Resolve installed dependency versions from lockfiles instead of node_modules

[dario-piotrowicz]

getInstalledPackageVersion now consults the nearest lockfile (pnpm-lock.yaml, package-lock.json, yarn.lock, or bun.lock) before falling back to resolving from node_modules. The lockfile is parsed once and memoized, making repeated version lookups significantly faster. This also improves the accuracy of the dependency metadata collected during deploys. All four major package managers (npm, pnpm, yarn, and bun) are supported across their lockfile format versions

---

Note

I run some benchmarks on this PR's prerelease and I must say that the perf benefit seems to be quite minimal even when dealing with a good number of dependencies (~130). That however might be because of performance fs operations on my system, maybe the different could be more significative on older less powerful machines (also this definitely scaled batter, so the more the dependencies the more this approach speeds things up).

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: performance improvement

A picture of a cute animal (not mandatory, but encouraged)

[changeset-bot]

🦋 Changeset detected

Latest commit: be782c6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 8 packages

Name	Type
@cloudflare/workers-utils	Minor
wrangler	Patch
@cloudflare/autoconfig	Patch
@cloudflare/cli-shared-helpers	Patch
@cloudflare/deploy-helpers	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch
@cloudflare/workers-auth	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

⚠️ Issues found

.changeset/fuzzy-tails-listen.md — Version type should be minor, not patch:

Support testing Streaming Tail Workers in Vitest Pool Workers.

Per .changeset/README.md, patch is for bug fixes and small improvements. minor is for new features. Adding support for testing a new Worker type (Streaming Tail Workers) is a new feature and should be a minor release.

---

All other reviewed changesets look good:

• .changeset/lockfile-version-resolution.md — Meaningful description; version choices acceptable.
• .changeset/email-routing-deploy-apply.md — Minor for new feature; good detail.
• .changeset/fuzzy-dogs-listen.md — Minor for new feature; adequate description.
• .changeset/fuzzy-lions-provision.md — Minor for new feature; good description.
• .changeset/drop-provisioning-experimental-header.md — Patch for small wording change.
• .changeset/fix-nonascii-vitest-pool-workers-redirect.md — Patch for bug fix; clear explanation.
• .changeset/fix-nonascii-mf-vitest-worker-data-header.md — Patch for bug fix; clear explanation.
• .changeset/autoconfig-nuxt-preserve-modules.md — Patch for bug fix; good description.
• .changeset/create-cloudflare-nuxt-preserve-modules.md — Patch for bug fix; good description.
• .changeset/workflows-sensitive-step-output.md — Minor for new feature; good description.
• .changeset/c3-frameworks-update-14759.md — Skipped per instruction (dependency update changeset for create-cloudflare).

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@14703

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@14703

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@14703

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@14703

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@14703

miniflare

npm i https://pkg.pr.new/miniflare@14703

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@14703

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@14703

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@14703

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@14703

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@14703

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@14703

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@14703

wrangler

npm i https://pkg.pr.new/wrangler@14703

commit: be782c6

[ask-bonk]

@dario-piotrowicz Bonk workflow was cancelled.

View workflow run · To retry, trigger Bonk again.

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• .changeset/lockfile-version-resolution.md: [@cloudflare/wrangler]
• packages/deploy-helpers/src/deploy/helpers/package-dependencies.ts: [@cloudflare/wrangler]
• packages/workers-utils/package.json: [@cloudflare/wrangler]
• packages/workers-utils/src/index.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/index.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/lockfiles-resolution/bun.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/lockfiles-resolution/discovery.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/lockfiles-resolution/index.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/lockfiles-resolution/npm.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/lockfiles-resolution/pnpm.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/lockfiles-resolution/resolve.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/lockfiles-resolution/yarn.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/node-modules.ts: [@cloudflare/wrangler]
• packages/workers-utils/src/package-resolution/package-resolution.ts: [@cloudflare/wrangler]
• packages/workers-utils/tests/package-resolution/lockfile-resolution/bun.test.ts: [@cloudflare/wrangler]
• packages/workers-utils/tests/package-resolution/lockfile-resolution/npm.test.ts: [@cloudflare/wrangler]
• packages/workers-utils/tests/package-resolution/lockfile-resolution/pnpm.test.ts: [@cloudflare/wrangler]
• packages/workers-utils/tests/package-resolution/lockfile-resolution/resolve.test.ts: [@cloudflare/wrangler]
• packages/workers-utils/tests/package-resolution/lockfile-resolution/share.ts: [@cloudflare/wrangler]
• packages/workers-utils/tests/package-resolution/lockfile-resolution/yarn.test.ts: [@cloudflare/wrangler]
• packages/workers-utils/tests/package-resolution/package-resolution.test.ts: [@cloudflare/wrangler]
• pnpm-lock.yaml: [@cloudflare/wrangler]

[dario-piotrowicz]

I've converted this PR to draft since the main reason for this PR is to implement a more performant solution (that requires fewer fs operations) but by running some benchmarks it does not look like this solution is any better than the current one 😕 : https://github.com/dario-piotrowicz/wrangler-14703-benchmarking/actions/runs/29760120747

So I need to investigate what's going on (and potentially just stick the the current solution)