[petebacondarwin]

Stacked directly on #16540 (replacement for auto-merged #16538), with #16539 following this runtime upgrade.

Backports the useful runtime and fallback compatibility-date behavior from #16403 and #16437, using the now-merged mixed-v2 release #16429.

V1 exports getLocalWorkerdCompatibilityDate(), fills missing dates from the bundled workers-utils default, and runs dev/preview through Miniflare. Pin the published Miniflare 5.20261023.0-beta in all three retained consumers, Wrangler 4.153.0 and its peer minimum, Workers types 5.20261023.1, and the matching helpers. All five direct workers-utils consumers move together to actual release 0.49.0; deploy-helpers 0.24.0, containers-shared 0.23.3, and workers-auth 0.15.1 keep the public helper graph compatible. These supersede the unpublished 0.48.1 / 0.23.1 intentions in this draft. Preserve every private workspace:* reference and the plugin's v1 release metadata.

Regenerate the genuine lockfile with pnpm 10.33.0. Earlier backports supply the retained Undici 7.30.1 client (#16480), HTTP adapter (#16493), request cookie fix (#16501), retained Zod (#16502), export cleanup (#16503), and WebSocket ownership fix (#16504). Their upgrades stay in those parents exactly once. This PR's remaining diff contains only the runtime/helper/types pins, their real lock changes, and the existing single runtime changeset.

The released runtime/helper packages also supply the public dependency portions of #16476 (Undici) and #16490 (Zod). Published workers-auth 0.15.1 supplies #16485's Windows keyring installation fix for retained remote-bindings authentication. There are no copied public-package source files, upstream dependency tests, installed-Wrangler CLI tests, or extra mapping-only PRs/changesets. The new V5-only opt-in Artifacts simulator from #16177 is included in Miniflare but requires no v1 feature restoration.

Publication is no longer blocked: npm returned HTTP 200 for Miniflare, Wrangler and all four coupled helpers. The actual release manifests and published dependency graph were compared before installing; intended versions alone were not treated as coverage.

Validation: Node 22.22.1 / pnpm 10.33.0; genuine frozen install, pnpm build, pnpm check (including types), pnpm test:ci, pnpm test:fixtures, relevant local dev/preview playgrounds and credential-free package-manager E2E checks pass. Runtime/default-date API and all exact pins/private workspace references are verified. Ancestor #16407 separately still awaits actual PostgreSQL/MySQL queries through the plugin's dev/preview paths; no live credentials are configured here.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because: this consumes published runtime fixes through pinned dependencies; existing retained tests, plugin dev/preview integration suites and API checks validate the integration without duplicating upstream dependency tests.
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: updates existing runtime/default-date behavior and dependencies; the plugin changeset describes the user-facing effect.

Note

This is a contribution from an AI agent: Codex, preparing maintainer-requested v1 backports.

[changeset-bot]

🦋 Changeset detected

Latest commit: 3eb00cd

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[petebacondarwin]

@dependabot[bot] (recorded bot author of #16403) and @petebacondarwin (verified human ant-core approver), please check this Vite plugin v1 backport and approve it once it is ready and looks good.

V1 uses the bundled workers-utils fallback compatibility date and Miniflare for dev/preview. This adapts the original to intended pinned npm dependencies: Miniflare 5.20261022.0-beta, matching Wrangler/helpers and Workers types, with one plugin patch changeset. Earlier merged #16379 supplies the previous runtime; #16407 supplies the separate retained Hyperdrive changes. Private workspace references and intentional public-package removals are preserved.

This remains draft: the runtime/helper versions from pending release #16429 are unpublished (npm HTTP 404), so real pnpm lockfile regeneration and build/type/test validation must follow publication. Static checks pass; no runtime validation against the intended versions is claimed.

[petebacondarwin]

@dependabot[bot] (recorded bot author of #16437) and @edmundhung (verified human ant-core approver), please check this Vite plugin v1 backport and approve it once it is ready and looks good.

V1 uses the bundled workers-utils fallback compatibility date and Miniflare in dev/preview. Pending release #16429 now combines #16403 and #16437 into the October 23 runtime. This existing supplying backport advances to intended Miniflare 5.20261023.0-beta, Wrangler 4.153.0, Workers types 5.20261023.1, and fallback date 2026-10-23, keeping the coupled helper pins and one plugin patch changeset together. Earlier merged #16379 already supplies the previous published runtime, and parent #16407 supplies the separate retained Hyperdrive changes.

This remains draft: all six required runtime/helper releases return npm HTTP 404, and a real pnpm resolution attempt fails for the intended Miniflare version. Metadata checks pass; genuine lockfile regeneration and build/type/test validation must follow publication. Private workspace references and intentional public-source removals are preserved.

[petebacondarwin]

@tannerlinsley (author of #16476) and @petebacondarwin (verified human ant-core approver), please check the public dependency portion of this Vite plugin v1 backport and approve it once it is ready and looks good.

Parent #16480 supplies the independently useful retained remote-bindings Undici 7.30.1 upgrade. This existing runtime draft supplies the separately bundled public dependency fix through the same intended Miniflare 5.20261023.0-beta, Wrangler 4.153.0 and coupled helper versions already required for #16403 and #16437. Pending main release #16429 now contains #16476 in those versions. The remaining diff is still eight files; its existing runtime changeset now notes the HTTP fix. The real parent lockfile and earlier upgrades are preserved without duplication.

