fix: disable dotfiles serving via /@fs/ by default

[antfu]

Description

Continue from #2850, disable dotfiles serving by default to father enhance the security.

Additional context

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following

• Read the Contributing Guidelines.
• Read the Pull Request Guidelines and follow the Commit Convention.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
• Ideally, include relevant tests that fail without this PR but pass with it.

[patak-dev]

Did you check what is the interaction with Vite's cache (node_modules/.vite)? I checked that this is also restricted, and I imagine that imported path rewrites are not going through /@fs/ when loading the optimized deps cache?
Also maybe worth checking, the .vitepress directory

[Shinigami92]

Just some minot things

[antfu]

Did you check what is the interaction with Vite's cache (node_modules/.vite)? I checked that this is also restricted, and I imagine that imported path rewrites are not going through /@fs/ when loading the optimized deps cache?
Also maybe worth checking, the .vitepress directory

Oh... Good catch. I will try to find a solution for that tmr

[antfu]

As discussions with the team, we decided to abandoned this PR for now, as #2977 and #2850 already covered major security issues. Anding this changes will affect accessing to .vite and .vitepress and other ecosystem usages, at this point, this is more harmful than it's actually trying to solve. We might explore more options to provide further serving controls if the community is asking for it. Close this for now.