chore: bump the worker-npm-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the worker-npm-dependencies group with 5 updates in the /cloudflare-worker directory:

Package	From	To
@cloudflare/vitest-pool-workers	0.16.13	0.20.2
@cloudflare/workers-types	4.20260613.1	5.20260804.1
typescript	5.9.3	7.0.2
vitest	4.1.8	4.1.10
wrangler	4.98.0	4.119.0

Updates @cloudflare/vitest-pool-workers from 0.16.13 to 0.20.2

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.20.2

Patch Changes

• Updated dependencies [20470fa, 9c74538, 266172b, a88d169, a88d169, daf65f2, a9e5abb]:
  • wrangler@4.119.0
  • miniflare@5.20260801.0-alpha

@​cloudflare/vitest-pool-workers@​0.20.1

Patch Changes

• Updated dependencies [cc63aae, f92d1fc, a249591, f92d1fc, f92d1fc, cec9d88, e0bbf55]:
  • wrangler@4.118.0

@​cloudflare/vitest-pool-workers@​0.20.0

Minor Changes

• #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

  The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

  • wrappedBindings
  • cacheWarnUsage
  • fetchMock: you should use outboundService instead
  • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

  Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

• #14586 5a56dda Thanks @​emily-shen! - Preserve the deprecated Miniflare cache option

  Vitest configurations using cache continue to work after the internal Miniflare v5 upgrade. The option is translated to cacheAPI; new configurations should use cacheAPI directly.

• #14586 5a56dda Thanks @​emily-shen! - Stop enabling Miniflare's removed unsafeStickyBlobs option

  The pool no longer sets the unsafeStickyBlobs Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.

• Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

  • miniflare@5.20260730.0-alpha
  • wrangler@4.117.0

@​cloudflare/vitest-pool-workers@​0.19.1

Patch Changes

• Updated dependencies [01d7020, beec0fb, 48f0c6c, 8049ca4, d7f38c3, 1394867, cc54478, 5c25cfe, b21eac2, bb09f1b, 1f61001, 01d7020, e31ab0f]:
  • miniflare@4.20260730.0
  • wrangler@4.116.0

@​cloudflare/vitest-pool-workers@​0.19.0

Minor Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.20.2

Patch Changes

• Updated dependencies [20470fa, 9c74538, 266172b, a88d169, a88d169, daf65f2, a9e5abb]:
  • wrangler@4.119.0
  • miniflare@5.20260801.0-alpha

0.20.1

Patch Changes

• Updated dependencies [cc63aae, f92d1fc, a249591, f92d1fc, f92d1fc, cec9d88, e0bbf55]:
  • wrangler@4.118.0

0.20.0

Minor Changes

• #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

  The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

  • wrappedBindings
  • cacheWarnUsage
  • fetchMock: you should use outboundService instead
  • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

  Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

• #14586 5a56dda Thanks @​emily-shen! - Preserve the deprecated Miniflare cache option

  Vitest configurations using cache continue to work after the internal Miniflare v5 upgrade. The option is translated to cacheAPI; new configurations should use cacheAPI directly.

• #14586 5a56dda Thanks @​emily-shen! - Stop enabling Miniflare's removed unsafeStickyBlobs option

  The pool no longer sets the unsafeStickyBlobs Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.

• Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

  • miniflare@5.20260730.0-alpha
  • wrangler@4.117.0

0.19.1

Patch Changes

• Updated dependencies [01d7020, beec0fb, 48f0c6c, 8049ca4, d7f38c3, 1394867, cc54478, 5c25cfe, b21eac2, bb09f1b, 1f61001, 01d7020, e31ab0f]:
  • miniflare@4.20260730.0

... (truncated)

Commits

• 2938c01 Version Packages (#15021)
• b6a8629 Revert "Version Packages (#14977)" (#15033)
• 42c4227 Version Packages (#14977)
• 95d9b12 Version Packages (#14946)
• 83a37e3 docs: point vitest-pool-workers BUILD section at the tsdown config (#14940)
• fcb5402 Version Packages (#14939)
• 5a56dda Miniflare v5 alpha (#14586)
• 96fd16f Version Packages (#14898)
• 760a85b Version Packages (#14824)
• e6480e3 [vitest-pool-workers] Make workerd verbose logging configurable (#14879)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 4.20260613.1 to 5.20260804.1

Commits

• See full diff in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vitest from 4.1.8 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• a7a61e7 chore: release v4.1.9 (#10598)
• 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
• 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
• a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
• See full diff in compare view

Updates wrangler from 4.98.0 to 4.119.0

Release notes

Sourced from wrangler's releases.

wrangler@4.119.0

Minor Changes

• #14952 20470fa Thanks @​nelsonjsduarte! - Add --parse-type flag to wrangler ai-search create

  wrangler ai-search create now accepts --parse-type to control how a website data source discovers URLs. sitemap (the default) reads XML sitemaps; discover follows links recursively.

  Previously the parse type could only be chosen through the interactive wizard, which was skipped whenever --source was supplied — so it was impossible to create a discover instance from a script.

  wrangler ai-search create my-instance \
    --type web-crawler \
    --source https://example.com \
    --parse-type discover

  The interactive wizard now offers Discover alongside Sitemap. --parse-type is only valid with --type web-crawler; passing it with --type builtin or --type r2 is rejected, since the API stores the value for those source types but never reads it. When the flag is omitted in non-interactive mode the field is left unset and the API default (sitemap) applies.

• #14941 266172b Thanks @​nickpatt! - Improve the Local Explorer's Observability views

  console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).

• #14064 a9e5abb Thanks @​petebacondarwin! - Add support for OAuth 2.0 Device Authorization Grant to wrangler login

  Run wrangler login --device to authenticate without a local callback server. Useful in containers, remote SSH sessions, Codespaces, and any other environment where localhost:8976 is unreachable from your browser.

  The new flow:

  • prints the verification URL and user code to the terminal,
  • attempts to open the verification URL in your default browser automatically (suppressed via --browser=false),
  • and polls the token endpoint until you approve the request (with a 5-minute hard cap).

  The verification URL is supplied by the authorization server, so it is rejected unless it is an https URL on the same auth domain the device code was requested from — it is never printed or opened otherwise.

  --callback-host and --callback-port cannot be combined with --device, since this flow does not start a local callback server.

Patch Changes

• #14984 9c74538 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260730.1	^5.20260731.1
  workerd	1.20260730.1	1.20260731.1

• #15012 0d33cb8 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

... (truncated)

Commits

• 2938c01 Version Packages (#15021)
• b6a8629 Revert "Version Packages (#14977)" (#15033)
• 42c4227 Version Packages (#14977)
• 511635c [wrangler] Skip the CAA half of the unenv-preset testDns E2E (#15016)
• ebd1dfd [vite-plugin] Surface Local Explorer API to headless agents, matching wrangle...
• a9e5abb [wrangler] Add OAuth 2.0 Device Authorization Grant support (#14064)
• 20470fa [wrangler] Add --parse-type to ai-search create (#14952)
• 5fd6127 [miniflare] De-flake rate limit tests at bucket boundaries (#14961)
• 95d9b12 Version Packages (#14946)
• e0bbf55 [wrangler] Fix workflows errors messages (#14919)
• Additional commits viewable in compare view

[richardthe3rd]

@dependabot rebase

[richardthe3rd]

Closing this — the typescript bump to 6.0.3 breaks npm ci because openapi-typescript@7.13.0 declares typescript@"^5.x" as a peer dependency and no release of openapi-typescript supports TypeScript 6 yet.

The error:

npm error ERESOLVE could not resolve
npm error peer typescript@"^5.x" from openapi-typescript@7.13.0
npm error Found: typescript@6.0.3

I've added an ignore rule to .github/dependabot.yml (branch claude/ci-failure-review-440-s7fgbe) to block major TypeScript bumps in the worker group until openapi-typescript ships TS6 support. Once it does, we can remove the ignore rule and let Dependabot re-open the bump.

---

Generated by Claude Code