Cloudflare Now Owns Astro and Vite. If Your Frontend Runs on Either, Your Whole Toolchain Has One Landlord.
On June 4, Cloudflare acquired VoidZero, the company Evan You spun up to build a unified JavaScript toolchain. VoidZero is the home of Vite, Vitest, the Rolldown bundler, the Oxc/Oxlint Rust tooling, and Vite+, the new single-entry-point toolchain. Vite alone sits under something like 130 million weekly downloads' worth of the frontend ecosystem. Cloudflare also acquired Astro back in January. So as of two weeks ago, one company owns both a major framework and the build tool that a large share of the JavaScript world (including a lot of frameworks that aren't Astro) depends on.
If you build for the web, there's a real chance two separate layers of your stack now report to the same place. That's worth thinking about clearly, without the doom that usually attaches to acquisition news.
What Cloudflare actually bought
This wasn't a logo grab. VoidZero is the connective tissue of modern frontend builds. Vite is the dev server and build tool a huge fraction of projects run, directly or through a framework. Vitest is the test runner that ships with most of them. Rolldown is the Rust bundler meant to replace the JavaScript-based internals. Oxc is the Rust-based linter/parser stack underneath. Vite+ ties all of it into one binary (vp dev, vp test, vp build) managing your runtime, package manager, and toolchain from a single entry point.
Add Astro, which Cloudflare already owned, and the picture is a single company sitting on both a framework people choose and the build infrastructure that framework (and Next, SvelteKit, SolidStart, and most of the rest) quietly runs on. Cloudflare didn't buy a competitor to Vercel's framework. It bought the floor a lot of the room is standing on.
"Still MIT" is necessary, not sufficient
Cloudflare and VoidZero made the expected pledge: Vite, Vitest, Rolldown, Oxc, and Vite+ stay strictly open source under MIT, with a nod toward vendor neutrality. Good. That pledge matters and I take it at face value for the code that exists today. An MIT license you've already downloaded can't be revoked, and if Cloudflare ever did something hostile, the community could fork from the last open commit.
But "open source" answers the wrong question. The license protects you from the rug-pull scenario: the sudden relicense, the paywalled core. It does not protect you from the slower, more likely thing: roadmap capture. The owner of a toolchain decides what gets built first, which integrations are first-class, what the defaults are, and where the "just works" path leads. When the company steering Vite also sells an edge platform, the gravity of every default points somewhere specific over time. Nothing has to be locked. It just has to be easiest. The path of least resistance is a product strategy, and you rarely notice you're on it.
This is the same pattern as the Astro acquisition, and the honest thing to say is that nothing bad has visibly happened there. The framework kept shipping, Cloudflare didn't wreck it, the deploy story got tighter. That's the realistic base case here too: it's fine, maybe even good in the short run. Faster Rust toolchain, one less thing to wire up, a well-funded owner keeping the lights on. The risk isn't a betrayal next quarter. It's that two layers of your stack now share an owner whose incentives aren't identical to yours, and that's a structural fact regardless of how nice the current stewards are.
The actual exposure for a solo dev
Be precise about what you're exposed to, because "one company owns my tools" sounds worse than it is.
You are not exposed to losing Vite. The code is out, the community is enormous, and a fork is always available. You are not meaningfully exposed to a near-term price shock on the open-source tooling itself. What you are exposed to is concentration: a future where your framework, your build tool, your test runner, and your host all nudge toward the same vendor, and the "default" architecture quietly assumes that vendor's edge, that vendor's storage, that vendor's KV. Individually each nudge is convenient. Stacked, they're a stack you didn't deliberately choose.
The mitigation is not to abandon Vite. That would be reacting to a risk that hasn't materialized by paying a cost that's certain. The mitigation is to keep your build portable. Know that you can produce a plain static or Node output and deploy it somewhere that isn't Cloudflare without a rewrite. Don't adopt the deepest first-party integration just because it's frictionless. Keep your exit cheap, so that if the gravity ever does point somewhere you don't want to go, leaving costs you a weekend instead of a quarter.
What I'd actually do
If you're on Vite or Astro today, stay. Keep upgrading. Enjoy the faster Rust toolchain and the fact that a serious company is funding tools you rely on for free. This is not a switch-now situation, and bailing to some less-popular toolchain to avoid a hypothetical is a worse trade than the one you're worried about.
But do two cheap things. First, run the ownership audit on your own stack: list your framework, build tool, test runner, host, and storage, and notice how many now trace back to Cloudflare. That number is your concentration, and you should at least know it. Second, prove your exit once: build a deployable artifact that runs off Cloudflare, even if you never ship it there. If that works, you've converted "we're locked in" from a fear into a fact you've checked, and you can use the convenient defaults with your eyes open instead of by accident.
Cloudflare owning Astro and Vite isn't a crisis. It's a consolidation, and consolidation is fine right up until the day your priorities and your landlord's stop matching. Know who your landlord is. Keep a key to a different door. Then go ship.
Author
Lukas
@lukcombinator