Update dependency @cloudflare/vite-plugin to v1.32.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vite-plugin (source)	1.30.3 → 1.32.3

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.32.3

Compare Source

Patch Changes

• #​13427 c4deb1d Thanks @​edmundhung! - Harden file serving for Vite dev

  The Vite plugin now includes Wrangler config files, Vite config files, and .wrangler state files in server.fs.deny so they cannot be fetched directly from the Vite dev server.

• Updated dependencies [854d66c, 6f63eaa, aef9825, eaaa728, 58292f6, 5e5bbc1, d5ff5a4, 07a918c, 89c7829, 60565dd, 6cbcdeb, 90aee27]:

  • miniflare@​4.20260415.0
  • wrangler@​4.83.0

v1.32.2

Compare Source

Patch Changes

• Updated dependencies [9b2b6ba]:
  • wrangler@​4.82.2

v1.32.1

Compare Source

Patch Changes

• Updated dependencies [6b11b07, dd4e888]:
  • wrangler@​4.82.1

v1.32.0

Compare Source

Minor Changes

• #​13137 1313275 Thanks @​emily-shen! - Add e hotkey to open local explorer during dev

  Press e during vite dev to open the local explorer UI at /cdn-cgi/explorer, which allows you to inspect the state of your D1, R2, KV, DO and Workflow bindings.

Patch Changes

• Updated dependencies [5338bb6, 79fd529, 28bc2be, 4fd138b, bafb96b, c50cb5b, 2589395, 525a46b, 5eff8c1, 1313275]:
  • wrangler@​4.82.0
  • miniflare@​4.20260410.0

v1.31.2

Compare Source

Patch Changes

• Updated dependencies [42c7ef0, c510494, 8b71eca, a42e0e8, 7ca6f6e]:
  • miniflare@​4.20260409.0
  • wrangler@​4.81.1

v1.31.1

Compare Source

Patch Changes

• Updated dependencies [a3e3b57, 7d318e1, fa6d84f, 96ee5d4, 7d318e1, 7a60d4b, 78cbe37, 6fa5dfd]:
  • miniflare@​4.20260405.0
  • wrangler@​4.81.0

v1.31.0

Compare Source

Minor Changes

• #​13011 b9b7e9d Thanks @​ruifigueira! - Add experimental headful browser rendering support for local development

  Experimental: This feature may be removed or changed without notice.

  When developing locally with the Browser Rendering API, you can enable headful (visible) mode via the X_BROWSER_HEADFUL environment variable to see the browser while debugging:

  X_BROWSER_HEADFUL=true wrangler dev
  X_BROWSER_HEADFUL=true vite dev

  Note: when using @cloudflare/playwright, two Chrome windows may appear — the initial blank page and the one created by browser.newPage(). This is expected behavior due to how Playwright handles browser contexts via CDP.

• #​13051 d5bffde Thanks @​dario-piotrowicz! - Update getLocalWorkerdCompatibilityDate to return today's date

  The re-exported getLocalWorkerdCompatibilityDate function from @cloudflare/vite-plugin previously resolved the workerd compatibility date by traversing the local miniflare installation, which was unreliable in some package manager setups. It now simply returns today's date. The function is also marked as deprecated — callers should just use today's date instead, for example like so: new Date().toISOString().slice(0, 10)

Patch Changes

• #​13125 f76652c Thanks @​kayluhb! - Fix SyntaxError when SSR-transformed module ends with a single-line comment

  When module code ends with a // comment (e.g. //# sourceMappingURL=... preserved by vite-plus), the closing } of the async wrapper in runInlinedModule was absorbed into the comment, causing SyntaxError: Unexpected end of input. Adding a newline before the closing brace prevents this.

• #​13188 110002c Thanks @​shulaoda! - Normalize the return value of getAssetsDirectory() with vite.normalizePath() to ensure assets.directory in the output wrangler.json always uses forward slashes

• Updated dependencies [9c4035b, 5d29055, fb67a18, d5bffde, ab44870, 48d83ca, b2f53ea, b9b7e9d, 14e72eb, 4dc94fd, b2f53ea, d5bffde, 48d83ca]:

  • wrangler@​4.80.0
  • miniflare@​4.20260401.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​marked@​6.0.0
	@​types/​bun@​1.3.12
	starlight-llms-txt@​0.6.1
	openai@​5.12.2 ⏵ 6.34.0	+1		+1
	nanospinner@​1.2.2
	@​types/​semver@​7.7.1
	seobot@​1.5.0
	@​types/​node-forge@​1.3.14
	starlight-image-zoom@​0.13.2
	astro-font@​1.1.0
	linkify-it@​5.0.0
	prettier-plugin-astro@​0.14.1
	striptags@​3.2.0
	faiss-node@​0.5.1
	toastify-js@​1.12.0
	@​types/​toastify-js@​1.12.4
	prettier-plugin-organize-imports@​4.3.0
	node-forge@​1.4.0
	gray-matter@​4.0.3
	schema-dts@​1.1.5
	dayjs@​1.11.20
	@​tailwindcss/​typography@​0.5.19
	marked@​16.4.2
	glob@​13.0.6
	@​supabase/​supabase-js@​2.103.2
	mermaid@​11.14.0
	prettier-plugin-tailwindcss@​0.7.2
	fast-xml-parser@​5.6.0
	langchain@​0.3.37
	@​jsr/​std__semver@​1.0.8

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @supabase/supabase-js is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@supabase/supabase-js@2.103.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@supabase/supabase-js@2.103.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud