Update dependency @cloudflare/vite-plugin to v1.51.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vite-plugin (source)	1.42.1 → 1.51.1

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.51.1

Compare Source

Patch Changes

• #​15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture

  Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.

  Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.

  The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.

• Updated dependencies [35c87e9, b4f0c97, 8cf78c8, a60ff4d, 99eb50c, 35c87e9]:

  • wrangler@​4.120.0
  • miniflare@5.20260801.1-alpha

v1.51.0

Compare Source

Minor Changes

• #​14941 266172b Thanks @​nickpatt! - Improve the Local Explorer's Observability views

  console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).

• #​14996 ebd1dfd Thanks @​nickpatt! - Surface Local Explorer API to headless agents

  When a Vite dev or preview server with the Cloudflare plugin is started in a headless AI agent environment, the plugin now prints the Local Explorer API URL and useful resource routes to stdout so agents can discover and call them programmatically.

Patch Changes

• Updated dependencies [20470fa, 9c74538, 266172b, a88d169, a88d169, daf65f2, a9e5abb]:
  • wrangler@​4.119.0
  • miniflare@5.20260801.0-alpha

v1.50.0

Compare Source

Minor Changes

• #​14944 a249591 Thanks @​nickpatt! - Enable local observability capture by default in dev

  wrangler dev and the Vite plugin now capture request traces and console logs into the Local Explorer's Observability tab out of the box — previously this was opt-in behind X_LOCAL_OBSERVABILITY=true. Set X_LOCAL_OBSERVABILITY=false to opt out (for example if the extra per-worker collector/streaming-tail services cause trouble in a multi-process dev-registry setup).

Patch Changes

• Updated dependencies [cc63aae, f92d1fc, a249591, f92d1fc, f92d1fc, cec9d88, e0bbf55]:
  • wrangler@​4.118.0

v1.49.1

Compare Source

Patch Changes

• #​14586 5a56dda Thanks @​emily-shen! - Rewrite local testing paths (/cdn-cgi/*)

  Miniflare v5 moved its internal local testing endpoints to /cdn-cgi/local/* (and /__cf_local/* for endpoints that must remain reachable over tunnels) to prevent any potential collision with production routes. wrangler dev and the Vite plugin now transparently rewrite the old paths to the new ones, meaning you can continue to use the old paths without issue.

  These are the new paths:

  • /cdn-cgi/handler/scheduled → /cdn-cgi/local/scheduled
  • /cdn-cgi/handler/email → /cdn-cgi/local/email
  • /cdn-cgi/explorer/* → /cdn-cgi/local/explorer/*
  • /cdn-cgi/mf/scheduled → /cdn-cgi/local/scheduled (Note /cdn-cgi/mf/scheduled is already deprecated)
  • /cdn-cgi/mf/stream/* → /__cf_local/stream/*
  • /cdn-cgi/mf/imagedelivery/* → /__cf_local/imagedelivery/*

• Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

  • miniflare@5.20260730.0-alpha
  • wrangler@​4.117.0

v1.49.0

Compare Source

Minor Changes

• #​14905 b21eac2 Thanks @​jamesopstad! - The experimental build output directory now includes the Worker's configuration at .cloudflare/output/v0/workers/default/config.json instead of .cloudflare/output/v0/workers/<worker-name>/worker.config.json

Patch Changes

• Updated dependencies [01d7020, beec0fb, 48f0c6c, 8049ca4, d7f38c3, 1394867, cc54478, 5c25cfe, b21eac2, bb09f1b, 1f61001, 01d7020, e31ab0f]:
  • miniflare@​4.20260730.0
  • wrangler@​4.116.0

v1.48.0

Compare Source

Minor Changes

• #​14883 76e6014 Thanks @​jamesopstad! - Serve the bundled client HTML in dev when Vite's experimental.bundledDev is enabled

  Note that this feature is experimental and subject to change.

Patch Changes

• #​14862 c232d05 Thanks @​petebacondarwin! - Destroy the client socket instead of crashing when a WebSocket upgrade fails

  If dispatchFetch rejected while a WebSocket upgrade was still in flight (for example when Miniflare is disposed during a dev server shutdown or restart), the error escaped the async upgrade handler as an unhandled rejection. This could terminate the dev server process and leaked the client socket. The upgrade handler now catches such failures and tears the socket down cleanly.

• #​14837 de6a951 Thanks @​1rgs! - Fix compatibility with Vite's experimental.bundledDev option. Keep Miniflare, containers, and tunnels alive when a build runs in dev.

  The plugin used the buildEnd hook as its signal that the dev server was closing, and tore down its dev resources there. Vite's experimental.bundledDev runs a build pass during serve, which fires buildEnd while the dev server is still live — so Miniflare was disposed (the next request failed with Expected \miniflare` to be defined`), locally-built container images were removed, and any active tunnel was closed, all mid-serve.

  During serve, these resources are now torn down from a patched server.close. We will replace server patching with first-class APIs when they are added to Vite.

• #​14851 fb89b72 Thanks @​exKAZUu! - Retry transient module-transport failures in the runner worker

  Each fetchModule invoke was a single fetch to the dev server with no retry. If that one fetch failed transiently (e.g. Network connection lost when workerd reuses a loopback connection that Node just closed), Vite's module runner cached the rejection and every request importing the affected module failed for the rest of the dev session. The invoke is an idempotent request for module code, so retry it up to three times before giving up.

• Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

  • wrangler@​4.115.0
  • miniflare@​4.20260722.1

v1.47.0

Compare Source

Minor Changes

• #​14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #​14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

• Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

  • wrangler@​4.114.0
  • miniflare@​4.20260722.0

v1.46.0

Compare Source

Minor Changes

• #​14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

  Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

  // cloudflare.config.ts
  import { defineSettings, defineWorker } from "wrangler/experimental-config";
  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  
  export const settings = defineSettings({
  	accountId: "<your-account-id>",
  });
  
  export default defineWorker({
  	name: "my-worker",
  	entrypoint,
  	compatibilityDate: "2026-05-18",
  });

  This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

Patch Changes

• Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:
  • miniflare@​4.20260721.0
  • wrangler@​4.113.0

v1.45.1

Compare Source

Patch Changes

• #​14610 e727842 Thanks @​martijnwalraven! - Keep watching config changes after a failed dev server restart

  Previously, when a config change made the dev server restart fail — for example because the updated Worker config was invalid — the plugin stopped watching config changes entirely: the change handler (covering the Worker config files, local dev vars, and the assets configuration) removed itself before restarting, and only a successfully created server would register a fresh one. Since Vite keeps the current server running when a restart fails, every subsequent config change (including the one that fixes the config) was silently ignored for the rest of the session.

  The handler now stays registered and guards against re-entrant restarts instead, so fixing the config restarts the dev server as expected.

• #​14418 cb30df3 Thanks @​matthewdavidrodgers! - Improve routing performance for Workers with assets

  Reduce request handling latency by streamlining the router Worker's request path. The loopback infrastructure remains available for future use.

• Updated dependencies [34e696d, d39ae01, 3de70df, c79504f, 9f04a7e, 9f04a7e, cb30df3, cb6c3f9, c7dbe1a, 3f3afbb, e6fbc4e, 4e1a7a7, 9f04a7e]:

  • miniflare@​4.20260714.0
  • wrangler@​4.112.0

v1.45.0

Compare Source

Minor Changes

• #​14652 317ce1f Thanks @​jamesopstad! - Append Workers runtime types to the generated types when using experimental.newConfig, with a new types.includeRuntime option

  When using the experimental new config (cloudflare.config.ts), the plugin now appends the Workers runtime types (generated from your compatibility date and flags) to worker-configuration.d.ts, alongside the types inferred from your config. This is controlled by a new experimental.newConfig.types.includeRuntime option, which defaults to true.

  As part of this change, types are now generated only during vite dev (not vite build), since compatibility settings are resolved from the active dev session. This affects the experimental new config path only.

Patch Changes

• #​14588 eb99ab1 Thanks @​emily-shen! - fix: Respect auth profiles when using remote bindings in the Vite plugin

  Auth profiles (configured via wrangler auth create and wrangler auth activate) were previously being ignored when using remote bindings with the Vite plugin. This is now fixed.

  Note that the profile directory is resolved based on the Vite project root.

• #​14645 cbdd107 Thanks @​jamesopstad! - Fix load time crash on Node.js versions earlier than 22.15

  The plugin eagerly imported registerHooks from node:module, which only exists on Node.js v22.15.0+. registerHooks is now read lazily, meaning that missing support is only surfaced when using experimental.newConfig.

• Updated dependencies [7692a61, ed33326, 018574b, eb99ab1, cdf3148, 7692a61, 7692a61, 3015320, 899c297, 9da77ac, 317ce1f]:

  • miniflare@​4.20260710.0
  • wrangler@​4.111.0

v1.44.0

Compare Source

Minor Changes

• #​14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

  A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.

  await step.do(
    "call flaky API",
    {
      retries: {
        limit: 5,
        backoff: "constant",
        delay: ({ ctx }) => ctx.attempt * 1000,
      },
    },
    async () => {
      /* ... */
    }
  );

  The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

Patch Changes

• Updated dependencies [0283a1f, 7b28392, 1b965c5]:
  • wrangler@​4.110.0
  • miniflare@​4.20260708.1

v1.43.3

Compare Source

Patch Changes

• Updated dependencies [e3f0cd6, 8511ddf, 9f74a5f, e3f0cd6, c782e2a, 2fedb1f, 17d2fc1]:
  • miniflare@​4.20260708.0
  • wrangler@​4.109.0

v1.43.2

Compare Source

Patch Changes

• Updated dependencies [54f74b8, 0852346, 54f74b8]:
  • wrangler@​4.108.0
  • miniflare@​4.20260706.0

v1.43.1

Compare Source

Patch Changes

• Updated dependencies [e7e5780, d88555e, 5fd8bee, 5d9990e, bf49a41, 1ac96a1, f416dd9, 1ca8d8f, 16fbf81, b973ed3]:
  • miniflare@​4.20260702.0
  • wrangler@​4.107.1

v1.43.0

Compare Source

Minor Changes

• #​14382 fd92d56 Thanks @​petebacondarwin! - Add support for declarative Durable Object exports

  wrangler deploy now accepts an exports map in wrangler.json as a declarative alternative to the legacy migrations array.

  Each entry in exports is keyed by Durable Object class name. type carries the export kind (currently always "durable-object"); the state field carries the lifecycle and defaults to "created" (live) when omitted:

  {
    "exports": {
      // Provision a new Durable Object class (`MyDO`)
      "MyDO": { "type": "durable-object", "storage": "sqlite" },
      // Delete Durable Object class (`OldGone`)
      "OldGone": { "type": "durable-object", "state": "deleted" },
      // Rename a Durable Object class (from `OldName` to `NewName`)
      "OldName": {
        "type": "durable-object",
        "state": "renamed",
        "renamed_to": "NewName"
      },
      "NewName": { "type": "durable-object", "storage": "sqlite" },
      // Transfer a Durable Object (`Outgoing`) to a new Worker (`target-worker`)
      "Outgoing": {
        "type": "durable-object",
        "state": "transferred",
        "transferred_to": "target-worker"
      },
      // Prepare to receive the transfer of a Durable Object (`Incoming`) from another Worker (`source-worker`)
      "Incoming": {
        "type": "durable-object",
        "state": "expecting-transfer",
        "storage": "sqlite",
        "transfer_from": "source-worker"
      }
    }
  }

  When a Worker declares Durable Object class bindings but no lifecycle for them (neither a migrations array nor an exports map), wrangler warns and now suggests a declarative exports entry for each class (previously it suggested a legacy migrations block).

