencor/opencor/dist/libopencor.

Changes:

• Update the dev-server configureServer middleware to strip query strings, safely decode URL paths, and ensure resolved file paths remain within libopencorDir.
• Add a file-type check before serving content from disk.
• Bump package version from 4.0.3 → 4.0.4 in package.json and package-lock.json.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
vite.config.js	Improves dev middleware URL parsing and prevents directory traversal when serving /libopencor/* paths.
package.json	Version bump to 4.0.4.
package-lock.json	Lockfile version bump to 4.0.4.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

vite.config.js:148

• The traversal guard rejects relative === "", but an empty relative path just means the resolved path is exactly realLibopencorDir (i.e., /libopencor/). That’s not an escape, and it’s already handled by the statSync(...).isFile() check below. Keeping this condition makes the comment about “escaping the directory” misleading and adds an unnecessary special case.

              relative === "" ||
              relative === ".." ||
              relative.startsWith(`..${path.sep}`) ||
              path.isAbsolute(relative)
            ) {

vite.config.js:176

• This middleware hard-codes Content-Type: application/javascript for every /libopencor/* asset, but libopencor is under a wasm/<version>/... directory and is likely to serve .wasm and other non-JS assets as well. Serving .wasm as JS can break streaming compilation and can cause incorrect handling in some clients. Consider selecting the content type based on path.extname(filePath) (at least .wasm vs .js).

            res.writeHead(200, {
              "Content-Type": "application/javascript",
              "Cross-Origin-Embedder-Policy": "require-corp",
              "Cross-Origin-Resource-Policy": "same-origin",
            });