[petebacondarwin]

Backports #16486 to Vite plugin v1.

V1 shares the original request conversion bug: the HTTP adapter comma-joins repeated Set-Cookie request values, including commas in Expires. Preserve each cookie when converting HTTP requests and WebSocket upgrades. Retain the original real-socket regressions, including normal Cookie joining and other repeated headers.

Stacked on #16493. That earlier backport supplies the published HTTP adapter upgrade; this PR contains only the independently remaining header conversion fix, its tests, and one plugin patch changeset. Existing private workspace references and runtime pins remain intact.

Validation: pnpm build, pnpm check (including types), pnpm test:ci, pnpm test:fixtures, and all 4 WebSocket playground tests in each of dev and preview pass with Node 22.22.1 / pnpm 10.33.0.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: restores existing HTTP and WebSocket header semantics without adding configuration.

Note

This is a contribution from an AI agent: Codex.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 8f37ae7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[petebacondarwin]

@petebacondarwin (recorded author of #16486) and @NuroDev (verified human ant-core approver), could you please check this Vite plugin v1 backport and approve it if it looks good?

V1 has the same comma-joining bug for repeated incoming Set-Cookie values. This retains the HTTP/WebSocket conversion fix and real-socket regressions. Earlier #16493 supplies the published adapter upgrade; it is not repeated here. Build, checks/types, retained tests/fixtures, and 4 WebSocket tests in each of dev and preview pass.

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[clanky-the-clanker]

✅ Approved — No findings. The pull request keeps each repeated Set-Cookie request value separate on both the HTTP and WebSocket upgrade paths, adds tests for both paths, and includes a plugin changeset.

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

🚀 Release: ✅ LGTM

Risk: Low. One patch changeset for the plugin. The private workspace references and runtime pins are unchanged.

---

🔒 Security: ✅ LGTM

No security concerns in the header conversion change.

---

📖 AGENTS.md: ✅ LGTM

The change follows the repository guidance: it uses a [vite-plugin] title prefix, adds a plugin changeset and includes tests.

---

📋 Code Quality: ✅ LGTM

The new createHeadersForIncomingMessage helper in packages/vite-plugin-cloudflare/src/utils.ts starts from the existing createHeaders output. It then rebuilds set-cookie from req.headers["set-cookie"], which Node always gives as an array. So a comma inside an Expires attribute no longer splits a cookie.

Both places that turn incoming requests into Fetch headers now use the helper:

• createRequestForIncomingMessage in utils.ts
• the WebSocket upgrade path in websockets.ts

The HTTP spec checks that each Set-Cookie value is kept. It also checks that Cookie and other repeated headers are still joined as before. The WebSocket spec checks the upgrade path. I found no problems with types, imports or repository conventions.

---

⚡ Performance: ✅ LGTM

Only the request's Set-Cookie values get extra handling. The work this adds per request is negligible.

---

📝 Documentation: ✅ LGTM

The changeset describes the fix. No public docs are needed, because no new configuration is added.

---

_{Reviewed commit: 8f37ae78}

[pkg-pr-new]

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16501

commit: 8f37ae7

[workers-devprod]

Codeowners reviews satisfied