[dependabot]

Bumps the cloudflare group with 4 updates in the / directory: @cloudflare/vitest-plugin, @cloudflare/workers-types, cf and wrangler.

Updates @cloudflare/vitest-plugin from 1.4.7 to 1.4.8

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.4.8

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• #16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

  • miniflare@5.20261023.0-beta
  • wrangler@4.153.0

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.4.8

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• #16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

  • miniflare@5.20261023.0-beta
  • wrangler@4.153.0

Commits

• See full diff in compare view

Updates @cloudflare/workers-types from 5.20261026.1 to 5.20261027.1

Commits

• See full diff in compare view

Updates cf from 1.0.0-beta.21 to 1.0.0-beta.23

Release notes

Sourced from cf's releases.

cf@1.0.0-beta.23

Minor Changes

• dbbdcb3: Update the generated command surface for Forge OpenAPI release a3c32024372cc93b9572dd62cacaeb270e7221a4.

Patch Changes

• 255cd26: Update dependencies published from the Workers SDK repository:

  • @cloudflare/autoconfig: 0.8.0 → 0.8.1
  • @cloudflare/build-output-utils: 0.9.4 → 0.9.5
  • @cloudflare/cli-shared-helpers: 0.2.8 → 0.2.9
  • @cloudflare/codemods: 0.6.0 → 0.6.1
  • @cloudflare/config: 0.28.0 → 0.28.1
  • @cloudflare/containers-shared: 0.23.2 → 0.23.3
  • @cloudflare/deploy-helpers: 0.23.0 → 0.24.0
  • @cloudflare/runtime-types: 0.1.15 → 0.1.16
  • @cloudflare/workers-auth: 0.15.0 → 0.15.1
  • @cloudflare/workers-utils: 0.48.0 → 0.49.0
  • miniflare: 5.20261019.2-beta → 5.20261023.0-beta

cf@1.0.0-beta.22

Minor Changes

• a7fa33c: Detect DeepSeek Harness as an AI coding agent.

  Recognize commands run by DeepSeek Harness through its DSH_SHELL environment marker. Capture the agent session ID when DSH_SESSION_ID is available.

• 7993e1d: Update the generated command surface for Forge OpenAPI release 67c5887b849fdde3ac07438146fa92a0010e2f53.

• 5ef0a6d: Update the generated command surface for Forge OpenAPI release 708fba786988846438caab6d7540f4f5006a2a5f.

• f08f693: Update the generated command surface for Forge OpenAPI release cd7e523512a1ee2fb6b5b041daa68661e61c9119.

• 2c4ec34: Update the generated command surface for Forge OpenAPI release d04a1ddd718bb1c91f79d3220174e5a16ed1cacd.

• 54b5920: Update the generated command surface for Forge OpenAPI release e2386f5f515cf598f7ebdf682f2eeb60f43d9088.

Patch Changes

• a50dd58: Show additional API error messages on stderr

  Include the response envelope's messages entries after errors when a request fails, so validation details such as missing parameter names are visible. Preserve the full envelope for success: false responses returned with a successful HTTP status, and keep successful-response output unchanged.

... (truncated)

Changelog

Sourced from cf's changelog.

1.0.0-beta.23

Minor Changes

• dbbdcb3: Update the generated command surface for Forge OpenAPI release a3c32024372cc93b9572dd62cacaeb270e7221a4.

Patch Changes

• 255cd26: Update dependencies published from the Workers SDK repository:

  • @cloudflare/autoconfig: 0.8.0 → 0.8.1
  • @cloudflare/build-output-utils: 0.9.4 → 0.9.5
  • @cloudflare/cli-shared-helpers: 0.2.8 → 0.2.9
  • @cloudflare/codemods: 0.6.0 → 0.6.1
  • @cloudflare/config: 0.28.0 → 0.28.1
  • @cloudflare/containers-shared: 0.23.2 → 0.23.3
  • @cloudflare/deploy-helpers: 0.23.0 → 0.24.0
  • @cloudflare/runtime-types: 0.1.15 → 0.1.16
  • @cloudflare/workers-auth: 0.15.0 → 0.15.1
  • @cloudflare/workers-utils: 0.48.0 → 0.49.0
  • miniflare: 5.20261019.2-beta → 5.20261023.0-beta

1.0.0-beta.22

Minor Changes

• a7fa33c: Detect DeepSeek Harness as an AI coding agent.

  Recognize commands run by DeepSeek Harness through its DSH_SHELL environment marker. Capture the agent session ID when DSH_SESSION_ID is available.

• 7993e1d: Update the generated command surface for Forge OpenAPI release 67c5887b849fdde3ac07438146fa92a0010e2f53.

• 5ef0a6d: Update the generated command surface for Forge OpenAPI release 708fba786988846438caab6d7540f4f5006a2a5f.

• f08f693: Update the generated command surface for Forge OpenAPI release cd7e523512a1ee2fb6b5b041daa68661e61c9119.

• 2c4ec34: Update the generated command surface for Forge OpenAPI release d04a1ddd718bb1c91f79d3220174e5a16ed1cacd.

• 54b5920: Update the generated command surface for Forge OpenAPI release e2386f5f515cf598f7ebdf682f2eeb60f43d9088.

Patch Changes

• a50dd58: Show additional API error messages on stderr

  Include the response envelope's messages entries after errors when a request fails, so validation details such as missing parameter names are visible. Preserve the full envelope for success: false responses returned with a successful HTTP status, and keep successful-response output unchanged.

• a251687: Clarify the banner when using a project's local cf version

... (truncated)

Commits

• 5b2aa78 Version Packages (beta) (#420)
• ee24007 chore(deps): update all non-major dependencies (#417)
• dbbdcb3 chore: update OpenAPI to a3c32024372c (#415)
• 255cd26 fix(deps): update workers-sdk derived dependencies (#418)
• d0682b5 Version Packages (beta) (#398)
• 5ef0a6d chore: update OpenAPI to 708fba786988 (#414)
• a251687 fix: clarify local cf version in banner (#384)
• a50dd58 fix: show supplementary API error messages on stderr (#377)
• a7fa33c feat: detect DeepSeek Harness (#408)
• b31a9ea fix(d1): reject migration names that Windows cannot store (#411)
• Additional commits viewable in compare view

Updates wrangler from 4.152.0 to 4.153.0

Release notes

Sourced from wrangler's releases.

wrangler@4.153.0

Minor Changes

• #14865 c0e915f Thanks @​TheSaiEaranti! - Add an --infer-origin-from-routes flag to wrangler dev

  When a config has routes, local dev infers the origin from the first route, so the Worker sees request.url, the Host header, and any Origin header rewritten to the route's host even though the client connected to localhost. That silently breaks Host/Origin-sensitive logic — for example a CORS check allowlisting http://localhost:* receives http://<route-host> instead and rejects the request only in local dev.

  The inference is intentional and remains the default. Passing --infer-origin-from-routes=false now opts out, preserving the real local origin without removing routes from the config. An explicitly configured --host, --local-upstream, or dev.host continues to take precedence either way. The flag only affects local development: in remote mode the route host still determines the preview session as before.

• #15955 23ef63a Thanks @​ericclemmons! - Expand dotenv variable references in --secrets-file input

  Dotenv files supplied through --secrets-file to deploy, versions upload, and preview now expand $VAR and ${VAR} references using process values and earlier file values. Process environment values override matching file keys, including explicitly empty values. Treat dotenv secrets files as trusted input: they can read and upload any process environment value, such as a CI credential referenced by X=${GITHUB_TOKEN}. In CI, use secrets files whose contents untrusted contributors cannot modify.

  This changes how existing dotenv secrets files are interpreted: an unset reference becomes an empty string, so PASSWORD=pa$word becomes pa when word is unset. Escape literal dollar signs with a backslash (PASSWORD=pa\$word), or use a JSON secrets file to preserve values exactly. JSON input and bulk-secret commands, including piped stdin, retain their existing literal parsing.

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16403 5f82a56 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261019.1	^5.20261022.1
  workerd	1.20261019.1	1.20261022.1

• #16437 e651d7c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261022.1	^5.20261023.1
  workerd	1.20261022.1	1.20261023.1

• #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #16485 b7e762d Thanks @​Cherry! - Fix the Windows keyring install when the config path contains a space

  On Windows, wrangler login --use-keyring could not set up keyring storage when the configuration path contained a space, such as a C:\Users\John Smith profile, so credentials fell back to the plaintext file. Keyring setup now works for those paths and credentials are stored encrypted.

... (truncated)

Commits

• See full diff in compare view