Skip to content

chore(deps): update cloudflare#9

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cloudflare
Open

chore(deps): update cloudflare#9
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/cloudflare

Conversation

@renovate

@renovate renovate Bot commented Apr 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/vitest-pool-workers (source) ^0.13.1 → ^0.18.8 age confidence
@cloudflare/workers-types ^4.20260317.1 → ^4.20260702.1 age confidence

Release Notes

cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.18.8

Compare Source

Patch Changes

v0.18.7

Compare Source

Patch Changes

  • #​14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

  • #​14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

  • #​14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

  • #​14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

    The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

    These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

  • Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

    • miniflare@​4.20260721.0
    • wrangler@​4.113.0

v0.18.6

Compare Source

Patch Changes

v0.18.5

Compare Source

Patch Changes

v0.18.4

Compare Source

Patch Changes

  • #​14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

    A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.

    await step.do(
  "call flaky API",
  {
    retries: {
      limit: 5,
      backoff: "constant",
      delay: ({ ctx }) => ctx.attempt * 1000,
    },
  },
  async () => {
    /* ... */
  }
);

    The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

  • Updated dependencies [0283a1f, 7b28392, 1b965c5]:

    • wrangler@​4.110.0
    • miniflare@​4.20260708.1

v0.18.3

Compare Source

Patch Changes

  • #​14489 e3f0cd6 Thanks @​edmundhung! - Add listDurableObjectIds() to Miniflare

    Miniflare now exposes listDurableObjectIds() for listing persisted Durable Object instance IDs by binding name. The Vitest pool now uses this shared Miniflare API internally instead of duplicating Miniflare's storage listing logic.

  • Updated dependencies [e3f0cd6, 8511ddf, 9f74a5f, e3f0cd6, c782e2a, 2fedb1f, 17d2fc1]:

    • miniflare@​4.20260708.0
    • wrangler@​4.109.0

v0.18.2

Compare Source

Patch Changes

v0.18.1

Compare Source

Patch Changes

v0.18.0

Compare Source

Minor Changes

  • #​14382 fd92d56 Thanks @​petebacondarwin! - Add support for declarative Durable Object exports

    wrangler deploy now accepts an exports map in wrangler.json as a declarative alternative to the legacy migrations array.

    Each entry in exports is keyed by Durable Object class name. type carries the export kind (currently always "durable-object"); the state field carries the lifecycle and defaults to "created" (live) when omitted:

    {
  "exports": {
    // Provision a new Durable Object class (`MyDO`)
    "MyDO": { "type": "durable-object", "storage": "sqlite" },
    // Delete Durable Object class (`OldGone`)
    "OldGone": { "type": "durable-object", "state": "deleted" },
    // Rename a Durable Object class (from `OldName` to `NewName`)
    "OldName": {
      "type": "durable-object",
      "state": "renamed",
      "renamed_to": "NewName"
    },
    "NewName": { "type": "durable-object", "storage": "sqlite" },
    // Transfer a Durable Object (`Outgoing`) to a new Worker (`target-worker`)
    "Outgoing": {
      "type": "durable-object",
      "state": "transferred",
      "transferred_to": "target-worker"
    },
    // Prepare to receive the transfer of a Durable Object (`Incoming`) from another Worker (`source-worker`)
    "Incoming": {
      "type": "durable-object",
      "state": "expecting-transfer",
      "storage": "sqlite",
      "transfer_from": "source-worker"
    }
  }
}

    When a Worker declares Durable Object class bindings but no lifecycle for them (neither a migrations array nor an exports map), wrangler warns and now suggests a declarative exports entry for each class (previously it suggested a legacy migrations block).

    The deployment response now surfaces the server's reconciliation result — created namespaces, applied tombstones, structured per-scenario info entries, and a removable_entries hint for stale tombstones that are safe to delete from the config. Blocking errors return the structured per-class detail with scenario tags, suggested remediation, and any referencing-script context.

    wrangler versions upload also forwards exports. Declarative exports lifecycle changes are reconciled when the version is deployed (wrangler versions deploy or wrangler deploy), so a versions upload payload can declare new classes in exports without immediately provisioning them. An actor binding (durable_objects.bindings) to a class declared only in exports on the same versions upload is rejected with a clear error (code 100406) — the binding cannot be resolved until the namespace is provisioned. Either stage the new class via ctx.exports.X (no binding required) on versions upload and add the binding at deploy time, or use wrangler deploy to provision and bind in one step (the same constraint applies to the migrations flow).

    Multi-version deploys (wrangler versions deploy A@50% B@50%) where the selected versions disagree on declarative exports are rejected server-side with a clear message: deploy the version that changes exports at 100% first, then run the percentage-split deploy. This prevents traffic on one branch routing to code that references unprovisioned or just-deleted DO namespaces. Single-version (100%) deploys are unaffected.

