chore(deps): bump @cloudflare/vitest-pool-workers from 0.9.14 to 0.12.8

[dependabot]

Bumps @cloudflare/vitest-pool-workers from 0.9.14 to 0.12.8.

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.12.8

Patch Changes

• Updated dependencies [8a210af, eb8a415, 3b06b18, 17961bb, 52fdfe7, 6d8d9cd, cb72c11]:
  • [email protected]
  • [email protected]

@​cloudflare/vitest-pool-workers@​0.12.7

Patch Changes

• #12056 6d5f69f Thanks @​edmundhung! - fix: allow Vite query parameters like ?raw on .sql file imports

  Importing .sql files with Vite query parameters (e.g., import sql from "./query.sql?raw") would fail with "No such module" errors in vitest-pool-workers 0.12.x. Both import styles now work:

  • import sql from "./query.sql?raw" (Vite handles the ?raw transform)
  • import sql from "./query.sql" (loaded as Text module)

• #11917 7b40ceb Thanks @​ksawaneh! - Fix CommonJS require() of .json files in the module fallback service (avoids SyntaxError: Unexpected token ':').

• #11897 bbd8a5e Thanks @​dario-piotrowicz! - Bundle the zod dependency to reduce supply chain attack surface

  In order to prevent possible npm vulnerability attacks, the team's policy is to bundle dependencies in our packages where possible. This helps ensure that only trusted code runs on the user's system, even if compromised packages are later published to npm.

  This change bundles zod (a pure JavaScript validation library with no native dependencies) into miniflare and @​cloudflare/vitest-pool-workers.

  Other dependencies remain external for technical reasons:

  • sharp: Native binary with platform-specific builds
  • undici: Dynamically required at runtime in worker threads
  • ws: Has optional native bindings for performance
  • workerd: Native binary (Cloudflare's JavaScript runtime)
  • @cspotcode/source-map-support: Uses require.cache manipulation at runtime
  • youch: Dynamically required for lazy loading

• Updated dependencies [a0a9ef6, ad4666c, 014e7aa, e414f05, 77e82d2, f08ef21, 0641e6c, eacedba, 05714f8, e8b2ef5, bbd8a5e]:

  • [email protected]
  • [email protected]

@​cloudflare/vitest-pool-workers@​0.12.6

Patch Changes

• Updated dependencies [614bbd7, 788bf78, 1375577, bba0968, c3407ad, f9e8a45]:
  • [email protected]
  • [email protected]

@​cloudflare/vitest-pool-workers@​0.12.5

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.12.8

Patch Changes

• Updated dependencies [8a210af, eb8a415, 3b06b18, 17961bb, 52fdfe7, 6d8d9cd, cb72c11]:
  • [email protected]
  • [email protected]

0.12.7

Patch Changes

• #12056 6d5f69f Thanks @​edmundhung! - fix: allow Vite query parameters like ?raw on .sql file imports

  Importing .sql files with Vite query parameters (e.g., import sql from "./query.sql?raw") would fail with "No such module" errors in vitest-pool-workers 0.12.x. Both import styles now work:

  • import sql from "./query.sql?raw" (Vite handles the ?raw transform)
  • import sql from "./query.sql" (loaded as Text module)

• #11917 7b40ceb Thanks @​ksawaneh! - Fix CommonJS require() of .json files in the module fallback service (avoids SyntaxError: Unexpected token ':').

• #11897 bbd8a5e Thanks @​dario-piotrowicz! - Bundle the zod dependency to reduce supply chain attack surface

  In order to prevent possible npm vulnerability attacks, the team's policy is to bundle dependencies in our packages where possible. This helps ensure that only trusted code runs on the user's system, even if compromised packages are later published to npm.

  This change bundles zod (a pure JavaScript validation library with no native dependencies) into miniflare and @​cloudflare/vitest-pool-workers.

  Other dependencies remain external for technical reasons:

  • sharp: Native binary with platform-specific builds
  • undici: Dynamically required at runtime in worker threads
  • ws: Has optional native bindings for performance
  • workerd: Native binary (Cloudflare's JavaScript runtime)
  • @cspotcode/source-map-support: Uses require.cache manipulation at runtime
  • youch: Dynamically required for lazy loading

• Updated dependencies [a0a9ef6, ad4666c, 014e7aa, e414f05, 77e82d2, f08ef21, 0641e6c, eacedba, 05714f8, e8b2ef5, bbd8a5e]:

  • [email protected]
  • [email protected]

0.12.6

Patch Changes

• Updated dependencies [614bbd7, 788bf78, 1375577, bba0968, c3407ad, f9e8a45]:
  • [email protected]
  • [email protected]

... (truncated)

Commits

• 95154f5 Version Packages (#12184)
• 1228dee Version Packages (#12045)
• 7b40ceb [vitest-pool-workers] Fix JSON require() in module fallback (#11917)
• bbd8a5e Minimize the number of the Miniflare package dependencies (#11897)
• 6d5f69f fix(vitest-pool-workers): allow Vite query parameters like ?raw on module i...
• fb0e101 Version Packages (#12021)
• 0c7e1f4 Version Packages (#11937)
• 9f59043 fix(vitest-pool-workers): suppress deprecation warnings in test subprocesses ...
• 25e2c60 Bump capnp-es to ^0.0.14 (#11943)
• bca7114 Version Packages (#11903)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jan 30, 2026 6:37am