chore(deps): update cloudflare-workers

[renovate-fullsend]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vitest-pool-workers (source)	^0.18.0 → ^0.21.0
@cloudflare/vitest-pool-workers (source)	^0.8.0 → ^0.21.0
@cloudflare/workers-types	5.20260723.1 → 5.20260816.1
wrangler (source)	4.113.0 → 4.123.0
wrangler (source)	4.113.0 → 4.123.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.21.3

Compare Source

Patch Changes

• Updated dependencies [b8fd112, f0f2054, 339509d]:
  • miniflare@5.20260811.1-alpha
  • wrangler@​4.123.0

v0.21.2

Compare Source

Patch Changes

• #​15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

  Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

• #​15148 0b82b15 Thanks @​jamesopstad! - Ignore a nodejs_compat compatibility flag that the compatibility date already enables

  workerd rejects a compatibility flag that its compatibility date enables by default, so a Worker configured with both a compatibility date of 2026-08-04 or later and nodejs_compat failed to start locally with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore".

  The redundant nodejs_compat and nodejs_compat_v2 flags are now dropped when starting the runtime, which has no effect on the resulting Worker because the compatibility date enables both anyway. no_nodejs_compat and no_nodejs_compat_v2 still switch Node.js compatibility off, and a flag specified alongside its own opt-out is left alone so that workerd still reports those as contradictory.

• #​15123 d0c976c Thanks @​dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

  As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

  To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

  @cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

  wrangler types also no longer attributes its @types/node suggestion to "the nodejs_compat flag", which it can now make for Workers that do not set the flag at all.

• #​15131 90dd5e5 Thanks @​vicb! - Bump capnp-es to 0.0.15.

  Also re-generate the types for the latest .capnp files

• Updated dependencies [d0c976c, d0c976c, 0b82b15, d0c976c, d0c976c, 90dd5e5, 3b02915]:

  • miniflare@5.20260811.0-alpha
  • wrangler@​4.122.0

v0.21.1

Compare Source

Patch Changes

• #​14882 ab9132d Thanks @​petebacondarwin! - Report built-in modules that a Worker's compatibility settings don't provide as module errors, instead of crashing workerd

  Previously, a Worker whose module graph statically reached a compatibility-gated built-in that wasn't enabled — for example import "node:child_process" without nodejs_compat — took down the runtime with *** Received signal #​11: Segmentation fault before any test ran. Vitest reported only Worker exited unexpectedly, naming neither the module nor the file that imported it, which made the cause very hard to find. The import didn't even have to be called; being reachable from the entrypoint was enough.

  The module fallback service answered these specifiers with a redirect to the modules root, but workerd already resolves node:/cloudflare:/workerd: specifiers there, so the redirect pointed back at the module workerd was in the middle of resolving and it recursed until the stack overflowed. Such a specifier only reaches the fallback service when workerd's own registry has already missed, so it's now reported as not found: workerd raises No such module "node:child_process", matching what wrangler dev does for the same Worker. The accompanying pool error names the module and points at compatibility flags rather than suggesting you bundle it, which can't help for a module built into the runtime.

• Updated dependencies [15cad03, 026e058, 731b33a, e1b5b4b, 5b1b930, 6e7d37d, d669088, 15cad03, c7aede7, 0aa8fa5]:

  • wrangler@​4.121.0
  • miniflare@5.20260804.1-alpha

v0.21.0

Compare Source

Minor Changes

• #​14994 2194f88 Thanks @​emily-shen! - Update the Workers Vitest pool for Miniflare's config-based options

  The Workers Vitest pool now converts the Miniflare options it creates for test sessions to Miniflare's config-based workers shape.

  For the most part, users should not expect to notice any changes.

  However, while miniflare.modulesRules is preserved for common text and WASM fixture imports, it is not a full replacement for Miniflare's old modules: true module graph collection and you may notice some differences in behaviour.

Patch Changes

• Updated dependencies [6dbd192, 2194f88, 2194f88, 2194f88, 2194f88, 2194f88, 2194f88, 2194f88]:
  • miniflare@5.20260804.0-alpha
  • wrangler@​4.120.1

v0.20.3

Compare Source

Patch Changes

• #​15013 8cf78c8 Thanks @​dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0

• Updated dependencies [35c87e9, b4f0c97, 8cf78c8, a60ff4d, 99eb50c, 35c87e9]:

  • wrangler@​4.120.0
  • miniflare@5.20260801.1-alpha

v0.20.2

Compare Source

Patch Changes

• Updated dependencies [20470fa, 9c74538, 266172b, a88d169, a88d169, daf65f2, a9e5abb]:
  • wrangler@​4.119.0
  • miniflare@5.20260801.0-alpha

v0.20.1

Compare Source

Patch Changes

• Updated dependencies [cc63aae, f92d1fc, a249591, f92d1fc, f92d1fc, cec9d88, e0bbf55]:
  • wrangler@​4.118.0

v0.20.0

Compare Source

Minor Changes

• #​14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options

  The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

  • wrappedBindings
  • cacheWarnUsage
  • fetchMock: you should use outboundService instead
  • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

  Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

• #​14586 5a56dda Thanks @​emily-shen! - Preserve the deprecated Miniflare cache option

  Vitest configurations using cache continue to work after the internal Miniflare v5 upgrade. The option is translated to cacheAPI; new configurations should use cacheAPI directly.

• #​14586 5a56dda Thanks @​emily-shen! - Stop enabling Miniflare's removed unsafeStickyBlobs option

  The pool no longer sets the unsafeStickyBlobs Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.

• Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

  • miniflare@5.20260730.0-alpha
  • wrangler@​4.117.0

v0.19.1

Compare Source

Patch Changes

• Updated dependencies [01d7020, beec0fb, 48f0c6c, 8049ca4, d7f38c3, 1394867, cc54478, 5c25cfe, b21eac2, bb09f1b, 1f61001, 01d7020, e31ab0f]:
  • miniflare@​4.20260730.0
  • wrangler@​4.116.0

v0.19.0

Compare Source

Minor Changes

• #​14879 e6480e3 Thanks @​dmmulroy! - Add a verbose option to cloudflareTest() and cloudflarePool() configuration

  Set verbose: false to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to true to preserve existing output.

Patch Changes

• #​14821 edc203e Thanks @​mishushakov! - Ignore workerd's disconnected: peer disconnected without gracefully ending TLS session exception logs

  When tests make real fetch() calls to external TLS endpoints, servers and load balancers routinely close idle keepalive connections without sending a TLS close_notify. No request fails — the connection is idle — but workerd logs a kj/compat/tls.c++ exception with a full stack trace each time, flooding otherwise green test runs. This is the TLS sibling of the disconnected: ... messages already in the ignore list, so filter it the same way.

• Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

  • wrangler@​4.115.0
  • miniflare@​4.20260722.1

v0.18.8

Compare Source

Patch Changes

• #​14793 7b3fea6 Thanks @​trafgals! - Prevent worker disposal errors from failing otherwise successful test runs

  Errors raised while disposing test Workers are now logged for diagnostics rather than overriding the test result. Set NODE_DEBUG=vitest-pool-workers to view these errors.

• Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

  • wrangler@​4.114.0
  • miniflare@​4.20260722.0

cloudflare/workerd (@​cloudflare/workers-types)

v5.20260816.1

Compare Source

v5.20260815.1

Compare Source

v5.20260814.1

Compare Source

v5.20260813.1

Compare Source

v5.20260812.1

Compare Source

v5.20260811.1

Compare Source

v5.20260810.1

Compare Source

v5.20260809.1

Compare Source

v5.20260808.1

Compare Source

v5.20260807.2

Compare Source

v5.20260804.1

Compare Source

v5.20260801.1

Compare Source

v5.20260731.1

Compare Source

v5.20260730.1

Compare Source

v5.20260729.1

Compare Source

v5.20260728.1

Compare Source

v5.20260727.1

Compare Source

v5.20260726.1

Compare Source

v5.20260724.1

Compare Source

cloudflare/workers-sdk (wrangler)

v4.123.0

Compare Source

Minor Changes

• #​15113 b8fd112 Thanks @​BSFishy! - Add local dev simulation for Cloudflare Access ctx.access.getIdentity()

  You can now configure a mock Cloudflare Access identity in wrangler.json so that ctx.access.getIdentity() returns it during local development.

  // wrangler.json
  {
    "access": {
      "dev": {
        "aud": "my-app-aud-tag",
        "identity": {
          "email": "user@example.com",
          "name": "Test User"
        }
      }
    }
  }

• #​15152 f0f2054 Thanks @​GregBrimble! - [private beta]: Updates the --ignore-defaults flag to --ignore-base-config on wrangler preview commands.

  --ignore-base-config now only takes effect on Preview creation, rather than on each deployment, since Preview base configuration is now copy-on-create rather than inherit-on-deploy.

• #​14872 339509d Thanks @​dario-piotrowicz! - Add automatic update prompts for out-of-date Cloudflare agent skills

  When Cloudflare skills were previously installed by Wrangler and the upstream cloudflare/skills repository has newer content, Wrangler now offers to update them after eligible commands complete.

  To reduce prompt fatigue, the update check only runs once a month (30 days since the last install or update). Declining suppresses the prompt until the next upstream change.

  When declining an update, Wrangler offers the option to permanently disable future update prompts. This preference is stored globally in ~/.wrangler/agents-skills-install.jsonc. The WRANGLER_NO_SKILLS_UPDATE_PROMPTS=true environment variable can also be used to suppress prompts. The --install-skills flag remains available regardless of these settings.

Patch Changes

• Updated dependencies [b8fd112]:
  • miniflare@5.20260811.1-alpha

v4.122.0

Compare Source

Minor Changes

• #​15123 d0c976c Thanks @​dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

  As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

  To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

  @cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

  wrangler types also no longer attributes its @types/node suggestion to "the nodejs_compat flag", which it can now make for Workers that do not set the flag at all.

Patch Changes

• #​15123 d0c976c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260804.1	^5.20260811.1
  workerd	1.20260804.1	1.20260811.1

• #​15148 0b82b15 Thanks @​jamesopstad! - Ignore a nodejs_compat compatibility flag that the compatibility date already enables

  workerd rejects a compatibility flag that its compatibility date enables by default, so a Worker configured with both a compatibility date of 2026-08-04 or later and nodejs_compat failed to start locally with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore".

  The redundant nodejs_compat and nodejs_compat_v2 flags are now dropped when starting the runtime, which has no effect on the resulting Worker because the compatibility date enables both anyway. no_nodejs_compat and no_nodejs_compat_v2 still switch Node.js compatibility off, and a flag specified alongside its own opt-out is left alone so that workerd still reports those as contradictory.

• #​15123 d0c976c Thanks @​dependabot! - Stop adding a redundant nodejs_compat flag to generated Wrangler configurations

  create-cloudflare and wrangler setup write today's date as the compatibility_date, and from 2026-08-04 that already enables nodejs_compat. Adding the flag as well made the generated project fail to start with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore", so the flag is now only added for earlier compatibility dates.

  create-cloudflare also removes the flag when a template, or a framework's own scaffolder, already wrote it into a configuration that ends up using such a compatibility date, and still installs @types/node for these projects even though there is no longer a flag to detect them by.

  wrangler setup does the same for a wrangler.json(c) that is already in the project: it writes today's date over whatever date that configuration was written for, so a nodejs_compat it finds there is removed as part of writing the file.

• #​15142 3b02915 Thanks @​penalosa! - Fix remote binding sessions reusing stale binding configurations

  Starting a new remote bindings session that reuses a Worker name no longer picks up the bindings from a previous session, which could cause Binding "..." not found errors.

• Updated dependencies [d0c976c, d0c976c, 0b82b15, d0c976c, 90dd5e5]:

  • miniflare@5.20260811.0-alpha

v4.121.0

Compare Source

Minor Changes

• #​15079 15cad03 Thanks @​podonnell-dev! - Add Preview base config secret commands

  Wrangler now manages Worker Preview base config secrets with wrangler preview base-config secret put, delete, list, and bulk. These commands update the Worker's previews_base_config.env, keeping shared defaults scoped to all of that Worker's Previews. wrangler preview base-config secret list reads from the Worker's Preview base config and prints secret names with values masked. wrangler preview base-config secret bulk deletes a secret when its value is null, matching wrangler secret bulk.

• #​15000 731b33a Thanks @​edmundhung! - Allow Wrangler projects to build a Worker once and reuse it in createTestHarness()

  Build the Worker once:

  wrangler deploy --dry-run --outdir ./worker-output

  Then reuse the emitted Worker during test harness startup and reset:

  const server = createTestHarness({
    workers: [
      {
        configPath: "./wrangler.jsonc",
        prebuiltWorkerDir: "./worker-output",
      },
    ],
  });

• #​14737 e1b5b4b Thanks @​ttoino! - Add email.sending as an event subscription source for queues

  wrangler queues subscription create now accepts --source email.sending alongside two new flags, --zone-id and --domain, which identify the zone and the sending domain (zone apex or a verified subdomain) to subscribe to. Both flags are required for this source. The subscription's resource is displayed as the sending domain in wrangler queues subscription get.

• #​15073 d669088 Thanks @​FlorentCollin! - Add US jurisdiction support to wrangler d1 create

  You can now create a D1 database in the US jurisdiction with wrangler d1 create <name> --jurisdiction us. The new jurisdiction is also listed in the command's help output.

• #​15079 15cad03 Thanks @​podonnell-dev! - Use Preview deployment PATCH APIs for Preview secret commands

  Wrangler now updates Worker Preview secrets by patching the named Preview's latest deployment instead of patching the Worker's Previews settings. This keeps secret changes scoped to one Preview, avoids affecting production or other Previews, and creates a new Preview deployment that goes live at 100% immediately. wrangler preview secret list now reads from the named Preview's latest deployment and prints secret names with values masked. wrangler preview secret bulk now deletes a secret when its value is null, matching wrangler secret bulk.

• #​14924 0aa8fa5 Thanks @​ariesclark! - Honor DO_NOT_TRACK=1 as a telemetry opt-out

  Wrangler now disables telemetry when DO_NOT_TRACK=1 is set, regardless of other telemetry settings.

Patch Changes

• #​15081 026e058 Thanks @​podonnell-dev! - Compact wrangler preview deployment success output

  wrangler preview now prints a concise success summary with the Preview name, Preview URL, deployment ID, and Deployment URL instead of the previous box-art settings summary.

• #​15132 5b1b930 Thanks @​dario-piotrowicz! - Fetch script metadata directly instead of listing all scripts

  When resolving Durable Object migrations, fetch the specific script's service metadata via /workers/services/{name} instead of listing all scripts in the account via /workers/scripts. This avoids downloading metadata for every Worker in the account just to find one script's migration tag.

• #​15032 6e7d37d Thanks @​Sertug17! - Fix wrangler dev commands crashing with No such module "wrangler:modules-watch" when "no_bundle": true

  Running wrangler dev or wrangler pages dev with bundling disabled ("no_bundle": true in wrangler.json, or the --no-bundle flag) no longer crashes at startup with Uncaught Error: No such module "wrangler:modules-watch". Live reloading on file changes continues to work as before.

• Updated dependencies [c7aede7]:

  • miniflare@5.20260804.1-alpha

v4.120.1

Compare Source

Patch Changes

• #​15072 6dbd192 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260801.1	^5.20260804.1
  workerd	1.20260801.1	1.20260804.1

• #​14994 2194f88 Thanks @​emily-shen! - Update local development for Miniflare's config-based options

  Wrangler now converts the Miniflare options it creates for local development to Miniflare's config-based workers shape.

  Users should not expect to notice any changes.

• Updated dependencies [6dbd192, 2194f88, 2194f88, 2194f88, 2194f88, 2194f88, 2194f88]:

  • miniflare@5.20260804.0-alpha

v4.120.0

Compare Source

Minor Changes

• #​15008 35c87e9 Thanks @​skepticfx! - Adds the ability to find container instances by exact ID or name

  wrangler containers instances <application_id> --search <instance_id_or_name> now searches every page and returns exact matches in human-readable or JSON output. JSON returns a top-level array, including an empty array when there is no match, while human-readable output prints a no-match message. If multiple instances have the same exact name, every matching instance is returned.

• #​15008 35c87e9 Thanks @​skepticfx! - Add explicit pagination to container instance JSON output

  Use wrangler containers instances <application_id> --json --per-page <size> to return one page with machine-readable result_info, then pass its next_page_token to --page-token to retrieve the next page. Plain --json remains backward-compatible: it requests the complete list and returns the existing top-level array.

Patch Changes

• #​15013 8cf78c8 Thanks @​dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0

• #​15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture

  Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.

  Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.

  The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.

• Updated dependencies [b4f0c97, [8cf78c8](https://redirect.github.com/cloudflare/workers-sdk/commit/8cf78c83cb4c64be8b458d7bd618b47e7c

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[github-actions]

Site preview

Preview: https://edf102bd-site.fullsend-ai.workers.dev

Commit: 1dafa6550eaa4de553e12c0f43a074b32a1b6ae1

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:52 AM UTC · Completed 4:04 AM UTC

Commit: 642cf9c · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:34 PM UTC · Completed 3:48 PM UTC

Commit: 946a2af · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:50 AM UTC · Completed 4:04 AM UTC

Commit: cd55b19 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:35 PM UTC · Completed 3:49 PM UTC

Commit: 521a467 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:54 AM UTC · Completed 4:09 AM UTC

Commit: 4f4542c · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:34 PM UTC · Completed 3:47 PM UTC

Commit: 760a76d · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:57 AM UTC · Completed 4:10 AM UTC

Commit: b39def3 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:35 PM UTC · Completed 3:54 PM UTC

Commit: 7709604 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:54 AM UTC · Completed 4:11 AM UTC

Commit: 3b230af · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:31 PM UTC · Completed 3:45 PM UTC

Commit: 78c652b · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:28 AM UTC · Completed 3:44 AM UTC

Commit: 2bd0fdc · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:22 PM UTC · Completed 3:39 PM UTC

Commit: 27e18bf · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:33 AM UTC · Completed 3:50 AM UTC

Commit: 6693b1e · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:22 PM UTC · Completed 3:37 PM UTC

Commit: 1dafa65 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[high] api-contract

The inner package pins vitest at ^3.2.0, but @cloudflare/vitest-pool-workers@0.21.x requires vitest@^4.1.0 as a peer dependency. The Makefile mint-cf-worker-test target runs cd $(WORKERSRC_DIR) && npm install independently — there is no lockfile in the inner directory, so npm will resolve vitest 3.x from the ^3.2.0 range, producing a peer dependency conflict. The root package.json already has vitest: ^4.1.4 (correctly aligned), but the inner package installs independently.

Suggested fix: Update vitest in internal/dispatch/cf/workersrc/package.json from ^3.2.0 to ^4.1.0 (or ^4.1.4 to match the root).