    Local development (wrangler dev, vite dev and unstable_startWorker) reads Durable Object SQLite storage settings from the new exports field, so applications using the declarative flow get correct local-dev storage without needing to also declare a migrations block.

    @cloudflare/vitest-pool-workers also picks up Durable Object configuration from exports, so tests against an exports-only Worker run with the correct local SQLite storage and can reach unbound Durable Object classes via ctx.exports.X.

    wrangler types is also aware of exports. Live entries (including expecting-transfer, the receiving side of a two-phase transfer) are added to Cloudflare.GlobalProps.durableNamespaces, which types ctx.exports.X for unbound Durable Objects declared only via exports.

Patch Changes

v0.17.0

Compare Source

Minor Changes

  • #​14490 75d8cb0 Thanks @​petebacondarwin! - Make Workflow introspector get() async

    The introspectWorkflow(...).get() method now returns a promise, so callers must await it:

    const introspector = await introspectWorkflow(env.MY_WORKFLOW);

// Before
const instances = introspector.get();

// After
const instances = await introspector.get();

    This aligns Workflow introspection with the shared implementation used by createTestHarness().

Patch Changes

  • #​14490 75d8cb0 Thanks @​petebacondarwin! - Support require("./x.wasm?module") in CommonJS dependencies

    Previously, only literal await import("./x.wasm?module") specifiers were rewritten through the static analysis path added in #​11094. CommonJS dependencies that use require("./x.wasm?module") reach the module-fallback service at runtime, where the ?module suffix went unhandled. The fallback either failed with No such module "<abs>/x.wasm?module" or, when a CompiledWasm rule was configured, attempted to evaluate the WebAssembly bytes as JavaScript.

    However, these require()s work in deployed workers because esbuild's bundler statically rewrites these require() calls into ES dynamic imports. vitest-pool-workers' Vite-based pipeline doesn't do that rewrite and instead defers to the module-fallback at runtime.

    The module-fallback now strips ?module from the resolved target and synthesizes a CommonJS wrapper that re-requires the underlying .wasm by absolute path, exposing it on default to match what workerd produces for CompiledWasm modules.

  • Updated dependencies [75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, f10d4ad, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, d292046, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, e0cc2cb, 75d8cb0, 75d8cb0, 75d8cb0]:

    • wrangler@​4.106.0
    • miniflare@​4.20260630.0

v0.16.20

Compare Source

Patch Changes

  • #​14398 c5014cc Thanks @​apeacock1991! - Add evictDurableObject and evictAllDurableObjects test helpers to cloudflare:test

    These helpers let you exercise how a Durable Object behaves across evictions in your tests. Eviction is graceful: durable storage is preserved, in-memory state is reset by tearing down the instance, hibernatable WebSockets are hibernated rather than closed, and eviction waits for in-flight requests to drain.

    import { evictDurableObject, evictAllDurableObjects } from "cloudflare:test";
import { env } from "cloudflare:workers";

const id = env.COUNTER.idFromName("my-counter");
const stub = env.COUNTER.get(id);

// Evict the Durable Object instance pointed to by a specific stub
await evictDurableObject(stub);
await evictDurableObject(stub, { webSockets: "close" });

// Evict all currently-running Durable Objects in evictable namespaces
await evictAllDurableObjects();

  • #​14394 8a5cf8c Thanks @​Partha-Shankar! - fix(d1): escape migrationsTableName and filenames in SQLite queries

    D1 migration commands in both wrangler and @cloudflare/vitest-pool-workers interpolated the migrationsTableName config value and migration filenames directly into SQL strings without any escaping. This meant:

    • A table name such as my"table would produce invalid SQL in CREATE TABLE, SELECT, and INSERT statements, and
    • A migration filename containing an apostrophe (e.g. what's-new.sql) would break the INSERT INTO ... VALUES ('...') statement appended after each migration in wrangler.

    Both identifiers are now properly escaped before interpolation: migrationsTableName is wrapped in double-quotes with internal double-quotes doubled (SQL-standard identifier quoting), and migration filenames used as string literals have their single-quotes doubled before insertion.

