Bump the workerd-and-workers-types group with 2 updates

[dependabot]

Bumps the workerd-and-workers-types group with 2 updates: @cloudflare/workers-types and workerd.

Updates @cloudflare/workers-types from 5.20261016.1 to 5.20261019.1

Commits

• See full diff in compare view

Updates workerd from 1.20261016.1 to 1.20261019.1

Release notes

Sourced from workerd's releases.

v1.20261019.1

What's Changed

• More deduplication and cleanup in TS streams by @​jasnell in cloudflare/workerd#7795
• Test Expect: 100-continue on the hyper listener by @​danlapid in cloudflare/workerd#7815

Full Changelog: cloudflare/workerd@v1.20261018.1...v1.20261019.1

v1.20261018.1

What's Changed

• [nfc] Add IWYU guidelines to AGENTS.md, Remove rust_io_link_check by @​fhanau in cloudflare/workerd#7736
• Deflake server bench test by @​jasnell in cloudflare/workerd#7797

Full Changelog: cloudflare/workerd@v1.20261017.1...v1.20261018.1

v1.20261017.1

What's Changed

• Hold an actor's RPC exceptions behind its output gate by @​ry in cloudflare/workerd#7747
• Defer pull to a batch's last chunk on the auto-allocate path by @​jasnell in cloudflare/workerd#7764
• Log internal build URL from the get go by @​ketanhwr in cloudflare/workerd#7775
• STOR-5615: Set the Durable Object retry policy per stub by @​apeacock1991 in cloudflare/workerd#7672
• Fix Git Bash discovery in Windows workspace status by @​floitsch in cloudflare/workerd#7782
• [build] Remove non-deterministic scratch crate by @​fhanau in cloudflare/workerd#7778
• Add a transient marker for Durable Object call failures by @​apeacock1991 in cloudflare/workerd#7717
• Pin how stream constructors read source, sink and transformer members by @​jasnell in cloudflare/workerd#7767
• v8 15.7 by @​csjh in cloudflare/workerd#7776
• Release a queued ReadableStream's source once its algorithms clear by @​jasnell in cloudflare/workerd#7770
• Adds a new bench mechanism by @​jasnell in cloudflare/workerd#7669
• Pin additional behaviors and deduplicate more by @​jasnell in cloudflare/workerd#7771
• Pin how stream constructors read source, sink and transformer members by @​jasnell in cloudflare/workerd#7784
• Triage WPT updates with the wpt-update skill in CI by @​npaun in cloudflare/workerd#7731
• Pin a byte source's expectedLength as an exact total by @​jasnell in cloudflare/workerd#7786
• Update WPT by @​workers-devprod in cloudflare/workerd#7792
• Bump @​opennextjs/cloudflare from 1.17.2 to 1.20.2 by @​dependabot[bot] in cloudflare/workerd#7791

New Contributors

• @​ry made their first contribution in cloudflare/workerd#7747

Full Changelog: cloudflare/workerd@v1.20261016.1...v1.20261017.1

Commits

• 781048b Release 2026-10-19
• 7e4cf03 Test Expect: 100-continue on the hyper listener
• 2c34e93 Merge pull request #7795 from cloudflare/jasnell/ts-streams-duplicate-consoli...
• 8b8ed9f Release 2026-10-18
• 7f02098 Run TransformStream's close, abort and cancel through one finish
• 6094cc6 Drop TransformStream guards that construction makes unreachable
• 3c5991b Merge pull request #7797 from cloudflare/jasnell/deflake-server-bench-test
• da6f403 Deflake server bench test
• 1568dcf Merge pull request #7736 from cloudflare/felix/092226-build-graph
• 9629fdd [build] Remove rust_io_link_check
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

[changeset-bot]

🦋 Changeset detected

Latest commit: be58b84

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
miniflare	Patch
wrangler	Patch
@cloudflare/deploy-helpers	Patch
@cloudflare/pages-shared	Patch
@cloudflare/remote-bindings	Patch
@cloudflare/runtime-types	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[clanky-the-clanker]

💬 Approved with comments — The workerd and workers-types bump is consistent across the catalog, DEFAULT_COMPAT_DATE and the changeset. One INFO note: an esbuild devDependency was added to autoconfig and codemods, which neither package appears to use.

Findings: 1 info

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #16352.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## INFO (1)

### [Code Quality] `esbuild` devDependency added to `autoconfig` and `codemods`, which do not import it. Harmless, since it uses the catalog version, but outside this bump's scope. Please confirm it is intended.
- **File:** packages/autoconfig/package.json:44

---

📋 Code Quality: 💬 1 info

The bump is consistent. Separately, an esbuild devDependency was added to two packages without explanation.

Recommendation: 💬 Optional Nits

• [INFO] esbuild devDependency added to autoconfig and codemods, which do not import it. Harmless, since it uses the catalog version, but outside this bump's scope. Please confirm it is intended. (packages/autoconfig/package.json:44)

View full review

• The pnpm-workspace.yaml catalog now pins workerd 1.20261019.1 and @cloudflare/workers-types ^5.20261019.1. DEFAULT_COMPAT_DATE in packages/workers-utils/src/default-compat-date.ts is updated to 2026-10-19 to match.
• [INFO] packages/autoconfig/package.json:44 and packages/codemods/package.json:51 each gain "esbuild": "catalog:default".
  • Neither package imports esbuild in its sources. The only match is a string literal in a codemods test.
  • Both packages build with tsup, and tsup already brings in esbuild.
  • The new entries use the existing catalog version, so they do no harm. They are still outside what this pull request says it does, which is the workerd and workers-types bump.
  • Please confirm they are intended, for example to pin esbuild for tsup. If not, drop them and regenerate the lockfile.

---

✅ All other checks passed

🔒 Security: ✅ LGTM

Routine runtime and type-definition version bump. Any esbuild addition resolves to the existing pinned catalog version.

---

📖 AGENTS.md: ✅ LGTM

No AGENTS.md updates needed.

---

⚡ Performance: ✅ LGTM

No performance concerns.

---

📝 Documentation: ✅ LGTM

The changeset accompanies the dependency bump; no documentation concerns.

---

_{Reviewed commit: be58b840}

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@16352

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@16352

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@16352

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@16352

@cloudflare/containers-shared

npm i https://pkg.pr.new/@cloudflare/containers-shared@16352

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@16352

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@16352

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@16352

miniflare

npm i https://pkg.pr.new/miniflare@16352

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@16352

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@16352

@cloudflare/runtime-types

npm i https://pkg.pr.new/@cloudflare/runtime-types@16352

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@16352

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@16352

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@16352

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@16352

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@16352

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@16352

wrangler

npm i https://pkg.pr.new/wrangler@16352

commit: be58b84

[workers-devprod]

Codeowners reviews satisfied

[petebacondarwin]

The explicit esbuild: "catalog:default" devDependencies added in be58b840f are intentional: they supply the esbuild peer used by Vite/Vitest in autoconfig and codemods.

Both packages use tsup@8.3.0, which requires esbuild@^0.23.0 and resolves to 0.23.1. With pnpm 10.33.0, peer resolution through tsup's bundle-require dependency can expose that older copy at the package level. Vite then binds to it, even though Vite 8.2.0 expects ^0.27.0 || ^0.28.0. Tracing pnpm showed different handling of resolved peers on the first traversal versus reuse of cached dependency results, which explains why the two otherwise similar packages could get different bindings. A clean install also swapped which package had the older binding.

Declaring esbuild directly makes the intended peer version explicit. After regenerating the lockfile, Vite uses the catalog's 0.28.2 in both packages, while tsup retains its own compatible 0.23.1. The unused Vite/Vitest snapshots bound to 0.23.1 are removed. These declarations supply a tool's peer dependency, so no source import is needed.

The remaining @better-auth/stripe hash change is expected: pnpm hashes its long resolved peer context, which includes @cloudflare/workers-types. Updating that version changes the hash; the Stripe integration's version and tarball integrity are unchanged.

Validated with Node 22.22.1 and pnpm 10.33.0: frozen install, catalog/pinned-dependency and formatting checks, plus all 243 autoconfig tests and 410 codemods tests passed.