Skip to content

chore(deps): bump undici, wrangler, @cloudflare/vitest-pool-workers and miniflare in /services/sync-service - #6150

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/services/sync-service/multi-901e167a53
Open

chore(deps): bump undici, wrangler, @cloudflare/vitest-pool-workers and miniflare in /services/sync-service#6150
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/services/sync-service/multi-901e167a53

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps undici to 8.10.1 and updates ancestor dependencies undici, wrangler, @cloudflare/vitest-pool-workers and miniflare. These dependencies need to be updated together.

Updates undici from 7.24.4 to 8.10.1

Release notes

Sourced from undici's releases.

v8.10.1

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.10.0...v8.10.1

... (truncated)

Commits
  • ede2a74 Bumped v8.10.1 (#5743)
  • d0389ca test: skip HTTP/2 churn test on Node.js 26 (#5742)
  • 8b00542 fix(agent): preserve pools with pending GOAWAY replays (#5740)
  • c32ea13 fix(h2): forward 1xx informational responses to onInfo (#5712)
  • f474548 test: restore /xhr to the WPT filter (#5723)
  • 3e622dc fix(cache): evict entries when a key holds a single entry (#5737)
  • fc3450d fix(socks5-proxy-agent): destroy socket when negotiation times out (#5709)
  • efc4f09 build(deps): bump brace-expansion (#5719)
  • 8726edc build(deps-dev): bump @​fastify/busboy from 3.2.1 to 3.2.2 (#5718)
  • 5033aa1 fix(env-http-proxy-agent): ignore trailing dots when matching no_proxy (#5637)
  • Additional commits viewable in compare view

Updates wrangler from 4.102.0 to 4.124.0

Release notes

Sourced from wrangler's releases.

wrangler@4.124.0

Minor Changes

  • #15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

    A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

    {
  "name": "my-worker",
  "main": "worker.js",
  "compatibility_date": "2026-07-01",
  "containers": [
    { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
  ],
  "exports": {
    "MyContainerDO": {
      "type": "durable-object",
      "storage": "sqlite",
      "container": "my-container"
    }
  }
}

    The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

    container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

    • a container reference names a container that does not exist
    • two Durable Object exports claim the same container
    • a container and a Durable Object export disagree about which one they are linked to
    • a container ends up linked to no Durable Object at all
    • two containers share a name
    • a container's class_name names a Durable Object whose storage is legacy-kv
    • two containers are attached to the same Durable Object

    That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #14999 ba54f0d Thanks @​mittalpk! - Fix .env loading on Windows leaking stale, differently-cased duplicate keys

    On Windows, wrangler loads .env values through a case-insensitive Proxy wrapper so lookups like env.PATH and env.Path resolve to the same value, and this object is assigned directly to process.env. When a key was set again under a different casing (e.g. a value in .env.local overriding one from .env with different casing), the previous casing was never removed from the underlying object. env.PATH/env.Path still returned the correct, latest value, but anything that enumerates process.env — Object.keys, for...in, JSON.stringify, object spread, or a spawned subprocess inheriting the environment — would see both the stale and current key.

    Duplicate entries no longer appear, so environment variables passed to subprocesses and any code that lists the environment now see only the latest value for each variable.

  • #15044 b7422b0 Thanks @​stareezy-1! - Normalize structural CRLF line endings before sending D1 commands to the remote query API

... (truncated)

Commits
  • 8ee43f6 Version Packages (#15175)
  • f431166 Prevent date-enabled Node.js compatibility from adding conflicting globals to...
  • 1552bce [wrangler] Quieten warnings and stray output in tests (#15209)
  • bc5726b Pass access.dev through to Miniflare via `unstable_getMiniflareWorkerOptions(...
  • e967c39 [wrangler] Skip container deploy e2e tests on non-Linux CI (#15233)
  • 265256a WC-5744 [previews] fix: wrangler preview base-config flag inheritance (#15153)
  • 75cf407 [wrangler] Enable new config for cf dev (#15082)
  • 8fb2b87 [wrangler] Use FedRAMP container registries (#15196)
  • ba54f0d [wrangler] Fix case-insensitive-env leaking stale duplicate keys on override ...
  • 7cee278 [wrangler] Let CLOUDFLARE_ACCOUNT_ID override the cached account id in pages ...
  • Additional commits viewable in compare view

Updates @cloudflare/vitest-pool-workers from 0.16.17 to 0.22.0

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.22.0

Minor Changes

  • #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

    @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

    If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

    When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

  • #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

    inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

  • #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

  • #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

    When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

    The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

  • Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

@​cloudflare/vitest-pool-workers@​0.21.3

Patch Changes

@​cloudflare/vitest-pool-workers@​0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

  • #15148 0b82b15 Thanks @​jamesopstad! - Ignore a nodejs_compat compatibility flag that the compatibility date already enables

    workerd rejects a compatibility flag that its compatibility date enables by default, so a Worker configured with both a compatibility date of 2026-08-04 or later and nodejs_compat failed to start locally with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore".

