[mkuznets]

Dependabot had 37 open alerts, all in the two Workers fixture lockfiles (test/miniflare, examples/d1-worker). Both now report zero under npm audit, as does the root. No code scanning or secret scanning alerts and no repository advisories were open.

What moved

Where	Was	Now	Clears
both fixtures	@cloudflare/vitest-pool-workers ^0.21.3	@cloudflare/vitest-plugin ^1.4.7	deprecated package; brings miniflare with patched sharp
both fixtures	vitest ^4.1.10	^4.1.12	vitest, @vitest/mocker; pulls vite 8.3.5 (vite, launch-editor) and source-map-js 1.2.2
both fixtures	wrangler ^4.123.0	^4.152.0	the exact version the plugin pins, so one copy in the lockfile
example	hono ^4.13.2	^4.13.14	4 hono advisories

Overrides

Two remain, because upstream pins exact vulnerable versions and has no newer release yet:

Package	Pinned by	Fixed in
undici 7.29.1	miniflare 5.20261019.2-beta	7.30.1
zod 4.6.5	@cloudflare/vitest-plugin 1.4.7	4.6.6

Both are patch/minor moves within the same major, and only test tooling is affected. Drop each once the plugin pins a patched version.

The move to @cloudflare/vitest-plugin

@cloudflare/vitest-pool-workers 0.23.0 is marked deprecated, renamed to @cloudflare/vitest-plugin. The move is a rename: the same cloudflareTest export and the same /types entry, so vitest.config.ts and test/tsconfig.json change only the import path. Both worker-configuration.d.ts are regenerated for the newer workerd. Compatibility dates are untouched.

vitest stays on 4.x. The plugin accepts 5, but a major is out of scope here.

Consumer skill

skills/sqlc-d1-typescript/reference/local-d1-test.md still described the pre-0.21 pool API: defineWorkersConfig with poolOptions.workers, ProvidedEnv augmentation, and implicit per-test storage isolation. It now mirrors examples/d1-worker, which make test-example verifies: the cloudflareTest plugin, Cloudflare.Env, @cloudflare/vitest-plugin/types, and reset() in beforeEach. SKILL.md step 6 names the new package.

Verification

make verify-local green: unit and candidate tests, generated-output drift clean, 33 miniflare tests, 5 example tests. make fmt-check clean.