  • Updated dependencies [5f40dd5, 34e0cef, 3b743c1, daa5389, 8a5cf8c]:

    • wrangler@​4.105.0
    • miniflare@​4.20260625.0

v0.16.19

Compare Source

Patch Changes

v0.16.18

Compare Source

Patch Changes

v0.16.17

Compare Source

Patch Changes

v0.16.16

Compare Source

Patch Changes

v0.16.15

Compare Source

Patch Changes

v0.16.14

Compare Source

Patch Changes

v0.16.13

Compare Source

Patch Changes

v0.16.12

Compare Source

Patch Changes

  • #​14152 3d7992e Thanks @​petebacondarwin! - Fix module resolution failing when project path contains spaces

    When a project lived under a directory with spaces (e.g. /Users/me/Documents/Master CMS/project), the vitest pool would fail with No such module "threads.js" before any test executed. The module fallback service now uses the rawSpecifier from workerd's fallback request to correctly decode file:// URLs, avoiding the double-encoding of spaces (%20 → %2520) that occurred when workerd resolved these URLs as relative paths.

  • #​14105 337e912 Thanks @​dario-piotrowicz! - Remove trailing periods from URLs in terminal output

    URLs printed to the terminal with a sentence-ending period (e.g. https://example.com/path.) would include the period when clicked in some terminal emulators, causing 404 errors. This removes trailing periods from all URLs displayed in CLI output across wrangler, miniflare, vitest-pool-workers, and workers-utils.

  • #​14112 3a746ac Thanks @​penalosa! - Pin non-bundled runtime dependencies to exact versions

    Dependencies that are not bundled into a package's published output are installed directly into consumers' dependency trees, so they are now pinned to exact versions instead of semver ranges. This closes a supply-chain gap where an unpinned external dependency could resolve to a compromised upstream release on a fresh install. A new pnpm check:pinned-deps lint enforces this for all published packages (and for the shared pnpm catalog) going forward.

  • #​14061 da8e306 Thanks @​Vardiak! - Preserve Durable Object WebSocket handler invocation order

    Durable Object WebSocket events could begin executing out of order in the Workers Vitest integration when several events arrived while the test wrapper was resolving user code.

    Handler invocation now preserves arrival order while still allowing asynchronous handler completion to run concurrently.

  • Updated dependencies [b210c5e, aec1bb8, e06cbb7, 9a26191, 5565823, 4ef790b, 890fca7, 6fc9777, 337e912, 8e7b74f, e86489a, 42288d4, 65b5f9e, 3a746ac, 64ef9fd, 94b29f7]:

    • wrangler@​4.97.0
    • miniflare@​4.20260601.0

v0.16.11

Compare Source

Patch Changes

v0.16.10

Compare Source

Patch Changes

v0.16.9

Compare Source

Patch Changes

  • #​13933 90092c0 Thanks @​petebacondarwin! - Derive bundler externals from package.json and shrink the published bundle

    The bundler's external list was previously hand-maintained and out of sync with package.json — undici and semver were both listed as external despite being only devDependencies. The published dist/pool/index.mjs consequently contained a top-level import { fetch } from "undici" that was only resolvable because pnpm happened to hoist undici

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Apr 19, 2026
@renovate
renovate Bot force-pushed the renovate/cloudflare branch from 3be4e94 to a7b37db Compare April 20, 2026 15:28
@pkg-pr-new

pkg-pr-new Bot commented Apr 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/@kagal/acme@9

npm i https://pkg.pr.new/@kagal/ca@9

npm i https://pkg.pr.new/@kagal/ct@9

commit: be392a3

@renovate
renovate Bot force-pushed the renovate/cloudflare branch 4 times, most recently from 089bb05 to 6af78aa Compare April 26, 2026 21:19
@renovate
renovate Bot force-pushed the renovate/cloudflare branch 8 times, most recently from 5ef7fa8 to 914c748 Compare May 5, 2026 20:15
@renovate
renovate Bot force-pushed the renovate/cloudflare branch 7 times, most recently from 610f6d1 to 57d74d8 Compare May 12, 2026 11:43
@renovate
renovate Bot force-pushed the renovate/cloudflare branch 8 times, most recently from 907241e to 460dfdc Compare May 19, 2026 01:48
@renovate
renovate Bot force-pushed the renovate/cloudflare branch 9 times, most recently from c09258b to abe2551 Compare June 4, 2026 14:47
@renovate
renovate Bot force-pushed the renovate/cloudflare branch 5 times, most recently from 54ba801 to 5488588 Compare June 9, 2026 07:03
@socket-security

socket-security Bot commented Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​cloudflare/​workers-types@​4.20260317.1 ⏵ 4.20260702.1100 +1100100 +199 -1100

View full report

@renovate
renovate Bot force-pushed the renovate/cloudflare branch 8 times, most recently from d809724 to 60dc6a2 Compare June 16, 2026 02:55
@renovate
renovate Bot force-pushed the renovate/cloudflare branch 6 times, most recently from 3d94ec7 to 02608d4 Compare June 20, 2026 02:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants