Various package updates to fix dependabot issues (#8114)

penalosa · web-flow · commit 0322d085f634 · 2025-02-17T14:55:24.000Z
* fix https://github.com/cloudflare/workers-sdk/security/code-scanning/3 * Update Hono * Update cookie * update dompurify and eliminate cross-spawn * update fast-loops * vite + vitest * vite + vitest * types/node * lockfile * bump undici * Add changesets for significant bumps
diff --git a/.changeset/fresh-doors-cheat.md b/.changeset/fresh-doors-cheat.md
@@ -0,0 +1,5 @@
+---
+"playground-preview-worker": patch
+---
+
+Upgrade to Hono v4
diff --git a/.changeset/gold-bears-admire.md b/.changeset/gold-bears-admire.md
@@ -0,0 +1,5 @@
+---
+"turbo-r2-archive": patch
+---
+
+Upgrade to Hono v4
diff --git a/.changeset/good-plants-stare.md b/.changeset/good-plants-stare.md
@@ -0,0 +1,5 @@
+---
+"turbo-r2-archive": patch
+---
+
+Upgrade to Hono v4
diff --git a/package.json b/package.json
@@ -29,7 +29,7 @@
 		"type:tests": "dotenv -- turbo type:tests"
 	},
 	"dependencies": {
-		"@actions/artifact": "^2.0.1",
+		"@actions/artifact": "^2.2.1",
 		"@changesets/changelog-github": "^0.5.0",
 		"@changesets/cli": "^2.27.1",
 		"@changesets/parse": "^0.4.0",
diff --git a/packages/chrome-devtools-patches/package.json b/packages/chrome-devtools-patches/package.json
@@ -14,7 +14,6 @@
 		"testenv": "make testenv"
 	},
 	"devDependencies": {
-		"patch-package": "^6.5.1",
 		"wrangler": "workspace:*"
 	},
 	"volta": {
diff --git a/packages/cloudflare-workers-bindings-extension/package.json b/packages/cloudflare-workers-bindings-extension/package.json
@@ -12,19 +12,19 @@
 	"publisher": "cloudflare",
 	"main": "./dist/extension.js",
 	"scripts": {
-		"vscode:prepublish": "pnpm run package",
+		"build": "vsce package",
+		"check:lint": "eslint src --ext ts",
+		"check:type": "tsc --noEmit",
 		"compile": "pnpm run check:type && pnpm run check:lint && node esbuild.js",
-		"dev": "npm-run-all -p watch:*",
-		"watch:esbuild": "node esbuild.js --watch",
-		"watch:tsc": "tsc --noEmit --watch --project tsconfig.json",
-		"package": "pnpm run check:type && pnpm run check:lint && node esbuild.js --production",
 		"compile-tests": "tsc -p . --outDir out",
-		"watch-tests": "tsc -p . -w --outDir out",
+		"deploy": "vsce publish --pre-release",
+		"dev": "concurrently -n esbuild,tsc \"pnpm run watch:esbuild\" \"pnpm run watch:tsc\"",
+		"package": "pnpm run check:type && pnpm run check:lint && node esbuild.js --production",
 		"test": "node ./out/test/runTest.js",
-		"check:type": "tsc --noEmit",
-		"check:lint": "eslint src --ext ts",
-		"build": "vsce package",
-		"deploy": "vsce publish --pre-release"
+		"vscode:prepublish": "pnpm run package",
+		"watch-tests": "tsc -p . -w --outDir out",
+		"watch:esbuild": "node esbuild.js --watch",
+		"watch:tsc": "tsc --noEmit --watch --project tsconfig.json"
 	},
 	"contributes": {
 		"commands": [
@@ -120,11 +120,11 @@
 		"@typescript-eslint/eslint-plugin": "^7.14.1",
 		"@typescript-eslint/parser": "^7.11.0",
 		"@vscode/test-electron": "^2.4.1",
+		"concurrently": "^8.2.2",
 		"esbuild": "^0.21.5",
 		"eslint": "^8.57.0",
 		"glob": "^7.1.4",
 		"mocha": "^10.2.0",
-		"npm-run-all": "^4.1.5",
 		"typescript": "^5.4.5",
 		"vsce": "^2.15.0",
 		"wrangler": "workspace:*"
diff --git a/packages/edge-preview-authenticated-proxy/package.json b/packages/edge-preview-authenticated-proxy/package.json
@@ -14,7 +14,7 @@
 		"@cloudflare/eslint-config-worker": "workspace:*",
 		"@cloudflare/workers-types": "^4.20250204.0",
 		"@types/cookie": "^0.6.0",
-		"cookie": "^0.6.0",
+		"cookie": "^0.7.0",
 		"promjs": "^0.4.2",
 		"toucan-js": "^3.3.1",
 		"wrangler": "workspace:*"
diff --git a/packages/playground-preview-worker/package.json b/packages/playground-preview-worker/package.json
@@ -14,14 +14,14 @@
 		"test:e2e": "vitest run"
 	},
 	"dependencies": {
-		"hono": "^3.12.11",
+		"hono": "^4.7.0",
 		"zod": "^3.22.3"
 	},
 	"devDependencies": {
 		"@cloudflare/eslint-config-worker": "workspace:*",
 		"@cloudflare/workers-types": "^4.20250204.0",
 		"@types/cookie": "^0.6.0",
-		"cookie": "^0.6.0",
+		"cookie": "^0.7.0",
 		"itty-router": "^4.0.13",
 		"promjs": "^0.4.2",
 		"toucan-js": "^3.3.1",
diff --git a/packages/playground-preview-worker/src/index.ts b/packages/playground-preview-worker/src/index.ts
@@ -194,9 +194,9 @@ app.post(`${rootDomain}/api/worker`, async (c) => {
 	const userObject = c.env.UserSession.get(userObjectId);
 
 	return userObject.fetch("https://example.com", {
-		body: c.req.body,
+		body: c.req.raw.body,
 		method: "POST",
-		headers: c.req.headers,
+		headers: c.req.raw.headers,
 	});
 });
 
@@ -272,18 +272,19 @@ app.all(`${previewDomain}/*`, async (c) => {
 	if (c.req.method === "OPTIONS") {
 		return new Response(null, {
 			headers: {
-				"Access-Control-Allow-Origin": c.req.headers.get("Origin") ?? "",
+				"Access-Control-Allow-Origin": c.req.raw.headers.get("Origin") ?? "",
 				"Access-Control-Allow-Methods": "*",
 				"Access-Control-Allow-Credentials": "true",
 				"Access-Control-Allow-Headers":
-					c.req.headers.get("Access-Control-Request-Headers") ?? "x-cf-token",
+					c.req.raw.headers.get("Access-Control-Request-Headers") ??
+					"x-cf-token",
 				"Access-Control-Expose-Headers": "*",
 				Vary: "Origin, Access-Control-Request-Headers",
 			},
 		});
 	}
 	const url = new URL(c.req.url);
-	if (c.req.headers.has("cf-raw-http")) {
+	if (c.req.raw.headers.has("cf-raw-http")) {
 		return handleRawHttp(c.req.raw, url, c.env);
 	}
 	const token = getCookie(c, "token");
@@ -302,7 +303,7 @@ app.all(`${previewDomain}/*`, async (c) => {
 		url,
 		new Request(c.req.raw, {
 			headers: {
-				...Object.fromEntries(c.req.headers),
+				...Object.fromEntries(c.req.raw.headers),
 				"cf-run-user-worker": "true",
 			},
 			redirect: "manual",
diff --git a/packages/turbo-r2-archive/package.json b/packages/turbo-r2-archive/package.json
@@ -18,8 +18,8 @@
 		"type:check": "tsc"
 	},
 	"dependencies": {
-		"@hono/zod-validator": "^0.1.8",
-		"hono": "^3.12.11",
+		"@hono/zod-validator": "^0.4.2",
+		"hono": "^4.7.0",
 		"zod": "^3.22.3"
 	},
 	"devDependencies": {
diff --git a/packages/turbo-r2-archive/src/routes.ts b/packages/turbo-r2-archive/src/routes.ts
@@ -54,14 +54,14 @@ router.put(
 			return c.json({ error: "MISSING_TEAM_ID" }, 400);
 		}
 
-		if (c.req.headers.get("Content-Type") !== "application/octet-stream") {
+		if (c.req.raw.headers.get("Content-Type") !== "application/octet-stream") {
 			return c.json({ error: "EXPECTED_OCTET_STREAM" }, 415);
 		}
 
-		const artifactTag = c.req.headers.get("x-artifact-tag");
+		const artifactTag = c.req.raw.headers.get("x-artifact-tag");
 		const r2Object = await c.env.R2_ARTIFACT_ARCHIVE.put(
 			`${teamID}/${artifactID}`,
-			c.req.body,
+			c.req.raw.body,
 			{
 				customMetadata: artifactTag
 					? {
diff --git a/packages/wrangler/src/dev/create-worker-preview.ts b/packages/wrangler/src/dev/create-worker-preview.ts
@@ -1,3 +1,4 @@
+import crypto from "node:crypto";
 import { URL } from "node:url";
 import { fetch } from "undici";
 import { fetchResult } from "../cfetch";
@@ -121,15 +122,6 @@ export interface CfPreviewToken {
 	prewarmUrl: URL;
 }
 
-// Credit: https://stackoverflow.com/a/2117523
-function randomId(): string {
-	return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, function (c) {
-		const r = (Math.random() * 16) | 0,
-			v = c == "x" ? r : (r & 0x3) | 0x8;
-		return v.toString(16);
-	});
-}
-
 // URLs are often relative to the zone. Sometimes the base zone
 // will be grey-clouded, and so the host must be swapped out for
 // the worker route host, which is more likely to be orange-clouded.
@@ -199,7 +191,7 @@ export async function createPreviewSession(
 		inspector.searchParams.append("cf_workers_preview_token", token);
 
 		return {
-			id: randomId(),
+			id: crypto.randomUUID(),
 			value: token,
 			host: ctx.host ?? inspector.host,
 			inspectorUrl: switchHost(inspector.href, ctx.host, !!ctx.zone),
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"playground-preview-worker": patch
 +---
++
 +Upgrade to Hono v4