[petebacondarwin]

Backports the Vite plugin v1 effect of #16426 using the published runtime from #16556. The previous parent backports #16543, #16578 and #16579 have merged, so this PR now targets vite-plugin-v1 directly.

Clients signing Accept-Encoding: identity on the experimental local R2 S3 endpoint received 403 SignatureDoesNotMatch through Vite dev and preview. Miniflare 5.20261023.3-beta fixes runtime header normalization, but V1 also prepended identity in its request adapter, turning the signed value into identity, identity. Preserve the original header (including absence) for the canonical S3 route. Other Worker requests keep their existing encoding handling. Cover the actual Vite request handler with real HTTP requests and verify signed PUT/GET through the built plugin's dev/build/preview APIs.

Pin all three direct Miniflare consumers to published 5.20261023.3-beta and the coupled Wrangler dependency/peer/registry fixtures to 4.156.0 (the actual release, replacing the earlier unpublished 4.155.1 intent). Align retained shared helpers with the published graph: deploy-helpers 0.24.3, cli-shared-helpers 0.3.0, containers-shared 0.23.5, and workers-utils 0.50.1. Regenerate the genuine pnpm lockfile. Private packages and their workspace:* references remain intact. No public dependency source or upstream tests are restored.

The same Miniflare release supplies #16327: cross-process service/DO/tail bindings stay routed after a runtime crash restart, relevant to V1's existing development registry. No independently useful change remains for a separate backport or changeset. #16556 is recorded as covered by this existing runtime PR. This PR contains one plugin patch changeset.

Validation with Node 22.22.1 and pnpm 10.33.0: real lockfile regeneration and frozen install; pnpm check (58 tasks, including build/types); pnpm test:ci (8 tasks, including 237 plugin tests); request-adapter regression fails before the source change and passes after; signed identity-header PUT and GET both return 200 through actual Vite dev and preview, with correct stored contents. Local Explorer API smoke also passes. pnpm test:fixtures also passes all 6 tasks, including 30 development-registry tests and the build harness (5 Vitest and 2 Playwright tests). No credentialed deployment or remote API tests are claimed.

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: the plugin patch changeset describes the fix to the existing experimental S3 endpoint.

Note

This is a contribution from an AI agent: Codex, under the authorized v1 backport automation.

[changeset-bot]

🦋 Changeset detected

Latest commit: 22ad813

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[petebacondarwin]

@pmiguel (original author) @dario-piotrowicz (verified human ant-core approver): please check this v1 backport of #16426 and approve it if it looks good. V1 exposes the local S3 endpoint via r2_buckets[].local_dev.experimental_s3_credentials; I reproduced signed Accept-Encoding: identity failures through the plugin's actual dev and preview APIs. This draft records intended Miniflare 5.20261023.3-beta/Wrangler 4.155.1/deploy-helpers 0.24.3 from pending #16556, atop #16579/#16578/#16543. Those versions are not on npm yet, so the genuine parent lock is preserved and publication/install/build/types/plugin endpoint validation must complete before readiness. No public dependency source or tests are copied.

[pmiguel]

The backport approach looks correct to me at first glance. The pending release that includes the fix (#16556) now targets Wrangler 4.156.0, so you should update the pinned version. Follow up validation to be done after the new packages get published, as noted.

[pkg-pr-new]

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16580

commit: 22ad813

[petebacondarwin]

@dexvdev (original author) @petebacondarwin (verified human ant-core approver): please check this v1 backport coverage of #16327 and approve it if it looks good. This existing PR's published Miniflare 5.20261023.3-beta pin supplies the cross-process binding crash-restart fix to V1's development registry. No separate source copy, upstream test, or mapping-only changeset is needed. It also contains the necessary V1 signed-S3 request adapter fix and coupled Wrangler 4.156.0 upgrade; build, types, retained tests and actual dev/preview signed requests pass.

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

[petebacondarwin]

@workers-devprod (recorded original author, ANT Bot) @dario-piotrowicz (verified human ant-core approver): please check this v1 backport of the compatible runtime release from #16556 and approve it if it looks good. This existing PR now pins the actually published Miniflare 5.20261023.3-beta and Wrangler 4.156.0 with the matching helper graph and regenerated lockfile. It supplies #16426 and #16327 without another release-only PR. V1 additionally needed to preserve signed S3 headers in its own adapter; build/types, retained suites and signed PUT/GET through dev and preview pass.

[devin-ai-integration]

Devin Review found 1 potential issue.

[clanky-the-clanker]

💬 Approved with comments — The source change is small and correct, and the tests cover it. The one remaining note asks for a fuller changeset and does not block merging.

Findings: 1 info

_{The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.}

---

🚀 Release: 💬 1 info

The changeset leaves out the second runtime fix that comes with the Miniflare upgrade

Recommendation: 💬 Optional Nits

• [INFO] The changeset could mention the bundled Miniflare fix for cross-process service, Durable Object and tail bindings after a crash restart, which is part of this upgrade but missing from the release note. (.changeset/v1-r2-s3-signed-encoding.md:7)

View full review

The Miniflare 5.20261023.3-beta upgrade also fixes cross-process service, Durable Object and tail bindings losing their routing after a runtime crash restart. The changeset only describes the signed S3 header fix. Mentioning the restart fix too would give plugin users the full effect of the upgrade.

---

✅ All other checks passed

🔒 Security: ✅ LGTM

No security issues found.

---

📖 AGENTS.md: ✅ LGTM

The change follows the repository's maintenance-branch rules. Private packages keep workspace:* references, public SDK packages are pinned to exact published versions, and there is a plugin changeset.

---

📋 Code Quality: ✅ LGTM

No issues found. The bypass applies only to the exact /cdn-cgi/local/r2/s3 route and paths below it, and the regression tests drive the real request handler.

---

⚡ Performance: ✅ LGTM

No performance issues found.

---

📝 Documentation: ✅ LGTM

No documentation issues found.

---

_{Reviewed commit: 22ad8138}