chore: align Vite, Vitest, and Wrangler tooling

[ndisidore]

Updates a few of our dev dependencies and reduces version sprawl across packages/manually maintained types

• Align Wrangler at 4.119.0 and @cloudflare/vitest-pool-workers at 0.18.8 across every consumer; upgrade Vitest users to 4.1.10 and the relevant Workers types to 5.x
• Pin Vite 7.3.6 monorepo-wide with the compatible React plugin (Vite 8/Oxc leaves Stage-3 decorators unlowered; workers-sdk#12626)
• Remove the obsolete CodeMirror overrides, update and deduplicate its packages, and remove the now-unused js-yaml override
• Add a shared types:generate command that regenerates and checks Wrangler-owned Worker declarations

All tested and working locally

[ask-bonk]

Review: chore: align Vite, Vitest, and Wrangler tooling

Verified locally on this branch: pnpm types:check, pnpm lint:check (exit 0, warnings only), node scripts/generate-worker-types.mjs --check (all 19 packages ok), and node --test scripts/release-manifest.test.js (4/4) all pass. The Vite pin, CodeMirror dedup, and js-yaml removal all check out in the lockfile. Overall this is a solid, well-documented cleanup. A few observations below — most are minor, one is worth deciding on.

Version sprawl: workerd regressed from 1 → 3 versions

The PR's stated goal is "reduces version sprawl," but removing the workerd: ">=1.20260623.1" override has the opposite effect for workerd specifically. Before this PR the lockfile had exactly one workerd (1.20260731.1); after, there are three:

• 1.20260801.1 — from the direct wrangler@4.119.0 (pulls miniflare@5.20260801.0-alpha)
• 1.20260722.1 — from @cloudflare/vitest-pool-workers@0.18.8, which pins its own wrangler@4.114.0 → miniflare@4.20260722.0
• 1.20260625.1 — from packages/gatekeeper-scheduler's direct "miniflare": "4.20260625.0" pin (untouched by this PR, though its package.json was edited here)

The 4.114.0 pin inside vitest-pool-workers isn't something we control, but the gatekeeper-scheduler miniflare pin is — aligning or removing it (or restoring a workerd override) would cut this back down. Worth a sentence in the PR body either way, since it directly contradicts the "reduce sprawl" claim.

Also note wrangler@4.119.0 now pulls in miniflare@5.20260801.0-alpha — an alpha in the test harness path. If that's a known/accepted consequence of 4.119.0, fine, but it's worth being explicit about.

PR-body vs. actual version discrepancies

The description says "Align Wrangler at 4.118.0" and "@cloudflare/vitest-pool-workers at 0.18.8," but the code pins wrangler at ^4.119.0 everywhere (~4.119.0 in integration-tests). Not a code problem — just update the body so reviewers/changelog match reality.

Vitest not fully "aligned"

The body says "upgrade Vitest users to 4.1.10," but several remain on ^3.2.4 (configurator-ui, gatekeeper-mcp, gatekeeper-mcp-portal, integration-tests, mcp-shared) and router is ^4.1.9 rather than 4.1.10. If leaving the MCP/older ones on 3.x is deliberate (they don't use pool-workers 4.x), a one-line note would help; the stray router ^4.1.9 looks like an oversight worth bumping to ^4.1.10 for exactness.

@cloudflare/workers-types still on 4.x in one place

packages/integration-tests keeps @cloudflare/workers-types@^4.20260623.1 while others moved to 5.x. Intentional or missed? Worth confirming.

Nits / things I liked

• scripts/generate-worker-types.mjs is nicely documented and the --check (non-mutating sibling temp + banner/mainModule normalization) is a clean way to keep the giant generated files honest without hand-edits. The idempotent restore re-patch and the runtimeOnlyConfigs borrow for mcp-shared are good touches.
• The mock-storage.ts switch from @cloudflare/workers-types/experimental to a /// <reference> on the generated file is consistent with the new direction; the oxlint-disable comment is justified.
• New src/env.d.ts files for gatekeeper-mcp/gatekeeper-mcp-portal and the CLIENT_ID/CLIENT_SECRET additions to google.ts/slack.ts Env types correctly keep secrets/vars out of the generated file, matching the script's documented convention.

None of these block; the workerd-sprawl point and the body/version mismatches are the main things to reconcile before merge.

[ask-bonk]

Review posted to PR #46: #46 (comment)

Summary

I verified the branch locally — types:check, lint:check (exit 0), generate-worker-types.mjs --check (all 19 packages ok), and the release-manifest golden test all pass. The Vite 7.3.6 pin, CodeMirror dedup, and js-yaml removal are all correctly reflected in the lockfile.

Key findings I raised:

1. workerd sprawl regressed 1 → 3 versions (the main substantive point). Removing the workerd override contradicts the PR's "reduce version sprawl" goal:

   • 1.20260801.1 (direct wrangler@4.119.0, which pulls miniflare@5...alpha)
   • 1.20260722.1 (vitest-pool-workers pins its own wrangler@4.114.0)
   • 1.20260625.1 (gatekeeper-scheduler's direct miniflare@4.20260625.0 pin — controllable, and its package.json was edited in this PR anyway)

2. PR body vs. reality: body says Wrangler 4.118.0 but code pins ^4.119.0; body says Vitest 4.1.10 but several packages stay on ^3.2.4 and router is ^4.1.9.

3. integration-tests still on @cloudflare/workers-types@4.x while others moved to 5.x — confirm if intentional.

4. Praised the well-documented generate-worker-types.mjs script (non-mutating --check, idempotent patching, runtimeOnlyConfigs borrow for mcp-shared) and the correct handling of secrets in src/env.d.ts / Env types.

None of the findings are blocking; the workerd-sprawl point and the body/version mismatches are the main items to reconcile before merge.

github run

[ask-bonk]

Review: chore: align Vite, Vitest, and Wrangler tooling

I re-verified this against the current head of nathan/chore/align-tooling-deps (commit 4a0fc46). Solid, well-documented cleanup — the Vite 7.3.6 pin, CodeMirror dedup, and override removals all check out. A couple of the concerns raised in the earlier automated review appear to have been based on a stale snapshot; I've corrected them below so they don't block merge on false pretenses.

Corrections to the earlier review

• workerd is at 2 versions, not 3. The lockfile resolves exactly two: 1.20260801.1 (from the direct wrangler@4.119.0) and 1.20260722.1 (from the wrangler@4.114.0 that @cloudflare/vitest-pool-workers@0.18.8 pins internally). The claimed third version 1.20260625.1 does not exist in the lockfile — this PR actually bumped gatekeeper-scheduler's miniflare from 4.20260625.0 to 5.20260801.0-alpha (packages/gatekeeper-scheduler/package.json), which is what eliminated it. So going from 1→2 is a real (small) regression driven entirely by the vitest-pool-workers-owned 4.114.0 pin, which isn't something we control. Worth a sentence in the body, but there's no controllable knob left here.

• Vitest and @cloudflare/workers-types are fully aligned. Every vitest consumer is ^4.1.10 (including router, gatekeeper-mcp, gatekeeper-mcp-portal, mcp-shared, configurator-ui); none remain on ^3.2.4, and router is not on ^4.1.9. integration-tests is on @cloudflare/workers-types@^5.20260722.1, not 4.x. These earlier concerns don't apply to the current tree.

• PR body version. The body already reads "Align Wrangler at 4.119.0," which matches the ^4.119.0 pins (~4.119.0 in integration-tests), so that discrepancy is resolved too.

The one real thing worth a sentence: alpha miniflare in the harness path

wrangler@4.119.0 pulls miniflare@5.20260801.0-alpha → workerd@1.20260801.1. That's an alpha of the test/build harness (not a prod runtime binding, and miniflare isn't in minimumReleaseAgeExclude, but it's transitive of the direct wrangler dep so the release-age policy applies to wrangler itself). If landing on the alpha is a known/accepted consequence of 4.119.0, a one-liner in the body would make that explicit for the changelog.

Verified good

• js-yaml is fully gone from the lockfile (zero js-yaml@ entries), so dropping the CVE-2026-53550 override is safe — the vulnerable transitive was removed, not merely un-pinned.
• CodeMirror deduped to a single version each: @codemirror/commands@6.10.4, @codemirror/state@6.7.1, @codemirror/view@6.43.7 — newer than the removed pins, confirming the dedup claim.
• scripts/generate-worker-types.mjs is nicely documented; the non-mutating --check (sibling temp + banner/mainModule normalization), the idempotent restore re-patch, and the runtimeOnlyConfigs borrow for mcp-shared are all clean.
• The new src/env.d.ts files (gatekeeper-mcp, gatekeeper-mcp-portal) and the CLIENT_ID/CLIENT_SECRET additions to google.ts/slack.ts Env correctly keep secrets/injected vars (MCP_PORTAL_TOKEN, MCP_PORTAL_TRUST_ANNOTATIONS, WORKERS_AI) out of the generated files — matching the script's documented convention.
• The mock-storage.ts switch from @cloudflare/workers-types/experimental to a /// <reference> on the generated file (with a justified oxlint-disable) is consistent with the new direction.

Nothing blocking. The only substantive item is the alpha-miniflare note in the body; the workerd 1→2 point is minor and not controllable in this repo.

[ask-bonk]

Review posted to PR #46: #46 (comment)

Summary

I re-verified this PR against the current head (4a0fc46) and found that the earlier automated review's main substantive claims were based on a stale snapshot. My review corrects them:

Corrections:

1. workerd is at 2 versions, not 3. Lockfile resolves 1.20260801.1 (direct wrangler@4.119.0) and 1.20260722.1 (via vitest-pool-workers' internal wrangler@4.114.0 pin). The claimed third 1.20260625.1 doesn't exist — this PR bumped gatekeeper-scheduler's miniflare from 4.20260625.0 to 5.20260801.0-alpha, eliminating it. The remaining 1→2 split is driven entirely by the vitest-pool-workers-owned 4.114.0 pin, which isn't controllable here.
2. Vitest/workers-types are fully aligned. Every consumer is vitest@^4.1.10 (including router and the MCP packages); integration-tests is on @cloudflare/workers-types@^5.x. The earlier claims of ^3.2.4 / ^4.1.9 / 4.x stragglers don't apply.
3. PR body already says 4.119.0, matching the code.

Genuine observation: wrangler@4.119.0 pulls miniflare@5.20260801.0-alpha into the harness path — worth a one-line note in the body if that's accepted.

Verified good: js-yaml is completely gone from the lockfile (making the CVE override removal safe), CodeMirror is deduped to single newer versions, the generate-worker-types.mjs script is clean, and the new env.d.ts/Env changes correctly keep secrets out of generated files.

Nothing blocking.

github run

[ask-bonk]

Review: chore: align Vite, Vitest, and Wrangler tooling

I re-verified this against the current head of nathan/chore/align-tooling-deps (commit 5ee8676), after a fresh pnpm install --frozen-lockfile (lockfile is internally consistent — the frozen install succeeded). This is a clean, well-documented cleanup and everything checks out.

Verification (all green)

• node scripts/generate-worker-types.mjs --check → all 19 packages ok (the generated worker-configuration.d.ts files are up to date).
• pnpm types:check → exit 0 across every package.
• pnpm lint:check (oxlint) → exit 0 (warnings only: no-shadow, consistent-function-scoping, etc. — all pre-existing).
• node --test scripts/release-manifest.test.js → 4/4 pass (golden manifest unaffected).

Confirming the earlier corrections against the current tree

The two automated reviews on this thread disagreed with each other; I re-checked the lockfile and package manifests directly, and the corrected (second) review is the accurate one:

• workerd resolves to exactly 2 versions, not 3. The lockfile has 1.20260801.1 (from the direct wrangler@4.119.0) and 1.20260722.1 (from the wrangler@4.114.0 that @cloudflare/vitest-pool-workers@0.18.8 pins internally). There is no 1.20260625.1 — this PR bumped gatekeeper-scheduler's miniflare from 4.20260625.0 to 5.20260801.0-alpha (packages/gatekeeper-scheduler/package.json:35), which removed it. So the sprawl regression is only 1→2 and is driven entirely by the vitest-pool-workers-owned 4.114.0 pin — not controllable in this repo.

• Vitest and @cloudflare/workers-types are fully aligned. I grepped every package.json: every vitest consumer is ^4.1.10 (including router, gatekeeper-mcp, gatekeeper-mcp-portal, mcp-shared, configurator-ui); no ^3.2.4 or ^4.1.9 stragglers remain. Every @cloudflare/workers-types is ^5.x (integration-tests is ^5.20260722.1, not 4.x). The earlier "stragglers" concerns don't apply to the current tree.

• PR body matches code: body says "Align Wrangler at 4.119.0," which matches the ^4.119.0 pins (~4.119.0 in integration-tests).

The one item worth a sentence in the body: alpha miniflare in the harness path

wrangler@4.119.0 → miniflare@5.20260801.0-alpha → workerd@1.20260801.1, and gatekeeper-scheduler now takes miniflare: "5.20260801.0-alpha" directly. That's an alpha of the test/build harness (not a prod runtime binding). Note the supply-chain angle: workerd/@cloudflare/workerd-* are in minimumReleaseAgeExclude (pnpm-workspace.yaml:19) but miniflare is not, so the 24h release-age gate does apply to it as a transitive of the direct wrangler/miniflare deps. If landing on the alpha is a known/accepted consequence of 4.119.0, a one-liner in the body would make it explicit for the changelog.

Verified good

• js-yaml is completely gone from the lockfile (0 js-yaml@ entries), so dropping the CVE override is safe — the vulnerable transitive was removed, not merely un-pinned.
• CodeMirror deduped to a single version each: @codemirror/commands@6.10.4, @codemirror/state@6.7.1, @codemirror/view@6.43.7.
• scripts/generate-worker-types.mjs is nicely documented; the non-mutating --check (sibling temp + banner/mainModule normalization), the idempotent restore re-patch, and the runtimeOnlyConfigs borrow (mcp-shared, a library, borrows gatekeeper-mcp's wrangler.jsonc with --include-env false) are all clean and correct.
• New src/env.d.ts (gatekeeper-mcp, gatekeeper-mcp-portal) and the CLIENT_ID/CLIENT_SECRET additions to google.ts/slack.ts Env, plus WORKERS_AI: Ai in workshop-backend/src/env.d.ts, correctly keep secrets/injected vars out of the generated files — matching the script's documented convention.
• mcp-shared correctly moved off @cloudflare/workers-types@4.x / vitest@3.x to the generated worker-configuration.d.ts (tsconfig.json types) and vitest@^4.1.10; the { timeout: 15_000 } bump on the compiler-invoking generateSessionTypes suite is reasonable for CI contention.
• The mock-storage.ts switch from @cloudflare/workers-types/experimental to a /// <reference> on the generated file (with a justified oxlint-disable) is consistent with the new direction.

Nothing blocking. The only substantive item is the alpha-miniflare note in the body; the workerd 1→2 split is minor and not controllable here.

[ask-bonk]

Review posted to PR #46: #46 (comment)

Summary

I checked out the current head (5ee8676), did a fresh pnpm install --frozen-lockfile (succeeded, so the lockfile is consistent), and independently verified every claim on this thread.

Verification (all green):

• generate-worker-types.mjs --check → all 19 packages ok
• pnpm types:check → exit 0
• pnpm lint:check → exit 0 (pre-existing warnings only)
• release-manifest golden test → 4/4

Which earlier review was right: The second (corrected) automated review is accurate; the first was stale. Confirmed by direct lockfile/manifest inspection:

1. workerd = 2 versions, not 3 — 1.20260801.1 (direct wrangler@4.119.0) and 1.20260722.1 (via vitest-pool-workers' internal wrangler@4.114.0). The 1.20260625.1 was eliminated because this PR bumped gatekeeper-scheduler to miniflare@5.20260801.0-alpha. The 1→2 split isn't controllable here.
2. Vitest / workers-types fully aligned — every consumer is vitest@^4.1.10, every @cloudflare/workers-types is ^5.x (including integration-tests). No 3.x / 4.1.9 / 4.x stragglers.
3. PR body already matches (says 4.119.0).

One genuine item for the body: wrangler@4.119.0 pulls miniflare@5.20260801.0-alpha into the harness. I added the nuance that miniflare is not in minimumReleaseAgeExclude (only workerd/@cloudflare/workerd-* are), so the release-age gate does apply to it — worth a one-line changelog note.

Verified good: js-yaml fully removed (making the CVE override drop safe), CodeMirror deduped, the generate-worker-types.mjs script and its runtimeOnlyConfigs borrow for mcp-shared, and the env.d.ts/Env changes correctly keeping secrets out of generated files.

Nothing blocking.

github run