cloudflare/workers-sdk @cloudflare/vite-plugin@1.42.0

@cloudflare/vite-plugin@1.42.0

Repository: cloudflare/workers-sdk

Tag: @cloudflare/vite-plugin@1.42.0

Published: 2026-06-18T15:13:33Z

Prerelease: no

Release notes:

Minor Changes

• #14339 `aa49856` Thanks @jamesopstad! - Add a build command to the experimental, internal cf-vite delegate binary

cf-vite build runs Vite's full multi-environment app build (via the Builder API) and enables the experimental Build Output API by default, emitting a self-contained .cloudflare/output/v0/ directory. It forces experimental.newConfig and experimental.newConfig.cfBuildOutput on, so a cloudflare.config.ts is required at the project root.

Patch Changes

• #14346 `e930bd4` Thanks @haidargit! - Bump ws from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p

GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high severity) reports a remote memory-exhaustion DoS in ws@<8.21.0: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a ws server or client via OOM. The fix shipped in ws@8.21.0 (commit 2b2abd45, released 2026-05-22), which also introduces the maxBufferedChunks and maxFragments options. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.

• #14351 `6c7df19` Thanks @jamesopstad! - Force the experimental new config on by default in the cf-vite dev delegate

• #14218 `4eed569` Thanks @matingathani! - Allow resolve.external containing only Node.js built-ins in Worker environments

Vitest 4 automatically sets resolve.external to the full list of Node.js built-in modules for non-standard Vite environments via its internal runnerTransform plugin. Previously, the Cloudflare Vite plugin rejected any non-empty resolve.external array, throwing an incompatibility error on startup when used alongside Vitest 4.

The validation check now allows resolve.external arrays that contain only Node.js built-in module names (both bare fs and node:fs forms). The error is only thrown when resolve.external is true or contains non-built-in package names that would prevent user code from being bundled into the Worker.

• Updated dependencies [`673b09e`, `e930bd4`, `f6e49dd`, `5c3bb11`, `296ad65`, `594544d`, `a79b899`, `5dfb788`, `ca61558`, `36777db`]:
• miniflare@4.20260617.0
• wrangler@4.102.0