Bump the packages group across 1 directory with 14 updates

.github/workflows/semgrep.yml

@@ -5,7 +5,7 @@ on:
     branches: [main, master]
   workflow_dispatch: {}
   schedule:
-    - cron: '0 0 1-7 * 2' # per-repo, staggered across month
+    - cron: "0 0 1-7 * 2" # per-repo, staggered across month
 concurrency:
   group: semgrep-${{ github.event_name }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

README.md

@@ -48,13 +48,13 @@ Use this deployment to test an implementation.
 
 This repository uses [npm](https://docs.npmjs.com/cli/v11/using-npm/workspaces) and [cargo](https://doc.rust-lang.org/book/ch14-03-cargo-workspaces.html) workspaces. There are several packages which it provides:
 
-| Package                                                        | Language   | Description                                                                            |
-| :------------------------------------------------------------- | :--------- | :------------------------------------------------------------------------------------- |
-| [http-message-sig](./packages/http-message-sig/)               | TypeScript | HTTP Message Signatures as defined in RFC 9421                                         |
-| [jsonwebkey-thumbprint](./packages/jsonwebkey-thumbprint/)     | TypeScript | JWK Thumbprint as defined in RFC 7638                                                  |
+| Package                                                        | Language   | Description                                                                                                                                                                   |
+| :------------------------------------------------------------- | :--------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [http-message-sig](./packages/http-message-sig/)               | TypeScript | HTTP Message Signatures as defined in RFC 9421                                                                                                                                |
+| [jsonwebkey-thumbprint](./packages/jsonwebkey-thumbprint/)     | TypeScript | JWK Thumbprint as defined in RFC 7638                                                                                                                                         |
 | [web-bot-auth](./packages/web-bot-auth/)                       | TypeScript | HTTP Message Signatures for Bots as defined in [draft-meunier-webbotauth-httpsig-protocol-00](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-httpsig-protocol/00/) |
 | [web-bot-auth](./crates/web-bot-auth/)                         | Rust       | HTTP Message Signatures for Bots as defined in [draft-meunier-webbotauth-httpsig-protocol-00](https://datatracker.ietf.org/doc/draft-meunier-webbotauth-httpsig-protocol/00/) |
-| [http-signature-directory](./crates/http-signature-directory/) | Rust       | Validates whether an HTTP message signature directory is correctly signed and valid    |
+| [http-signature-directory](./crates/http-signature-directory/) | Rust       | Validates whether an HTTP message signature directory is correctly signed and valid                                                                                           |
 
 ## Security Considerations
 

examples/browser-extension/package.json

@@ -3,7 +3,7 @@
   "version": "0.2.0",
   "description": "Enterprise browser extension adding an HTTP Message signature to all requests",
   "scripts": {
-    "build:chrome": "tsup src/background.ts --format esm --platform browser --target chrome100 --clean --out-dir dist/mv3/chromium --external node:crypto",
+    "build:chrome": "tsdown src/background.ts --format esm --platform browser --target chrome100 --out-dir dist/mv3/chromium --deps.never-bundle node:crypto",
     "bundle:chrome": "npm run build:chrome && node ./scripts/build_web_artifacts.mjs",
     "start:config": "http-server ./dist/web-ext-artifacts -p 8000",
     "test": "echo \"Error: no test specified\" && exit 1",
@@ -28,10 +28,10 @@
   },
   "homepage": "https://github.com/cloudflareresearch/web-bot-auth#readme",
   "devDependencies": {
-    "@types/chrome": "0.0.326",
+    "@types/chrome": "0.2.0",
     "@types/libsodium-wrappers": "0.7.14",
     "crx": "5.0.1",
     "http-server": "14.1.1",
-    "libsodium-wrappers": "0.7.15"
+    "libsodium-wrappers": "0.8.4"
   }
 }

examples/verification-workers/package.json

@@ -11,7 +11,7 @@
 		"cf-typegen": "wrangler types"
 	},
 	"devDependencies": {
-		"@cloudflare/vitest-pool-workers": "^0.8.18",
+		"@cloudflare/vitest-pool-workers": "^0.16.20",
 		"@cloudflare/workers-types": "^4.20250406.0",
 		"wrangler": "^4.16.1"
 	}

examples/verification-workers/vitest.config.mts

@@ -1,11 +1,10 @@
-import { defineWorkersConfig } from "@cloudflare/vitest-pool-workers/config";
+import { cloudflareTest } from "@cloudflare/vitest-pool-workers";
+import { defineConfig } from "vitest/config";
 
-export default defineWorkersConfig({
-	test: {
-		poolOptions: {
-			workers: {
-				wrangler: { configPath: "./wrangler.jsonc" },
-			},
-		},
-	},
+export default defineConfig({
+	plugins: [
+		cloudflareTest({
+			wrangler: { configPath: "./wrangler.jsonc" },
+		}),
+	],
 });

examples/verification-workers/worker-configuration.d.ts

@@ -87,7 +87,7 @@ declare abstract class WorkerGlobalScope extends EventTarget<WorkerGlobalScopeEv
 }
 /* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console) */
 interface Console {
-	"assert"(condition?: boolean, ...data: any[]): void;
+	assert(condition?: boolean, ...data: any[]): void;
 	/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/clear_static) */
 	clear(): void;
 	/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/console/count_static) */
@@ -148,13 +148,7 @@ declare namespace WebAssembly {
 		constructor(message?: string);
 	}
 	type ValueType =
-		| "anyfunc"
-		| "externref"
-		| "f32"
-		| "f64"
-		| "i32"
-		| "i64"
-		| "v128";
+		"anyfunc" | "externref" | "f32" | "f64" | "i32" | "i64" | "v128";
 	interface GlobalDescriptor {
 		value: ValueType;
 		mutable?: boolean;
@@ -550,15 +544,7 @@ interface DurableObjectNamespaceNewUniqueIdOptions {
 	jurisdiction?: DurableObjectJurisdiction;
 }
 type DurableObjectLocationHint =
-	| "wnam"
-	| "enam"
-	| "sam"
-	| "weur"
-	| "eeur"
-	| "apac"
-	| "oc"
-	| "afr"
-	| "me";
+	"wnam" | "enam" | "sam" | "weur" | "eeur" | "apac" | "oc" | "afr" | "me";
 interface DurableObjectNamespaceGetDurableObjectOptions {
 	locationHint?: DurableObjectLocationHint;
 }
@@ -820,8 +806,7 @@ interface EventListenerObject<EventType extends Event = Event> {
 	handleEvent(event: EventType): void;
 }
 type EventListenerOrEventListenerObject<EventType extends Event = Event> =
-	| EventListener<EventType>
-	| EventListenerObject<EventType>;
+	EventListener<EventType> | EventListenerObject<EventType>;
 /**
  * EventTarget is a DOM interface implemented by objects that can receive events and may have listeners for them.
  *
@@ -1540,9 +1525,7 @@ declare abstract class FetchEvent extends ExtendableEvent {
 	passThroughOnException(): void;
 }
 type HeadersInit =
-	| Headers
-	| Iterable<Iterable<string>>
-	| Record<string, string>;
+	Headers | Iterable<Iterable<string>> | Record<string, string>;
 /**
  * This Fetch API interface allows you to perform various actions on HTTP request and response headers. These actions include retrieving, setting, adding to, and removing. A Headers object has an associated header list, which is initially empty and consists of zero or more name and value pairs.  You can add to this using methods like append() (see Examples.) In all methods of this interface, header names are matched by case-insensitive byte sequence.
  *
@@ -1647,8 +1630,7 @@ interface ResponseInit {
 	encodeBody?: "automatic" | "manual";
 }
 type RequestInfo<CfHostMetadata = unknown, Cf = CfProperties<CfHostMetadata>> =
-	| Request<CfHostMetadata, Cf>
-	| string;
+	Request<CfHostMetadata, Cf> | string;
 /**
  * This Fetch API interface represents a resource request.
  *
@@ -1666,8 +1648,10 @@ declare var Request: {
  *
  * [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request)
  */
-interface Request<CfHostMetadata = unknown, Cf = CfProperties<CfHostMetadata>>
-	extends Body {
+interface Request<
+	CfHostMetadata = unknown,
+	Cf = CfProperties<CfHostMetadata>,
+> extends Body {
 	/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/Request/clone) */
 	clone(): Request<CfHostMetadata, Cf>;
 	/**
@@ -1972,25 +1956,15 @@ declare abstract class R2Bucket {
 	put(
 		key: string,
 		value:
-			| ReadableStream
-			| ArrayBuffer
-			| ArrayBufferView
-			| string
-			| null
-			| Blob,
+			ReadableStream | ArrayBuffer | ArrayBufferView | string | null | Blob,
 		options?: R2PutOptions & {
 			onlyIf: R2Conditional | Headers;
 		}
 	): Promise<R2Object | null>;
 	put(
 		key: string,
 		value:
-			| ReadableStream
-			| ArrayBuffer
-			| ArrayBufferView
-			| string
-			| null
-			| Blob,
+			ReadableStream | ArrayBuffer | ArrayBufferView | string | null | Blob,
 		options?: R2PutOptions
 	): Promise<R2Object>;
 	createMultipartUpload(
@@ -2467,9 +2441,7 @@ interface TextDecoderStreamTextDecoderStreamInit {
  *
  * [MDN Reference](https://developer.mozilla.org/docs/Web/API/ByteLengthQueuingStrategy)
  */
-declare class ByteLengthQueuingStrategy
-	implements QueuingStrategy<ArrayBufferView>
-{
+declare class ByteLengthQueuingStrategy implements QueuingStrategy<ArrayBufferView> {
 	constructor(init: QueuingStrategyInit);
 	/* [MDN Reference](https://developer.mozilla.org/docs/Web/API/ByteLengthQueuingStrategy/highWaterMark) */
 	get highWaterMark(): number;
@@ -3157,11 +3129,7 @@ declare abstract class BaseAiTextEmbeddings {
 }
 type RoleScopedChatInput = {
 	role:
-		| "user"
-		| "assistant"
-		| "system"
-		| "tool"
-		| (string & NonNullable<unknown>);
+		"user" | "assistant" | "system" | "tool" | (string & NonNullable<unknown>);
 	content: string;
 	name?: string;
 };
@@ -3524,9 +3492,7 @@ interface BGEM3InputEmbedding {
 	truncate_inputs?: boolean;
 }
 type Ai_Cf_Baai_Bge_M3_Output =
-	| BGEM3OuputQuery
-	| BGEM3OutputEmbeddingForContexts
-	| BGEM3OuputEmbedding;
+	BGEM3OuputQuery | BGEM3OutputEmbeddingForContexts | BGEM3OuputEmbedding;
 interface BGEM3OuputQuery {
 	response?: {
 		/**
@@ -3907,8 +3873,7 @@ declare abstract class Base_Ai_Cf_Baai_Bge_Reranker_Base {
 	postProcessedOutputs: Ai_Cf_Baai_Bge_Reranker_Base_Output;
 }
 type Ai_Cf_Meta_Llama_4_Scout_17B_16E_Instruct_Input =
-	| Ai_Cf_Meta_Llama_4_Prompt
-	| Ai_Cf_Meta_Llama_4_Messages;
+	Ai_Cf_Meta_Llama_4_Prompt | Ai_Cf_Meta_Llama_4_Messages;
 interface Ai_Cf_Meta_Llama_4_Prompt {
 	/**
 	 * The input text prompt for the model to generate a response.
@@ -4399,8 +4364,7 @@ type AIGatewayProviders =
 	| "adobe-firefly";
 type AIGatewayHeaders = {
 	"cf-aig-metadata":
-		| Record<string, number | string | boolean | null | bigint>
-		| string;
+		Record<string, number | string | boolean | null | bigint> | string;
 	"cf-aig-custom-cost":
 		| {
 				per_token_in?: number;
@@ -4974,8 +4938,7 @@ interface IncomingRequestCfPropertiesBotManagement {
