--- title: Cloudflare acquires VoidZero, TypeORM hits 1.0 | daily.dev description: Cloudflare has acquired VoidZero — the company behind Vite, Vitest, Rolldown, and Oxc — with the full team joining Cloudflare. All projects remain... canonical: https://daily.dev/posts/cloudflare-acquires-voidzero-typeorm-hits-1-0-utw4jja5l twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cloudflare acquires VoidZero, TypeORM hits 1.0 | daily.dev og:description: Cloudflare has acquired VoidZero — the company behind Vite, Vitest, Rolldown, and Oxc — with the full team joining Cloudflare. All projects remain... og:url: https://daily.dev/posts/cloudflare-acquires-voidzero-typeorm-hits-1-0-utw4jja5l og:image: https://api.daily.dev/og/posts/uTW4jJa5l.png og:image:alt: Cloudflare acquires VoidZero, TypeORM hits 1.0 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare acquires VoidZero, TypeORM hits 1.0 **[Web Digest](https://daily.dev/sources/webdev_digest)** · 3 min read · 0 upvotes · 0 comments ## Summary Cloudflare has acquired VoidZero — the company behind Vite, Vitest, Rolldown, and Oxc — with the full team joining Cloudflare. All projects remain MIT-licensed, and Cloudflare is committing $1M to a Vite ecosystem fund managed by the Vite core team. Vite will become the foundation of Cloudflare's unified CLI. Community reaction is mixed given past corporate acquisitions of open source tooling. Also covered: a CBSE exam portal breach exposed nearly 2 million student records via four basic security failures (client-side auth, hardcoded passwords, IDOR, and a misconfigured S3 bucket). VS Code now supports MCP Apps that render interactive HTML in sandboxed iframes, demonstrated with a Go pprof flame graph. TypeORM 1.0 also shipped after nearly a decade, merging 575 PRs and requiring Node.js 20+. ## Content **TLDR:** Cloudflare's acquisition of VoidZero — the team behind Vite, Vitest, Rolldown, and Oxc — is the story of the day, with community reaction still split on what corporate ownership means for open source tooling long-term. TypeORM finally crossed 1.0 after nearly a decade, though that was covered in yesterday's digest. A CBSE exam portal breach exposed records of nearly 2 million students through four textbook security mistakes, worth reading if you're building anything with auth or file storage. MCP Apps in VS Code now let servers return interactive HTML rendered in sandboxed iframes, which is a meaningful step beyond plain-text tool responses. --- ## Cloudflare acquires VoidZero, commits $1M to Vite ecosystem fund Cloudflare bought VoidZero — Evan You's company behind Vite, Vitest, Rolldown, and Oxc — and the entire team joins Cloudflare. All projects stay MIT-licensed. Cloudflare is putting $1M into a Vite ecosystem fund administered by the Vite core team, not Cloudflare directly. Vite becomes the foundation of Cloudflare's unified CLI, with cf dev as a superset of vite dev. The honest read: Cloudflare has serious infrastructure but rough developer experience, and VoidZero built the tooling people actually enjoy. Whether that's still true in three years is the real bet — the BastionZero shutdown gets raised as a counterexample every time someone cites Astro as a positive precedent. [Read more](https://app.daily.dev/posts/ROgTXL5vD) ## CBSE portal breach exposed 2 million student records through four basic security failures A breakdown of the CBSE onscreen marking portal breach is worth reading as a case study. The four failures: client-side authentication enforcement, a hardcoded master password in frontend JavaScript, missing object-level authorization (IDOR/BOLA — OWASP API #1), and a publicly listable misconfigured S3 bucket. None of these are exotic. The post closes with a defense-in-depth model that's worth internalizing: the server is the sole trust boundary, owning all auth, secrets, and file access brokering. If you're building anything with file storage or role-based access, this is a useful checklist. [Read more](https://app.daily.dev/posts/FbEDd2KZo) ## MCP Apps in VS Code render interactive HTML inside sandboxed iframes GitHub and Microsoft developer advocates demoed MCP Apps — a VS Code feature where MCP server tools can return rich interactive HTML rendered in sandboxed iframes directly in the chat window. The live demo used a Go pprof flame graph with a React frontend served via an MCP server. Shopify is already building branded in-chat experiences with it. Plain-text tool responses were the obvious bottleneck for anything data-heavy, and this is a real step forward for building useful developer tooling on top of MCP. [Read more](https://app.daily.dev/posts/z81YBUeaN) --- ## Also notable - **TypeORM 1.0 ships after nearly a decade:** Already covered in yesterday's digest — TypeORM 1.0 merges 575 PRs, requires Node.js 20+, and ships a codemod for migrating from 0.3.x. [Read more](https://app.daily.dev/posts/arCozn4CZ) - **Theme systems at scale: design token and component-level theming patterns:** A writeup on architecting theme systems for large-scale UI customization covers design token patterns and the architectural tradeoffs when component-level theming needs to stay consistent across a big codebase. [Read more](https://app.daily.dev/posts/cpUI9sqES) --- Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs), [#mcp](https://daily.dev/tags/mcp), [#cloudflare](https://daily.dev/tags/cloudflare), [#vite](https://daily.dev/tags/vite) [View this post on daily.dev](https://daily.dev/posts/cloudflare-acquires-voidzero-typeorm-hits-1-0-utw4jja5l) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/cloudflare-acquires-voidzero-typeorm-hits-1-0-utw4jja5l","headline":"Cloudflare acquires VoidZero, TypeORM hits 1.0","text":"Cloudflare has acquired VoidZero — the company behind Vite, Vitest, Rolldown, and Oxc — with the full team joining Cloudflare. All projects remain MIT-licensed, and Cloudflare is committing $1M to a Vite ecosystem fund managed by the Vite core team. Vite will become the foundation of Cloudflare's unified CLI. Community reaction is mixed given past corporate acquisitions of open source tooling. Also covered: a CBSE exam portal breach exposed nearly 2 million student records via four basic security failures (client-side auth, hardcoded passwords, IDOR, and a misconfigured S3 bucket). VS Code now supports MCP Apps that render interactive HTML in sandboxed iframes, demonstrated with a Go pprof flame graph. TypeORM 1.0 also shipped after nearly a decade, merging 575 PRs and requiring Node.js 20+.","url":"https://daily.dev/posts/cloudflare-acquires-voidzero-typeorm-hits-1-0-utw4jja5l","datePublished":"2026-06-07T04:18:23.400Z","dateModified":"2026-06-07T04:18:40.376Z","author":{"@type":"Organization","name":"Web Digest","logo":"https://media.daily.dev/image/upload/s--C833eNQW--/f_auto,q_auto/v1773839396/logos/webdev_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/webdev_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/webdev_digest","name":"Web Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Web Digest","item":"https://daily.dev/sources/webdev_digest"},{"@type":"ListItem","position":3,"name":"Cloudflare acquires VoidZero, TypeORM hits 1.0"}]} ```