[tyffical]

Motivation

• Local execution keeps an in-process fallback and version branches only for Vite 5 and early 6. With Vite 6.4 as the floor, every supported Vite runs each call through its module runner.
• [APPS-2961] Update: warn that Vite below 6.4 is deprecated and run the repo on Node 24 #627 warns about the same floor for every plugin.
• Ticket: APPS-2961 Run local backend functions in parallel, with per-call realtime console logs.
• Stack order, merged bottom up:
  1. [APPS-2961] Update: require Vite 6.4 or later for the apps plugin #622 (this PR)
  2. [APPS-2961] Refactor: move local execution's side-effect-free helpers into their own module #604
  3. [APPS-2961] Update: run each local backend function call in a fresh process #608
  4. [APPS-2961] Add: limit local call processes with Node's permission model #617
  5. [APPS-2961] Update: run local backend function calls in parallel, with per-call log prefixes #603
  6. [APPS-2961] Add: CI matrix running local execution against real Vite 7 and 8 installs #606

Architecture

flowchart LR
    A["vite build / vite dev"] --> B{"config hook: this.meta.viteVersion, else the imported vite version"}
    B -- "below 6.4" --> C["Throw: needs Vite 6.4 or later, with upgrade hint"]
    B -- "6.4 or later" --> D["Rest of the apps plugin"]

Loading

• The @datadog/vite-plugin peer range stays >= 5.x <= 8.x: only the enabled apps plugin refuses an older Vite.

Changes

10 changes across vite-version.ts, package.json, index.ts, dev-server-module-graph.ts, vite-parse-ast.ts, network-guard.ts, build-config.ts, dev-server-request-guard.ts and README.md

What changed	File
Refuses a Vite below 6.4 with one exported message, comparing with semver the this.meta.viteVersion or, on Vite 6, the imported vite version.	vite-version.ts
Adds semver 7.7.2, already in the lockfile, as a dependency of the apps plugin and so of each published plugin.	package.json
Runs the check first in the apps plugin's config hook, outside this repo's test env.	index.ts
Reads the SSR environment graph without the Vite 5 fallback.	dev-server-module-graph.ts
Drops the handling for Vite's CJS parseAst getter: the parser loads through a native dynamic import, which gets Vite's ESM entry.	vite-parse-ast.ts
Removes the Vite 5 plugin container exemption.	network-guard.ts
Drops the load hook's own filter recheck, since Vite 6.3 and later apply hook filters.	index.ts
Pins cloud-execution bundles to Vite's defaultServerConditions unconditionally, dropping the Vite 5 fallback.	build-config.ts
States the Vite 6.4 requirement.	README.md
Notes that Vite 6 runs its host check after plugin middleware, which is why the guard keeps its own.	dev-server-request-guard.ts

QA Instructions

• All 6 checks pass on a scaffolded app with this branch's packed plugin on Node 20.19.4, the last against a Datadog staging org, verified at 5b3a1614. Setup: build-plugins: Testing and QA Guide.

Check	Result	Evidence
vite build on Vite 6.4.5 and 8.3.4	Builds	✓ built in 57ms and 35ms, each writing dist/datadog-app-assets.zip
vite dev server on Vite 6.4.5 and 8.3.4	Starts	VITE v6.4.5 ready in 431 ms, VITE v8.3.4 ready in 331 ms; GET / returns 200
POST /__dd/debugBundle on both	Bundles the function	200, text/plain bundle holding getGreeting
Same request with Host: attacker.example	Refused	Vite 6.4.5: the plugin's own JSON 403, since Vite 6 checks hosts after plugin middleware. Vite 8.3.4: Vite's text/plain 403
vite build and vite on Vite 6.3.7	Refused	Both exit with Error: The Datadog Apps plugin needs Vite 6.4 or later (found 6.3.7).; no server starts
dev:verify on Vite 6.4.5	Runs in the cloud	getGreeting returns 200 through preview-async

yarn build:all && (cd packages/published/vite-plugin && yarn pack -o /tmp/vite-plugin.tgz)
# In a scaffolded app, for "vite": "6.4.5", "vite": "8.3.4" and "vite": "6.3.7":
npm install /tmp/vite-plugin.tgz && npx vite build
# ✓ built in …, with dist/datadog-app-assets.zip written
# On 6.3.7, this and `npx vite` fail: The Datadog Apps plugin needs Vite 6.4 or later (found 6.3.7).
npx vite --port 5173
# In another shell, with <name> the `<64-hex>.<export>` query name in the proxy that GET /src/<file>.backend.ts returns:
curl -s -X POST -H 'Content-Type: application/json' -d '{"functionName":"<name>"}' http://localhost:5173/__dd/debugBundle
# 200: the function's bundle
curl -s -X POST -H 'Host: attacker.example:5173' -H 'Content-Type: application/json' -d '{"functionName":"<name>"}' http://localhost:5173/__dd/debugBundle
# 403: Blocked request. This host ("attacker.example") is not allowed.
TMPDIR=/private/tmp yarn test:unit
# Expected: every suite passes; on a loaded machine, re-run a 10 s timeout alone with --runInBand
npx vite --mode dev-verify --port 5173  # 6.4.5 app, staging DD_API_KEY/DD_APP_KEY: POST getGreeting to /__dd/executeAction returns 200 via the cloud

Blast Radius

• No feature flag: the floor applies wherever the apps plugin is enabled.
• Medium risk: an apps project on Vite below 6.4 stops building until it upgrades; other plugins in @datadog/vite-plugin are unaffected.