  The deployment response now surfaces the server's reconciliation result — created namespaces, applied tombstones, structured per-scenario info entries, and a removable_entries hint for stale tombstones that are safe to delete from the config. Blocking errors return the structured per-class detail with scenario tags, suggested remediation, and any referencing-script context.

  wrangler versions upload also forwards exports. Declarative exports lifecycle changes are reconciled when the version is deployed (wrangler versions deploy or wrangler deploy), so a versions upload payload can declare new classes in exports without immediately provisioning them. An actor binding (durable_objects.bindings) to a class declared only in exports on the same versions upload is rejected with a clear error (code 100406) — the binding cannot be resolved until the namespace is provisioned. Either stage the new class via ctx.exports.X (no binding required) on versions upload and add the binding at deploy time, or use wrangler deploy to provision and bind in one step (the same constraint applies to the migrations flow).

  Multi-version deploys (wrangler versions deploy A@50% B@50%) where the selected versions disagree on declarative exports are rejected server-side with a clear message: deploy the version that changes exports at 100% first, then run the percentage-split deploy. This prevents traffic on one branch routing to code that references unprovisioned or just-deleted DO namespaces. Single-version (100%) deploys are unaffected.

  Local development (wrangler dev, vite dev and unstable_startWorker) reads Durable Object SQLite storage settings from the new exports field, so applications using the declarative flow get correct local-dev storage without needing to also declare a migrations block.

  @cloudflare/vitest-pool-workers also picks up Durable Object configuration from exports, so tests against an exports-only Worker run with the correct local SQLite storage and can reach unbound Durable Object classes via ctx.exports.X.

  wrangler types is also aware of exports. Live entries (including expecting-transfer, the receiving side of a two-phase transfer) are added to Cloudflare.GlobalProps.durableNamespaces, which types ctx.exports.X for unbound Durable Objects declared only via exports.

Patch Changes

• Updated dependencies [aa5d580, 6b0ce98, fd92d56, bfe48db, be3f792, 0277bfa, 98793d8, e1532eb]:
  • wrangler@​4.107.0
  • miniflare@​4.20260701.0

v1.42.4

Compare Source

Patch Changes

• #​14490 75d8cb0 Thanks @​petebacondarwin! - Preserve D1 migration paths in generated Worker configs

  When a Worker config with a D1 binding is built by the Vite plugin, the generated wrangler.json now points migrations_dir back to the source migration directory. This lets tools that read the generated config, such as createTestHarness(), find the same D1 migrations as the source Worker config.

• Updated dependencies [75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, f10d4ad, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, d292046, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, e0cc2cb, 75d8cb0, 75d8cb0, 75d8cb0]:

  • wrangler@​4.106.0
  • miniflare@​4.20260630.0

v1.42.3

Compare Source

Patch Changes

• Updated dependencies [5f40dd5, 34e0cef, 3b743c1, daa5389, 8a5cf8c]:
  • wrangler@​4.105.0
  • miniflare@​4.20260625.0

v1.42.2

Compare Source

Patch Changes

• #​14358 4ef872f Thanks @​gabivlj! - Fix container egress interception on arm64 Docker runtimes

  Both wrangler dev and the Cloudflare Vite plugin no longer force the proxy-everything sidecar image to pull as linux/amd64, allowing Docker to select the native image from the multi-platform manifest. Set MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM to force a specific platform when needed.

• Updated dependencies [a085dec, 9a0de8f, fab565f, 3f02864, 4ef872f, 2a02858, e312dec]:

  • miniflare@​4.20260623.0
  • wrangler@​4.104.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cloudflare/​vite-plugin@​1.42.1 ⏵ 1.51.1	-1		+1	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Trivial package: npm @img/sharp-darwin-arm64 has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-darwin-arm64@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-darwin-x64 has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-darwin-x64@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-arm has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-linux-arm@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-arm64 has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-linux-arm64@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-ppc64 has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-linux-ppc64@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-ppc64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-riscv64 has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-linux-riscv64@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-riscv64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-s390x has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-linux-s390x@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-s390x@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-x64 has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-linux-x64@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linuxmusl-arm64 has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-linuxmusl-arm64@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-arm64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linuxmusl-x64 has 1 lines of code Location: Package overview From: ? → npm/@cloudflare/vite-plugin@1.51.1 → npm/@img/sharp-linuxmusl-x64@0.35.2 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-x64@0.35.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm @cloudflare/vite-plugin in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.51.1 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/vite-plugin@1.51.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report