Skip to content

chore(deps): update cloudflare#9

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cloudflare
Open

chore(deps): update cloudflare#9
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cloudflare

Conversation

@renovate

@renovate renovate Bot commented Apr 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/vitest-pool-workers (source) ^0.13.1 → ^0.16.15 age confidence
@cloudflare/workers-types ^4.20260317.1 → ^4.20260612.1 age confidence

Release Notes

cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.16.15

Compare Source

Patch Changes

v0.16.14

Compare Source

Patch Changes

v0.16.13

Compare Source

Patch Changes

v0.16.12

Compare Source

Patch Changes

  • #​14152 3d7992e Thanks @​petebacondarwin! - Fix module resolution failing when project path contains spaces

    When a project lived under a directory with spaces (e.g. /Users/me/Documents/Master CMS/project), the vitest pool would fail with No such module "threads.js" before any test executed. The module fallback service now uses the rawSpecifier from workerd's fallback request to correctly decode file:// URLs, avoiding the double-encoding of spaces (%20 → %2520) that occurred when workerd resolved these URLs as relative paths.

  • #​14105 337e912 Thanks @​dario-piotrowicz! - Remove trailing periods from URLs in terminal output

    URLs printed to the terminal with a sentence-ending period (e.g. https://example.com/path.) would include the period when clicked in some terminal emulators, causing 404 errors. This removes trailing periods from all URLs displayed in CLI output across wrangler, miniflare, vitest-pool-workers, and workers-utils.

  • #​14112 3a746ac Thanks @​penalosa! - Pin non-bundled runtime dependencies to exact versions

    Dependencies that are not bundled into a package's published output are installed directly into consumers' dependency trees, so they are now pinned to exact versions instead of semver ranges. This closes a supply-chain gap where an unpinned external dependency could resolve to a compromised upstream release on a fresh install. A new pnpm check:pinned-deps lint enforces this for all published packages (and for the shared pnpm catalog) going forward.

  • #​14061 da8e306 Thanks @​Vardiak! - Preserve Durable Object WebSocket handler invocation order

    Durable Object WebSocket events could begin executing out of order in the Workers Vitest integration when several events arrived while the test wrapper was resolving user code.

    Handler invocation now preserves arrival order while still allowing asynchronous handler completion to run concurrently.

  • Updated dependencies [b210c5e, aec1bb8, e06cbb7, 9a26191, 5565823, 4ef790b, 890fca7, 6fc9777, 337e912, 8e7b74f, e86489a, 42288d4, 65b5f9e, 3a746ac, 64ef9fd, 94b29f7]:

    • wrangler@​4.97.0
    • miniflare@​4.20260601.0

v0.16.11

Compare Source

Patch Changes

v0.16.10

Compare Source

Patch Changes

v0.16.9

Compare Source

Patch Changes

  • #​13933 90092c0 Thanks @​petebacondarwin! - Derive bundler externals from package.json and shrink the published bundle

    The bundler's external list was previously hand-maintained and out of sync with package.json — undici and semver were both listed as external despite being only devDependencies. The published dist/pool/index.mjs consequently contained a top-level import { fetch } from "undici" that was only resolvable because pnpm happened to hoist undici from other packages' devDependencies during local development.

    The bundler now derives its external list from dependencies + peerDependencies in package.json, making it impossible for a devDependency to silently end up externalized.

    Combined with the new "sideEffects": false declaration in @cloudflare/workers-utils, the unused cloudflared / tunnel exports (and their transitive undici import) are now tree-shaken out of the pool entirely. dist/pool/index.mjs no longer references undici at all, and shrinks from ~489 KB to ~125 KB.

  • Updated dependencies [52e9082, 0733688, fc1f7b9, 30657e1, 8c569c6, f598eac, 3a1fbed]:

    • wrangler@​4.94.0
    • miniflare@​4.20260521.0

v0.16.8

Compare Source

Patch Changes

  • #​13919 c7eab7f Thanks @​petebacondarwin! - Fix the outbound CF-Worker header reflecting the route pattern hostname instead of the parent zone, and falling back to <worker-name>.example.com under vite dev, vitest-pool-workers, and getPlatformProxy

    Two related issues affected the CF-Worker header on outbound subrequests in local development:

    1. Under @cloudflare/vite-plugin, @cloudflare/vitest-pool-workers, and getPlatformProxy, the header fell back to <worker-name>.example.com even when routes were configured, because unstable_getMiniflareWorkerOptions and the equivalent getPlatformProxy worker-options path did not propagate a zone value to Miniflare. This broke local development against services that reject unknown CF-Worker hosts (for example, Apple WeatherKit returns 403 Forbidden).
    2. Across the above paths and wrangler dev --local, when a route used the zone_name field (for example { pattern: "foo.example.com/*", zone_name: "example.com" }), the header was set to the pattern's hostname (foo.example.com) rather than the zone name (example.com). Production sets CF-Worker to the zone name that owns the Worker, so this was inconsistent with deployed behaviour.

