@cloudflare/vitest-pool-workers was renamed to @cloudflare/vitest-plugin
for its v1 release; the old name stopped at 0.22.0 with pinned vulnerable
wrangler and miniflare versions. Vitest stays on 4: the plugin's peer
range is still ^4.1.0.
Replace pnpm-lock.yaml with package-lock.json. pnpm-workspace.yaml's
allowBuilds becomes package.json#allowScripts, which npm 11 gates the same way,
listing only the packages actually present in the tree.
Resolves open dependency advisories for hono (<4.12.25), and clears
vulnerable transitive versions of undici (<7.28.0), ws (<8.21.0), and
esbuild (<0.28.1) pulled in by the older wrangler toolchain.
- Pre-declare Node.js compatibility flags in miniflare config to
prevent [vpw:debug] messages during test runs
- Use --no-file-parallelism to fix dangling handle causing
"close timed out" warning on exit
tiennm99
dependabot[bot]