Skip to content

build(deps): bump undici, @cloudflare/vite-plugin and wrangler#4

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-2b83e6c990
Open

build(deps): bump undici, @cloudflare/vite-plugin and wrangler#4
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-2b83e6c990

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Mar 22, 2026

Bumps undici to 7.24.4 and updates ancestor dependencies undici, @cloudflare/vite-plugin and wrangler. These dependencies need to be updated together.

Updates undici from 7.18.2 to 7.24.4

Release notes

Sourced from undici's releases.

v7.24.4

What's Changed

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

What's Changed

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

What's Changed

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

What's Changed

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

... (truncated)

Commits

Updates @cloudflare/vite-plugin from 1.21.2 to 1.30.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.30.0

Minor Changes

  • #12848 ce48b77 Thanks @​emily-shen! - Enable local explorer by default

    This ungates the local explorer, a UI that lets you inspect the state of D1, DO and KV resources locally by visiting /cdn-cgi/explorer during local development.

    Note: this feature is still experimental, and can be disabled by setting the env var X_LOCAL_EXPLORER=false.

Patch Changes

  • #12942 4f7fd79 Thanks @​jamesopstad! - Avoid splicing into the middleware stack for Vite versions other than v6

    Previously, the plugin spliced its pre-middleware into the Vite middleware stack relative to viteCachedTransformMiddleware. In Vite 8, this middleware can be omitted in some scenarios, which would cause the splice to fail. The plugin now registers pre-middleware using server.middlewares.use() directly, which places it in the correct position for Vite 7+. For Vite 6, the middleware is moved to the correct position in a post hook.

  • Updated dependencies [782df44, 3c988e2, 62545c9, d028ffb, cb71403, 71ab981, 3a1c149, 7c3c6c6, ce48b77, 8729f3d]:

    • wrangler@4.76.0
    • miniflare@4.20260317.1
    • @​cloudflare/unenv-preset@​2.16.0

@​cloudflare/vite-plugin@​1.29.1

Patch Changes

  • #12936 cff91ff Thanks @​jamesopstad! - Select the appropriate vite/module-runner implementation during dev based on the user's Vite version

    The plugin now builds against Vite 8 and ships two bundled copies of vite/module-runner: one from Vite 8 and one from Vite 7.1.12 (the last version before a breaking change to the module runner in Vite 7.2.0). At dev server startup, the correct implementation is selected based on the user's installed Vite version. This is Vite 8's module runner for users on Vite >= 7.2.0, and the legacy module runner for users on older versions.

  • Updated dependencies [c9b3184, 13df6c7, df0d112, 81ee98e, c600ce0, f509d13, 3b81fc6, 0a7fef9]:

    • wrangler@4.75.0
    • miniflare@4.20260317.0

@​cloudflare/vite-plugin@​1.29.0

Minor Changes

  • #12885 12505c9 Thanks @​edmundhung! - Add Vite 8 to the supported peer dependency range

    The package now lists Vite 8 in its peer dependency range, so installs with Vite 8 no longer show a peer dependency warning.

Patch Changes

  • #12859 876108a Thanks @​dario-piotrowicz! - Fix crash when plugins send HMR events before runner initialization

    Previously, if another Vite plugin (such as vite-plugin-vue-devtools) sent HMR events during configureServer before the Cloudflare plugin had initialized its runner, the dev server would crash with AssertionError: The WebSocket is undefined. The environment's WebSocket send operations are now deferred until the runner is fully initialized, allowing early HMR events to be handled gracefully.

  • Updated dependencies [ade0aed, 2b9a186, 65f1092, 7b0d8f5, 351e1e1, 2b9a186]:

    • miniflare@4.20260312.1
    • wrangler@4.74.0

@​cloudflare/vite-plugin@​1.28.0

Minor Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.30.0

Minor Changes

  • #12848 ce48b77 Thanks @​emily-shen! - Enable local explorer by default

    This ungates the local explorer, a UI that lets you inspect the state of D1, DO and KV resources locally by visiting /cdn-cgi/explorer during local development.

    Note: this feature is still experimental, and can be disabled by setting the env var X_LOCAL_EXPLORER=false.

Patch Changes

  • #12942 4f7fd79 Thanks @​jamesopstad! - Avoid splicing into the middleware stack for Vite versions other than v6

    Previously, the plugin spliced its pre-middleware into the Vite middleware stack relative to viteCachedTransformMiddleware. In Vite 8, this middleware can be omitted in some scenarios, which would cause the splice to fail. The plugin now registers pre-middleware using server.middlewares.use() directly, which places it in the correct position for Vite 7+. For Vite 6, the middleware is moved to the correct position in a post hook.

  • Updated dependencies [782df44, 3c988e2, 62545c9, d028ffb, cb71403, 71ab981, 3a1c149, 7c3c6c6, ce48b77, 8729f3d]:

    • wrangler@4.76.0
    • miniflare@4.20260317.1
    • @​cloudflare/unenv-preset@​2.16.0

1.29.1

Patch Changes

  • #12936 cff91ff Thanks @​jamesopstad! - Select the appropriate vite/module-runner implementation during dev based on the user's Vite version

    The plugin now builds against Vite 8 and ships two bundled copies of vite/module-runner: one from Vite 8 and one from Vite 7.1.12 (the last version before a breaking change to the module runner in Vite 7.2.0). At dev server startup, the correct implementation is selected based on the user's installed Vite version. This is Vite 8's module runner for users on Vite >= 7.2.0, and the legacy module runner for users on older versions.

  • Updated dependencies [c9b3184, 13df6c7, df0d112, 81ee98e, c600ce0, f509d13, 3b81fc6, 0a7fef9]:

    • wrangler@4.75.0
    • miniflare@4.20260317.0

1.29.0

Minor Changes

  • #12885 12505c9 Thanks @​edmundhung! - Add Vite 8 to the supported peer dependency range

    The package now lists Vite 8 in its peer dependency range, so installs with Vite 8 no longer show a peer dependency warning.

Patch Changes

  • #12859 876108a Thanks @​dario-piotrowicz! - Fix crash when plugins send HMR events before runner initialization

    Previously, if another Vite plugin (such as vite-plugin-vue-devtools) sent HMR events during configureServer before the Cloudflare plugin had initialized its runner, the dev server would crash with AssertionError: The WebSocket is undefined. The environment's WebSocket send operations are now deferred until the runner is fully initialized, allowing early HMR events to be handled gracefully.

  • Updated dependencies [ade0aed, 2b9a186, 65f1092, 7b0d8f5, 351e1e1, 2b9a186]:

    • miniflare@4.20260312.1
    • wrangler@4.74.0

... (truncated)

Commits
  • 7d2661b Version Packages (#12945)
  • 4f7fd79 Avoid splicing into the middleware stack for Vite versions other than v6 (#12...
  • aa26784 Convert from ESLint to oxlint, Prettier to oxfmt (#12930)
  • a671740 Version Packages (#12923)
  • e25bd0e Update prettier to 3.8.1 (#12939)
  • cff91ff Use Vite 8 for building the plugin and as the default for running tests (#12936)
  • af20d06 Add support for TanStack Start in @​cloudflare/vite-plugin README (#11537)
  • 2e6b4ab Version Packages (#12876)
  • 876108a [vite-plugin] Fix crash when plugins send HMR events before runner initializa...
  • 12505c9 feat(vite-plugin-cloudflare): add Vite 8 to the supported peer dependency ran...
  • Additional commits viewable in compare view

Updates wrangler from 4.60.0 to 4.76.0

Release notes

Sourced from wrangler's releases.

wrangler@4.76.0

Minor Changes

  • #12893 782df44 Thanks @​gpanders! - Rewrite wrangler containers list to use the paginated Dash API endpoint

    wrangler containers list now fetches from the /dash/applications endpoint instead of /applications, displaying results in a paginated table with columns for ID, Name, State, Live Instances, and Last Modified. Container state is derived from health instance counters (active, degraded, provisioning, ready).

    The command supports --per-page (default 25) for interactive pagination with Enter to load more and q/Esc to quit, and --json for machine-readable output. Non-interactive environments load all results in a single request.

  • #12957 62545c9 Thanks @​natewong1313! - Add Stream binding support to Wrangler and workers-utils

    Wrangler and workers-utils now recognize the stream binding in configuration, deployment metadata, and generated worker types. This enables projects to declare Stream bindings in wrangler.json and have the binding represented consistently across validation, metadata mapping, and type generation.

  • #12848 ce48b77 Thanks @​emily-shen! - Enable local explorer by default

    This ungates the local explorer, a UI that lets you inspect the state of D1, DO and KV resources locally by visiting /cdn-cgi/explorer during local development.

    Note: this feature is still experimental, and can be disabled by setting the env var X_LOCAL_EXPLORER=false.

Patch Changes

  • #12938 71ab981 Thanks @​dario-piotrowicz! - Add backward-compatible autoconfig support for Astro v5 and v4 projects

    The astro add cloudflare command in older Astro versions installs the latest adapter version, which causes compatibility issues. This change adds manual configuration logic for projects using Astro versions before 6.0.0:

    • Astro 6.0.0+: Uses the native astro add cloudflare command (unchanged behavior)
    • Astro 5.x: Installs @astrojs/cloudflare@12 and manually configures the adapter
    • Astro 4.x: Installs @astrojs/cloudflare@11 and manually configures the adapter
    • Astro < 4.0.0: Returns an error prompting the user to upgrade

  • #11892 7c3c6c6 Thanks @​staticpayload! - Handle registry ports when matching container image digests

    Wrangler now strips tags without breaking registry ports when comparing local images to remote digests. This prevents unnecessary pushes for tags like localhost:5000/app:tag.

  • Updated dependencies [3c988e2, d028ffb, cb71403, 3a1c149, ce48b77, 8729f3d]:

    • miniflare@4.20260317.1
    • @​cloudflare/unenv-preset@​2.16.0

wrangler@4.75.0

Minor Changes

  • #12492 3b81fc6 Thanks @​thomasgauvin! - feat: add wrangler tunnel commands for managing Cloudflare Tunnels

    Adds a new set of commands for managing remotely-managed Cloudflare Tunnels directly from Wrangler:

    • wrangler tunnel create <name> - Create a new Cloudflare Tunnel
    • wrangler tunnel list - List all tunnels in your account
    • wrangler tunnel info <tunnel> - Display details about a specific tunnel
    • wrangler tunnel delete <tunnel> - Delete a tunnel (with confirmation)
    • wrangler tunnel run <tunnel> - Run a tunnel using cloudflared

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump undici, @cloudflare/vite-plugin and wrangler
5104e89 
Bumps [undici](https://github.com/nodejs/undici) to 7.24.4 and updates ancestor dependencies [undici](https://github.com/nodejs/undici), [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). These dependencies need to be updated together.


Updates `undici` from 7.18.2 to 7.24.4
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.18.2...v7.24.4)

Updates `@cloudflare/vite-plugin` from 1.21.2 to 1.30.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.30.0/packages/vite-plugin-cloudflare)

Updates `wrangler` from 4.60.0 to 4.76.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.76.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 7.24.4
  dependency-type: indirect
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.30.0
  dependency-type: direct:development
- dependency-name: wrangler
  dependency-version: 4.76.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants