build(deps-dev): Bump miniflare from 4.20260722.0 to 4.20260722.1

[dependabot]

Bumps miniflare from 4.20260722.0 to 4.20260722.1.

Release notes

Sourced from miniflare's releases.

miniflare@4.20260722.1

Minor Changes

• #14702 e426cb9 Thanks @​Sipixer! - Support passing V8 flags to workerd via the MINIFLARE_WORKERD_V8_FLAGS environment variable

  The generated workerd config already supports v8Flags, but Miniflare never populated it, so the runtime always ran with V8's default heap limit (~1.4 GB). Large dev applications (e.g. big SSR module graphs under @cloudflare/vite-plugin, where each server-file edit grows the runner isolate's heap) can reach that limit, at which point workerd aborts with V8 fatal error; location = Reached heap limit and every subsequent dispatchFetch() fails with fetch failed until the dev server is manually restarted.

  Setting e.g. MINIFLARE_WORKERD_V8_FLAGS="--max-old-space-size=4096" raises the limit and keeps long dev sessions alive. The variable follows the same space-separated format as MINIFLARE_WORKERD_AUTOGATES.

• #14280 465c0fb Thanks @​tahmid-23! - Add a local S3-compatible API for R2 buckets at /cdn-cgi/local/r2/s3/<bucket-id>, where <bucket-id> is the ID the bucket is configured with in the r2Buckets option

  Buckets configured with s3Credentials: { accessKeyId, secretAccessKey } in r2Buckets are served over an S3-compatible HTTP API, authenticated with AWS Signature Version 4 (both Authorization header and presigned URL query authentication). Supported operations: GetObject, HeadObject, PutObject, CopyObject, DeleteObject, DeleteObjects, ListObjects, ListObjectsV2, HeadBucket, ListBuckets, CreateMultipartUpload, UploadPart, UploadPartCopy, CompleteMultipartUpload, and AbortMultipartUpload. Status codes, error responses, and unsupported-header screening mirror R2's S3 endpoint, including its static responses for bucket-configuration reads and its named errors for unimplemented operations.

• #14712 6e0bf6e Thanks @​mack-erel! - Support connect() on remote VPC Network and VPC Service bindings in local development

  Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported. Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development.

  This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required.

Patch Changes

• #14784 1035f74 Thanks @​ATKasem! - Fix getWithMetadata dropping metadata for falsy KV values

  KVNamespace.getWithMetadata returned null metadata whenever the stored value was falsy — an empty string or "0" — because the metadata branch was guarded by a truthiness check on the value. The guard now checks for null explicitly, so metadata is preserved for empty-string and "0" values while genuinely missing keys still return null.

• #14864 3a22ae5 Thanks @​Hashim1999164! - Hide the workerd console window on Windows when the parent process has no console. Spawning workerd without windowsHide: true caused Windows Terminal to open a visible, focus-stealing window for background or detached parents (for example Astro's astro dev --background).

Changelog

Sourced from miniflare's changelog.

4.20260722.1

Minor Changes

• #14702 e426cb9 Thanks @​Sipixer! - Support passing V8 flags to workerd via the MINIFLARE_WORKERD_V8_FLAGS environment variable

  The generated workerd config already supports v8Flags, but Miniflare never populated it, so the runtime always ran with V8's default heap limit (~1.4 GB). Large dev applications (e.g. big SSR module graphs under @cloudflare/vite-plugin, where each server-file edit grows the runner isolate's heap) can reach that limit, at which point workerd aborts with V8 fatal error; location = Reached heap limit and every subsequent dispatchFetch() fails with fetch failed until the dev server is manually restarted.

  Setting e.g. MINIFLARE_WORKERD_V8_FLAGS="--max-old-space-size=4096" raises the limit and keeps long dev sessions alive. The variable follows the same space-separated format as MINIFLARE_WORKERD_AUTOGATES.

• #14280 465c0fb Thanks @​tahmid-23! - Add a local S3-compatible API for R2 buckets at /cdn-cgi/local/r2/s3/<bucket-id>, where <bucket-id> is the ID the bucket is configured with in the r2Buckets option

  Buckets configured with s3Credentials: { accessKeyId, secretAccessKey } in r2Buckets are served over an S3-compatible HTTP API, authenticated with AWS Signature Version 4 (both Authorization header and presigned URL query authentication). Supported operations: GetObject, HeadObject, PutObject, CopyObject, DeleteObject, DeleteObjects, ListObjects, ListObjectsV2, HeadBucket, ListBuckets, CreateMultipartUpload, UploadPart, UploadPartCopy, CompleteMultipartUpload, and AbortMultipartUpload. Status codes, error responses, and unsupported-header screening mirror R2's S3 endpoint, including its static responses for bucket-configuration reads and its named errors for unimplemented operations.

• #14712 6e0bf6e Thanks @​mack-erel! - Support connect() on remote VPC Network and VPC Service bindings in local development

  Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported. Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development.

  This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required.

Patch Changes

• #14784 1035f74 Thanks @​ATKasem! - Fix getWithMetadata dropping metadata for falsy KV values

  KVNamespace.getWithMetadata returned null metadata whenever the stored value was falsy — an empty string or "0" — because the metadata branch was guarded by a truthiness check on the value. The guard now checks for null explicitly, so metadata is preserved for empty-string and "0" values while genuinely missing keys still return null.

• #14864 3a22ae5 Thanks @​Hashim1999164! - Hide the workerd console window on Windows when the parent process has no console. Spawning workerd without windowsHide: true caused Windows Terminal to open a visible, focus-stealing window for background or detached parents (for example Astro's astro dev --background).

Commits

• 760a85b Version Packages (#14824)
• 1035f74 fix(miniflare): KV getWithMetadata drops metadata for falsy values (#14784)
• 465c0fb [miniflare] Expose R2 via an S3-compatible API locally (#14280)
• 18ccb7c [miniflare] Fix flaky sites.spec.ts by bundling kv-asset-handler from source ...
• 3a22ae5 fix(miniflare): hide workerd console window on Windows (#14864)
• 6e0bf6e [miniflare] Support connect() on remote VPC Network bindings in local dev (#1...
• e426cb9 [miniflare] Support workerd V8 flags via MINIFLARE_WORKERD_V8_FLAGS environme...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)