Vite server.fs.allow default filesystem access limits

Filesystem Access Control in Vite Dev Server

Vite provides the server.fs.allow configuration to restrict which directories the development server can serve. By default, the server allows access to files within the project root and any directory the process can read, which can potentially expose files outside the intended project scope if not explicitly restricted.

While server.fs.allow and server.fs.deny provide mechanisms to whitelist or blacklist specific paths, the default permissive behavior requires manual intervention to ensure a strict security posture during development.

Given the current implementation in Vite 5.x, what are the implications of shifting to a restrictive default where only the project root is allowed? Would this change break common patterns for monorepos or shared workspace dependencies that reside outside the immediate project root?