Bump undici, @cloudflare/vite-plugin and wrangler in /website

[dependabot]

Bumps undici to 7.28.0 and updates ancestor dependencies undici, @cloudflare/vite-plugin and wrangler. These dependencies need to be updated together.

Updates undici from 7.24.8 to 7.28.0

Release notes

Sourced from undici's releases.

v7.28.0

⚠️ Security Release

This release line addresses 7 security advisories, all shipped in v7.28.0.

Action required: Upgrade to undici 7.28.0 or later.

npm install undici@^7.28.0

The v7 line is not affected by GHSA-38rv-x7px-6hhq (CVE-2026-9675), which is an 8.x-only regression.

Note on GHSA-hm92-r4w5-c3mj: this fix shipped in v7.28.0, not the earlier 7.2x line — the vulnerable single-pool code was still present through v7.27.2. The per-origin pool fix is 3805b8f8 (#5041).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	7.28.0	8cb10f98
GHSA-vmh5-mc38-953g	CVE-2026-9697	High (7.4)	7.28.0	04201f89
GHSA-hm92-r4w5-c3mj	CVE-2026-6734	High (7.5)	7.28.0	3805b8f8
GHSA-pr7r-676h-xcf6	CVE-2026-9678	Moderate (5.9)	7.28.0	85a24055
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	7.28.0	d0574cc4
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	7.28.0	d0574cc4
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	7.28.0	ea8930cf

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: 8cb10f98 websocket: limit the number of fragments in a message (part of backport a027a4a0 Backport WebSocket maxPayloadSize fixes to v7.x, #5423)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service.

• Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
• Workaround: none — upgrade is required.

TLS certificate validation bypass in SOCKS5 ProxyAgent — CVE-2026-9697

GHSA-vmh5-mc38-953g · CWE-295

... (truncated)

Commits

• f9eba0a Bumped v7.28.0 (#5430)
• a027a4a Backport WebSocket maxPayloadSize fixes to v7.x (#5423)
• 8cb10f9 websocket: limit the number of fragments in a message
• 04201f8 fix: honor requestTls when proxy is SOCKS5
• fcd642f fix(socks5): preserve dispatch backpressure return value (#5166)
• bc98c97 fix(socks5): use configured connector in Socks5ProxyAgent (#5168)
• 9e1c743 fix(socks5): encode embedded IPv4 tails in IPv6 literals correctly (#5099)
• 376c8be fix(socks5): enforce authenticated state before CONNECT (#5097)
• 3805b8f fix(socks5-proxy-agent): use per-origin pools to prevent cross-origin routing...
• 85a2405 fix(cache): trim qualified field names
• Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.37.1 to 1.45.1

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.45.1

Patch Changes

• #14610 e727842 Thanks @​martijnwalraven! - Keep watching config changes after a failed dev server restart

  Previously, when a config change made the dev server restart fail — for example because the updated Worker config was invalid — the plugin stopped watching config changes entirely: the change handler (covering the Worker config files, local dev vars, and the assets configuration) removed itself before restarting, and only a successfully created server would register a fresh one. Since Vite keeps the current server running when a restart fails, every subsequent config change (including the one that fixes the config) was silently ignored for the rest of the session.

  The handler now stays registered and guards against re-entrant restarts instead, so fixing the config restarts the dev server as expected.

• #14418 cb30df3 Thanks @​matthewdavidrodgers! - Improve routing performance for Workers with assets

  Reduce request handling latency by streamlining the router Worker's request path. The loopback infrastructure remains available for future use.

• Updated dependencies [34e696d, d39ae01, 3de70df, c79504f, 9f04a7e, 9f04a7e, cb30df3, cb6c3f9, c7dbe1a, 3f3afbb, e6fbc4e, 4e1a7a7, 9f04a7e]:

  • miniflare@4.20260714.0
  • wrangler@4.112.0

@​cloudflare/vite-plugin@​1.45.0

Minor Changes

• #14652 317ce1f Thanks @​jamesopstad! - Append Workers runtime types to the generated types when using experimental.newConfig, with a new types.includeRuntime option

  When using the experimental new config (cloudflare.config.ts), the plugin now appends the Workers runtime types (generated from your compatibility date and flags) to worker-configuration.d.ts, alongside the types inferred from your config. This is controlled by a new experimental.newConfig.types.includeRuntime option, which defaults to true.

  As part of this change, types are now generated only during vite dev (not vite build), since compatibility settings are resolved from the active dev session. This affects the experimental new config path only.

Patch Changes

• #14588 eb99ab1 Thanks @​emily-shen! - fix: Respect auth profiles when using remote bindings in the Vite plugin

  Auth profiles (configured via wrangler auth create and wrangler auth activate) were previously being ignored when using remote bindings with the Vite plugin. This is now fixed.

  Note that the profile directory is resolved based on the Vite project root.

• #14645 cbdd107 Thanks @​jamesopstad! - Fix load time crash on Node.js versions earlier than 22.15

  The plugin eagerly imported registerHooks from node:module, which only exists on Node.js v22.15.0+. registerHooks is now read lazily, meaning that missing support is only surfaced when using experimental.newConfig.

• Updated dependencies [7692a61, ed33326, 018574b, eb99ab1, cdf3148, 7692a61, 7692a61, 3015320, 899c297, 9da77ac, 317ce1f]:

  • miniflare@4.20260710.0
  • wrangler@4.111.0

@​cloudflare/vite-plugin@​1.44.0

Minor Changes

• #14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

  A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.45.1

Patch Changes

• #14610 e727842 Thanks @​martijnwalraven! - Keep watching config changes after a failed dev server restart

  Previously, when a config change made the dev server restart fail — for example because the updated Worker config was invalid — the plugin stopped watching config changes entirely: the change handler (covering the Worker config files, local dev vars, and the assets configuration) removed itself before restarting, and only a successfully created server would register a fresh one. Since Vite keeps the current server running when a restart fails, every subsequent config change (including the one that fixes the config) was silently ignored for the rest of the session.

  The handler now stays registered and guards against re-entrant restarts instead, so fixing the config restarts the dev server as expected.

• #14418 cb30df3 Thanks @​matthewdavidrodgers! - Improve routing performance for Workers with assets

  Reduce request handling latency by streamlining the router Worker's request path. The loopback infrastructure remains available for future use.

• Updated dependencies [34e696d, d39ae01, 3de70df, c79504f, 9f04a7e, 9f04a7e, cb30df3, cb6c3f9, c7dbe1a, 3f3afbb, e6fbc4e, 4e1a7a7, 9f04a7e]:

  • miniflare@4.20260714.0
  • wrangler@4.112.0

1.45.0

Minor Changes

• #14652 317ce1f Thanks @​jamesopstad! - Append Workers runtime types to the generated types when using experimental.newConfig, with a new types.includeRuntime option

  When using the experimental new config (cloudflare.config.ts), the plugin now appends the Workers runtime types (generated from your compatibility date and flags) to worker-configuration.d.ts, alongside the types inferred from your config. This is controlled by a new experimental.newConfig.types.includeRuntime option, which defaults to true.

  As part of this change, types are now generated only during vite dev (not vite build), since compatibility settings are resolved from the active dev session. This affects the experimental new config path only.

Patch Changes

• #14588 eb99ab1 Thanks @​emily-shen! - fix: Respect auth profiles when using remote bindings in the Vite plugin

  Auth profiles (configured via wrangler auth create and wrangler auth activate) were previously being ignored when using remote bindings with the Vite plugin. This is now fixed.

  Note that the profile directory is resolved based on the Vite project root.