 	 */
 	clientTrustScore: number;
 }
-interface IncomingRequestCfPropertiesBotManagementEnterprise
-	extends IncomingRequestCfPropertiesBotManagement {
+interface IncomingRequestCfPropertiesBotManagementEnterprise extends IncomingRequestCfPropertiesBotManagement {
 	/**
 	 * Results of Cloudflare's Bot Management analysis
 	 */
@@ -5516,8 +5479,7 @@ declare type Iso3166Alpha2Code =
 /** The 2-letter continent codes Cloudflare uses */
 declare type ContinentCode = "AF" | "AN" | "AS" | "EU" | "NA" | "OC" | "SA";
 type CfProperties<HostMetadata = unknown> =
-	| IncomingRequestCfProperties<HostMetadata>
-	| RequestInitCfProperties;
+	IncomingRequestCfProperties<HostMetadata> | RequestInitCfProperties;
 interface D1Meta {
 	duration: number;
 	size_after: number;
@@ -6026,9 +5988,7 @@ declare namespace Rpc {
 		[__WORKFLOW_ENTRYPOINT_BRAND]: never;
 	}
 	export type EntrypointBranded =
-		| WorkerEntrypointBranded
-		| DurableObjectBranded
-		| WorkflowEntrypointBranded;
+		WorkerEntrypointBranded | DurableObjectBranded | WorkflowEntrypointBranded;
 	// Types that can be used through `Stub`s
 	export type Stubable = RpcTargetBranded | ((...args: any[]) => any);
 	// Types that can be passed over RPC
@@ -6131,10 +6091,9 @@ declare namespace Rpc {
 		T extends object,
 		Reserved extends string = never,
 	> = MaybeCallableProvider<T> & {
-		[K in Exclude<
-			keyof T,
-			Reserved | symbol | keyof StubBase<never>
-		>]: MethodOrProperty<T[K]>;
+		[
+			K in Exclude<keyof T, Reserved | symbol | keyof StubBase<never>>
+		]: MethodOrProperty<T[K]>;
 	};
 }
 declare namespace Cloudflare {
@@ -6185,16 +6144,9 @@ declare module "cloudflare:workers" {
 		webSocketError?(ws: WebSocket, error: unknown): void | Promise<void>;
 	}
 	export type WorkflowDurationLabel =
-		| "second"
-		| "minute"
-		| "hour"
-		| "day"
-		| "week"
-		| "month"
-		| "year";
+		"second" | "minute" | "hour" | "day" | "week" | "month" | "year";
 	export type WorkflowSleepDuration =
-		| `${number} ${WorkflowDurationLabel}${"s" | ""}`
-		| number;
+		`${number} ${WorkflowDurationLabel}${"s" | ""}` | number;
 	export type WorkflowDelayDuration = WorkflowSleepDuration;
 	export type WorkflowTimeoutDuration = WorkflowSleepDuration;
 	export type WorkflowBackoff = "constant" | "linear" | "exponential";
@@ -6239,7 +6191,8 @@ declare module "cloudflare:workers" {
 	export abstract class WorkflowEntrypoint<
 		Env = unknown,
 		T extends Rpc.Serializable<T> | unknown = unknown,
-	> implements Rpc.WorkflowEntrypointBranded
+	>
+		implements Rpc.WorkflowEntrypointBranded
 	{
 		[Rpc.__WORKFLOW_ENTRYPOINT_BRAND]: never;
 		protected ctx: ExecutionContext;
@@ -6483,8 +6436,7 @@ type VectorizeVectorMetadataValue = string | number | boolean | string[];
  * Additional information to associate with a vector.
  */
 type VectorizeVectorMetadata =
-	| VectorizeVectorMetadataValue
-	| Record<string, VectorizeVectorMetadataValue>;
+	VectorizeVectorMetadataValue | Record<string, VectorizeVectorMetadataValue>;
 type VectorFloatArray = Float32Array | Float64Array;
 interface VectorizeError {
 	code?: number;