[miniflare/wrangler] Bump undici to v7.24.8 and remove pnpm patch by petebacondarwin · Pull Request #13450 · cloudflare/workers-sdk

petebacondarwin · 2026-04-13T11:27:52Z

Bumps undici from 7.24.4 to 7.24.8, which includes the upstream fix (nodejs/undici#5006) for isTraversableNavigable() returning true unconditionally. This caused POST/PUT requests with non-2xx responses (e.g. 401) to throw TypeError: fetch failed because undici entered the 401 credential-retry block and failed on stream-backed request bodies.

Since the fix is now included upstream, this PR removes the pnpm patch we applied in #13058 as a workaround.

Changes

Bump undici and undici-types from 7.24.4 → 7.24.8 in the pnpm catalog
Remove undici@7.24.4 from patchedDependencies and delete patches/undici@7.24.4.patch
Remove now-unused @ts-expect-error directives on the clone() overrides in src/http/request.ts and src/http/response.ts (undici 7.24.8 types no longer error on these)
Fix SpecIterableIterator type incompatibility in R2 tests — use structural types for keys/delimitedPrefixes helpers instead of R2Objects from @cloudflare/workers-types (removes unused R2Objects import)
Fix SpecIterableIterator type incompatibility in vite-plugin websockets.ts — convert @remix-run/node-fetch-server Headers to Record<string, string> before passing to miniflare.dispatchFetch
Add regression test covering GET/POST/PUT × various non-2xx status codes via dispatchFetch

Reviewer notes

undici@7.24.4 (unpatched) still appears in the lockfile as a transitive dependency of an older bundled miniflare version — this is expected and harmless since workspace packages now resolve to 7.24.8.
The test exercises dispatchFetch which routes through undici's fetch() to workerd, covering the exact code path that was broken.
The @ts-ignore comments on the super.clone() calls are intentionally kept — only the outer @ts-expect-error directives (which suppressed the method-override error) became unused with the new types.
undici 7.24.8 changed Headers.keys() to return SpecIterableIterator<string> instead of IterableIterator<string>. This causes type mismatches wherever third-party Headers types (e.g. @cloudflare/workers-types, @remix-run/node-fetch-server) are passed to undici-typed APIs. The fixes in this PR work around these at the call sites.

⚠️ Human review checklist

Verify the @ts-expect-error removals are safe — confirm that clone() and status overrides still compile correctly with undici 7.24.8 types (CI build will confirm this)
Confirm no other @ts-expect-error directives in miniflare reference undici types that may have changed
Review websockets.ts Record<string, string> conversion — headers.forEach collapses multi-value headers to a single value per key; verify this is acceptable for WebSocket upgrade requests
Check if there are other places in the monorepo where Headers objects cross the undici / workers-types boundary that may also need fixing

Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because:
Public documentation
- Cloudflare docs PR(s):
- Documentation not necessary because: this is a dependency bump with no user-facing API changes

Link to Devin session: https://app.devin.ai/sessions/fea4cbb20470478ca29d0c117e41896d
Requested by: @petebacondarwin

devin-ai-integration · 2026-04-13T11:27:56Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR that start with 'DevinAI' or '@devin'.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

changeset-bot · 2026-04-13T11:28:00Z

🦋 Changeset detected

Latest commit: 5b3c9f0

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

ask-bonk · 2026-04-13T11:29:17Z

The new test correctly uses useDispose(mf) which is the standard pattern in this test file.

Let me review the overall changes once more:

pnpm-workspace.yaml: Catalog updated from 7.24.4 to 7.24.8 for both undici and undici-types. Patch removed. Clean.
patches/undici@7.24.4.patch: Deleted. Correct since the fix is upstream.
pnpm-lock.yaml: All workspace packages moved from patched 7.24.4 to 7.24.8. The old unpatched 7.24.4 remains only as transitive dep of bundled miniflare@4.20260317.1. Clean.
.changeset/bump-undici-remove-patch.md: Proper changeset for miniflare and wrangler as patch. Good.
Test: Good regression test covering the exact code path. Uses useDispose, comments reference the issue, covers GET/POST/PUT with various status codes.

