# What changed in @vitejs/plugin-rsc

> 15 changes in @vitejs/plugin-rsc 0.5 from its official release notes, upgrade guides and advisories: 8 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/@vitejs/plugin-rsc/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @vitejs/plugin-rsc 0.5

### Security

- Encrypted closures are now bound to their action id. (0.5.37) — [release notes](https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-rsc%400.5.37)
- @vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server Components (0.5.26) — [security advisory](https://github.com/advisories/GHSA-W94C-4VHP-22GX)
- @vitejs/plugin-rsc has a Denial of Service with React Server Components (0.5.23) — [security advisory](https://github.com/advisories/GHSA-V457-WXVJ-P9W9)
- @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint (0.5.8) — [security advisory](https://github.com/advisories/GHSA-G239-Q96Q-X4QM)
- Vite Plugin React has a Denial of Service Vulnerability in React Server Components (0.5.7) — [security advisory](https://github.com/advisories/GHSA-CPQF-F22C-R95X)
- Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components (0.5.7) — [security advisory](https://github.com/advisories/GHSA-C6M7-Q6PR-C64R)
- @vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server (0.5.6) — [security advisory](https://github.com/advisories/GHSA-J76J-5P5G-9WFR)
- React Server Components are Vulnerable to RCE (0.5.3) — [security advisory](https://github.com/advisories/GHSA-FMH4-WR37-44FP)

### New APIs and options

- The transformHoistInlineDirective meta now exposes closure captures. (0.5.37) — [release notes](https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-rsc%400.5.37)

### Fixes and other changes

- Scan build strip now skips glob dynamic import specifiers. (0.5.38) — [release notes](https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-rsc%400.5.38)
- Server Function source is now dropped from client sourcemaps. (0.5.37) — [release notes](https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-rsc%400.5.37)
- CSS wrappers no longer end up inside a trailing comment when a module has no final newline. (0.5.37) — [release notes](https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-rsc%400.5.37)
- Finalizes the asset manifest after CSS processing, so the manifest reflects CSS assets. (0.5.36) — [release notes](https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-rsc%400.5.36)
- Uses anonymous cross-origin mode for CSS. (0.5.36) — [release notes](https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-rsc%400.5.36)
- Resolves the facade client entry with strictExecutionOrder. (0.5.36) — [release notes](https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-rsc%400.5.36)