chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Resolved 1 open Dependabot security alert by bumping the vulnerable transitive dependency's parent packages

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#54	ws	high	Bumped wrangler (^4.61.0 -> ^4.112.0) and @cloudflare/vitest-pool-workers (^0.15.1 -> ^0.18.6) in examples/js-worker, both of which now pull in a miniflare release that depends on the patched ws@8.21.0 instead of the vulnerable 8.18.0 (GHSA-96hv-2xvq-fx4p, memory exhaustion DoS from tiny fragments/data chunks)

Additional changes required to keep the build green

• Bumped @cloudflare/workers-types (^4.20260127.0 -> ^5.20260719.1) to match the newer workerd runtime types pulled in by the updated wrangler/miniflare
• The newer @cloudflare/workers-types makes the tracing field on the global ExecutionContext type required, which is incompatible with Hono's own (older-shaped) ExecutionContext type returned by c.executionCtx. Fixed by explicitly importing and using Hono's ExecutionContext type in examples/js-worker/src/index.ts instead of relying on the ambient global type — no runtime behavior change.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 75e44c55-8ce1-425b-8dbc-19a9f9bf7855

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR resolves an open Dependabot security alert by updating the examples/js-worker toolchain dependencies so that miniflare pulls in a patched ws version, and adjusts TypeScript typing to remain compatible with the newer Cloudflare Workers type definitions.

Changes:

• Bumped wrangler and @cloudflare/vitest-pool-workers (and updated the lockfile), resulting in miniflare depending on ws@8.21.0 instead of 8.18.0.
• Bumped @cloudflare/workers-types in the examples/js-worker workspace to match the newer runtime/tooling types.
• Updated examples/js-worker/src/index.ts to use Hono’s ExecutionContext type explicitly to avoid incompatibility with the newer global ExecutionContext typing.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
package-lock.json	Locks updated dependency graph reflecting the wrangler/miniflare updates and the patched ws version.
examples/js-worker/package.json	Bumps devDependencies to versions that address the ws vulnerability and align Workers types.
examples/js-worker/src/index.ts	Imports and uses Hono’s ExecutionContext type to keep typechecking compatible with updated @cloudflare/workers-types.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.