    Both bugs are fixed: the new unstable_getMiniflareWorkerOptions / getPlatformProxy path now propagates a zone derived from the first configured route, and all four local-dev paths now prefer a route's explicit zone_name over the pattern hostname when computing that zone. When zone_name isn't set, the existing best-effort behaviour is preserved — for wrangler dev this means dev.host is still honoured as a local override and the pattern hostname is used as a final fallback. Resolving the parent zone for zone_id-only, custom_domain, or plain-string routes would require an API lookup, so locally we still approximate it with the pattern hostname.

    Note: dev.host is intentionally not consulted by the unstable_getMiniflareWorkerOptions / getPlatformProxy paths — the dev config block is specific to wrangler dev.

  • Updated dependencies [fa1f61f, 2679e05, 7e40d98, adc9221, 735852d, d803737, c7eab7f, e04e180, 59cd880, 62abf97, e8c2031, e349fe0, da0fa8c, a5c9365]:

    • miniflare@​4.20260520.0
    • wrangler@​4.93.1

v0.16.7

Compare Source

Patch Changes

v0.16.6

Compare Source

Patch Changes

  • #​13833 0e4a830 Thanks @​thegeekasteroid! - Filter benign disconnected: WebSocket peer disconnected workerd stderr noise during test runs.

    The ignoreMessages array in the pool already filters several benign workerd disconnect messages (e.g. disconnected: WebSocket was aborted). On recent workerd versions, tests that exercise the WebSocket API also surface disconnected: WebSocket peer disconnected warnings during normal teardown. These are not user-actionable and obscure real test failures. Add the message to the existing filter alongside the other disconnected: entries.

  • Updated dependencies [19ed49a, 3ff0a50, bf688f7, 2e72c83, 802eaf4, 506aa02, 8f5cdb1, be8a98c]:

    • miniflare@​4.20260515.0
    • wrangler@​4.92.0

v0.16.5

Compare Source

Patch Changes

v0.16.4

Compare Source

Patch Changes

v0.16.3

Compare Source

Patch Changes

v0.16.2

Compare Source

Patch Changes

v0.16.1

Compare Source

Patch Changes

v0.16.0

Compare Source

Minor Changes

  • #​13810 2b8c0cc Thanks @​jamesopstad! - Stabilize the secrets configuration property

    The secrets property in the Wrangler config file is no longer experimental and will no longer emit an experimental warning when used. Required secrets are validated during local development and deploy, and used as the source of truth for type generation.

    {
  "secrets": {
    "required": ["API_KEY", "DB_PASSWORD"]
  }
}
Patch Changes

  • #​12974 1127114 Thanks @​ask-bonk! - Rewrite self-referencing service bindings to kCurrentWorker before renaming the runner worker

    When a wrangler config has a service binding to itself (e.g. services: [{ binding: "SELF", service: "my-worker" }] where the worker is named "my-worker"), the binding's literal name pointed to a worker that no longer existed once vitest-pool-workers renamed the runner to vitest-pool-workers-runner-<project>. The self-reference is now rewritten to the miniflare kCurrentWorker symbol, which resolves at request time relative to the referer worker and so survives the rename. Previously this rewrite lived in wrangler's unstable_getMiniflareWorkerOptions, but it's only needed for vitest-pool-workers' rename — other consumers (getPlatformProxy, @cloudflare/vite-plugin) preserve the original worker name and so don't need it.

  • Updated dependencies [e07825a, 58899d8, 3020214, 0099265, 25f5ef2, bb27219, 194d75e, 12fb5db, 18b9d5b, 9f532f7, 1127114, 3ceadef, 2b8c0cc, 1a5cc86]:

    • wrangler@​4.88.0
    • miniflare@​4.20260504.0

v0.15.2

Compare Source

Patch Changes

v0.15.1

Compare Source

Patch Changes

v0.15.0

Compare Source

Minor Changes

  • #​13623 b156b2e Thanks @​penalosa! - Add reset() and abortAllDurableObjects() helpers to cloudflare:test

    The reset() helper deletes all data from attached bindings, and resets all Durable Object instances. This is useful for resetting state between test blocks.

