Cloudflare Worker Secrets `.dev.vars` are being bundled.

[JarnoLeConte]

I'm using React Router as a...

framework

Reproduction

1. Create a new project with React Router Cloudflare D1 template
2. Create a .dev.vars file in the root of the project
3. Build the project

npx create-react-router@latest --template remix-run/react-router-templates/cloudflare-d1
cd my-react-router-app
npm i
echo "SECRET=default" > .dev.vars
npm run build

⚠️ Result

The build folder now contains a file ./server/.dev.vars:

Multi environments

The same problem occurs when you are working with different Cloudflare environments configured in wrangler.jsonc, but then the behaviour differs slightly.

ℹ️ How to reproduce with multiple environments?

1. Create a new project with React Router Cloudflare D1 template
2. Create a .dev.vars file in the root of the project to store development variables/secrets.
3. Create a .dev.vars.staging file to store staging variables/secrets.
4. Create a file named .env.staging with content CLOUDFLARE_ENV=staging to instruct Vite to use the right Cloudflare environment.
5. Build the project with Vite in mode 'staging'

npx create-react-router@latest --template remix-run/react-router-templates/cloudflare-d1
cd my-react-router-app
npm i
echo "SECRET=default" > .dev.vars
echo "SECRET=staging" > .dev.vars.staging
echo "CLOUDFLARE_ENV=staging" > .env.staging
npm run build -- --mode=staging

⚠️ Result

Again, the build folder now contains a file named ./server/.dev.vars (same as before), but now with the staging secrets:

System Info

System:
    OS: macOS 15.5
    CPU: (10) arm64 Apple M1 Pro
    Memory: 209.05 MB / 32.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 20.11.0 - ~/.nvm/versions/node/v20.11.0/bin/node
    npm: 10.2.4 - ~/.nvm/versions/node/v20.11.0/bin/npm
  Browsers:
    Chrome: 136.0.7103.114
    Safari: 18.5
  npmPackages:
    @react-router/dev: ^7.5.3 => 7.6.0 
    react-router: ^7.5.3 => 7.6.0 
    vite: ^6.3.3 => 6.3.5

Used Package Manager

npm

Expected Behavior

I'm not expecting the contents of .dev.vars and .dev.vars.{environment} to be included in server bundle, because it's meant to store secrets, see Cloudflare Documentation. This behaviour has changed compared to remix where the file did not end up in the build output.

Actual Behavior

Cloudflare Worker Secrets defined in .dev.vars or .dev.vars.{environment} are being bundled to ./build/server/.dev.vars

[JarnoLeConte]

On second thought, maybe it's not a big deal that the file lives in the build folder.
I was expecting that all files in de build folder were being uploaded to Cloudflare, but that doesn't seem to be the case.

I guess that the file is listed there to make local development work, so wrangler can start the application from there and use the .env.dev variables.

The main reason I got confused is because when I'm deploying to staging, by running npx run build -- --mode staging, a build was created where the output contains a file .dev.vars containing my development variables. I don't have a specific .env.vars.staging file because secrets for staging/production are managed through wrangler CLI, but therefore Vite falls back to .dev.vars to build the project, that is why my development variables end up in the staging build. This is still unintentional I guess, but they aren't uploaded to Cloudflare though.