@cloudflare/vite-plugin 1.12.1 → 1.12.3

package/dist/asset-workers/router-worker.js

@@ -4596,8 +4596,10 @@ var Analytics = class {
         // blob4
         this.data.coloRegion,
         // blob5
-        this.data.abuseMitigationURLHost
+        this.data.abuseMitigationURLHost,
         // blob6
+        this.data.xssDetectionImageHref
+        // blob7
       ]
     });
   }
@@ -6178,6 +6180,21 @@ var worker_default = {
               }
             }
           }
+          if (url.pathname === "/_image") {
+            const hrefParam = url.searchParams.get("href");
+            if (hrefParam && hrefParam.length > 2 && hrefParam.startsWith("//")) {
+              try {
+                const hrefUrl = new URL("https:" + hrefParam);
+                const isImageFetchDest = request.headers.get("sec-fetch-dest") == "image";
+                if (hrefUrl.hostname !== url.hostname && !isImageFetchDest) {
+                  analytics.setData({ xssDetectionImageHref: hrefParam });
+                  return new Response("Blocked", { status: 403 });
+                }
+              } catch {
+                console.log(`Invalid href parameter in /_image: ${hrefParam}`);
+              }
+            }
+          }
           analytics.setData({
             timeToDispatch: performance.now() - startTimeMs
           });

package/dist/index.js

@@ -7607,6 +7607,8 @@ function createCloudflareEnvironmentOptions({
       ssr: true,
       rollupOptions: {
         input: workerConfig.main,
+        // workerd checks the types of the exports so we need to ensure that additional exports are not added to the entry module
+        preserveEntrySignatures: "strict",
         // rolldown-only option
         ..."rolldownVersion" in vite ? { platform: "neutral" } : {}
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/vite-plugin",
-  "version": "1.12.1",
+  "version": "1.12.3",
   "description": "Cloudflare plugin for Vite",
   "keywords": [
     "cloudflare",
@@ -37,14 +37,14 @@
     "get-port": "^7.1.0",
     "picocolors": "^1.1.1",
     "tinyglobby": "^0.2.12",
-    "unenv": "2.0.0-rc.19",
+    "unenv": "2.0.0-rc.20",
     "ws": "8.18.0",
-    "miniflare": "4.20250823.1",
-    "@cloudflare/unenv-preset": "2.7.0",
-    "wrangler": "4.33.1"
+    "@cloudflare/unenv-preset": "2.7.2",
+    "miniflare": "4.20250902.0",
+    "wrangler": "4.34.0"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^4.20250823.0",
+    "@cloudflare/workers-types": "^4.20250902.0",
     "@types/node": "^22.10.1",
     "@types/ws": "^8.5.13",
     "magic-string": "^0.30.12",
@@ -55,12 +55,12 @@
     "vitest": "~3.2.0",
     "@cloudflare/containers-shared": "0.2.10",
     "@cloudflare/mock-npm-registry": "0.0.0",
-    "@cloudflare/workers-shared": "0.18.7",
+    "@cloudflare/workers-shared": "0.18.8",
     "@cloudflare/workers-tsconfig": "0.0.0"
   },
   "peerDependencies": {
     "vite": "^6.1.0 || ^7.0.0",
-    "wrangler": "^4.33.1"
+    "wrangler": "^4.34.0"
   },
   "publishConfig": {
     "access": "public"