wrangler@4.103.0 depends on unpublished esbuild@0.28.1; miniflare path depends on unpublished undici@7.28.0

[derek-codebridge]

What happened

The current fixed Wrangler dependency path appears to reference package versions that are not published on npm, which blocks install/audit remediation.

Reproduction

npm view wrangler@4.103.0 dependencies --json
npm view esbuild@0.28.1 version
npm view miniflare@4.20260617.1 dependencies --json
npm view undici@7.28.0 version

Current result

wrangler@4.103.0 lists esbuild: 0.28.1 and miniflare: 4.20260617.1.

npm view esbuild@0.28.1 version returns E404 / no matching version.

miniflare@4.20260617.1 lists undici: 7.28.0.

npm view undici@7.28.0 version returns E404 / no matching version.

Impact

Installing or updating to the fixed Wrangler/Miniflare path fails with ETARGET/E404 because npm cannot resolve those transitive dependencies. This prevents downstream projects from moving to the intended fixed dependency line.

Expected result

The published Wrangler/Miniflare dependency graph should only reference package versions available on npm, or the missing package versions should be published.

Environment

Checked on 2026-06-20 against the public npm registry.

[harryzcy]

Both esbuild@0.28.1 and undici@7.28.0 exist on npm

• https://www.npmjs.com/package/esbuild/v/0.28.1
• https://www.npmjs.com/package/undici/v/7.28.0

Are you setting min-release-age for npm config? that could prevent npm from seeing newer package versions

[jamesopstad]

Closing as the specified versions are published.