Update dependency @cloudflare/vite-plugin to v1.55.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vite-plugin (source)	1.42.1 → 1.55.0

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.55.0

Compare Source

Minor Changes

• #​15674 a939a6c Thanks @​ghostwriternr! - Support explicit named Container image selection in local development

  The Vite plugin builds or pulls named images from Wrangler configuration and exposes their local tags through ctx.container.images. Pass one of those references to ctx.container.start({ image }) to select the image.

  This extends the experimental Durable Object-managed Containers interface.

Patch Changes

• Updated dependencies [6874aa9, 2298cf1, d96b319, 876eea1, 2b39fc2]:
  • wrangler@​4.134.0
  • miniflare@5.20260917.0-alpha

v1.54.11

Compare Source

Patch Changes

• Updated dependencies [71b6f10, ad23e6e, bac0c6a, be2437a, bac0c6a, 6f3d7b5]:
  • miniflare@5.20260916.0-alpha
  • wrangler@​4.133.0

v1.54.10

Compare Source

Patch Changes

• #​14775 1be7b97 Thanks @​dario-piotrowicz! - Sync Local Explorer endpoint lists across agent hints

  The Local Explorer endpoint list is now consistent across the three places it appears: the AGENTS.md template in create-cloudflare, the runtime agent hint in wrangler dev, and the Vite plugin agent hint. All three now include the observability/clear endpoint, use the canonical /cdn-cgi/local/explorer path, and have cross-reference comments pointing to each other.

• #​15399 982b806 Thanks @​tpmmorris! - Improve over-limit run_worker_first errors when duplicate rules are present

  The error now reports distinct and duplicate-entry counts and lists duplicated rules, making it clear when removing redundant entries can bring the configuration within the limit.

  Too many `run_worker_first` rules were provided; 105 rules provided (99 distinct, 6 duplicate entries) exceeds max of 100. Note: duplicate entries count towards the route limit. Ensure that no duplicate rules are present in your `run_worker_first` configuration.
  
  The duplicated rules found are:
  - "/rule/0"
  - "/rule/1"
  - "/rule/2"
  - "/rule/3"
  - "/rule/4"
  ...and 1 more duplicated rule.
  

• Updated dependencies [1be7b97, b149147, 7db596c, 76c0ce6, a83d7ac, a0856da, e35c4a1, d3565a5, a83d7ac, cb0955f, fa79b26, 16d1310, ca71205, 1015cfb, 982b806, ffabe74, 7db596c, e03822a, a83d7ac, 641df47, c4a6279]:

  • wrangler@​4.132.0
  • miniflare@5.20260915.0-alpha

v1.54.9

Compare Source

Patch Changes

• #​15574 164e4fb Thanks @​RealBhupesh! - Ignore .wrangler persistence writes in Vite's file watcher

  Miniflare stores local D1, KV, R2, and observability state under .wrangler/state. Those writes were watched as source changes on Linux and Windows, which fired every plugin hotUpdate hook and could make page loads take seconds. The plugin now ignores **/.wrangler/** while preserving any server.watch.ignored patterns already set by the user.

• Updated dependencies [8997652]:

  • miniflare@5.20260911.1-alpha
  • wrangler@​4.131.2

v1.54.8

Compare Source

Patch Changes

• Updated dependencies [945aaa3, 945aaa3, 47d906f, c2699bf, 945aaa3, 945aaa3]:
  • wrangler@​4.131.1
  • miniflare@5.20260911.0-alpha

v1.54.7

Compare Source

Patch Changes

• #​15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• Updated dependencies [0b43395, 9d75006, b605aa6, f45b596, f69f95a, a549e58, 36aed7f, 493e635, bff525d, dbb3ff4, fea3cd0, 96688b3, 6bd7b6c, 15cd6e1, be1caec, ed5797a, dbc9506, 128235a, f8aea7e, 24ef86b]:

  • wrangler@​4.131.0
  • miniflare@5.20260910.0-alpha

v1.54.6

Compare Source

Patch Changes

• Updated dependencies [edb3631, dbf6aad, bcebf08, e20df20, e20df20, 63c7ff1, a4e41df]:
  • miniflare@5.20260908.0-alpha
  • wrangler@​4.130.0

v1.54.5

Compare Source

Patch Changes

• #​15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

  When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

• Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

  • miniflare@5.20260907.0-alpha
  • wrangler@​4.129.1

v1.54.4

Compare Source

Patch Changes

• #​15407 7662118 Thanks @​xgame92! - Surface Worker export type fetch errors during development

  The Vite plugin now reports the Worker name, HTTP status, and response body when fetching export types fails. This preserves the underlying error instead of replacing it with a JSON parsing error.

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6, 93d72a5, f6fb347, f6fb347, dc24057, d2d8eea]:

  • miniflare@5.20260903.0-alpha
  • wrangler@​4.129.0

v1.54.3

Compare Source

Patch Changes

• Updated dependencies [dbbb795, 200780f, b3f2628, 87a7acf, 1809c5e, ea28cc3, b3fb2bf, 707cb6f]:
  • wrangler@​4.128.0
  • miniflare@5.20260831.0-alpha

v1.54.2

Compare Source

Patch Changes

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:
  • miniflare@5.20260828.0-alpha
  • wrangler@​4.127.1

v1.54.1

Compare Source

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@​4.127.0

v1.54.0

Compare Source

Minor Changes

• #​15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

  Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

• #​15326 9fcb1c9 Thanks @​jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

  The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.

Patch Changes

• Updated dependencies [aa54b49, 4a67a28, 2d78137, 04e8564, d1cc3af, 693ca29, 693ca29, 693ca29, daefb3c, 37ed753, f76b68e, ad89456, c809851, c66d2d5, 693ca29, 74de3ab, 0cb8690, 9fcb1c9, 22182da, a4c3458, 433fa98, d589d30, dd5148d, 82d11fc]:
  • miniflare@5.20260825.0-alpha
  • wrangler@​4.126.0

v1.53.1

Compare Source

Patch Changes

• Updated dependencies [59872c4, c68f9cb, 99a1f49, 5ae9d5b, 4b52975, ce9b151, ef73a28, 649f667, 39dcea6, 99a1f49, 99a1f49, 99a1f49, f2437e6, 30c2d47]:
  • wrangler@​4.125.0
  • miniflare@5.20260820.0-alpha

v1.53.0

Compare Source

Minor Changes

• #​15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

  A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

  {
    "name": "my-worker",
    "main": "worker.js",
    "compatibility_date": "2026-07-01",
    "containers": [
      { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
    ],
    "exports": {
      "MyContainerDO": {
        "type": "durable-object",
        "storage": "sqlite",
        "container": "my-container"
      }
    }
  }

  The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

  container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

  • a container reference names a container that does not exist
  • two Durable Object exports claim the same container
  • a container and a Durable Object export disagree about which one they are linked to
  • a container ends up linked to no Durable Object at all
  • two containers share a name
  • a container's class_name names a Durable Object whose storage is legacy-kv
  • two containers are attached to the same Durable Object

  That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

• #​15238 3a4fc6b Thanks @​jamesopstad! - Honor access.dev when running Workers with @cloudflare/vite-plugin, so ctx.access.getIdentity() returns the configured identity.

• #​15028 d4f441f Thanks @​harshmathurx! - Handle Worker-side request body cancellation without surfacing stream controller errors in local dev.

• #​15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

  When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

  The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

• #​15239 f431166 Thanks @​jamesopstad! - Prevent date-enabled Node.js compatibility from adding conflicting globals to generated runtime types

  Runtime type generation now treats Node.js compatibility enabled by a compatibility date the same way as an explicit nodejs_compat flag. Node.js globals continue to come from @types/node instead of being generated as any declarations that override those types.

• #​15196 8fb2b87 Thanks @​skepticfx! - Use the FedRAMP High managed container registry when Wrangler targets the FedRAMP High compliance region

  Container builds, pushes, deployments, image commands, and local development now select the corresponding production or staging FedRAMP registry and API from either compliance_region or CLOUDFLARE_COMPLIANCE_REGION.

• Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

  • wrangler@​4.124.0
  • miniflare@5.20260815.0-alpha

v1.52.1

Compare Source

Patch Changes

• Updated dependencies [b8fd112, f0f2054, 339509d]:
  • miniflare@5.20260811.1-alpha
  • wrangler@​4.123.0

v1.52.0

Compare Source

Minor Changes

• #​15123 d0c976c Thanks @​dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

  As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

  To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

  @cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

  wrangler types also no longer attributes its @types/node suggestion to "the nodejs_compat flag", which it can now make for Workers that do not set the flag at all.

Patch Changes

• #​15148 0b82b15 Thanks @​jamesopstad! - Ignore a nodejs_compat compatibility flag that the compatibility date already enables

  workerd rejects a compatibility flag that its compatibility date enables by default, so a Worker configured with both a compatibility date of 2026-08-04 or later and nodejs_compat failed to start locally with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore".

  The redundant nodejs_compat and nodejs_compat_v2 flags are now dropped when starting the runtime, which has no effect on the resulting Worker because the compatibility date enables both anyway. no_nodejs_compat and no_nodejs_compat_v2 still switch Node.js compatibility off, and a flag specified alongside its own opt-out is left alone so that workerd still reports those as contradictory.

• Updated dependencies [d0c976c, d0c976c, 0b82b15, d0c976c, d0c976c, 90dd5e5, 3b02915]:

  • miniflare@5.20260811.0-alpha
  • wrangler@​4.122.0

v1.51.3

Compare Source

Patch Changes

• Updated dependencies [15cad03, 026e058, 731b33a, e1b5b4b, 5b1b930, 6e7d37d, d669088, 15cad03, c7aede7, 0aa8fa5]:
  • wrangler@​4.121.0
  • miniflare@5.20260804.1-alpha

v1.51.2

Compare Source

Patch Changes

• #​14994 2194f88 Thanks @​emily-shen! - Update dev and preview for Miniflare's config-based options

  The Vite plugin now converts the Miniflare options it creates for dev and preview sessions to Miniflare's config-based workers shape.

  Users should not expect to notice any changes.

• Updated dependencies [6dbd192, 2194f88, 2194f88, 2194f88, 2194f88, 2194f88, 2194f88, 2194f88]:

  • miniflare@5.20260804.0-alpha
  • wrangler@​4.120.1

v1.51.1

Compare Source

Patch Changes

• #​15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture

  Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.

  Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.

  The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.

• Updated dependencies [35c87e9, b4f0c97, 8cf78c8, a60ff4d, 99eb50c, 35c87e9]:

  • wrangler@​4.120.0
  • miniflare@5.20260801.1-alpha

v1.51.0

Compare Source

Minor Changes

• #​14941 266172b Thanks @​nickpatt! - Improve the Local Explorer's Observability views

  console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).

• #​14996 ebd1dfd Thanks @​nickpatt! - Surface Local Explorer API to headless agents

  When a Vite dev or preview server with the Cloudflare plugin is started in a headless AI agent environment, the plugin now prints the Local Explorer API URL and useful resource routes to stdout so agents can discover and call them programmatically.

Patch Changes

• Updated dependencies [20470fa, 9c74538, 266172b, a88d169, a88d169, daf65f2, a9e5abb]:
  • wrangler@​4.119.0
  • miniflare@5.20260801.0-alpha

v1.50.0

Compare Source

Minor Changes

• #​14944 a249591 Thanks @​nickpatt! - Enable local observability capture by default in dev

  wrangler dev and the Vite plugin now capture request traces and console logs into the Local Explorer's Observability tab out of the box — previously this was opt-in behind X_LOCAL_OBSERVABILITY=true. Set X_LOCAL_OBSERVABILITY=false to opt out (for example if the extra per-worker collector/streaming-tail services cause trouble in a multi-process dev-registry setup).

