Merge pull request #310 from spoo-me/chore/dep-bumps

chore(deps): upgrade python and edge toolchain dependencies

Author: Zingzy

.github/dependabot.yml

@@ -15,6 +15,10 @@ updates:
         patterns:
           - "*"
     open-pull-requests-limit: 5
+    ignore:
+      # redis-py 8.x is blocked for now (see pyproject.toml pin).
+      - dependency-name: "redis"
+        versions: [">=8"]
 
   - package-ecosystem: "docker"
     directory: "/"

edge/spoo-edge-cache/package-lock.json

@@ -12,9 +12,10 @@
     "check": "wrangler types --check --strict-vars=false && tsc --noEmit && vitest run"
   },
   "devDependencies": {
-    "@cloudflare/vitest-pool-workers": "^0.9.12",
+    "@cloudflare/vitest-pool-workers": "^0.22.0",
+    "msw": "^2.15.0",
     "typescript": "^5.9.0",
-    "vitest": "^3.2.0",
-    "wrangler": "^4.30.0"
+    "vitest": "^4.1.11",
+    "wrangler": "^4.124.0"
   }
 }

edge/spoo-edge-cache/package.json

@@ -1,19 +1,21 @@
 import {
   createExecutionContext,
   env,
-  fetchMock,
   waitOnExecutionContext,
 } from "cloudflare:test";
-import { afterEach, beforeAll, describe, expect, it } from "vitest";
+import { HttpResponse, http } from "msw";
+import { setupServer } from "msw/node";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
 
 import fixtures from "../contract/fixtures.json";
 import worker, { lookupKey } from "../src/index";
 
-beforeAll(() => {
-  fetchMock.activate();
-  fetchMock.disableNetConnect();
-});
-afterEach(() => fetchMock.assertNoPendingInterceptors());
+// onUnhandledRequest: "error" is the disableNetConnect() of MSW — any
+// outbound fetch a test didn't arm via expectOriginFetch fails loudly.
+const server = setupServer();
+beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
+afterEach(() => server.resetHandlers());
+afterAll(() => server.close());
 
 /** Stub the next passthrough to origin and tag it so tests can assert
  * "this request reached origin" unambiguously. */
@@ -22,7 +24,21 @@ function expectOriginFetch(
   path: string | RegExp = /.*/,
   method = "GET",
 ) {
-  fetchMock.get(host).intercept({ path, method }).reply(200, "origin-served");
+  server.use(
+    http.all(
+      `${host}/*`,
+      ({ request }) => {
+        const url = new URL(request.url);
+        const pathMatches =
+          typeof path === "string"
+            ? url.pathname === path
+            : path.test(url.pathname);
+        if (request.method !== method || !pathMatches) return undefined;
+        return HttpResponse.text("origin-served");
+      },
+      { once: true },
+    ),
+  );
 }
 
 // The handler is typed for edge-ingress requests (IncomingRequestCfProperties);

edge/spoo-edge-cache/test/index.spec.ts

@@ -4,7 +4,7 @@
     "module": "es2022",
     "moduleResolution": "bundler",
     "lib": ["es2022"],
-    "types": ["@cloudflare/vitest-pool-workers"],
+    "types": ["@cloudflare/vitest-pool-workers/types"],
     "strict": true,
     "noEmit": true,
     "skipLibCheck": true,

edge/spoo-edge-cache/tsconfig.json

@@ -0,0 +1,16 @@
+import { cloudflareTest } from "@cloudflare/vitest-pool-workers";
+import { defineConfig } from "vitest/config";
+
+// Tests run inside actual workerd with the KV binding simulated from
+// wrangler.jsonc — the closest thing to production short of a PoP.
+export default defineConfig({
+  plugins: [
+    cloudflareTest({
+      wrangler: { configPath: "./wrangler.jsonc" },
+      // A developer's .dev.vars (ORIGIN_OVERRIDE for `wrangler dev`)
+      // must not leak into tests — passthrough behavior is under test
+      // and expects the plain fetch(request) path.
+      miniflare: { bindings: { ORIGIN_OVERRIDE: "" } },
+    }),
+  ],
+});

edge/spoo-edge-cache/vitest.config.mts

@@ -23,7 +23,8 @@ dependencies = [
     "pymongo>=4.13.0",
     "python-dotenv>=1.1.0",
     "python-multipart>=0.0.20",
-    "redis>=6.2.0",
+    # redis-py 8.x is blocked for now — keep the client on 7.x.
+    "redis>=6.2.0,<8",
     "regex>=2026.1.15",
     "sentry-sdk>=2.44.0",
     "slowapi>=0.1.9",

edge/spoo-edge-cache/vitest.config.ts

@@ -1,107 +1,75 @@
 aiohappyeyeballs==2.7.1
-aiohttp==3.14.1
+aiohttp==3.14.3
 aiosignal==1.4.0
-annotated-doc==0.0.4
-annotated-types==0.7.0
-anyio==4.14.1
+annotated-doc==0.0.5
+annotated-types==0.8.0
+anyio==4.14.2
 argon2-cffi==25.1.0
 argon2-cffi-bindings==25.1.0
 attrs==26.1.0
 authlib==1.7.2
-certifi==2026.6.17
-cffi==2.0.0
-cfgv==3.5.0
-charset-normalizer==3.4.7
+certifi==2026.7.22
+cffi==2.1.1
+charset-normalizer==3.5.1
 click==8.4.2
-coverage==7.15.0
-crawlerdetect==0.3.2
-cryptography==49.0.0
+crawlerdetect==0.4.2
+cryptography==50.0.0
 deprecated==1.3.1
 dicttoxml==1.7.16
-distlib==0.4.3
 dnspython==2.8.0
 email-validator==2.3.0
 emoji==2.15.0
 et-xmlfile==2.0.0
-execnet==2.1.2
 fast-depends==3.0.8
-fastapi==0.139.0
-faststream==0.7.1
-filelock==3.29.5
+fastapi==0.141.1
+faststream==0.7.4
+filelock==3.32.3
 frozenlist==1.8.0
-geoip2==5.2.0
+geoip2==5.3.0
 h11==0.16.0
 httpcore==1.0.9
 httptools==0.8.0
 httpx==0.28.1
-identify==2.6.19
-idna==3.18
-iniconfig==2.3.0
+idna==3.19
 itsdangerous==2.2.0
 jinja2==3.1.6
-joserfc==1.7.2
+joserfc==1.7.4
 limits==5.8.0
-markdown-it-py==4.2.0
 markupsafe==3.0.3
 maxminddb==3.1.1
-mdurl==0.1.2
 multidict==6.7.1
-nodeenv==1.10.0
 openpyxl==3.1.5
-outcome==1.3.0.post0
-packaging==26.2
-platformdirs==4.10.0
-pluggy==1.6.0
-pprintpp==0.4.0
-pre-commit==4.6.0
+packaging==26.3
 propcache==0.5.2
 pycountry==26.2.16
 pycparser==3.0
 pydantic==2.13.4
 pydantic-core==2.46.4
-pydantic-settings==2.14.2
-pygments==2.20.0
+pydantic-settings==2.15.0
 pyjwt==2.13.0
 pymongo==4.17.0
-pytest==9.1.1
-pytest-asyncio==1.4.0
-pytest-clarity==1.0.1
-pytest-cov==7.1.0
-pytest-mock==3.15.1
-pytest-randomly==4.1.0
-pytest-sugar==1.1.1
-pytest-xdist==3.8.0
-python-discovery==1.4.3
-python-dotenv==1.2.2
+python-dotenv==1.2.3
 python-multipart==0.0.32
 pyyaml==6.0.3
 redis==7.4.1
-regex==2026.6.28
+regex==2026.7.19
 requests==2.34.2
 requests-file==3.0.1
-rich==15.0.0
-ruff==0.15.20
-sentry-sdk==2.64.0
+sentry-sdk==2.68.0
 slowapi==0.1.10
-sniffio==1.3.1
-sortedcontainers==2.4.0
-starlette==1.3.1
+starlette==1.6.0
 structlog==26.1.0
-termcolor==3.3.0
-tldextract==5.3.1
-trio==0.33.0
+tldextract==5.3.2
 typing-extensions==4.16.0
-typing-inspection==0.4.2
+typing-inspection==0.4.4
 ua-parser==1.0.2
 ua-parser-builtins==202606
 ua-parser-rs==0.1.5
 urllib3==2.7.0
-uv==0.11.26
-uvicorn==0.49.0
+uvicorn==0.52.4
 uvloop==0.22.1
 validators==0.35.0
-virtualenv==21.5.1
 watchfiles==1.2.0
-websockets==16.0
-wrapt==2.2.2
-yarl==1.24.2
+websockets==17.0.1
+wrapt==2.3.0
+yarl==1.24.5