chore(deps-dev): bump miniflare from 3.20230922.0 to 3.20231030.2

[dependabot]

Bumps miniflare from 3.20230922.0 to 3.20231030.2.

Release notes

Sourced from miniflare's releases.

[email protected]

Patch Changes

• #4505 1b348782 Thanks @​mrbbot! - fix: remove __STATIC_CONTENT_MANIFEST from module worker env

  When using Workers Sites with a module worker, the asset manifest must be imported from the __STATIC_CONTENT_MANIFEST virtual module. Miniflare provided this module, but also erroneously added __STATIC_CONTENT_MANIFEST to the env object too. Whilst this didn't break anything locally, it could cause users to develop Workers that ran locally, but not when deployed. This change ensures env doesn't contain __STATIC_CONTENT_MANIFEST.

[email protected]

Minor Changes

• #4348 be2b9cf5 Thanks @​mrbbot! - feat: add support for wrapped bindings

  This change adds a new wrappedBindings worker option for configuring workerd's wrapped bindings. These allow custom bindings to be written as JavaScript functions accepting an env parameter of "inner bindings" and returning the value to bind. For more details, refer to the API docs.

• #4341 d9908743 Thanks @​RamIdeas! - Added a handleRuntimeStdio which enables wrangler (or any other direct use of Miniflare) to handle the stdout and stderr streams from the workerd child process. By default, if this option is not provided, the previous behaviour is retained which splits the streams into lines and calls console.log/console.error.

[email protected]

Minor Changes

• #4324 16cc2e92 Thanks @​penalosa! - Update to latest [email protected]

• #4322 8a25b7fb Thanks @​dario-piotrowicz! - add unsafeEvalBinding option

  Add option to leverage the newly introduced UnsafeEval workerd binding API, such API is used to evaluate javascript code at runtime via the provided eval and newFunction methods.

  The API, for security reasons (as per the workers docs), is not to be use in production but it is intended for local purposes only such as local testing.

  To use the binding you need to specify a string value for the unsafeEvalBinding, such will be the name of the UnsafeEval bindings that will be made available in the workerd runtime.

  For example the following code shows how to set the binding with the UNSAFE_EVAL name and evaluate the 1+1 string:

  const mf = new Miniflare({
  	log,
  	modules: true,
  	script: `
        export default {
            fetch(req, env, ctx) {
                const two = env.UNSAFE_EVAL.eval('1+1');
                return new Response('two = ' + two); // returns 'two = 2'
            }
        }
    `,

... (truncated)

Changelog

Sourced from miniflare's changelog.

3.20231030.2

Patch Changes

• #4505 1b348782 Thanks @​mrbbot! - fix: remove __STATIC_CONTENT_MANIFEST from module worker env

  When using Workers Sites with a module worker, the asset manifest must be imported from the __STATIC_CONTENT_MANIFEST virtual module. Miniflare provided this module, but also erroneously added __STATIC_CONTENT_MANIFEST to the env object too. Whilst this didn't break anything locally, it could cause users to develop Workers that ran locally, but not when deployed. This change ensures env doesn't contain __STATIC_CONTENT_MANIFEST.

3.20231030.1

Minor Changes

• #4348 be2b9cf5 Thanks @​mrbbot! - feat: add support for wrapped bindings

  This change adds a new wrappedBindings worker option for configuring workerd's wrapped bindings. These allow custom bindings to be written as JavaScript functions accepting an env parameter of "inner bindings" and returning the value to bind. For more details, refer to the API docs.

• #4341 d9908743 Thanks @​RamIdeas! - Added a handleRuntimeStdio which enables wrangler (or any other direct use of Miniflare) to handle the stdout and stderr streams from the workerd child process. By default, if this option is not provided, the previous behaviour is retained which splits the streams into lines and calls console.log/console.error.

3.20231030.0

Minor Changes

• #4324 16cc2e92 Thanks @​penalosa! - Update to latest [email protected]

• #4322 8a25b7fb Thanks @​dario-piotrowicz! - add unsafeEvalBinding option

  Add option to leverage the newly introduced UnsafeEval workerd binding API, such API is used to evaluate javascript code at runtime via the provided eval and newFunction methods.

  The API, for security reasons (as per the workers docs), is not to be use in production but it is intended for local purposes only such as local testing.

  To use the binding you need to specify a string value for the unsafeEvalBinding, such will be the name of the UnsafeEval bindings that will be made available in the workerd runtime.

  For example the following code shows how to set the binding with the UNSAFE_EVAL name and evaluate the 1+1 string:

  const mf = new Miniflare({
  	log,
  	modules: true,
  	script: `
        export default {
            fetch(req, env, ctx) {
                const two = env.UNSAFE_EVAL.eval('1+1');
                return new Response('two = ' + two); // returns 'two = 2'
            }
        }

... (truncated)

Commits

• 97727de Version Packages (#4495)
• 311ffbd [wrangler] fix: change wrangler (pages) dev to listen on localhost by def...
• 1b34878 fix: remove __STATIC_CONTENT_MANIFEST from module worker env (#4505)
• f728503 Version Packages (#4463)
• be2b9cf feat: add support for wrapped bindings (#4348)
• d990874 Intercept workerd logs + write all debug logs to a hidden file (#4341)
• 08615aa Version Packages (#4291)
• 3637d97 fix: add miniflare bin entry (#4428)
• 7fbe193 Change default ip for dev server from 0.0.0.0 to * (#4307)
• 9bc52cf Improve Testing (#4325)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.