deps-dev(deps-dev): bump the development-dependencies group with 5 updates by dependabot[bot] · Pull Request #29 · unredacted/csp-report-worker

dependabot · 2026-06-02T03:57:10Z

Bumps the development-dependencies group with 5 updates:

Package	From	To
@cloudflare/vitest-pool-workers	`0.16.6`	`0.16.11`
@cloudflare/workers-types	`4.20260518.1`	`4.20260602.1`
svelte-check	`4.4.8`	`4.5.0`
vite	`8.0.13`	`8.0.16`
vitest	`4.1.6`	`4.1.8`

Updates @cloudflare/vitest-pool-workers from 0.16.6 to 0.16.11

Release notes

Sourced from @cloudflare/vitest-pool-workers's releases.

@cloudflare/vitest-pool-workers@0.16.11

Patch Changes

#14070 96ae856 Thanks @dmmulroy! - Fix Durable Object RPC dispatch for constructors that return proxies

Durable Object RPC methods mediated by a returned Proxy are now resolved through that proxy after validating prototype exposure. This allows wrappers that bind methods to the underlying instance to use private fields and methods in Vitest, while matching workerd's rejection of constructor-assigned RPC overrides.

Updated dependencies [a2ef1a3, cbb39bd, cbb39bd, 408432a, 1103c07, 7bb5c7a, 5b5cbd3, a2ef1a3, 2c1d8b2, ce4eb20, 5fa3de6, 37176e5, 0ce88ea, 66d86ba, 9dee4cc, 97d7d81, c647ccc, f623ae4, c8c7ec0, 39d8717, ee56ec0, b64b7e4, e4c8fd9, 2dffeeb, 972d13d, 4c0da7b, 13cbadb, 59e43e4]:

miniflare@4.20260529.0

wrangler@4.96.0

@cloudflare/vitest-pool-workers@0.16.10

Patch Changes

Updated dependencies [ca5b604, c1fd2fd, 49c1a59, fee1ce4, b3962ff, d042705, 420e457, 8b1467e]:

wrangler@4.95.0

miniflare@4.20260526.0

@cloudflare/vitest-pool-workers@0.16.9

Patch Changes

#13933 90092c0 Thanks @petebacondarwin! - Derive bundler externals from package.json and shrink the published bundle

The bundler's external list was previously hand-maintained and out of sync with package.json — undici and semver were both listed as external despite being only devDependencies. The published dist/pool/index.mjs consequently contained a top-level import { fetch } from "undici" that was only resolvable because pnpm happened to hoist undici from other packages' devDependencies during local development.

The bundler now derives its external list from dependencies + peerDependencies in package.json, making it impossible for a devDependency to silently end up externalized.

Combined with the new "sideEffects": false declaration in @cloudflare/workers-utils, the unused cloudflared / tunnel exports (and their transitive undici import) are now tree-shaken out of the pool entirely. dist/pool/index.mjs no longer references undici at all, and shrinks from ~489 KB to ~125 KB.

Updated dependencies [52e9082, 0733688, fc1f7b9, 30657e1, 8c569c6, f598eac, 3a1fbed]:

wrangler@4.94.0

miniflare@4.20260521.0

@cloudflare/vitest-pool-workers@0.16.8

Patch Changes

#13919 c7eab7f Thanks @petebacondarwin! - Fix the outbound CF-Worker header reflecting the route pattern hostname instead of the parent zone, and falling back to <worker-name>.example.com under vite dev, vitest-pool-workers, and getPlatformProxy

Two related issues affected the CF-Worker header on outbound subrequests in local development:

Under @cloudflare/vite-plugin, @cloudflare/vitest-pool-workers, and getPlatformProxy, the header fell back to <worker-name>.example.com even when routes were configured, because unstable_getMiniflareWorkerOptions and the equivalent getPlatformProxy worker-options path did not propagate a zone value to Miniflare. This broke local development against services that reject unknown CF-Worker hosts (for example, Apple WeatherKit returns 403 Forbidden).

Across the above paths and wrangler dev --local, when a route used the zone_name field (for example { pattern: "foo.example.com/*", zone_name: "example.com" }), the header was set to the pattern's hostname (foo.example.com) rather than the zone name (example.com). Production sets CF-Worker to the zone name that owns the Worker, so this was inconsistent with deployed behaviour.

Both bugs are fixed: the new unstable_getMiniflareWorkerOptions / getPlatformProxy path now propagates a zone derived from the first configured route, and all four local-dev paths now prefer a route's explicit zone_name over the pattern hostname when computing that zone. When zone_name isn't set, the existing best-effort behaviour is preserved — for wrangler dev this means dev.host is still honoured as a local override and the pattern hostname is used as a final fallback. Resolving the parent zone for zone_id-only, custom_domain, or plain-string routes would require an API lookup, so locally we still approximate it with the pattern hostname.

Note: dev.host is intentionally not consulted by the unstable_getMiniflareWorkerOptions / getPlatformProxy paths — the dev config block is specific to wrangler dev.

Updated dependencies [fa1f61f, 2679e05, 7e40d98, adc9221, 735852d, d803737, c7eab7f, e04e180, 59cd880, 62abf97, e8c2031, e349fe0, da0fa8c, a5c9365]:

miniflare@4.20260520.0

wrangler@4.93.1

... (truncated)

Changelog

Sourced from @cloudflare/vitest-pool-workers's changelog.

0.16.11

Patch Changes

#14087 e3c862a Thanks @edmundhung! - Fix Durable Object RPC dispatch for constructors that return proxies

Durable Object RPC methods mediated by a returned Proxy are now resolved through that proxy after validating prototype exposure. This allows wrappers that bind methods to the underlying instance to use private fields and methods in Vitest, while matching workerd's rejection of constructor-assigned RPC overrides.

Updated dependencies [e3c862a, cbb39bd, cbb39bd, 408432a, 1103c07, 7bb5c7a, 5b5cbd3, e3c862a, e3c862a, 97d7d81, c647ccc, e3c862a, e3c862a, e3c862a, e3c862a, e3c862a, b64b7e4, e3c862a, e3c862a, e4c8fd9, 2dffeeb, e3c862a, e3c862a, 4c0da7b, 972d13d, 13cbadb, 59e43e4]:

miniflare@4.20260529.0

wrangler@4.96.0

0.16.10

Patch Changes

Updated dependencies [ca5b604, c1fd2fd, 49c1a59, fee1ce4, b3962ff, d042705, 420e457, 8b1467e]:

wrangler@4.95.0

miniflare@4.20260526.0

0.16.9

Patch Changes

#13933 90092c0 Thanks @petebacondarwin! - Derive bundler externals from package.json and shrink the published bundle

The bundler's external list was previously hand-maintained and out of sync with package.json — undici and semver were both listed as external despite being only devDependencies. The published dist/pool/index.mjs consequently contained a top-level import { fetch } from "undici" that was only resolvable because pnpm happened to hoist undici from other packages' devDependencies during local development.

The bundler now derives its external list from dependencies + peerDependencies in package.json, making it impossible for a devDependency to silently end up externalized.

Combined with the new "sideEffects": false declaration in @cloudflare/workers-utils, the unused cloudflared / tunnel exports (and their transitive undici import) are now tree-shaken out of the pool entirely. dist/pool/index.mjs no longer references undici at all, and shrinks from ~489 KB to ~125 KB.

Updated dependencies [52e9082, 0733688, fc1f7b9, 30657e1, 8c569c6, f598eac, 3a1fbed]:

wrangler@4.94.0

miniflare@4.20260521.0

0.16.8

Patch Changes

#13919 c7eab7f Thanks @petebacondarwin! - Fix the outbound CF-Worker header reflecting the route pattern hostname instead of the parent zone, and falling back to <worker-name>.example.com under vite dev, vitest-pool-workers, and getPlatformProxy

Two related issues affected the CF-Worker header on outbound subrequests in local development:

Under @cloudflare/vite-plugin, @cloudflare/vitest-pool-workers, and getPlatformProxy, the header fell back to <worker-name>.example.com even when routes were configured, because unstable_getMiniflareWorkerOptions and the equivalent getPlatformProxy worker-options path did not propagate a zone value to Miniflare. This broke local development against services that reject unknown CF-Worker hosts (for example, Apple WeatherKit returns 403 Forbidden).

Across the above paths and wrangler dev --local, when a route used the zone_name field (for example { pattern: "foo.example.com/*", zone_name: "example.com" }), the header was set to the pattern's hostname (foo.example.com) rather than the zone name (example.com). Production sets CF-Worker to the zone name that owns the Worker, so this was inconsistent with deployed behaviour.

Both bugs are fixed: the new unstable_getMiniflareWorkerOptions / getPlatformProxy path now propagates a zone derived from the first configured route, and all four local-dev paths now prefer a route's explicit zone_name over the pattern hostname when computing that zone. When zone_name isn't set, the existing best-effort behaviour is preserved — for wrangler dev this means dev.host is still honoured as a local override and the pattern hostname is used as a final fallback. Resolving the parent zone for zone_id-only, custom_domain, or plain-string routes would require an API lookup, so locally we still approximate it with the pattern hostname.

Note: dev.host is intentionally not consulted by the unstable_getMiniflareWorkerOptions / getPlatformProxy paths — the dev config block is specific to wrangler dev.

... (truncated)

Commits

0998725 Set disallowTypeAnnotations to false in `@typescript-eslint/consistent-ty...
3a746ac [tools] Lint that all non-bundled deps of published packages are pinned (#14112)
337e912 Remove trailing periods from URLs in terminal output (#14105)
50ef724 Version Packages (#14082)
e3c862a Revert "Version Packages" (#14087)
689f381 Version Packages (#14048)
96ae856 [vitest-pool-workers] Dispatch RPC methods through proxied Durable Object ins...
62dd39c Version Packages (#14012)
b92f87c Version Packages (#13995)
90092c0 [vitest-pool-workers] Stop externalizing devDependencies from the published b...
Additional commits viewable in compare view

Updates @cloudflare/workers-types from 4.20260518.1 to 4.20260602.1

Commits

See full diff in compare view

Updates svelte-check from 4.4.8 to 4.5.0

Release notes

Sourced from svelte-check's releases.

svelte-check@4.5.0

Minor Changes

feat: support Svelte 5 declaration tags (#3033)

Patch Changes

fix: properly handle props with the name slot inside Svelte 5 snippets (#3030)

feat: add support for svelte config ts/mts files (#3009)

Commits

67fbcae Version Packages (#3018)
3474048 fix(emitDts): drop declarations emitted outside declarationDir (#2965)
e9f4ce9 feat: support Svelte 5 declaration tags (#3033)
6bd8b17 fix: take into account component references when calculating snippet hoistabi...
86fafb1 fix: handle prop named "slot" inside Svelte 5 snippets (#3030)
f53efb3 feat: add support for svelte config ts/mts files (#3009)
6d19b08 fix: tweak "show compiled" icon (#3019)
6e31da3 fix: prevent > in expression affects HTML folding (#3029)
1521b92 fix: support prettier.useEditorConfig setting (#3026)
eb3fba7 feat: support CSS completions in nested style tags (#3022)
Additional commits viewable in compare view

Updates vite from 8.0.13 to 8.0.16

Release notes

Sourced from vite's releases.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.16 (2026-06-01)

Bug Fixes

deps: reject UNC paths for launch-editor-middleware (#22571) (50b9512)

reject windows alternate paths (#22572) (dc245c7)

8.0.15 (2026-06-01)

Features

send 408 on request timeout (#22476) (c85c9ee)

update rolldown to 1.0.3 (#22538) (646dbed)

Bug Fixes

capitalize error messages and remove spurious space in parse error (#22488) (85a0eff)

deps: update all non-major dependencies (#22511) (2686d7d)

dev: fix html-proxy cache key mismatch for /@fs/ HTML paths (#21762) (47c4213)

glob: error on relative glob in virtual module when no files match (#22497) (5c8e98f)

optimizer: close the rolldown bundle when write() rejects (#22528) (e3cfb9d)

resolve: provide onWarn for viteResolvePlugin in JS plugin containers (#22509) (40985f1)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22566) (3052a67)

Code Refactoring

correct logic in collectAllModules function (#22562) (6978a9c)

8.0.14 (2026-05-21)

Features

update rolldown to 1.0.2 (#22484) (96efc88)

Bug Fixes

deps: update all non-major dependencies (#22471) (98b8163)

dev: handle errors when sending messages to vite server (#22450) (e8e9a34)

html: handle trailing slash paths in transformIndexHtml (#22480) (5d94d1b)

optimizer: pass oxc jsx options to transformSync in dependency scan (#22342) (b3132da)

Miscellaneous Chores

deps: update rolldown-related dependencies (#22470) (7cb728e)

remove irrelevant commits from changelog (2c69495)

Code Refactoring

glob: do not rewrite import path for absolute base (#22310) (0ae2844)

... (truncated)

Commits

f94df87 release: v8.0.16
dc245c7 fix: reject windows alternate paths (#22572)
50b9512 fix(deps): reject UNC paths for launch-editor-middleware (#22571)
8d1b019 release: v8.0.15
2686d7d fix(deps): update all non-major dependencies (#22511)
3052a67 chore(deps): update rolldown-related dependencies (#22566)
e3cfb9d fix(optimizer): close the rolldown bundle when write() rejects (#22528)
6978a9c refactor: correct logic in collectAllModules function (#22562)
646dbed feat: update rolldown to 1.0.3 (#22538)
85a0eff fix: capitalize error messages and remove spurious space in parse error (#22488)
Additional commits viewable in compare view

Updates vitest from 4.1.6 to 4.1.8

Release notes

Sourced from vitest's releases.

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

Commits

e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the development-dependencies group with 5 updates: | Package | From | To | | --- | --- | --- | | [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.16.6` | `0.16.11` | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260518.1` | `4.20260602.1` | | [svelte-check](https://github.com/sveltejs/language-tools) | `4.4.8` | `4.5.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.13` | `8.0.16` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.6` | `4.1.8` | Updates `@cloudflare/vitest-pool-workers` from 0.16.6 to 0.16.11 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.16.11/packages/vitest-pool-workers) Updates `@cloudflare/workers-types` from 4.20260518.1 to 4.20260602.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `svelte-check` from 4.4.8 to 4.5.0 - [Release notes](https://github.com/sveltejs/language-tools/releases) - [Commits](https://github.com/sveltejs/language-tools/compare/svelte-check@4.4.8...svelte-check@4.5.0) Updates `vite` from 8.0.13 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vitest` from 4.1.6 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest) --- updated-dependencies: - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.16.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@cloudflare/workers-types" dependency-version: 4.20260602.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: svelte-check dependency-version: 4.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vitest dependency-version: 4.1.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-06-02T03:57:10Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

socket-security · 2026-06-02T03:59:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@cloudflare/vitest-pool-workers@0.16.6 ⏵ 0.16.11	⁺³	^-1
vitest@4.1.6 ⏵ 4.1.8	⁺³		^-1
vite@8.0.13 ⏵ 8.0.16	⁺¹	⁺¹
svelte-check@4.4.8 ⏵ 4.5.0			^-2
@cloudflare/workers-types@4.20260518.1 ⏵ 4.20260602.1		⁺¹	⁺¹
wrangler@4.92.0 ⏵ 4.96.0	⁺²	⁺⁹	⁺⁵

View full report

dependabot · 2026-06-08T09:35:31Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot closed this Jun 8, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/development-dependencies-a0d23c1cb5 branch June 8, 2026 09:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps-dev(deps-dev): bump the development-dependencies group with 5 updates#29

deps-dev(deps-dev): bump the development-dependencies group with 5 updates#29
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-a0d23c1cb5

dependabot Bot commented on behalf of github Jun 2, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 2, 2026

Uh oh!

socket-security Bot commented Jun 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

@​cloudflare/vitest-pool-workers@​0.16.11

Patch Changes

@​cloudflare/vitest-pool-workers@​0.16.10

Patch Changes

@​cloudflare/vitest-pool-workers@​0.16.9

Patch Changes

@​cloudflare/vitest-pool-workers@​0.16.8

Patch Changes

0.16.11

Patch Changes

0.16.10

Patch Changes

0.16.9

Patch Changes

0.16.8

Patch Changes

svelte-check@4.5.0

Minor Changes

Patch Changes

v8.0.16

v8.0.15

v8.0.14

8.0.16 (2026-06-01)

Bug Fixes

8.0.15 (2026-06-01)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

8.0.14 (2026-05-21)

Features

Bug Fixes

Miscellaneous Chores

Code Refactoring

v4.1.8

🐞 Bug Fixes

View changes on GitHub

v4.1.7

🐞 Bug Fixes

View changes on GitHub

Uh oh!

dependabot Bot commented on behalf of github Jun 2, 2026

Labels

Uh oh!

socket-security Bot commented Jun 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 2, 2026 •

edited

Loading

`@cloudflare/vitest-pool-workers@0`.16.11

`@cloudflare/vitest-pool-workers@0`.16.10

`@cloudflare/vitest-pool-workers@0`.16.9

`@cloudflare/vitest-pool-workers@0`.16.8