    The abortAllDurableObjects() helper resets all Durable Object instances without deleting persisted data.

    import { reset } from "cloudflare:test";
import { afterEach } from "vitest";

afterEach(async () => {
  await reset();
});
Patch Changes

v0.14.9

Compare Source

Patch Changes

v0.14.8

Compare Source

Patch Changes

  • #​13548 1aee990 Thanks @​emily-shen! - Update warning message when attempting to access exports not defined on the main worker

    Previously this referred to the SELF worker, which is now a deprecated API in the Vitest integration.

  • #​13607 d5d0446 Thanks @​petebacondarwin! - fix: Restore workflow binding before async cleanup in WorkflowIntrospectorHandle.dispose()

    Previously, dispose() awaited all instance abort operations before restoring the original env binding. On slower CI environments (especially Windows), this left a window where the next test could see a stale proxy, causing "Trying to mock step multiple times" errors or failed introspection. The binding is now restored synchronously before the async instance cleanup begins.

  • #​13007 2c3258d Thanks @​sheplu! - Reduce default log verbosity from VERBOSE to INFO

    The pool logger was previously hardcoded to VERBOSE, causing noisy debug messages on every test run (e.g. [vpw:debug] Adding compatibility flag...). Only informational, warning, and error messages are now printed by default.

    For debugging, set NODE_DEBUG=vitest-pool-workers to restore the detailed output.

  • Updated dependencies [05f4443, 4a9ba90, d8c895a, b35617b, 7dc0433, 8ca78bb, b6e1351, d8314c6, b35617b, 7f50300, 4fda685, be5e6a0, e456952, 59eec63, 50bf819, cc1413a, d0a9d1c, 4eb1da9, 8ca78bb, 266c418, 6d887db, 5716d69]:

    • wrangler@​4.84.0
    • miniflare@​4.20260420.0

v0.14.7

Compare Source

Patch Changes

v0.14.6

Compare Source

Patch Changes
  • Updated dependencies [9b2b6ba]:
    • wrangler@​4.82.2

v0.14.5

Compare Source

Patch Changes

v0.14.4

Compare Source

Patch Changes

v0.14.3

Compare Source

Patch Changes

v0.14.2

Compare Source

Patch Changes

  • #​13095 65e6684 Thanks @​penalosa! - Reject V8 coverage provider with a clear error message

    V8 native code coverage (`@vitest/coverage

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Apr 19, 2026
@renovate renovate Bot force-pushed the renovate/cloudflare branch from 3be4e94 to a7b37db Compare April 20, 2026 15:28
@pkg-pr-new

pkg-pr-new Bot commented Apr 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@kagal/acme@9

npm i https://pkg.pr.new/@kagal/ca@9

npm i https://pkg.pr.new/@kagal/ct@9

commit: 0b581d1

@renovate renovate Bot force-pushed the renovate/cloudflare branch 4 times, most recently from 089bb05 to 6af78aa Compare April 26, 2026 21:19
@renovate renovate Bot force-pushed the renovate/cloudflare branch 8 times, most recently from 5ef7fa8 to 914c748 Compare May 5, 2026 20:15
@renovate renovate Bot force-pushed the renovate/cloudflare branch 7 times, most recently from 610f6d1 to 57d74d8 Compare May 12, 2026 11:43
@renovate renovate Bot force-pushed the renovate/cloudflare branch 8 times, most recently from 907241e to 460dfdc Compare May 19, 2026 01:48
@renovate renovate Bot force-pushed the renovate/cloudflare branch 10 times, most recently from cb1f37c to dae89f1 Compare May 29, 2026 04:31
@renovate renovate Bot force-pushed the renovate/cloudflare branch 9 times, most recently from abe2551 to f3a2c64 Compare June 5, 2026 05:37
@renovate renovate Bot force-pushed the renovate/cloudflare branch 4 times, most recently from 54ba801 to 5488588 Compare June 9, 2026 07:03
@socket-security

socket-security Bot commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​cloudflare/​vitest-pool-workers@​0.16.159910077100100
Added@​cloudflare/​workers-types@​4.20260612.1100100100100100

View full report

@renovate renovate Bot force-pushed the renovate/cloudflare branch 4 times, most recently from f6fadc0 to 77dbee3 Compare June 11, 2026 21:09
@renovate renovate Bot force-pushed the renovate/cloudflare branch from 77dbee3 to 0b581d1 Compare June 12, 2026 03:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants