[petebacondarwin]

Backports the retained-workspace portion of #16490 to Vite plugin v1.

V1 directly calls HeadersSchema.parse() and RedirectsSchema.parse() from private workers-shared while constructing asset configuration. Update that bundled Zod copy from 4.6.5 to the published 4.6.6 release and regenerate the lockfile with pnpm 10.33.0. This addresses excessive memory use when validating oversized collections in code actually used by v1.

Stacked on #16501. Keep workers-shared private and preserve all workspace:* references. The public Miniflare/helper copies require their own published releases and remain intended coverage in the existing runtime draft #16444; this PR does not claim to update those bundled copies. No dependency's upstream regression tests are copied into v1.

Validation: Node 22.22.1 / pnpm 10.33.0; pnpm build, pnpm check (including types), pnpm test:ci, pnpm test:fixtures, and the existing asset headers/redirects playground pass in dev (6 pass, 3 expected failures) and preview (8 pass, 1 skipped).

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because: this consumes the published Zod fix; existing retained validator tests and plugin asset configuration playgrounds cover its integration, without copying Zod's own regression tests.
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: updates the validator dependency without adding user configuration.

Note

This is a contribution from an AI agent: Codex.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: f621ad8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[petebacondarwin]

@petebacondarwin (recorded author of #16490) and @edmundhung (verified human ant-core approver), could you please check this Vite plugin v1 backport and approve it if it looks good?

V1 directly uses the retained workers-shared Zod schemas for _headers and _redirects. This upgrades that bundled copy to published Zod 4.6.6 with a genuine lockfile and one plugin changeset. The public Miniflare/helper copies are covered separately through the now-published runtime release in existing #16444. Build, checks/types, retained tests/fixtures, and actual headers/redirects dev/preview playgrounds pass; no upstream dependency regression is copied.

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

[devin-ai-integration]

Devin Review found 1 potential issue.

[clanky-the-clanker]

✅ Approved — A small, scoped bump of the catalog Zod version (4.6.5 → 4.6.6) used by private workers-shared, with a matching plugin patch changeset. No issues found.

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

---

✅ All checks passed

📋 Code Quality: ✅ LGTM

This pull request changes one line in the pnpm-workspace.yaml catalog, moving zod from 4.6.5 to 4.6.6. packages/workers-shared picks it up through catalog:default. All workspace:* references are kept and workers-shared stays private, as the repository guidelines require. The lockfile was regenerated and was not reviewed line by line.

---

📝 Documentation: ✅ LGTM

The changeset .changeset/v1-retained-zod.md is a patch for @cloudflare/vite-plugin. It accurately describes the user-facing effect: _headers and _redirects validation now uses less memory on oversized collections. No public documentation changes are needed.

---

_{Reviewed commit: f621ad83}

[pkg-pr-new]

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16502

commit: f621ad8

[workers-devprod]

Codeowners reviews satisfied