build(deps): bump undici and miniflare

[dependabot]

Bumps undici to 7.29.0 and updates ancestor dependency miniflare. These dependencies need to be updated together.

Updates undici from 7.28.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Updates miniflare from 4.20260730.0 to 5.20260811.1-alpha

Release notes

Sourced from miniflare's releases.

miniflare@5.20260811.1-alpha

Minor Changes

• #15113 b8fd112 Thanks @​BSFishy! - Add local dev simulation for Cloudflare Access ctx.access.getIdentity()

  You can now configure a mock Cloudflare Access identity in wrangler.json so that ctx.access.getIdentity() returns it during local development.

  // wrangler.json
  {
    "access": {
      "dev": {
        "aud": "my-app-aud-tag",
        "identity": {
          "email": "user@example.com",
          "name": "Test User"
        }
      }
    }
  }

miniflare@5.20260811.0-alpha

Minor Changes

• #15123 d0c976c Thanks @​dependabot! - Add local support for WorkflowInstance.delete() and Workflow.deleteBatch()

  The updated @cloudflare/workers-types now requires delete() on workflow instances and deleteBatch() on the workflow binding. These methods are now implemented in the local workflows simulator so that local dev and tests match the production API.

• #15123 d0c976c Thanks @​dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

  As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

  To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

  @cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

  wrangler types also no longer attributes its @types/node suggestion to "the nodejs_compat flag", which it can now make for Workers that do not set the flag at all.

Patch Changes

• #15123 d0c976c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260804.1	^5.20260811.1
  workerd	1.20260804.1	1.20260811.1

... (truncated)

Changelog

Sourced from miniflare's changelog.

5.20260811.1-alpha

Minor Changes

• #15113 b8fd112 Thanks @​BSFishy! - Add local dev simulation for Cloudflare Access ctx.access.getIdentity()

  You can now configure a mock Cloudflare Access identity in wrangler.json so that ctx.access.getIdentity() returns it during local development.

  // wrangler.json
  {
    "access": {
      "dev": {
        "aud": "my-app-aud-tag",
        "identity": {
          "email": "user@example.com",
          "name": "Test User"
        }
      }
    }
  }

5.20260811.0-alpha

Minor Changes

• #15123 d0c976c Thanks @​dependabot! - Add local support for WorkflowInstance.delete() and Workflow.deleteBatch()

  The updated @cloudflare/workers-types now requires delete() on workflow instances and deleteBatch() on the workflow binding. These methods are now implemented in the local workflows simulator so that local dev and tests match the production API.

• #15123 d0c976c Thanks @​dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

  As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

  To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

  @cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

  wrangler types also no longer attributes its @types/node suggestion to "the nodejs_compat flag", which it can now make for Workers that do not set the flag at all.

Patch Changes

• #15123 d0c976c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260804.1	^5.20260811.1

... (truncated)

Commits

• c576a82 Version Packages (#15154)
• b8fd112 feat: implement local dev for ctx.access (#15113)
• e5d56e9 Version Packages (#15145)
• 0b82b15 Strip redundant nodejs_compat flags (#15148)
• d0c976c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
• 90dd5e5 chore: bump capnp-es to 0.0.15 (#15131)
• 15fc568 Version Packages (#15118)
• e06c369 fix main (#15133)
• c7aede7 [miniflare] Report tail event forwarding failures between dev sessions (#14993)
• d2f377e Version Packages (#15111)
• Additional commits viewable in compare view