[petebacondarwin]

Backport the independently useful retained portion of #16476. Vite plugin v1 bundles remote-bindings, whose tryExpandToken() calls Undici fetch() for the preview-token exchange. Undici 7.29.1 can emit an unhandled stream error after a malformed response rejects, terminating the dev process. Update the shared Undici and matching types catalog pins to 7.30.1, regenerate the pnpm lockfile, and add a plugin patch changeset for this bundled runtime dependency.

Stacked on the built-in-module backport #16479, which follows existing Hyperdrive #16407. The independent remaining diff is three files: the two catalog pins, their real pnpm-generated lock changes, and the plugin changeset. Preserve all private workspace:* references and exact public package pins. No public Miniflare source or upstream regression test is copied into this branch.

This fixes the retained client's bundled Undici copy. Published Miniflare 5.20261019.2-beta and the published helpers still contain Undici 7.29.1; this PR does not claim to update those bundled copies. Pending main release #16429 includes the upstream fix in Miniflare 5.20261023.0-beta, Wrangler 4.153.0 and coupled helpers. Existing runtime draft #16444 will supply those exact dependency versions after this PR, once npm publication permits real lock regeneration and validation. No new release-only PR or duplicated public dependency changeset is needed.

Validation uses Node 22.22.1 and pnpm 10.33.0, including the same pinned pnpm inside temporary package-manager projects. pnpm build, all 58 pnpm check tasks, and all eight retained pnpm test:ci tasks pass (including 211 plugin tests and 31 remote-bindings tests). The built plugin bundle contains the retained Undici 7.30.1 implementation. The local bindings playground passes all 10 tests in both dev and build/preview. Three selected local package-manager E2E tests also pass; no credentialed deployment tests were run. pnpm test:fixtures passes, including all 30 dev-registry tests, five test-harness Vitest tests and two Playwright tests.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because: existing retained client/plugin suites validate integration; the upstream Miniflare crash regression remains in main and is not duplicated as a v1 test.
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: this updates a bundled runtime dependency without changing public configuration or API.

Note

This is a contribution from an AI agent: Codex, preparing maintainer-requested v1 backports.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: f207fea

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[petebacondarwin]

@tannerlinsley (author of #16476) and @petebacondarwin (verified human ant-core approver), please check this Vite plugin v1 backport and approve it if it looks good.

The concrete retained change upgrades the Undici client bundled from remote-bindings, used by the preview-token exchange, plus matching types and a real pnpm lockfile. It has one plugin patch changeset. Existing upstream Miniflare tests stay in main. This is stacked on #16479 and #16407. Existing runtime draft #16444 will supply the separately bundled public Miniflare/helper fixes once their releases are published; the old published dependencies still contain their own Undici copies.

Build, all 58 checks, retained unit suites and fixtures, three selected local package-manager E2E assertions, and the local bindings playground in dev and preview pass with Node 22.22.1 and pnpm 10.33.0. The plugin bundle contains the retained Undici 7.30.1 implementation.

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[clanky-the-clanker]

✅ Approved — A clean dependency pin update with an accurate plugin changeset; no issues found.

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

📋 Code Quality: ✅ LGTM

The undici and undici-types catalog pins move to 7.30.1 together, and the lockfile resolves the new versions. The remaining undici@7.29.1 lockfile entry matches the description: published Miniflare and the published helpers still bundle that version.

---

📝 Documentation: ✅ LGTM

The plugin patch changeset accurately describes what users will notice and what changed in the bundled dependency.

---

_{Reviewed commit: f207feae}

[pkg-pr-new]

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16480

commit: f207fea

[workers-devprod]

Codeowners reviews satisfied