chore(deps): update dependency msw to v3

[ant-release-bot]

Upgrade both test suites to MSW 3.0.2 and adapt their mocking harnesses to its new imports and unhandled-frame API. Route workers-auth's imported Undici fetch through the CLI's MSW handlers, replace conflicting Undici mock dispatchers, and remove obsolete timer mocks that break Node's fetch implementation.

Rebase onto current main and regenerate the lockfile with the updated dependency graph.

Validation:

• pnpm check passes.
• pnpm --filter cf exec vp test run: 1,531 tests pass.
• pnpm --filter @cloudflare/wrangler-tests exec vp test run: 637 tests pass.

Both full suites ran after CLI generation and the compatibility test bundle build.

---

This PR contains the following updates:

Package	Change	Age	Confidence
msw (source)	2.15.0 → 3.0.2

---

Release Notes

mswjs/msw (msw)

v3.0.2

Compare Source

v3.0.2 (2026-10-03)

Bug Fixes

• vite: support virtual:msw imports in vitest (#​2802) (e73c381) @​kettanaito

v3.0.1

Compare Source

v3.0.1 (2026-09-30)

Bug Fixes

• treat CONNECT requests as the transport mechanism (#​2796) (7cad86a) @​kettanaito

v3.0.0

Compare Source

v3.0.0 (2026-09-28)

• v3.0.0 (#​2692) (2bb4342) @​kettanaito @​Andarist

⚠️ BREAKING CHANGES

• MSW is now ESM-only (#​2765).
• Deprecate support for Node.js v18 and v20 (#​2729). The minimal supported Node.js version is v22.
• msw/native is removed in favor of @msw/react-native.
• Require TypeScript 5.9 as the minimal version.
• Deprecate support for TypeScript 5.1 and 5.2 (#​2730)
• worker.stop() returns a Promise (#​2724). Awaiting it is relevant only for in-flight critical scenarios.
• graphql is now exported as msw/graphql (#​2691). GraphQL is now handled as a proper optional peer dependency.
• Removes the handleRequest() utility. Please use the defineNetwork() API instead.
• GraphQLLinkHandlers type has been renamed to GraphQLLink.
• The file:// requests now throw in Node.js as they normally do (not supported by fetch).
• The Content-Length request header is now removed by bypass().
• HTTP-to-WebSocket upgrade requests performed via fetch() now throw in Node.js as they normally do (not supported by fetch).
• Cookies are no longer managed in Node.js for better compatibilty. Instead, whatever is the default behavior of your environment that's the cookie behavior you get. This has no effect on the browser.
• WebSocket connection life cycle event has been renamed to websocket:connection (#​2783).
• onUnhandledRequest option has been renamed to onUnhandledFrame.
• The library no longer patches setTimeout to circumvent fake timers in test runners. You should advance the fake timers normally for delayed mocked responses to resolve.
• The library no longer returns a mocked cookie string on request.headers.get('cookie') in the handlers. It returns null in all environments. Please use the cookies resolver argument to have cookie-based logic.

Features

• Supports Node.js v24 and v26.
• Supports TypeScript v6.0 and v7.0.
• You can import individual utilities, like delay or passthrough, from the new msw/utils entrypoint for smaller footprint on your bundle.
• Support GraphQL v17.0.
• Support intercepting page navigations and form submissions (#​2721).
• Support GraphQL subscriptions (#​285, #​2763).
• Migrate from path-to-regexp to @msw/url (#​2678).
• Remove the following dependencies:
  • graphql
  • path-to-regexp
  • picocolors
  • statuses
  • strict-event-emitter
• Adds a Vite plugin for MSW (#​2781).
• Adds a websocket:error life cycle event to listen to WebSocket connection errors (#​2784).
• Support modifying the intercepted request headers in passthrough scenarios (#​2786).
• Support a new WebSocket Extension API that allows for better custom experiences (#​2791).

Bug fixes

• Fix an issue where preventing a page closure via the beforeunload listener would unregister the MSW worker (#​1105).
• Fix an issue that caused intermittent test failures in Vitest Browser Mode and Firefox if using maxWorkers: 1 (#​2726).
• Fix an issue where in-flight requests were incorrectly passthrough when performed before calling worker.stop() (#​2724, #​2597).
• Fix an issue where persisting cookies in localStorage would cause a maximum quota exceeded errors.
• Fix various issues related to the network interception in Node.js.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[pkg-pr-new]

npm i https://pkg.pr.new/cf@277

commit: 384444e

[ask-bonk]

Review: 1 findings.

Posted 1 inline finding.

github run

[github-actions]

cf --help startup

	mean	stddev	min	max
PR	262.5 ms	4.4 ms	254.8 ms	268.9 ms
base	265.6 ms	15.1 ms	256.4 ms	328.5 ms

Δ (PR vs base): ↓ -3.1 ms (-1.2%)

Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.

[ask-bonk]

LGTM

github run