build(deps): bump undici, @cloudflare/vitest-pool-workers, wrangler and @cloudflare/vite-plugin

[dependabot]

Bumps undici to 7.29.0 and updates ancestor dependencies undici, @cloudflare/vitest-pool-workers, wrangler and @cloudflare/vite-plugin. These dependencies need to be updated together.

Updates undici from 7.28.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Updates @cloudflare/vitest-pool-workers from 0.16.20 to 0.22.0

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.22.0

Minor Changes

• #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

  @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

  If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

• #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

• #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

  When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

• #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

  inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

• #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

• #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

  When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

  The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

• Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

  • wrangler@4.124.0
  • miniflare@5.20260815.0-alpha

@​cloudflare/vitest-pool-workers@​0.21.3

Patch Changes

• Updated dependencies [b8fd112, f0f2054, 339509d]:
  • miniflare@5.20260811.1-alpha
  • wrangler@4.123.0

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.22.0

Minor Changes

• #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

  @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

  If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

• #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

• #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

  When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

• #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

  inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

• #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

• #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

  When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

  The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

• Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

  • wrangler@4.124.0
  • miniflare@5.20260815.0-alpha

0.21.3

Patch Changes

• Updated dependencies [b8fd112, f0f2054, 339509d]:
  • miniflare@5.20260811.1-alpha
  • wrangler@4.123.0

0.21.2

Patch Changes

• #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

  Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

... (truncated)

Commits

• 8ee43f6 Version Packages (#15175)
• 3ddd3ce Fix module resolution for relative require() inside CJS deps when the proje...
• 1f79ace Use a fixed default compatibility date derived from the pinned workerd (#15185)
• 2cf3143 [vitest-pool-workers] Restore typed inject() keys (#15150)
• 49d4e00 [vitest-pool-workers] Adopt @​msw/cloudflare and remove MSW workarounds (#13830)
• c576a82 Version Packages (#15154)
• e5d56e9 Version Packages (#15145)
• d0c976c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
• 90dd5e5 chore: bump capnp-es to 0.0.15 (#15131)
• 15fc568 Version Packages (#15118)
• Additional commits viewable in compare view

Updates wrangler from 4.115.0 to 4.124.0

Release notes

Sourced from wrangler's releases.

wrangler@4.124.0

Minor Changes

• #15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

  A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

  {
    "name": "my-worker",
    "main": "worker.js",
    "compatibility_date": "2026-07-01",
    "containers": [
      { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
    ],
    "exports": {
      "MyContainerDO": {
        "type": "durable-object",
        "storage": "sqlite",
        "container": "my-container"
      }
    }
  }

  The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

  container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

  • a container reference names a container that does not exist
  • two Durable Object exports claim the same container
  • a container and a Durable Object export disagree about which one they are linked to
  • a container ends up linked to no Durable Object at all
  • two containers share a name
  • a container's class_name names a Durable Object whose storage is legacy-kv
  • two containers are attached to the same Durable Object

  That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

• #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

• #14999 ba54f0d Thanks @​mittalpk! - Fix .env loading on Windows leaking stale, differently-cased duplicate keys

  On Windows, wrangler loads .env values through a case-insensitive Proxy wrapper so lookups like env.PATH and env.Path resolve to the same value, and this object is assigned directly to process.env. When a key was set again under a different casing (e.g. a value in .env.local overriding one from .env with different casing), the previous casing was never removed from the underlying object. env.PATH/env.Path still returned the correct, latest value, but anything that enumerates process.env — Object.keys, for...in, JSON.stringify, object spread, or a spawned subprocess inheriting the environment — would see both the stale and current key.

  Duplicate entries no longer appear, so environment variables passed to subprocesses and any code that lists the environment now see only the latest value for each variable.

• #15044 b7422b0 Thanks @​stareezy-1! - Normalize structural CRLF line endings before sending D1 commands to the remote query API

... (truncated)

Commits

• 8ee43f6 Version Packages (#15175)
• f431166 Prevent date-enabled Node.js compatibility from adding conflicting globals to...
• 1552bce [wrangler] Quieten warnings and stray output in tests (#15209)
• bc5726b Pass access.dev through to Miniflare via `unstable_getMiniflareWorkerOptions(...
• e967c39 [wrangler] Skip container deploy e2e tests on non-Linux CI (#15233)
• 265256a WC-5744 [previews] fix: wrangler preview base-config flag inheritance (#15153)
• 75cf407 [wrangler] Enable new config for cf dev (#15082)
• 8fb2b87 [wrangler] Use FedRAMP container registries (#15196)
• ba54f0d [wrangler] Fix case-insensitive-env leaking stale duplicate keys on override ...
• 7cee278 [wrangler] Let CLOUDFLARE_ACCOUNT_ID override the cached account id in pages ...
• Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.48.0 to 1.54.4

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.54.4

Patch Changes

• #15407 7662118 Thanks @​xgame92! - Surface Worker export type fetch errors during development

  The Vite plugin now reports the Worker name, HTTP status, and response body when fetching export types fails. This preserves the underlying error instead of replacing it with a JSON parsing error.

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6, 93d72a5, f6fb347, f6fb347, dc24057, d2d8eea]:

  • miniflare@5.20260903.0-alpha
  • wrangler@4.129.0

@​cloudflare/vite-plugin@​1.54.3

Patch Changes

• Updated dependencies [dbbb795, 200780f, b3f2628, 87a7acf, 1809c5e, ea28cc3, b3fb2bf, 707cb6f]:
  • wrangler@4.128.0
  • miniflare@5.20260831.0-alpha

@​cloudflare/vite-plugin@​1.54.2

Patch Changes

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:
  • miniflare@5.20260828.0-alpha
  • wrangler@4.127.1

@​cloudflare/vite-plugin@​1.54.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

@​cloudflare/vite-plugin@​1.54.0

Minor Changes

• #15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

  Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

• #15326 9fcb1c9 Thanks @​jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

  The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.

Patch Changes

• Updated dependencies [aa54b49, 4a67a28, 2d78137, 04e8564, d1cc3af, 693ca29, 693ca29, 693ca29, daefb3c, 37ed753, f76b68e, ad89456, c809851, c66d2d5, 693ca29, 74de3ab, 0cb8690, 9fcb1c9, 22182da, a4c3458, 433fa98, d589d30, dd5148d, 82d11fc]:
  • miniflare@5.20260825.0-alpha
  • wrangler@4.126.0

@​cloudflare/vite-plugin@​1.53.1

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.54.4

Patch Changes

• #15407 7662118 Thanks @​xgame92! - Surface Worker export type fetch errors during development

  The Vite plugin now reports the Worker name, HTTP status, and response body when fetching export types fails. This preserves the underlying error instead of replacing it with a JSON parsing error.

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6, 93d72a5, f6fb347, f6fb347, dc24057, d2d8eea]:

  • miniflare@5.20260903.0-alpha
  • wrangler@4.129.0

1.54.3

Patch Changes

• Updated dependencies [dbbb795, 200780f, b3f2628, 87a7acf, 1809c5e, ea28cc3, b3fb2bf, 707cb6f]:
  • wrangler@4.128.0
  • miniflare@5.20260831.0-alpha

1.54.2

Patch Changes

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:
  • miniflare@5.20260828.0-alpha
  • wrangler@4.127.1

1.54.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

1.54.0

Minor Changes

• #15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

  Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

• #15326 9fcb1c9 Thanks @​jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

  The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.

Patch Changes

... (truncated)

Commits

• be87ff0 Version Packages (#15461)
• 7662118 [vite-plugin-cloudflare] Surface export type fetch errors (#15407)
• b7b4ff8 Version Packages (#15450)
• 10d6bfb Support partial manifests in build output (#15388)
• dbbb795 Move binding utilities into workers-utils (#15454)
• f808554 Version Packages (#15385)
• a831498 Version Packages (#15372)
• e9df120 Support multiple named Workers in the build output (#15371)
• 5377aae Version Packages (#15354)
• e56d2e6 Revert "Version Packages" (#15355)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

[changeset-bot]

⚠️ No Changeset found

Latest commit: adaf260

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@cloudflare/computer@131

commit: adaf260

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.