This stays draft: all six required runtime/helper versions still return npm HTTP 404 and genuine pnpm resolution fails for the intended Miniflare. Static metadata checks pass, but intended-dependency build/type/runtime validation requires publication and real lock regeneration. No removed public source or upstream regression tests are restored. Existing requests for #16403 and #16437 are not repeated.

[petebacondarwin]

@Cherry (recorded author of #16485) and @petebacondarwin (verified human ant-core approver), could you please check this Vite plugin v1 backport and approve it if it looks good?

Published workers-auth 0.15.1 supplies the Windows keyring installation fix to retained remote-bindings authentication. V1 can trigger this installation when remote bindings resolve keyring-backed credentials. The existing runtime/helper upgrade supplies the entire relevant change; no public source or CLI regression is restored.

Build, all workspace checks/types, retained tests/fixtures, 39 tests in each of local dev/preview, the default-date API, and 3 credential-free package-manager E2E tests pass with the intended published dependencies. Ancestor #16407 still needs live Hyperdrive PostgreSQL/MySQL queries.

[petebacondarwin]

@petebacondarwin (recorded author of #16490) and @edmundhung (verified human ant-core approver), could you please check this Vite plugin v1 backport and approve it if it looks good?

This supplies the public Miniflare/helper portion of the Zod update through their actual published releases. Earlier #16502 separately upgrades the retained workers-shared validator. Its catalog/lock changes stay in that parent, and the single existing runtime changeset describes this dependency upgrade.

Build, all workspace checks/types, retained tests/fixtures, 39 tests in each of local dev/preview, the default-date API, and 3 credential-free package-manager E2E tests pass with the intended published dependencies. Ancestor #16407 still needs live Hyperdrive PostgreSQL/MySQL queries.

[petebacondarwin]

@workers-devprod (recorded author, ANT Bot release automation account of #16429) and @NuroDev (verified human ant-core approver), could you please check this Vite plugin v1 backport and approve it if it looks good?

The mixed v2 release is the trigger for the compatible Miniflare 5.20261023.0-beta upgrade in all three v1 consumers. It is now published, together with Wrangler 4.153.0 and matching helpers. This reuses the original supplying runtime draft for #16403/#16437 and public dependency coverage; the genuine lockfile replaces the publication-blocked state, without another release-mapping PR or changeset.

Build, all workspace checks/types, retained tests/fixtures, 39 tests in each of local dev/preview, the default-date API, and 3 credential-free package-manager E2E tests pass with the intended published dependencies. Ancestor #16407 still needs live Hyperdrive PostgreSQL/MySQL queries.

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

[pkg-pr-new]

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16444

commit: d127f1d

[devin-ai-integration]

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[clanky-the-clanker]

💬 Approved with comments — The dependency pins are exact and consistent, and the private workspace references are kept. The only finding is an INFO note: fixtures and playgrounds still pin Wrangler below the plugin's new peer minimum.

Findings: 1 info

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

📋 Code Quality: 💬 1 info

The pins are consistent. One INFO note: fixtures and playgrounds still pin Wrangler 4.151.0.

Recommendation: 💬 Optional Nits

• [INFO] Fixtures and playgrounds still pin wrangler 4.151.0, below the plugin's new peer minimum ^4.153.0. Installs may print peer-dependency warnings, and those suites don't test against the pinned Wrangler 4.153.0. Aligning the pins is optional. (fixtures/shared/package.json:7)

View full review

🔄 Since last review: the WebSocket ownership change and its changeset are no longer part of this diff, so the earlier WARNING and the note about the out-of-date description are resolved. The note about the Wrangler pins still applies.

What was checked

• The miniflare, @cloudflare/workers-types, @cloudflare/workers-utils, @cloudflare/containers-shared, @cloudflare/deploy-helpers and @cloudflare/workers-auth pins are exact and consistent.
• The workers-types catalog entry in pnpm-workspace.yaml matches the plugin's pin of 5.20261023.1.
• The private workspace:* references and the workers-sdk.prerelease marker are unchanged.
• The new changeset is a plugin patch.

Wrangler pins below the new peer minimum

• The plugin's peer range for Wrangler is now ^4.153.0.
• fixtures/shared, fixtures/dev-registry, fixtures/create-test-harness-example and most plugin playgrounds still pin wrangler at 4.151.0.
• Installs may therefore print peer-dependency warnings, and those suites don't test against the newly pinned Wrangler.
• Aligning these pins is optional.

---

✅ All other checks passed

🚀 Release: ✅ LGTM

Risk: Low. There is a single plugin patch changeset, and the v1 prerelease metadata is preserved. The Wrangler pins in the fixtures are covered in the code quality section.

---

🔒 Security: ✅ LGTM

This pull request only bumps published packages to exact versions. The private workspace references are unchanged.

---

📖 AGENTS.md: ✅ LGTM

Public packages come from npm at exact versions, and private packages stay as workspace:* references, as the maintenance-branch rules require.

---

⚡ Performance: ✅ LGTM

No performance concerns.

---

📝 Documentation: ✅ LGTM

The runtime changeset describes the change users will see.

---

_{Reviewed commit: d127f1d3}

[workers-devprod]

Codeowners reviews satisfied