[pull] main from cloudflare:main

.changeset/dark-ads-appear.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/devprod-status-bot": minor
+---
+
+Notify when security advisories are submitted to workers-sdk

.changeset/fair-tools-happen.md

@@ -0,0 +1,5 @@
+---
+"wrangler": minor
+---
+
+Improve telemetry errors being sent to Sentry by `wrangler init` when it delegates to C3 by ensuring that they contain the output of the C3 execution.

.changeset/fix-jsonc-config-filename.md

@@ -0,0 +1,10 @@
+---
+"wrangler": patch
+"@cloudflare/workers-utils": patch
+---
+
+Fix `configFileName` returning wrong filename for `.jsonc` config files
+
+Previously, users with a `wrangler.jsonc` config file would see error messages and hints referring to `wrangler.json` instead of `wrangler.jsonc`. This was because the `configFormat` function collapsed both `.json` and `.jsonc` files into a single `"jsonc"` value, losing the distinction between them.
+
+Now `configFormat` returns `"json"` for `.json` files and `"jsonc"` for `.jsonc` files, allowing `configFileName` to return the correct filename for each format.

.changeset/happy-clubs-kiss.md

@@ -0,0 +1,7 @@
+---
+"create-cloudflare": patch
+---
+
+Bump the version of `@cloudflare/vitest-pool-workers` in the hello-world templates from `^0.8.19` to `^0.12.4`
+
+The version of the `@cloudflare/vitest-pool-workers` in the hello-world templates is currently `^0.8.19`, since the package is pre v1, the Caret syntax only installs the latest `0.8.x` version of the package, which is a bit outdated. So the changes here manually keep the package more up to date.

.changeset/purple-lemons-sip.md

@@ -0,0 +1,6 @@
+---
+"@cloudflare/vitest-pool-workers": patch
+"miniflare": patch
+---
+
+Bump capnp-es to ^0.0.14

packages/create-cloudflare/templates/hello-world-with-assets/js/package.json

@@ -9,7 +9,7 @@
 		"test": "vitest"
 	},
 	"devDependencies": {
-		"@cloudflare/vitest-pool-workers": "^0.8.19",
+		"@cloudflare/vitest-pool-workers": "^0.12.4",
 		"wrangler": "^3.101.0",
 		"vitest": "~3.2.0"
 	}

packages/create-cloudflare/templates/hello-world-with-assets/ts/package.json

@@ -10,7 +10,7 @@
 		"cf-typegen": "wrangler types"
 	},
 	"devDependencies": {
-		"@cloudflare/vitest-pool-workers": "^0.8.19",
+		"@cloudflare/vitest-pool-workers": "^0.12.4",
 		"typescript": "^5.5.2",
 		"vitest": "~3.2.0",
 		"wrangler": "^3.101.0"

packages/create-cloudflare/templates/hello-world/js/package.json

@@ -9,7 +9,7 @@
 		"test": "vitest"
 	},
 	"devDependencies": {
-		"@cloudflare/vitest-pool-workers": "^0.8.19",
+		"@cloudflare/vitest-pool-workers": "^0.12.4",
 		"wrangler": "^3.101.0",
 		"vitest": "~3.2.0"
 	}

packages/create-cloudflare/templates/hello-world/ts/package.json

@@ -10,7 +10,7 @@
 		"cf-typegen": "wrangler types"
 	},
 	"devDependencies": {
-		"@cloudflare/vitest-pool-workers": "^0.8.19",
+		"@cloudflare/vitest-pool-workers": "^0.12.4",
 		"typescript": "^5.5.2",
 		"vitest": "~3.2.0",
 		"wrangler": "^3.101.0"

packages/devprod-status-bot/src/index.ts

@@ -274,6 +274,30 @@ function isIssueOrPREvent(
 	return null;
 }
 
+// Repository advisory event type (not yet in @octokit/webhooks-types)
+interface RepositoryAdvisoryEvent {
+	action: "reported" | "published";
+	repository_advisory: {
+		ghsa_id: string;
+		html_url: string;
+		summary: string;
+		description: string;
+	};
+}
+
+function isRepositoryAdvisoryEvent(
+	message: WebhookEvent
+): RepositoryAdvisoryEvent | null {
+	if (
+		"repository_advisory" in message &&
+		"action" in message &&
+		message.action === "reported"
+	) {
+		return message as RepositoryAdvisoryEvent;
+	}
+	return null;
+}
+
 async function sendSecurityAlert(
 	webhookUrl: string,
 	{
@@ -347,6 +371,62 @@ async function sendSecurityAlert(
 	);
 }
 
