chore(deps): bump undici and miniflare

[dependabot]

Bumps undici to 7.29.0 and updates ancestor dependency miniflare. These dependencies need to be updated together.

Updates undici from 7.28.0 to 7.29.0

Release notes

Sourced from undici's releases.

v7.29.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 9f10f1e9, with regression coverage in 466e99d1.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 33928bc2.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by 98011a86.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by 1b5a5312, with corrected fixtures in 4a9dafb1.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 3bf91ddb.

Full Changelog: nodejs/undici@v7.28.0...v7.29.0

Commits

• 9e38fc1 Bumped v7.29.0 (#5590)
• d887e34 fix: validate coerced header values for CRLF (#5579)
• 33928bc fix: validate blob body content type
• 98011a8 fix(cache): harden cache directive parsing
• 4a9dafb test(retry): correct broken content-range fixtures in retry-handler.js
• 1b5a531 fix(retry): reject partial content length mismatch
• 466e99d test: cover crash on mixed unqualified and qualified private cache directives
• 9f10f1e fix: handle empty qualified private cache directive
• 3bf91dd fix: harden cookie domain, path, and unparsed attribute validation
• See full diff in compare view

Updates miniflare from 4.20260730.0 to 5.20260815.0-alpha

Release notes

Sourced from miniflare's releases.

miniflare@5.20260815.0-alpha

Patch Changes

• #15206 1277a72 Thanks @​petebacondarwin! - Recover automatically from a partially downloaded Chrome install for the Browser Run binding

  If the Chrome download for a browser binding was interrupted — a cancelled dev session, a killed test run, a machine going to sleep — the next launch could fail indefinitely with Failed to launch the browser process!, usually alongside a message about being unable to load resources.pak. @puppeteer/browsers treats an install as present as soon as the executable exists, and the Chrome archives extract alphabetically, so the executable is written long before the resources it needs. Every subsequent launch then reused the half-written directory, and the only way out was deleting the Chrome cache by hand.

  Miniflare now detects this: an install that Chrome has never successfully started from is cleared and re-downloaded on a failed launch, rather than reused forever. Overlapping launches also share a single download instead of racing to populate the same directory.

• #15231 4f922dc Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260811.1	^5.20260814.1
  workerd	1.20260811.1	1.20260814.1

• #15248 4d74b8d Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260814.1	^5.20260815.1
  workerd	1.20260814.1	1.20260815.1

• #15143 2e0c962 Thanks @​teamleaderleo! - Prevent workerd from remaining running during Miniflare shutdown when browser or proxy cleanup is slow or fails.

• #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

miniflare@5.20260811.1-alpha

Minor Changes

• #15113 b8fd112 Thanks @​BSFishy! - Add local dev simulation for Cloudflare Access ctx.access.getIdentity()

  You can now configure a mock Cloudflare Access identity in wrangler.json so that ctx.access.getIdentity() returns it during local development.

  // wrangler.json
  {
    "access": {
      "dev": {
        "aud": "my-app-aud-tag",
        "identity": {
          "email": "user@example.com",
          "name": "Test User"
        }
      }
    }

... (truncated)

Changelog

Sourced from miniflare's changelog.

5.20260815.0-alpha

Patch Changes

• #15206 1277a72 Thanks @​petebacondarwin! - Recover automatically from a partially downloaded Chrome install for the Browser Run binding

  If the Chrome download for a browser binding was interrupted — a cancelled dev session, a killed test run, a machine going to sleep — the next launch could fail indefinitely with Failed to launch the browser process!, usually alongside a message about being unable to load resources.pak. @puppeteer/browsers treats an install as present as soon as the executable exists, and the Chrome archives extract alphabetically, so the executable is written long before the resources it needs. Every subsequent launch then reused the half-written directory, and the only way out was deleting the Chrome cache by hand.

  Miniflare now detects this: an install that Chrome has never successfully started from is cleared and re-downloaded on a failed launch, rather than reused forever. Overlapping launches also share a single download instead of racing to populate the same directory.

• #15231 4f922dc Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260811.1	^5.20260814.1
  workerd	1.20260811.1	1.20260814.1

• #15248 4d74b8d Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260814.1	^5.20260815.1
  workerd	1.20260814.1	1.20260815.1

• #15143 2e0c962 Thanks @​teamleaderleo! - Prevent workerd from remaining running during Miniflare shutdown when browser or proxy cleanup is slow or fails.

• #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

5.20260811.1-alpha

Minor Changes

• #15113 b8fd112 Thanks @​BSFishy! - Add local dev simulation for Cloudflare Access ctx.access.getIdentity()

  You can now configure a mock Cloudflare Access identity in wrangler.json so that ctx.access.getIdentity() returns it during local development.

  // wrangler.json
  {
    "access": {
      "dev": {
        "aud": "my-app-aud-tag",
        "identity": {
          "email": "user@example.com",
          "name": "Test User"
        }

... (truncated)

Commits

• 8ee43f6 Version Packages (#15175)
• 1552bce [wrangler] Quieten warnings and stray output in tests (#15209)
• 5537030 Replace i iteration variable with more appropriate workerIndex (#15225)
• 1277a72 [miniflare] Recover from a partially downloaded Chrome install (#15206)
• 2e0c962 [miniflare] Start runtime disposal before browser/proxy cleanup (#15143)
• c576a82 Version Packages (#15154)
• b8fd112 feat: implement local dev for ctx.access (#15113)
• e5d56e9 Version Packages (#15145)
• 0b82b15 Strip redundant nodejs_compat flags (#15148)
• d0c976c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.