Skip to content

build(deps): bump undici, @cloudflare/vitest-pool-workers and wrangler in /nightlies-serving - #93

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nightlies-serving/multi-61bf93dc59
Open

build(deps): bump undici, @cloudflare/vitest-pool-workers and wrangler in /nightlies-serving#93
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nightlies-serving/multi-61bf93dc59

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor

Bumps undici to 7.29.0 and updates ancestor dependencies undici, @cloudflare/vitest-pool-workers and wrangler. These dependencies need to be updated together.

Updates undici from 7.28.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits
  • 9e38fc1 Bumped v7.29.0 (#5590)
  • d887e34 fix: validate coerced header values for CRLF (#5579)
  • 33928bc fix: validate blob body content type
  • 98011a8 fix(cache): harden cache directive parsing
  • 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
  • 1b5a531 fix(retry): reject partial content length mismatch
  • 466e99d test: cover crash on mixed unqualified and qualified private cache directives
  • 9f10f1e fix: handle empty qualified private cache directive
  • 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
  • See full diff in compare view

Updates @cloudflare/vitest-pool-workers from 0.19.0 to 0.21.0

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.21.0

Minor Changes

  • #14994 2194f88 Thanks @​emily-shen! - Update the Workers Vitest pool for Miniflare's config-based options

    The Workers Vitest pool now converts the Miniflare options it creates for test sessions to Miniflare's config-based workers shape.

    For the most part, users should not expect to notice any changes.

However, auxiliary workers declared in miniflare.workers that rely on relative local imports now need those imported modules to be declared explicitly in the migrated module manifest.

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.3

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.2

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.1

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.0

Minor Changes

  • #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

    • wrappedBindings
    • cacheWarnUsage
    • fetchMock: you should use outboundService instead
    • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.21.0

Minor Changes

  • #14994 2194f88 Thanks @​emily-shen! - Update the Workers Vitest pool for Miniflare's config-based options

    The Workers Vitest pool now converts the Miniflare options it creates for test sessions to Miniflare's config-based workers shape.

    For the most part, users should not expect to notice any changes.

    However, while miniflare.modulesRules is preserved for common text and WASM fixture imports, it is not a full replacement for Miniflare's old modules: true module graph collection and you may notice some differences in behaviour.

Patch Changes

0.20.3

Patch Changes

0.20.2

Patch Changes

0.20.1

Patch Changes

0.20.0

Minor Changes

  • #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

... (truncated)

Commits

Updates wrangler from 4.115.0 to 4.120.1

Release notes

Sourced from wrangler's releases.

wrangler@4.120.1

Patch Changes

wrangler@4.120.0

Minor Changes

  • #15008 35c87e9 Thanks @​skepticfx! - Adds the ability to find container instances by exact ID or name

    wrangler containers instances <application_id> --search <instance_id_or_name> now searches every page and returns exact matches in human-readable or JSON output. JSON returns a top-level array, including an empty array when there is no match, while human-readable output prints a no-match message. If multiple instances have the same exact name, every matching instance is returned.

  • #15008 35c87e9 Thanks @​skepticfx! - Add explicit pagination to container instance JSON output

    Use wrangler containers instances <application_id> --json --per-page <size> to return one page with machine-readable result_info, then pass its next_page_token to --page-token to retrieve the next page. Plain --json remains backward-compatible: it requests the complete list and returns the existing top-level array.

Patch Changes

  • #15013 8cf78c8 Thanks @​dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0

  • #15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture

    Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.

    Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.

    The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.

  • Updated dependencies [b4f0c97, 8cf78c8, a60ff4d, 99eb50c]:

wrangler@4.119.0

Minor Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump undici, @cloudflare/vitest-pool-workers and wrangler
bc76a96 
Bumps [undici](https://github.com/nodejs/undici) to 7.29.0 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). These dependencies need to be updated together.


Updates `undici` from 7.28.0 to 7.29.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.28.0...v7.29.0)

Updates `@cloudflare/vitest-pool-workers` from 0.19.0 to 0.21.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.21.0/packages/vitest-pool-workers)

Updates `wrangler` from 4.115.0 to 4.120.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.120.1/packages/wrangler)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.29.0
  dependency-type: indirect
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.21.0
  dependency-type: direct:development
- dependency-name: wrangler
  dependency-version: 4.120.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 11, 2026
@dependabot
dependabot Bot requested a review from philpennock as a code owner August 11, 2026 00:27
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying nats-tools with  Cloudflare Pages  Cloudflare Pages

Latest commit: bc76a96
Status: ✅  Deploy successful!
Preview URL: https://13eac0a9.nats-tools.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-nigh-00y0.nats-tools.pages.dev

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@philpennock philpennock Awaiting requested review from philpennock philpennock is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants