unstale

npm / @vitejs/plugin-rsc

@vitejs/plugin-rsc

What changed in @vitejs/plugin-rsc 0.5, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

8 security1 new APIs and options6 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

@vitejs/plugin-rsc 0.515 changes

Security 8

  • Encrypted closures are now bound to their action id.

    0.5.37release notes

  • @vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components

    0.5.26security advisory

  • @vitejs/plugin-rsc has a Denial of Service with React Server Components

    0.5.23security advisory

  • @vitejs/plugin-rsc has an Arbitrary File Read via /__vite_rsc_findSourceMapURL Endpoint

    0.5.8security advisory

  • Vite Plugin React has a Denial of Service Vulnerability in React Server Components

    0.5.7security advisory

  • Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

    0.5.7security advisory

  • @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server

    0.5.6security advisory

  • React Server Components are Vulnerable to RCE

    0.5.3security advisory

New APIs and options 1

  • The transformHoistInlineDirective meta now exposes closure captures.

    0.5.37release notes

Fixes and other changes 6

  • Scan build strip now skips glob dynamic import specifiers.

    0.5.38release notes

  • Server Function source is now dropped from client sourcemaps.

    0.5.37release notes

  • CSS wrappers no longer end up inside a trailing comment when a module has no final newline.

    0.5.37release notes

  • Finalizes the asset manifest after CSS processing, so the manifest reflects CSS assets.

    0.5.36release notes

  • Uses anonymous cross-origin mode for CSS.

    0.5.36release notes

  • Resolves the facade client entry with strictExecutionOrder.

    0.5.36release notes