chore(deps): bump undici and wrangler

[dependabot]

Bumps undici to 7.18.2 and updates ancestor dependency wrangler. These dependencies need to be updated together.

Updates undici from 7.14.0 to 7.18.2

Release notes

Sourced from undici's releases.

v7.18.2

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

• fix(decompress): limit Content-Encoding chain to 5 to prevent resourc… by @​mcollina in nodejs/undici#4729

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

What's Changed

• Test and Fix running without SSL by @​mcollina in nodejs/undici#4727
• docs: add security warning for strictContentLength option by @​mcollina in nodejs/undici#4726
• build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 by @​dependabot[bot] in nodejs/undici#4718
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @​dependabot[bot] in nodejs/undici#4719

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

What's Changed

• chore: extract infra and encoding methods by @​Uzlopak in nodejs/undici#4523
• ci: remove h2 by @​Uzlopak in nodejs/undici#4534
• ci: make nodejs-shared wf reusable, install binaryen for wasm-opt, test on node-nightly by @​Uzlopak in nodejs/undici#4535
• ci: fix nightly shared library case by @​Uzlopak in nodejs/undici#4543
• test: consume bodies of fetch responses to fix failing macos 20 ci by @​Uzlopak in nodejs/undici#4528
• docs: add Cache Interceptor example to README by @​tawseefnabi in nodejs/undici#4393
• test: remove node20 version check by @​Uzlopak in nodejs/undici#4544
• types: use MessagePort instance type in MessageEvent by @​Renegade334 in nodejs/undici#4546
• ci: set write permissions on job level by @​Uzlopak in nodejs/undici#4537
• lint: activate n/no-process-exit by @​Uzlopak in nodejs/undici#4548
• ci: run benchmarks on pull_requests and by pushing on specific branches only by @​Uzlopak in nodejs/undici#4536
• chore: activate n/prefer-node-protocol to enforce 'node:' prefix for requiring node built-ins by @​Uzlopak in nodejs/undici#4547
• feat(H2): correct CONNECT behaviour by @​metcoder95 in nodejs/undici#4541
• test: fix plans by @​Uzlopak in nodejs/undici#4550
• feat: add runtime feature "detection" by @​Uzlopak in nodejs/undici#4545
• perf: use less promises in extractBody by @​Uzlopak in nodejs/undici#4458
• fix(proxy-agent): add missing return after callback-call by @​Uzlopak in nodejs/undici#4553
• fix: remove redundant line in retry-handler by @​Uzlopak in nodejs/undici#4554
• ci: add no-wasm-simd option by @​Uzlopak in nodejs/undici#4533
• fix: use lazyloaders for runtime feature detection by @​Uzlopak in nodejs/undici#4557
• fix: minor changes in dispatcher-base.js and types for Dispatcher by @​Uzlopak in nodejs/undici#4556

... (truncated)

Commits

• 7e5cb2d Bumped v7.18.2 (#4730)
• b04e3cb fix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaus...
• 2bcb77b Bumped v7.18.1 (#4728)
• 58a12b7 build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4719)
• 5fa2930 build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (#4718)
• fbbe283 docs: add security warning for strictContentLength option (#4726)
• ce12d9e fix: do not crash if Node.js is compiled without SSL (#4727)
• ebe3e33 Bumped v7.18.0 (#4725)
• 4e9b88b fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
• d560767 Bumped v7.17.0 (#4724)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.

Updates wrangler from 4.59.1 to 4.65.0

Release notes

Sourced from wrangler's releases.

wrangler@4.65.0

Minor Changes

• #12473 b900c5a Thanks @​petebacondarwin! - Add CF_PAGES environment variables to wrangler pages dev

  wrangler pages dev now automatically injects Pages-specific environment variables (CF_PAGES, CF_PAGES_BRANCH, CF_PAGES_COMMIT_SHA, CF_PAGES_URL) for improved dev/prod parity. This enables frameworks like SvelteKit to auto-detect the Pages environment during local development.

  • CF_PAGES is set to "1" to indicate the Pages environment
  • CF_PAGES_BRANCH defaults to the current git branch (or "local" if not in a git repo)
  • CF_PAGES_COMMIT_SHA defaults to the current git commit SHA (or a placeholder if not in a git repo)
  • CF_PAGES_URL is set to a simulated commit preview URL (e.g., https://<sha>.<project-name>.pages.dev)

  These variables are displayed with their actual values in the bindings table during startup, making it easy to verify what branch and commit SHA were detected.

  These variables can be overridden by user-defined vars in the Wrangler configuration, .env, .dev.vars, or via CLI flags.

• #12464 10a1c4a Thanks @​petebacondarwin! - Allow deleting KV namespaces by name

  You can now delete a KV namespace by providing its name as a positional argument:

  wrangler kv namespace delete my-namespace

  This aligns the delete command with the create command, which also accepts a namespace name. The existing --namespace-id and --binding flags continue to work as before.

• #12382 d7b492c Thanks @​dario-piotrowicz! - Add Pages detection to autoconfig flows

  When running the autoconfig logic (via wrangler setup, wrangler deploy --x-autoconfig, or the programmatic autoconfig API), Wrangler now detects when a project appears to be a Pages project and handles it appropriately:

  • For wrangler deploy, it warns the user but still allows them to proceed
  • For wrangler setup and the programmatic autoconfig API, it throws a fatal error

• #12461 8809411 Thanks @​penalosa! - Support type: inherit bindings when using startWorker()

  This is an internal binding type that should not be used by external users of the API

• #12515 1a9eddd Thanks @​ascorbic! - Add --json flag to wrangler whoami for machine-readable output

  wrangler whoami --json now outputs structured JSON containing authentication status, auth type, email, accounts, and token permissions. When the user is not authenticated, the command exits with a non-zero status code and outputs {"loggedIn":false}, making it easy to check auth status in shell scripts without parsing text output.

  # Parse the JSON output
  wrangler whoami --json | jq '.accounts'
  Check if authenticated in a script. Returns 0 if authenticated, non-zero if not.
  if wrangler whoami --json > /dev/null 2>&1; then
  echo "Authenticated"
  else

... (truncated)

Commits

• 0ebc50d Version Packages (#12508)
• 56bed52 test(unenv): add test for native modules enabled after 2026-01-29 (#12539)
• f7fa326 Bump the workerd-and-workers-types group with 2 updates (#12541)
• b9c5c7a test: refactor --json tests (#12511)
• 9873579 Part 6️⃣ of removing CfWorkerInit["bindings"] (#12491)
• 41e18aa [Wrangler/Workflows] Add warning on deploy of workflows belonging to other wo...
• 6570ded Use vitest#expect from the local context (#12510)
• 10a1c4a [wrangler] Allow deleting KV namespaces by name (#12464)
• 762b547 Update snapshot (#12532)
• ad817dd [wrangler] Use project's package manager in wrangler setup (#12437)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.