Merge branch 'main' into push-pvxzxmsqszsk

Author: gpanders

.changeset/shaggy-frogs-tap.md

@@ -0,0 +1,5 @@
+---
+"wrangler": patch
+---
+
+Cap the number of errors and warnings for bulk KV put to avoid consuming too much memory

.changeset/tangy-ghosts-rule.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/workers-shared": patch
+---
+
+Handle next apps hosted at a path other than the root when blocking vulnerable non-image requests

.changeset/thin-grapes-rescue.md

@@ -0,0 +1,5 @@
+---
+"wrangler": patch
+---
+
+Better messaging for account owned tokens in `wrangler whoami`

.github/pr-labeler.config.yml

@@ -10,27 +10,21 @@ See below for a summary of this repo's Actions
 
 - Triggers
   - Updates to PRs.
+  - PRs in the merge queue.
 - Actions
   - Builds all the packages.
   - Runs formatting, linting and type checks.
   - Runs fixture tests, Wrangler unit tests, C3 unit tests, Miniflare unit tests, and ESLint + Prettier checks.
   - Adds the PR to a GitHub project
+  - Makes sure that Wrangler's warning for old Node.js versions works.
 
 ### E2E tests (e2e.yml)
 
 - Triggers
-  - Commits merged to the `changeset-release/main` branch (i.e. on "Version Packages" PRs).
-  - Updates to PRs, on the Cloudflare fork, with the `e2e` label applied.
-- Actions
-  - Runs the E2E tests for Wrangler.
-  - **If you're making a change that feels particularly risky, make sure you add the `e2e` label to get early warning of E2E test failures.**
-
-## Test old Node.js version (test-old-node-error.yml)
-
-- Triggers
-  - Commits merged to the `changeset-release/main` branch.
+  - Updates to PRs on the Cloudflare fork.
+  - PRs in the merge queue.
 - Actions
-  - Makes sure that Wrangler's warning for old Node.js versions works.
+  - Runs the E2E tests for Wrangler & Vite.
 
 ## Deploy Pages Previews (deploy-pages-preview.yml)
 
@@ -47,7 +41,7 @@ See below for a summary of this repo's Actions
 - Actions
   - Runs integrations tests to ensure the behaviour of the Worker powering the Workers Playground.
 
-## Create Pull Request Prerelease (create-pullrequest-prerelease.yml)
+## Create Pull Request Prerelease (prerelease.yml)
 
 - Triggers
   - Updates to PRs.
@@ -92,35 +86,11 @@ See below for a summary of this repo's Actions
     - Public packages are deployed to npm
     - Private packages will run their `deploy` script, if they have one.
 
-## Product-specific branch actions
-
-### D1 (d1.yml)
-
-- Triggers
-  - Commits merged to the `d1` branch, on the Cloudflare fork.
-- Actions
-  - Publishes the `wrangler` package to npm under the `d1` dist-tag.
-
 ## C3 related actions
 
 ### C3 E2E Tests (c3-e2e.yml)
 
 - Triggers
-  - Commits merged to the `changeset-release/main` branch (i.e. on "Version Packages" PRs).
-  - Updates to PRs, on the Cloudflare fork, with the `c3-e2e` label applied.
+  - Updates to PRs.
 - Actions
   - Runs the E2E tests for C3.
-
-### C3 E2E (Quarantine) (c3-e2e-quarantine.yml) ⚠️
-
-- Triggers
-  - 3AM every day
-- Actions
-  - Runs the _quarantined_ E2E tests for C3. It is expected to sometimes fail.
-
-### C3 E2E Tests (Dependabot) (c3-e2e-dependabot.yml)
-
-- Triggers
-  - Updates to PRs, by the dependabot user, which touch c3-frameworks-update changesets.
-- Actions
-  - Runs the all the C3 E2E (including quarantined) tests for the framework that was updated.

.github/workflows/README.md

@@ -4,6 +4,11 @@ on:
     paths:
       - "packages/create-cloudflare/src/frameworks/package.json"
 
+permissions:
+  # content:write permission needed to update add changesets to dependabot PRs
+  # (see tools/dependabot/generate-dependabot-pr-changesets.ts)
+  contents: write
+
 jobs:
   generate-changeset:
     runs-on: ubuntu-22.04

.github/workflows/c3-dependabot-versioning-prs.yml

@@ -3,6 +3,9 @@ on:
   merge_group:
   pull_request:
 
+permissions:
+  contents: read
+
 env:
   # TODO: switch back to 20.x onces [email protected] includes a fix for https://github.com/nodejs/node/issues/57869
   NODE_VERSION: 22

.github/workflows/c3-e2e.yml

@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  # note: no write permissions are needed since the workflow uses GH_ACCESS_TOKEN instead of GITHUB_TOKEN
+
 jobs:
   release:
     if: ${{ github.repository_owner == 'cloudflare' }}

.github/workflows/changesets.yml

@@ -20,6 +20,11 @@ on:
   pull_request:
     types: [synchronize, opened, reopened, labeled, unlabeled]
 
+permissions:
+  contents: read
+  # pull-request:write permission needed so that the workflow can comment on PRs
+  pull-requests: write
+
 jobs:
   deploy-pages-projects:
     # Only run this on PRs that are for the "cloudflare" org and not "from" `main`

.github/workflows/deploy-pages-previews.yml

@@ -1,10 +1,15 @@
 # This workflow cleans up any leftover projects created by e2e runs.
 
 name: E2E Project Cleanup
+
 on:
   workflow_dispatch:
   schedule:
     - cron: "0 3 * * *" # Run at 3am each day
+
+permissions:
+  contents: read
+
 jobs:
   cleanup:
     timeout-minutes: 30