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.22.0

Minor Changes

  • #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

    @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

    If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

    When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

  • #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

    inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

  • #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

  • #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

    When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

    The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

  • Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

0.21.3

Patch Changes

0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

... (truncated)

Commits
  • 8ee43f6 Version Packages (#15175)
  • 3ddd3ce Fix module resolution for relative require() inside CJS deps when the proje...
  • 1f79ace Use a fixed default compatibility date derived from the pinned workerd (#15185)
  • 2cf3143 [vitest-pool-workers] Restore typed inject() keys (#15150)
  • 49d4e00 [vitest-pool-workers] Adopt @​msw/cloudflare and remove MSW workarounds (#13830)
  • c576a82 Version Packages (#15154)
  • e5d56e9 Version Packages (#15145)
  • d0c976c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
  • 90dd5e5 chore: bump capnp-es to 0.0.15 (#15131)
  • 15fc568 Version Packages (#15118)
  • Additional commits viewable in compare view

Updates miniflare from 4.20260617.0 to 5.20260831.0-alpha

Release notes

Sourced from miniflare's releases.

miniflare@5.20260831.0-alpha

Minor Changes

  • #15353 87a7acf Thanks @​pombosilva! - Add --date-start and --date-end filters to wrangler workflows instances list

    You can now narrow an instance listing to a creation-time window:

    wrangler workflows instances list my-workflow --date-start 2026-01-01 --date-end 2026-01-31

    Either flag can be used independently. Both accept an ISO 8601 date or timestamp and are normalised to UTC before being sent, so a date-only value such as 2026-01-01 works as well as a full 2026-01-01T13:00:00Z. The bounds are inclusive and compose with the existing --status filter.

Patch Changes

  • #15436 200780f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260828.1 ^5.20260831.1
    workerd 1.20260828.1 1.20260831.1

  • #15406 b3f2628 Thanks @​james-elicx! - Reduce the installed bundle sizes of Wrangler and Miniflare

    Wrangler now resolves bundled workspace dependencies from source during monorepo builds so unused exports can be removed. Miniflare, its shared CLI and container dependencies now use granular @cloudflare/workers-utils entry points instead of loading the package barrel, reducing the raw Wrangler and Miniflare artifacts by 6.16 MiB (31.4%) and 1.06 MiB (22.9%) respectively without changing runtime behavior or installed dependencies.

miniflare@5.20260828.0-alpha

Minor Changes

  • #15337 b23de74 Thanks @​tpmmorris! - Add email inspection and testing to Local Explorer

    Add an Email group with Routing and Sending views for inspecting messages received by a Worker's email() handler and messages sent through its send_email bindings. Detail views show message content, metadata, attachments, and handler activity including forwarding, replies, rejection, and unhandled messages.

    Add a test-email composer that delivers custom text, HTML, headers, and attachments directly to the selected Worker's email() handler during local development.

  • #15305 015550a Thanks @​Monark-Arkmon! - Support env.IMAGES.hosted.createDirectUpload() in local development. Creates a draft image and returns an uploadURL served by a new local endpoint that accepts the completed upload as multipart/form-data (field name file). Matches production's validation (expiresIn bounds of 120–21600 seconds, rejecting UUID custom IDs) and single-use/expiry semantics: completing an unknown or already-used upload link returns 404/409, and an expired link returns 410.

  • #15305 015550a Thanks @​Monark-Arkmon! - Support the filter.metadata option on env.IMAGES.hosted.list() in local development, matching the metadata filtering behaviour of the production Images binding. Filters support the eq (implicit for bare values), in, gt, gte, lt, and lte operators, dot-notation nested field paths, and AND logic across multiple fields.

  • #15305 015550a Thanks @​Monark-Arkmon! - Support env.IMAGES.hosted.image(id).signedUrl() in local development. A fixed local-dev signing secret is used to generate and verify signed delivery URLs, so images uploaded with requireSignedURLs: true can only be fetched from the local image delivery endpoint with a valid, unexpired signature — matching the production Images binding's signed URL behaviour end-to-end.

  • #15373 3650d29 Thanks @​jamesopstad! - Rename Worker target fields from workerName to worker

    The experimental @cloudflare/config and Miniflare configuration APIs now use worker consistently for Worker, Durable Object, Workflow, dispatch namespace, and tail consumer targets.

Patch Changes

  • #15383 eb01850 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

... (truncated)

Changelog

Sourced from miniflare's changelog.

5.20260831.0-alpha

Minor Changes

  • #15353 87a7acf Thanks @​pombosilva! - Add --date-start and --date-end filters to wrangler workflows instances list

    You can now narrow an instance listing to a creation-time window:

    wrangler workflows instances list my-workflow --date-start 2026-01-01 --date-end 2026-01-31

    Either flag can be used independently. Both accept an ISO 8601 date or timestamp and are normalised to UTC before being sent, so a date-only value such as 2026-01-01 works as well as a full 2026-01-01T13:00:00Z. The bounds are inclusive and compose with the existing --status filter.

Patch Changes

  • #15436 200780f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260828.1 ^5.20260831.1
    workerd 1.20260828.1 1.20260831.1

  • #15406 b3f2628 Thanks @​james-elicx! - Reduce the installed bundle sizes of Wrangler and Miniflare

    Wrangler now resolves bundled workspace dependencies from source during monorepo builds so unused exports can be removed. Miniflare, its shared CLI and container dependencies now use granular @cloudflare/workers-utils entry points instead of loading the package barrel, reducing the raw Wrangler and Miniflare artifacts by 6.16 MiB (31.4%) and 1.06 MiB (22.9%) respectively without changing runtime behavior or installed dependencies.

5.20260828.0-alpha

Minor Changes

  • #15337 b23de74 Thanks @​tpmmorris! - Add email inspection and testing to Local Explorer

    Add an Email group with Routing and Sending views for inspecting messages received by a Worker's email() handler and messages sent through its send_email bindings. Detail views show message content, metadata, attachments, and handler activity including forwarding, replies, rejection, and unhandled messages.

    Add a test-email composer that delivers custom text, HTML, headers, and attachments directly to the selected Worker's email() handler during local development.

  • #15305 015550a Thanks @​Monark-Arkmon! - Support env.IMAGES.hosted.createDirectUpload() in local development. Creates a draft image and returns an uploadURL served by a new local endpoint that accepts the completed upload as multipart/form-data (field name file). Matches production's validation (expiresIn bounds of 120–21600 seconds, rejecting UUID custom IDs) and single-use/expiry semantics: completing an unknown or already-used upload link returns 404/409, and an expired link returns 410.

  • #15305 015550a Thanks @​Monark-Arkmon! - Support the filter.metadata option on env.IMAGES.hosted.list() in local development, matching the metadata filtering behaviour of the production Images binding. Filters support the eq (implicit for bare values), in, gt, gte, lt, and lte operators, dot-notation nested field paths, and AND logic across multiple fields.

  • #15305 015550a Thanks @​Monark-Arkmon! - Support env.IMAGES.hosted.image(id).signedUrl() in local development. A fixed local-dev signing secret is used to generate and verify signed delivery URLs, so images uploaded with requireSignedURLs: true can only be fetched from the local image delivery endpoint with a valid, unexpired signature — matching the production Images binding's signed URL behaviour end-to-end.

  • #15373 3650d29 Thanks @​jamesopstad! - Rename Worker target fields from workerName to worker

    The experimental @cloudflare/config and Miniflare configuration APIs now use worker consistently for Worker, Durable Object, Workflow, dispatch namespace, and tail consumer targets.

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Medium Risk
Major miniflare 5 alpha and transitive undici 8 can change local dev, deploy, and Vitest behavior without touching production worker logic; verify npm test and wrangler workflows after merge.

Overview
Updates Cloudflare Workers tooling in services/sync-service only—package.json version ranges and the npm lockfile. There are no changes to worker or sync application code.

wrangler moves from ^4.102.0 to ^4.124.0 (deploy/local dev CLI). miniflare jumps from the 4.x line to ^5.20260831.0-alpha (local Workers runtime simulator). @cloudflare/vitest-pool-workers goes from ^0.16.17 to ^0.22.0 (Vitest integration for e2e tests).

The lockfile refresh also pulls aligned transitive updates: newer workerd, sharp 0.35.x, zod 4.x under the vitest pool, and undici 8.x where the tree resolves it (existing undici override >=6.24.0 is unchanged).

Reviewed by Cursor Bugbot for commit 0932f8d. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
chore(deps): bump undici, wrangler, @cloudflare/vitest-pool-workers a…
0932f8d 
…nd miniflare

Bumps [undici](https://github.com/nodejs/undici) to 8.10.1 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler), [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) and [miniflare](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/miniflare). These dependencies need to be updated together.


Updates `undici` from 7.24.4 to 8.10.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.4...v8.10.1)

Updates `wrangler` from 4.102.0 to 4.124.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.124.0/packages/wrangler)

Updates `@cloudflare/vitest-pool-workers` from 0.16.17 to 0.22.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers)

Updates `miniflare` from 4.20260617.0 to 5.20260831.0-alpha
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/miniflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/miniflare@5.20260831.0-alpha/packages/miniflare)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 8.10.1
  dependency-type: indirect
- dependency-name: wrangler
  dependency-version: 4.124.0
  dependency-type: direct:production
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.22.0
  dependency-type: direct:development
- dependency-name: miniflare
  dependency-version: 5.20260831.0-alpha
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026
cursor[bot]
cursor Bot reviewed Sep 2, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 0932f8d. Configure here.

Comment thread services/sync-service/package.json
"@types/jsonwebtoken": "^9.0.9",
"bebop-tools": "^3.1.3",
"miniflare": "^4.20260617.0",
"miniflare": "^5.20260831.0-alpha",

@cursor cursor Bot Sep 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Miniflare 5 breaks test constructor API

High Severity

Bumping miniflare to 5.20260831.0-alpha drops the v4 flat constructor API that setupMiniflare() still uses. Miniflare 5 requires a workers array and no longer accepts modules / modulesRules, so every e2e test that constructs Miniflare will fail immediately.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 0932f8d. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments

Assignees

No one assigned

Labels

cloud-storage dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants