wxt-dev / wxt-dev/wxt

Popup HTML auto refresh does not work with Vite 6.0.9+

Open
#1,360 9 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
10.5k
Forks
564
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

Due to a security issue (https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6), Vite 6.0.9+ now requires a token to connect to the WebSocket endpoint.
Because WXT connects to the WS server on its own, this connection no longer successes.
https://github.com/wxt-dev/wxt/blob/7c18d9c0b8c638204b913b13de25c08ced5d9eb5/packages/wxt/src/sandbox/dev-server-websocket.ts#L43-L46

The way to fix would be to pass config.webSocketToken as a query param (e.g. ?token=${config.webSocketToken}) when connecting to WS server.
https://github.com/vitejs/vite/blob/9654348258eaa0883171533a2b74b4e2825f5fb6/packages/vite/src/node/config.ts#L610-L620
But ideally, it should not connect to the WebSocket server on its own and instead use import.meta.hot.

Reproduction

pnpm dlx wxt@latest init

Steps to reproduce
  1. pnpm dlx wxt@latest init
  2. pnpm dev
  3. Open the extension popup.
  4. Edit entrypoints/popup/index.html
System Info
System:
    OS: Windows 11 10.0.22631
    CPU: (24) x64 AMD Ryzen 9 5900X 12-Core Processor
    Memory: 11.03 GB / 31.92 GB
  Binaries:
    Node: 22.13.0 - C:\Program Files\nodejs\node.EXE
    npm: 10.9.2 - C:\Program Files\nodejs\npm.CMD
    pnpm: 9.15.3 - C:\Program Files\nodejs\pnpm.CMD
    bun: 1.1.38 - ~\AppData\Local\Microsoft\WinGet\Links\bun.EXE
  Browsers:
    Edge: Chromium (131.0.2903.99)
    Internet Explorer: 11.0.22621.3527
Used Package Manager

pnpm

Validations

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with packages/wxt/src/sandbox/dev-server-websocket.ts at the WebSocket connection referenced in the issue, then reproduce with pnpm dlx wxt@latest init, pnpm dev, and an edit to entrypoints/popup/index.html. Compare the connection requirements in Vite's config and verify that popup HTML auto-refresh works with Vite 6.0.9+.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript, vite
Domain
build-system, devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.