Out of Scope / Follow-ups

3 items deferred

Item	Status	Next step
This repo's Jest suite can't load Vite 7+, which ships ESM only, so it runs on Vite 6.4.3; unit tests skip the floor when BUILD_PLUGINS_ENV=test, since they use mock bundler versions.	Deferred	Real Vite 7 and 8 coverage comes from #606.
On Vite 6, the check reads the imported vite module's version, which can belong to another install in a mixed setup.	Accepted	Vite 6 gives no running version; revisit if a real project reports a mismatch.
Optional server.environments?. reads stay, since unit-test fakes omit them.	Deferred	#608 removes the reads.

Documentation

• APPS-2961 Run local backend functions in parallel, with per-call realtime console logs
• build-plugins: Testing and QA Guide

🤖 Generated with Claude Code

[tyffical]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T23:12:24.901910Z	8cc274c	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The Apps-only version requirement and compatibility cleanup are consistent, with only nonblocking coding-convention feedback remaining.

3 open issues

• Extract nested version-test arguments into named locals · New
• Extract nested test call arguments into named locals · New
• Extract nested helper call arguments into named locals · New

What changed in this PR

Requires Vite 7 or later when the Apps plugin is enabled, preparing local backend execution for the upcoming per-call process changes. Other Datadog plugins retain their existing Vite compatibility.

Changes:

• Adds an early version check with an upgrade hint and tests for rejection, acceptance, and the repository test bypass.
• Removes Vite 5/6 compatibility branches and their obsolete tests.
• Documents the Apps-specific Vite requirement.

File	Description
packages/​plugins/​apps/​src/​vite/​vite-version.ts	Adds the Vite version guard and upgrade message.
packages/​plugins/​apps/​src/​vite/​vite-version.test.ts	Tests supported, unsupported, and missing versions.
packages/​plugins/​apps/​src/​vite/​vite-parse-ast.ts	Removes legacy CommonJS parser handling.
packages/​plugins/​apps/​src/​vite/​vite-parse-ast.test.ts	Updates parser fixtures and removes the legacy case.
packages/​plugins/​apps/​src/​vite/​network-guard.ts	Removes the Vite 5 plugin-container exemption.
packages/​plugins/​apps/​src/​vite/​network-guard.test.ts	Removes tests for the deleted exemption.
packages/​plugins/​apps/​src/​vite/​index.ts	Enforces the version floor and removes compatibility fallbacks.
packages/​plugins/​apps/​src/​vite/​index.test.ts	Tests version enforcement and removes Vite 5 coverage.
packages/​plugins/​apps/​src/​vite/​dev-server-module-graph.ts	Uses the SSR environment graph directly.
packages/​plugins/​apps/​src/​vite/​dev-server-module-graph.test.ts	Updates fixtures to include the SSR environment.
packages/​plugins/​apps/​README.md	Documents the Vite 7 minimum.

_{Review effort: Balanced}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 8cc274ce6b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Live Debugger Runtime Benchmark

SDK-loaded dormant-probe runtime overhead, measured against an uninstrumented bundle in the same browser session.

Browser	Workload	Quality	Per-call overhead upper
chrome	Hot	clean	<= 2.80 ns
chrome	Tiny	clean	<= 0.03 ns
firefox	Hot	clean	<= 6.22 ns
firefox	Tiny	clean	<= 0.23 ns
safari	Hot	clean	<= 4.62 ns
safari	Tiny	clean	<= 0.03 ns

What do the Tiny and Hot workloads represent?

Browser Debugger SDK: 7.16.2 · built 2026-10-27 · S3 ETag 872de873

Full diagnostics

browser  workload  quality  per-call overhead upper  overhead upper          95% CI        A/A diag        block CI  acf(1)   baseline  instrumented                         samples
-------  --------  -------  -----------------------  --------------  --------------  --------------  --------------  ------  ---------  ------------  ------------------------------
chrome   Hot       clean                 <= 2.80 ns        <= 7.48%   2.59..2.78 ns   0.03..0.21 ns   2.57..2.80 ns    0.02  50.663 ms     54.365 ms   102 (trim 20%, outliers 7.8%)
chrome   Tiny      clean                 <= 0.03 ns        <= 0.67%  -0.01..0.03 ns  -0.02..0.02 ns  -0.02..0.03 ns    0.27  47.758 ms     47.770 ms  102 (trim 20%, outliers 10.8%)
firefox  Hot       clean                 <= 6.22 ns       <= 32.48%   6.14..6.22 ns  -0.04..0.05 ns   6.14..6.22 ns    0.31  40.680 ms     53.880 ms   102 (trim 20%, outliers 2.0%)
firefox  Tiny      clean                 <= 0.23 ns        <= 2.47%   0.19..0.23 ns  -0.02..0.02 ns   0.19..0.23 ns    0.03  52.150 ms     53.260 ms   102 (trim 20%, outliers 3.9%)
safari   Hot       clean                 <= 4.62 ns       <= 24.45%   4.54..4.62 ns  -0.09..0.00 ns   4.55..4.61 ns   -0.00  43.600 ms     54.200 ms   102 (trim 20%, outliers 2.9%)
safari   Tiny      clean                 <= 0.03 ns        <= 1.15%   0.02..0.03 ns  -0.00..0.01 ns   0.02..0.03 ns   -0.02  54.420 ms     55.050 ms   102 (trim 20%, outliers 3.9%)

Raw samples are in the live-debugger-runtime-bench-results artifact.