• #14645 cbdd107 Thanks @​jamesopstad! - Fix load time crash on Node.js versions earlier than 22.15

  The plugin eagerly imported registerHooks from node:module, which only exists on Node.js v22.15.0+. registerHooks is now read lazily, meaning that missing support is only surfaced when using experimental.newConfig.

• Updated dependencies [7692a61, ed33326, 018574b, eb99ab1, cdf3148, 7692a61, 7692a61, 3015320, 899c297, 9da77ac, 317ce1f]:

  • miniflare@4.20260710.0
  • wrangler@4.111.0

1.44.0

Minor Changes

• #14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

... (truncated)

Commits

• 82918ad Version Packages (#14699)
• cb30df3 Remove loopback for Router worker (#14418)
• e727842 fix(vite-plugin): keep watching config changes after a failed restart (#14610)
• b449bb0 Version Packages (#14644)
• ed33326 [miniflare] Add logging of emails sent by workers to .wrangler/tmp. (#14627)
• 317ce1f Generate runtime types when using the new config in vite dev and `wrangler ...
• eb99ab1 fix: pass auth profiles to vite (#14588)
• eced610 Version Packages (#14628)
• 774c09e Version Packages (#14603)
• e57b77c Version Packages (#14592)
• Additional commits viewable in compare view

Updates wrangler from 4.92.0 to 4.112.0

Release notes

Sourced from wrangler's releases.

wrangler@4.112.0

Minor Changes

• #14470 3de70df Thanks @​DiogoSantoss! - Add a top-level addresses field to Wrangler configuration for Email Routing

  You can now declare the inbound email addresses handled by your Worker directly in wrangler.json:

  {
    "name": "my-worker",
    "main": "src/index.ts",
    "compatibility_date": "2026-05-21",
    "addresses": ["support@example.com", "*@example.com"]
  }

• #14706 cb6c3f9 Thanks @​edmundhung! - Add Durable Object storage access to createTestHarness()

  You can now execute SQL against a SQLite-backed Durable Object to seed or assert the storage state.

  const server = createTestHarness({
    workers: [{ configPath: "./wrangler.json" }],
  });
  await server.listen();
  const worker = server.getWorker();
  const storage = await worker.getDurableObjectStorage("COUNTER", {
  name: "user-123",
  });
  await worker.fetch("/counter/user-123");
  const rows = await storage.exec(
  "SELECT value FROM counters WHERE id = ?",
  "user-123"
  );
  expect(rows).toEqual([{ value: 1 }]);

• #14562 9f04a7e Thanks @​martijnwalraven! - Emit a typed runtimeError event on the unstable_startWorker DevEnv for uncaught Worker exceptions

  Uncaught Worker exceptions were only source-mapped and printed, so programmatic consumers had to scrape terminal output to observe them. The DevEnv now re-emits a RuntimeErrorEvent (like reloadComplete) carrying the exception text and source-mapped stack — fed from Miniflare's pretty-error seam via the new handleUncaughtError option for exceptions the runtime catches, and from the inspector for those it does not.

Patch Changes

• #14682 d39ae01 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

... (truncated)

Commits

• 82918ad Version Packages (#14699)
• 24731b5 [wrangler] Wait for workerd cleanup in port conflict E2E (#14730)
• 028ce1f [wrangler] Wait for workers.dev propagation in E2Es (#14728)
• c79504f fix(wrangler): support containers in test harness (#14725)
• 4c1309e [wrangler] Use default readiness timeout in local dev E2Es (#14729)
• b38f494 chore: consolidate most packages on zod 4.4.3 in pnpm catalog (#14707)
• cb6c3f9 feat(wrangler): access do storage with test harness (#14706)
• c7dbe1a fix(wrangler): type the public startWorker input as WranglerStartDevWorkerInp...
• 9f04a7e feat: surface uncaught Worker exceptions as a typed runtimeError event in loc...
• 3de70df [wrangler] Add top-level addresses config field for Email Routing (#14470)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.