@astrojs/cloudflare - npm Package Compare versions

Comparing version 4.0.0 to 4.0.1

CHANGELOG.md

 # @astrojs/cloudflare
 
+## 4.0.1
+
+### Patch Changes
+
+- [#5301](https://github.com/withastro/astro/pull/5301) [`a79a37cad`](https://github.com/withastro/astro/commit/a79a37cad549b21f91599ff86899e456d9dcc7df) Thanks [@bluwy](https://github.com/bluwy)! - Fix environment variables usage in worker output and warn if environment variables are accessedd too early
+
+- Updated dependencies [[`88c1bbe3a`](https://github.com/withastro/astro/commit/88c1bbe3a71f85e92f42f13d0f310c6b2a264ade), [`a79a37cad`](https://github.com/withastro/astro/commit/a79a37cad549b21f91599ff86899e456d9dcc7df)]:
+  - astro@1.6.5
+
 ## 4.0.0
@@ -4,0 +13,0 @@

dist/server.advanced.d.ts

@@ -1,2 +0,1 @@
-import './shim.js';
 import type { SSRManifest } from 'astro';
@@ -3,0 +2,0 @@ declare type Env = {

dist/server.advanced.js

@@ -1,6 +0,8 @@
-import "./shim.js";
 import { App } from "astro/app";
+import { getProcessEnvProxy } from "./util.js";
+process.env = getProcessEnvProxy();
 function createExports(manifest) {
   const app = new App(manifest, false);
   const fetch = async (request, env, context) => {
+    process.env = env;
     const { origin, pathname } = new URL(request.url);
@@ -7,0 +9,0 @@ if (manifest.assets.has(pathname)) {

dist/server.directory.d.ts

@@ -1,2 +0,1 @@
-import './shim.js';
 import type { SSRManifest } from 'astro';
@@ -3,0 +2,0 @@ export declare function createExports(manifest: SSRManifest): {

dist/server.directory.js

@@ -1,3 +0,4 @@
-import "./shim.js";
 import { App } from "astro/app";
+import { getProcessEnvProxy } from "./util.js";
+process.env = getProcessEnvProxy();
 function createExports(manifest) {
@@ -10,2 +11,3 @@ const app = new App(manifest, false);
   }) => {
+    process.env = runtimeEnv.env;
     const { origin, pathname } = new URL(request.url);
@@ -12,0 +14,0 @@ if (manifest.assets.has(pathname)) {

package.json

 {
   "name": "@astrojs/cloudflare",
   "description": "Deploy your site to cloudflare workers or cloudflare pages",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "type": "module",
@@ -34,6 +34,6 @@ "types": "./dist/index.d.ts",
   "peerDependencies": {
-    "astro": "^1.6.4"
+    "astro": "^1.6.5"
   },
   "devDependencies": {
-    "astro": "1.6.4",
+    "astro": "1.6.5",
     "astro-scripts": "0.0.9",
@@ -40,0 +40,0 @@ "chai": "^4.3.6",

README.md

@@ -95,12 +95,14 @@ # @astrojs/cloudflare
 
-As Cloudflare Pages Functions [provides environment variables differently](https://developers.cloudflare.com/pages/platform/functions/#adding-environment-variables-locally), private environment variables needs to be set through [`vite.define`](https://vitejs.dev/config/shared-options.html#define) to work in builds.
+As Cloudflare Pages Functions [provides environment variables per request](https://developers.cloudflare.com/pages/platform/functions/#adding-environment-variables-locally), you can only access private environment variables when a request has happened. Usually, this means moving environment variable access inside a function.
 
 ```js
-// astro.config.mjs
-export default {
-  vite: {
-    define: {
-      'process.env.MY_SECRET': JSON.stringify(process.env.MY_SECRET),
-    },
-  },
+// pages/[id].json.js
+
+export function get({ params }) {
+  // Access environment variables per request inside a function
+  const serverUrl = import.meta.env.SERVER_URL;
+  const result = await fetch(serverUrl + "/user/" + params.id);
+  return {
+    body: await result.text(),
+  };
 }
@@ -107,0 +109,0 @@ ```

src/server.advanced.ts

@@ -1,6 +0,7 @@
-import './shim.js';
-
 import type { SSRManifest } from 'astro';
 import { App } from 'astro/app';
+import { getProcessEnvProxy } from './util.js';
 
+process.env = getProcessEnvProxy();
+
 type Env = {
@@ -15,2 +16,4 @@ ASSETS: { fetch: (req: Request) => Promise<Response> };
 	const fetch = async (request: Request, env: Env, context: any) => {
+		process.env = env as any;
+
 		const { origin, pathname } = new URL(request.url);
@@ -17,0 +20,0 @@

src/server.directory.ts

@@ -1,6 +0,7 @@
-import './shim.js';
-
 import type { SSRManifest } from 'astro';
 import { App } from 'astro/app';
+import { getProcessEnvProxy } from './util.js';
 
+process.env = getProcessEnvProxy();
+
 export function createExports(manifest: SSRManifest) {
@@ -17,2 +18,4 @@ const app = new App(manifest, false);
 	} & Record<string, unknown>) => {
+		process.env = runtimeEnv.env as any;
+
 		const { origin, pathname } = new URL(request.url);
@@ -19,0 +22,0 @@ // static assets

test/basics.test.js

@@ -27,2 +27,3 @@ import { loadFixture, runCLI } from './test-utils.js';
 			expect($('h1').text()).to.equal('Testing');
+			expect($('#env').text()).to.equal('secret');
 		} finally {
@@ -29,0 +30,0 @@ stop();

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Improved metrics

Total package byte prevSize

42792

increased by5.35%

Number of package files

33

increased by3.13%

Lines of code

621

increased by5.61%

Number of lines in readme file

121

increased by1.68%

Worsened metrics

Number of low supply chain risk alerts

6

increased by500%

No dependency changes