+async function sendRepositoryAdvisoryAlert(
+	webhookUrl: string,
+	advisoryEvent: RepositoryAdvisoryEvent
+) {
+	const advisory = advisoryEvent.repository_advisory;
+
+	return sendMessage(
+		webhookUrl,
+		{
+			cardsV2: [
+				{
+					cardId: "unique-card-id",
+					card: {
+						header: {
+							title: `🔐 Repository Security Advisory Reported`,
+							subtitle: advisory.summary,
+						},
+						sections: [
+							{
+								collapsible: true,
+								widgets: [
+									{
+										textParagraph: {
+											text: advisory.description,
+										},
+									},
+								],
+							},
+							{
+								collapsible: false,
+								widgets: [
+									{
+										buttonList: {
+											buttons: [
+												{
+													text: "View Advisory",
+													onClick: {
+														openLink: {
+															url: advisory.html_url,
+														},
+													},
+												},
+											],
+										},
+									},
+								],
+							},
+						],
+					},
+				},
+			],
+		},
+		"-repository-advisory-" + advisory.ghsa_id
+	);
+}
+
 async function sendUpcomingMeetingMessage(webhookUrl: string, ai: Ai) {
 	const message = await getBotMessage(
 		ai,
@@ -514,9 +594,18 @@ export default {
 				env.GITHUB_PAT,
 				body
 			);
+			// Flags suspicious issues/PRs for review
 			if (maybeSecurityIssue) {
 				await sendSecurityAlert(env.ALERTS_WEBHOOK, maybeSecurityIssue);
 			}
+			// Notifies when a repository advisory is reported to workers-sdk
+			const maybeRepositoryAdvisory = isRepositoryAdvisoryEvent(body);
+			if (maybeRepositoryAdvisory) {
+				await sendRepositoryAdvisoryAlert(
+					env.ALERTS_WEBHOOK,
+					maybeRepositoryAdvisory
+				);
+			}
 		}
 
 		if (url.pathname.startsWith("/pr-project") && request.method === "POST") {

packages/miniflare/package.json

@@ -72,7 +72,7 @@
 		"@types/ws": "^8.5.7",
 		"acorn": "8.14.0",
 		"acorn-walk": "8.3.2",
-		"capnp-es": "^0.0.11",
+		"capnp-es": "catalog:default",
 		"capnweb": "^0.1.0",
 		"chokidar": "^4.0.1",
 		"concurrently": "^8.2.2",

packages/miniflare/src/runtime/config/generated/workerd.ts

@@ -1,7 +1,7 @@
 // This file has been automatically generated by capnp-es.
 import * as $ from "capnp-es";
 
-export const _capnpFileId = BigInt("0xe6afd26682091c01");
+export const _capnpFileId = 0xe6afd26682091c01n;
 /**
  * Top-level configuration for a workerd instance.
  *

packages/vitest-pool-workers/package.json

@@ -70,7 +70,7 @@
 		"@vitest/runner": "catalog:default",
 		"@vitest/snapshot": "catalog:default",
 		"birpc": "0.2.14",
-		"capnp-es": "^0.0.11",
+		"capnp-es": "catalog:default",
 		"devalue": "^5.3.2",
 		"eslint": "catalog:default",
 		"get-port": "^7.1.0",

packages/vitest-pool-workers/scripts/rtti/rtti.js

@@ -1,6 +1,6 @@
 // This file has been automatically generated by capnp-es.
 import * as $ from "capnp-es";
-export const _capnpFileId = BigInt("0xb042d6da9e1721ad");
+export const _capnpFileId = 0xb042d6da9e1721adn;
 export const Type_Which = {
   /**
 * statically unknown type

packages/workers-utils/src/config/index.ts

@@ -20,23 +20,30 @@ export type {
 
 export function configFormat(
 	configPath: string | undefined
-): "jsonc" | "toml" | "none" {
+): "json" | "jsonc" | "toml" | "none" {
 	if (configPath?.endsWith("toml")) {
 		return "toml";
-	} else if (configPath?.endsWith("json") || configPath?.endsWith("jsonc")) {
+	}
+	if (configPath?.endsWith("jsonc")) {
 		return "jsonc";
 	}
+	if (configPath?.endsWith("json")) {
+		return "json";
+	}
 	return "none";
 }
 
 export function configFileName(configPath: string | undefined) {
 	const format = configFormat(configPath);
-	if (format === "toml") {
-		return "wrangler.toml";
-	} else if (format === "jsonc") {
-		return "wrangler.json";
-	} else {
-		return "Wrangler configuration";
+	switch (format) {
+		case "toml":
+			return "wrangler.toml";
+		case "json":
+			return "wrangler.json";
+		case "jsonc":
+			return "wrangler.jsonc";
+		default:
+			return "Wrangler configuration";
 	}
 }
 

packages/workers-utils/src/constants.ts

@@ -7,3 +7,8 @@ export const SERVICE_TAG_PREFIX = "cf:service=";
 export const ENVIRONMENT_TAG_PREFIX = "cf:environment=";
 
 export const PATH_TO_DEPLOY_CONFIG = ".wrangler/deploy/config.json";
+
+/**
+ * Config formats that use JSON parsing
+ */
+export const JSON_CONFIG_FORMATS: readonly string[] = ["json", "jsonc"];

packages/workers-utils/tests/config/config-format.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+import { configFileName, configFormat } from "../../src/config";
+
+describe("configFormat", () => {
+	it("returns 'toml' for .toml files", () => {
+		expect(configFormat("wrangler.toml")).toBe("toml");
+		expect(configFormat("/path/to/wrangler.toml")).toBe("toml");
+	});
+
+	it("returns 'json' for .json files", () => {
+		expect(configFormat("wrangler.json")).toBe("json");
+		expect(configFormat("/path/to/wrangler.json")).toBe("json");
+	});
+
+	it("returns 'jsonc' for .jsonc files", () => {
+		expect(configFormat("wrangler.jsonc")).toBe("jsonc");
+		expect(configFormat("/path/to/wrangler.jsonc")).toBe("jsonc");
+	});
+
+	it("returns 'none' for unknown formats", () => {
+		expect(configFormat("wrangler.yaml")).toBe("none");
+		expect(configFormat("wrangler.yml")).toBe("none");
+		expect(configFormat(undefined)).toBe("none");
+	});
+});
+
+describe("configFileName", () => {
+	it("returns 'wrangler.toml' for .toml config paths", () => {
+		expect(configFileName("wrangler.toml")).toBe("wrangler.toml");
+		expect(configFileName("/path/to/wrangler.toml")).toBe("wrangler.toml");
+	});
+
+	it("returns 'wrangler.json' for .json config paths", () => {
+		expect(configFileName("wrangler.json")).toBe("wrangler.json");
+		expect(configFileName("/path/to/wrangler.json")).toBe("wrangler.json");
+	});
+
+	it("returns 'wrangler.jsonc' for .jsonc config paths", () => {
+		expect(configFileName("wrangler.jsonc")).toBe("wrangler.jsonc");
+		expect(configFileName("/path/to/wrangler.jsonc")).toBe("wrangler.jsonc");
+	});
+
+	it("returns 'Wrangler configuration' for unknown formats", () => {
+		expect(configFileName("wrangler.yaml")).toBe("Wrangler configuration");
+		expect(configFileName(undefined)).toBe("Wrangler configuration");
+	});
+});

packages/wrangler/src/__tests__/init.test.ts

@@ -76,7 +76,7 @@ describe("init", () => {
 				"mockpm",
 				["create", "cloudflare@^2.5.0"],
 				{
-					stdio: "inherit",
+					stdio: ["inherit", "pipe", "pipe"],
 				}
 			);
 		});
@@ -87,7 +87,9 @@ describe("init", () => {
 			expect(execa).toHaveBeenCalledWith(
 				"mockpm",
 				["create", "cloudflare@^2.5.0", "--wrangler-defaults"],
-				{ stdio: "inherit" }
+				{
+					stdio: ["inherit", "pipe", "pipe"],
+				}
 			);
 		});
 
@@ -126,7 +128,7 @@ describe("init", () => {
 					"mockpm",
 					["run", "create-cloudflare"],
 					{
-						stdio: "inherit",
+						stdio: ["inherit", "pipe", "pipe"],
 					}
 				);
 			});
@@ -137,7 +139,9 @@ describe("init", () => {
 				expect(execa).toHaveBeenCalledWith(
 					"mockpm",
 					["run", "create-cloudflare", "--wrangler-defaults"],
-					{ stdio: "inherit" }
+					{
+						stdio: ["inherit", "pipe", "pipe"],
+					}
 				);
 			});
 		});
@@ -158,7 +162,7 @@ describe("init", () => {
 					env: {
 						CREATE_CLOUDFLARE_TELEMETRY_DISABLED: "1",
 					},
-					stdio: "inherit",
+					stdio: ["inherit", "pipe", "pipe"],
 				}
 			);
 		});
@@ -811,7 +815,9 @@ describe("init", () => {
 					"--existing-script",
 					"existing-memory-crystal",
 				],
-				{ stdio: "inherit" }
+				{
+					stdio: ["inherit", "pipe", "pipe"],
+				}
 			);
 		});
 		it("should download routes + custom domains + workers dev", async () => {