Cloudflare renamed its Workers Vitest package on 19 August 2026 and the mocking rewrite is what breaks

Summary. Cloudflare announced on 19 August 2026 that @cloudflare/vitest-pool-workers is now @cloudflare/vitest-plugin, and published version 1.0.0 to npm the next day at 17:42 UTC. The changelog says "The Vitest configuration API is unchanged," and for imports and configuration that is accurate. It is not accurate for outbound request mocking, which was removed from the package and replaced with two third-party dependencies: msw at version 2.14 or later, plus @msw/cloudflare, which sits at version 0.0.1, was last published on 30 June 2026, carries no licence on its GitHub repository, and has 95 stars. Cloudflare's documented install command asks for msw@^2.14.0; the @msw/cloudflare package declares a peer range of >=2.14.1, so the exact version Cloudflare's own command permits at the low end violates the dependency it installs alongside. Meanwhile the old package was never deprecated: @cloudflare/vitest-pool-workers still resolves to 0.22.0, published 18 August 2026, two days before its stated replacement existed. Teams on the Workers Paid plan, which starts at $5 USD per month per account, will find the codemod handles the rename in one command and handles none of this.

What Cloudflare actually shipped

The changelog post is dated 19 August 2026. It states that version 1 of the Workers Vitest integration is published as @cloudflare/vitest-plugin, that the package was formerly named @cloudflare/vitest-pool-workers, and that "Existing projects must update the dependency name, package imports, and TypeScript types entries."

The npm registry tells a slightly different story about timing. The @cloudflare/vitest-plugin package was created on 20 August 2026 at 14:33 UTC with a placeholder 0.0.0, and 1.0.0 landed at 17:42 UTC the same day. The changelog is dated a day before the artefact it points at.

Version 1.0.0 declares peer dependencies on vitest, @vitest/runner and @vitest/snapshot at ^4.1.0, so this is Vitest 4 only. Its runtime dependencies include wrangler 4.125.0, esbuild 0.28.1, zod 4.4.3, cjs-module-lexer 1.2.3, and miniflare at 5.20260820.0-alpha. A package labelled 1.0.0 pinned to an alpha build of the runtime it drives is worth noticing before you promote it into a release branch.

The rename map

The mechanical part is small and the codemod covers all of it.

Cloudflare ships a codemod: npx @cloudflare/codemods vitest:pool-workers-to-vitest-plugin, with --dry-run to preview and --files <glob> to limit scope. Yarn and pnpm variants are documented. The codemod updates the dependency, the imports and the test TypeScript configuration.

One detail in the manual migration diff is already stale. The guide's before-and-after shows "@cloudflare/vitest-pool-workers": "^0.16.0", but the last published version of that package is 0.22.0, released on 18 August 2026. If you are on a current pool-workers install, the diff you are asked to copy does not match your package.json.

The part that is not a rename

The changelog closes with one line: "For outbound request mocks in Workers tests, use the @msw/cloudflare integration." That sentence is doing a lot of work.

Check the Test APIs reference, last updated 20 August 2026. Its cloudflare:test export list covers events, queues, Durable Objects, D1 and Workflows: createExecutionContext(), waitOnExecutionContext(), createScheduledController(), createMessageBatch(), runInDurableObject(), applyD1Migrations(), introspectWorkflow() and the rest. There is no fetch-mocking export in that list at all. The declarative outbound mock that used to live in the package is gone from the documented surface.

The replacement is a two-package install:

            npm i -D msw@^2.14.0 @msw/cloudflare
          

Then a shared network mock, a Vitest setup file, and MSW request handlers:

            import { setupNetwork } from "@msw/cloudflare";

export const network = setupNetwork();
          

            import { afterAll, afterEach, beforeAll } from "vitest";
import { network } from "./network";

beforeAll(() => network.enable());
afterEach(() => network.resetHandlers());
afterAll(() => network.disable());
          

Individual tests then call network.use() with MSW's http.get() and HttpResponse.json(). WebSocket mocks use MSW's ws.link() API. It is a reasonable design. It is not "unchanged."

The peer range does not line up

This is the checkable defect. Cloudflare's documented install is msw@^2.14.0. The caret range admits 2.14.0 itself. But @msw/cloudflare@0.0.1 declares peerDependencies: { "msw": ">=2.14.1" }. Version 2.14.0 satisfies Cloudflare's instruction and fails the package's own peer requirement.

In practice most lockfile-free installs will pull msw 2.15.0, published 8 July 2026, and nothing will complain. A pinned or resolution-constrained monorepo that lands on 2.14.0 will produce a peer warning or, under strict pnpm settings, an install failure, and the error will point at a package the developer did not choose. Write msw@^2.14.1 and the problem disappears.

What you are actually taking a dependency on

Before this rename, mocking outbound requests in a Workers test suite was Cloudflare's problem. After it, it is Mock Service Worker's problem, and specifically a very young bridge package's problem.

msw itself is mature and MIT-licensed. The bridge is not the same animal. The mswjs/cloudflare repository was created on 22 April 2026, was last pushed on 7 July 2026, has published no GitHub releases, and returns null for its licence field through the GitHub API. Cloudflare made it the documented path on 19 August 2026, six weeks after its last commit.

For a team with a legal review step on third-party code, "no licence declared" is not a footnote. Absence of a licence is not permission; it is the default of reserved rights. That review should happen before the codemod runs, not after a security questionnaire asks about it.

The package README still advertises the removed feature

Open the npm page for @cloudflare/vitest-plugin 1.0.0 and its README lists seven bullets, one of which reads: "Provides a declarative interface for mocking outbound requests." Open the Vitest integration landing page in Cloudflare's docs, last updated 20 August 2026, and the same bullet list appears with six items. The mocking bullet is not there.

The same release ships a README claiming a capability its own documentation removed. If you are evaluating the package from npm rather than from the docs site, that is the line you will read.

Who this hits, and how to tell if it is you

You are affected if any of the following is true.

Your package.json contains @cloudflare/vitest-pool-workers. Nothing breaks today, because the old package still installs and its latest tag still resolves to 0.22.0. The pressure is documentation drift, not a hard cutoff.

Your test suite mocks outbound fetch calls from a Worker. This is the group with real work to do. The rename is a codemod; the mock rewrite is a rewrite of every mocked call site plus a new setup file.

You are still on Vitest 3. The plugin requires Vitest ^4.1.0. Cloudflare's separate Vitest 3 to Vitest 4 guide covers the move from v0.12.x to v0.13.x of the old package, and you need to be through that before the rename is even relevant.

You run pnpm with strict peer resolution in a monorepo. Check the msw version your lockfile actually resolves before you copy the documented install command.

The known issues survive the rename

None of these are new, and none of them are fixed by moving to 1.0.0. The known issues page, last updated 20 August 2026, still lists all of them.

That last row causes more flaky-test tickets than anything else on the list. Storage writes that are not awaited, and fetch or R2.get() response bodies that are never consumed, produce failures that move when you reorder the file.

What to do this week

Run the codemod with --dry-run first and read the diff. It touches package.json, imports and tsconfig types, and nothing else.

Before you install, change Cloudflare's command from msw@^2.14.0 to msw@^2.14.1 so the range matches the @msw/cloudflare peer requirement. One character of difference, and it removes an install-time warning you would otherwise chase.

Pin @msw/cloudflare. At 0.0.1 with no releases and no licence, a floating range on that package is an unforced risk. Pin the exact version, record it in your dependency review, and put a calendar note to re-check the licence field.

Treat the miniflare alpha pin as a reason to keep the old package installable for a rollback window. @cloudflare/vitest-pool-workers 0.22.0 is not deprecated and still resolves, so a revert is a package.json edit rather than an archaeology exercise.

If your Worker's cost profile is what pushed you toward heavier local testing in the first place, the arithmetic has not changed: Workers Paid is a $5 USD per month minimum per account, with 10 million requests included and $0.30 per additional million, plus 30 million CPU milliseconds included and $0.02 per additional million. Local test runs are free; the mistakes they catch are not.

What is still unknown

Cloudflare has not published a deprecation date for @cloudflare/vitest-pool-workers, and as of 24 August 2026 the package carries no deprecation notice on npm. There is no stated support window for the 0.x line.

Nor has Cloudflare said whether @msw/cloudflare will get a 1.0, a licence, or a formal support commitment. It is a Mock Service Worker repository, not a Cloudflare one, and the changelog links to it without qualification.

India-specific considerations

For Indian product teams shipping to regulated buyers, the licence gap is the item to escalate, not the rename. A software bill of materials that lists a dependency with no declared licence will stall a bank or insurer procurement review, and under the Digital Personal Data Protection Act 2023 the accountability for processing sits with the data fiduciary regardless of which upstream package introduced the exposure. Record the pinned version and the date you checked the licence field, so the answer to "when did you last review this" is a date rather than a shrug.

Test tooling migrations are also where offshore delivery teams lose a sprint quietly: the codemod runs green, CI stays green, and the mock rewrite is discovered three weeks later when someone adds a test that calls an external API. Audit for mocked outbound calls before you schedule the work, not after.

FAQ

How eCorpIT can help

Migrations like this fail quietly: the codemod goes green, CI stays green, and the mocked-call rewrite surfaces weeks later. Our QA and test automation practice audits an existing suite for mocked outbound calls, pins and reviews new third-party test dependencies, and runs the cutover behind a rollback window. We work the same way on Cloudflare Workers and Durable Objects delivery and on npm supply-chain policy, where an unlicensed 0.0.1 package is exactly the kind of item a buyer's security review stops on. eCorpIT is CMMI Level 5 and ISO 27001:2022 certified, and we design dependency review aligned with the evidence a regulated buyer asks for. Book a test-suite migration review if you want the audit done before the sprint is committed. Our wider software testing work covers the same ground for teams outside the Workers platform.

References

1. Cloudflare changelog: @cloudflare/vitest-pool-workers is now @cloudflare/vitest-plugin, 19 August 2026

1. Cloudflare Workers docs: Migrate to Vitest plugin

1. Cloudflare Workers docs: Mock outbound requests

1. Cloudflare Workers docs: Vitest integration overview

1. Cloudflare Workers docs: Test APIs reference

1. Cloudflare Workers docs: Vitest integration known issues

1. Cloudflare Workers docs: Isolation and concurrency

1. Cloudflare Workers docs: Migrate from Vitest 3 to Vitest 4

1. Cloudflare Workers docs: Workers pricing

1. npm registry: @cloudflare/vitest-plugin

1. npm registry: @cloudflare/vitest-pool-workers

1. npm registry: @msw/cloudflare

1. npm registry: msw

1. GitHub: mswjs/cloudflare

1. GitHub: mswjs/msw

Last updated 24 August 2026.