Patch Changes

• Updated dependencies [cc63aae, f92d1fc, a249591, f92d1fc, f92d1fc, cec9d88, e0bbf55]:
  • wrangler@​4.118.0

v1.49.1

Compare Source

Patch Changes

• #​14586 5a56dda Thanks @​emily-shen! - Rewrite local testing paths (/cdn-cgi/*)

  Miniflare v5 moved its internal local testing endpoints to /cdn-cgi/local/* (and /__cf_local/* for endpoints that must remain reachable over tunnels) to prevent any potential collision with production routes. wrangler dev and the Vite plugin now transparently rewrite the old paths to the new ones, meaning you can continue to use the old paths without issue.

  These are the new paths:

  • /cdn-cgi/handler/scheduled → /cdn-cgi/local/scheduled
  • /cdn-cgi/handler/email → /cdn-cgi/local/email
  • /cdn-cgi/explorer/* → /cdn-cgi/local/explorer/*
  • /cdn-cgi/mf/scheduled → /cdn-cgi/local/scheduled (Note /cdn-cgi/mf/scheduled is already deprecated)
  • /cdn-cgi/mf/stream/* → /__cf_local/stream/*
  • /cdn-cgi/mf/imagedelivery/* → /__cf_local/imagedelivery/*

• Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

  • miniflare@5.20260730.0-alpha
  • wrangler@​4.117.0

v1.49.0

Compare Source

Minor Changes

• #​14905 b21eac2 Thanks @​jamesopstad! - The experimental build output directory now includes the Worker's configuration at .cloudflare/output/v0/workers/default/config.json instead of .cloudflare/output/v0/workers/<worker-name>/worker.config.json

Patch Changes

• Updated dependencies [01d7020, beec0fb, 48f0c6c, 8049ca4, d7f38c3, 1394867, cc54478, 5c25cfe, b21eac2, bb09f1b, 1f61001, 01d7020, e31ab0f]:
  • miniflare@​4.20260730.0
  • wrangler@​4.116.0

v1.48.0

Compare Source

Minor Changes

• #​14883 76e6014 Thanks @​jamesopstad! - Serve the bundled client HTML in dev when Vite's experimental.bundledDev is enabled

  Note that this feature is experimental and subject to change.

Patch Changes

• #​14862 c232d05 Thanks @​petebacondarwin! - Destroy the client socket instead of crashing when a WebSocket upgrade fails

  If dispatchFetch rejected while a WebSocket upgrade was still in flight (for example when Miniflare is disposed during a dev se

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cloudflare/​vite-plugin@​1.42.1 ⏵ 1.55.0	-1		+1	+1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Trivial package: npm @img/sharp-darwin-arm64 has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-darwin-arm64@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-arm64@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-darwin-x64 has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-darwin-x64@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-darwin-x64@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-arm has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-linux-arm@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-arm64 has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-linux-arm64@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-arm64@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-ppc64 has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-linux-ppc64@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-ppc64@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-riscv64 has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-linux-riscv64@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-riscv64@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-s390x has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-linux-s390x@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-s390x@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linux-x64 has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-linux-x64@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linux-x64@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linuxmusl-arm64 has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-linuxmusl-arm64@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-arm64@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Trivial package: npm @img/sharp-linuxmusl-x64 has 1 lines of code Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 → npm/@img/sharp-linuxmusl-x64@0.35.4 ℹ Read more on: This package | This alert | What are trivial packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Removing this package as a dependency and implementing its logic will reduce supply chain risk. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@img/sharp-linuxmusl-x64@0.35.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		System shell access: npm @cloudflare/vite-plugin in module node:child_process Module: node:child_process Location: Package overview From: package.json → npm/@cloudflare/vite-plugin@1.55.0 ℹ Read more on: This package | This alert | What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@cloudflare/vite-plugin@1.55.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report