This is a clean, well-structured PR. The dependency bump is correct, the patch removal is justified, the lockfile changes are consistent, the test is well-written and follows existing patterns, and the changeset is appropriate.

LGTM

github run

github-actions · 2026-04-13T11:29:31Z

✅ All changesets look good

pkg-pr-new · 2026-04-13T12:11:16Z

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@13450

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@13450

miniflare

npm i https://pkg.pr.new/miniflare@13450

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@13450

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@13450

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@13450

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@13450

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@13450

wrangler

npm i https://pkg.pr.new/wrangler@13450

commit: be99cfc

workers-devprod · 2026-04-13T12:21:43Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

workers-devprod

Codeowners reviews satisfied

Update undici from 7.24.4 to 7.24.8 which includes the upstream fix for isTraversableNavigable() that caused POST/PUT requests with non-2xx responses to throw 'fetch failed'. Remove the now-unnecessary pnpm patch. Add test covering POST/PUT with various non-2xx status codes to prevent regression. Fixes #13013 Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

@ts-expect-error

undici 7.24.8 no longer considers these overrides as type errors, so the @ts-expect-error directives are now unused and cause TS2578. Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

Use structural types for keys/delimitedPrefixes helpers instead of R2Objects from @cloudflare/workers-types to avoid SpecIterableIterator incompatibility between undici 7.24.8's Headers and workers-types' Headers. Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

Convert @remix-run/node-fetch-server Headers to a plain Record<string, string> to avoid SpecIterableIterator type mismatch between undici 7.24.8 and the remix Headers implementation. Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

The test expects headers passed to dispatchFetch to be a Headers instance. Instead of converting to Record<string, string>, construct a new undici Headers object from the remix Headers to satisfy both the type system and the instanceof check. Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

The vite-plugin package doesn't have undici as a dependency. Import Headers from miniflare which re-exports it. Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

…n websocket test

…ing createHeaders Replace @remix-run/node-fetch-server's createHeaders() with direct construction of miniflare's Headers from request.rawHeaders. This avoids the type incompatibility between remix and undici Headers entirely, removes the redundant intermediate copy step, and correctly preserves multi-value headers by using append() instead of set().

miniflare 4.20260415.0 (via wrangler 4.83.0) pulls undici 7.24.8, which includes the backported fix for the 401-with-request-body crash (nodejs/undici#4941, cloudflare/workers-sdk#13450). The override is no longer needed.

devin-ai-integration Bot assigned petebacondarwin Apr 13, 2026

workers-devprod added this to workers-sdk Apr 13, 2026

github-project-automation Bot moved this to Untriaged in workers-sdk Apr 13, 2026

petebacondarwin force-pushed the devin/1776079204-bump-undici-remove-patch branch from 259ccc4 to 3754fb9 Compare April 13, 2026 11:30

petebacondarwin marked this pull request as ready for review April 13, 2026 12:21

petebacondarwin requested a review from workers-devprod as a code owner April 13, 2026 12:21

workers-devprod requested review from a team and penalosa and removed request for a team April 13, 2026 12:21

devin-ai-integration Bot reviewed Apr 13, 2026

View reviewed changes

penalosa approved these changes Apr 13, 2026

View reviewed changes

workers-devprod approved these changes Apr 13, 2026

View reviewed changes

github-project-automation Bot moved this from Untriaged to Approved in workers-sdk Apr 13, 2026

petebacondarwin force-pushed the devin/1776079204-bump-undici-remove-patch branch from 58241c1 to 180930e Compare April 13, 2026 17:17

This comment was marked as resolved.

Sign in to view

jamesopstad requested changes Apr 14, 2026

View reviewed changes

Comment thread packages/vite-plugin-cloudflare/src/websockets.ts Outdated

github-project-automation Bot moved this from Approved to In Review in workers-sdk Apr 14, 2026

petebacondarwin force-pushed the devin/1776079204-bump-undici-remove-patch branch from 180930e to be99cfc Compare April 14, 2026 12:31

petebacondarwin requested a review from jamesopstad April 14, 2026 12:38

jamesopstad approved these changes Apr 14, 2026

View reviewed changes

github-project-automation Bot moved this from In Review to Approved in workers-sdk Apr 14, 2026

devin-ai-integration Bot and others added 3 commits April 14, 2026 16:07

Remove unused @ts-expect-error directives for clone() overrides

6b28c26

undici 7.24.8 no longer considers these overrides as type errors, so the @ts-expect-error directives are now unused and cause TS2578. Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

devin-ai-integration Bot and others added 8 commits April 14, 2026 16:07

Remove unused R2Objects import after switching to structural types

3198175

Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

Fix: import Headers from miniflare instead of undici

dbba25d

The vite-plugin package doesn't have undici as a dependency. Import Headers from miniflare which re-exports it. Co-Authored-By: pbacondarwin <pete@bacondarwin.com>

vite-plugin: use imported (not ambient) Headers type from miniflare i…

5de5dac

…n websocket test

fix typing

7f7c853

PR feedback...

5b3c9f0

petebacondarwin force-pushed the devin/1776079204-bump-undici-remove-patch branch from be99cfc to 5b3c9f0 Compare April 14, 2026 15:07

jamesopstad merged commit 6f63eaa into main Apr 14, 2026
50 of 51 checks passed

jamesopstad deleted the devin/1776079204-bump-undici-remove-patch branch April 14, 2026 16:13

github-project-automation Bot moved this from Approved to Done in workers-sdk Apr 14, 2026

workers-devprod mentioned this pull request Apr 14, 2026

Version Packages #13461

Merged

masylum mentioned this pull request Apr 16, 2026

Server routers can't return 401 responses TanStack/router#7200

Closed

jamesopstad mentioned this pull request Apr 17, 2026

@cloudflare/vite-plugin: POST requests that return 401 fail with fetch failed (undici auth-retry requires non-null body source) #13578

Closed

bohdanbirdie mentioned this pull request Apr 20, 2026

Remove undici 7.18.2 override, bump wrangler to 4.83.0 bohdanbirdie/cloudstash#49

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[miniflare/wrangler] Bump undici to v7.24.8 and remove pnpm patch#13450

[miniflare/wrangler] Bump undici to v7.24.8 and remove pnpm patch#13450
jamesopstad merged 11 commits into
mainfrom
devin/1776079204-bump-undici-remove-patch

petebacondarwin commented Apr 13, 2026 •

edited by devin-ai-integration Bot

Loading

Uh oh!

devin-ai-integration Bot commented Apr 13, 2026

Uh oh!

changeset-bot Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

ask-bonk Bot commented Apr 13, 2026

Uh oh!

github-actions Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Apr 13, 2026 •

edited

Loading

Uh oh!

workers-devprod commented Apr 13, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

workers-devprod left a comment

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

petebacondarwin commented Apr 13, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Reviewer notes

⚠️ Human review checklist

Uh oh!

devin-ai-integration Bot commented Apr 13, 2026

🤖 Devin AI Engineer

Uh oh!

changeset-bot Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

ask-bonk Bot commented Apr 13, 2026

Uh oh!

github-actions Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

workers-devprod commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

workers-devprod left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

petebacondarwin commented Apr 13, 2026 •

edited by devin-ai-integration Bot

Loading

changeset-bot Bot commented Apr 13, 2026 •

edited

Loading

github-actions Bot commented Apr 13, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 13, 2026 •

edited

Loading

workers-devprod commented Apr 13, 2026 •

edited

Loading