From 7894fa43b6dfdf1974f5d7cf8408fddc15cb866b Mon Sep 17 00:00:00 2001
From: Cameron Robey <cameron@cameronrobey.co.uk>
Date: Mon, 15 Aug 2022 21:10:53 +0100
Subject: [PATCH] Bump undici version and minimum node version (#333)

* Bump undici version and minimum node version

To target security vulnerabilities in undici, we update to the latest version.

From undici v5.7.0, we require a node >=16.8.0 - here we update the minimum to 16.13.0 (the first Node 16 LTS release)

* Pin undici version

We should pin the version of undici

* Wrap `Body#formData()` `Buffer` chunks in `Uint8Array`s

Workaround for https://github.com/nodejs/undici/pull/1601

* Delay freed check in `HTMLRewriter` `ArrayBuffer(View)` chunk test

Co-authored-by: MrBBot <me@mrbbot.dev>
---
 .github/workflows/test.yml                    |  6 +-
 docs/src/content/get-started/cli.md           |  2 +-
 docs/src/content/get-started/migrating.md     |  2 +-
 package-lock.json                             | 86 +++++++++----------
 package.json                                  |  2 +-
 packages/cache/package.json                   |  4 +-
 packages/cli-parser/package.json              |  2 +-
 packages/core/package.json                    |  4 +-
 packages/core/src/plugins/core.ts             |  2 +-
 packages/core/src/standards/http.ts           |  4 +-
 packages/core/src/standards/streams.ts        |  2 +-
 packages/durable-objects/package.json         |  4 +-
 packages/html-rewriter/package.json           |  4 +-
 packages/html-rewriter/test/rewriter.spec.ts  |  2 +
 packages/http-server/package.json             |  4 +-
 .../jest-environment-miniflare/package.json   |  2 +-
 packages/kv/package.json                      |  2 +-
 packages/miniflare/bootstrap.js               |  4 +-
 packages/miniflare/package.json               |  4 +-
 packages/r2/package.json                      |  4 +-
 packages/runner-vm/package.json               |  2 +-
 packages/scheduler/package.json               |  2 +-
 packages/shared-test/package.json             |  2 +-
 packages/shared/package.json                  |  2 +-
 packages/sites/package.json                   |  2 +-
 packages/storage-file/package.json            |  2 +-
 packages/storage-memory/package.json          |  2 +-
 packages/storage-redis/package.json           |  2 +-
 packages/watcher/package.json                 |  2 +-
 packages/web-sockets/package.json             |  6 +-
 scripts/scaffold.mjs                          |  2 +-
 31 files changed, 87 insertions(+), 85 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0ea7e99f3..4c17091d0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,9 +7,9 @@ name: Test
 
 on:
   push:
-    branches: [ master ]
+    branches: [master]
   pull_request:
-    branches: [ master ]
+    branches: [master]
 
 jobs:
   test:
@@ -19,7 +19,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest]
-        node: [16.7.0, 18.x]
+        node: [16.13.0, 18.x]
         # See supported Node.js release schedule at https://nodejs.org/en/about/releases/
 
     steps:
diff --git a/docs/src/content/get-started/cli.md b/docs/src/content/get-started/cli.md
index 810905a88..a6aeaf7ae 100644
--- a/docs/src/content/get-started/cli.md
+++ b/docs/src/content/get-started/cli.md
@@ -32,7 +32,7 @@ $ npx miniflare
 
 <Aside type="warning" header="Warning">
 
-Miniflare requires at least **Node.js 16.7.0**, as it makes extensive use of
+Miniflare requires at least **Node.js 16.13.0**, as it makes extensive use of
 recently added web standards. You should use the latest Node.js version if
 possible, as Cloudflare Workers use a very up-to-date version of V8. Consider
 using a Node.js version manager such as https://volta.sh/ or
diff --git a/docs/src/content/get-started/migrating.md b/docs/src/content/get-started/migrating.md
index cb5a83c0f..ae2be6e38 100644
--- a/docs/src/content/get-started/migrating.md
+++ b/docs/src/content/get-started/migrating.md
@@ -11,7 +11,7 @@ guide walks you through how to upgrade your app.
 
 ### Upgrade Node.js
 
-**Node.js 16.7.0 is now the minimum required version**. You should use the
+**Node.js 16.13.0 is now the minimum required version**. You should use the
 latest Node.js version if possible, as Cloudflare Workers use a very up-to-date
 version of V8. Consider using a Node.js version manager such as
 <https://volta.sh/> or <https://github.com/nvm-sh/nvm>.
diff --git a/package-lock.json b/package-lock.json
index 1aadfba45..a28998791 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -33,7 +33,7 @@
         "which": "^2.0.2"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "node_modules/@ava/typescript": {
@@ -7613,9 +7613,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "5.5.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.5.1.tgz",
-      "integrity": "sha512-MEvryPLf18HvlCbLSzCW0U00IMftKGI5udnjrQbC5D4P0Hodwffhv+iGfWuJwg16Y/TK11ZFK8i+BPVW2z/eAw==",
+      "version": "5.8.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.8.2.tgz",
+      "integrity": "sha512-3KLq3pXMS0Y4IELV045fTxqz04Nk9Ms7yfBBHum3yxsTR4XNn+ZCaUbf/mWitgYDAhsplQ0B1G4S5D345lMO3A==",
       "engines": {
         "node": ">=12.18"
       }
@@ -7992,7 +7992,7 @@
         "@miniflare/core": "2.6.0",
         "@miniflare/shared": "2.6.0",
         "http-cache-semantics": "^4.1.0",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       },
       "devDependencies": {
         "@miniflare/shared-test": "2.6.0",
@@ -8000,7 +8000,7 @@
         "@types/http-cache-semantics": "^4.0.1"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/cli-parser": {
@@ -8018,7 +8018,7 @@
         "mri": "^1.1.6"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/core": {
@@ -8033,7 +8033,7 @@
         "dotenv": "^10.0.0",
         "kleur": "^4.1.4",
         "set-cookie-parser": "^2.4.8",
-        "undici": "5.5.1",
+        "undici": "5.8.2",
         "urlpattern-polyfill": "^4.0.3"
       },
       "devDependencies": {
@@ -8046,7 +8046,7 @@
         "dequal": "^2.0.2"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/durable-objects": {
@@ -8057,7 +8057,7 @@
         "@miniflare/core": "2.6.0",
         "@miniflare/shared": "2.6.0",
         "@miniflare/storage-memory": "2.6.0",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       },
       "devDependencies": {
         "@miniflare/cache": "2.6.0",
@@ -8065,7 +8065,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/html-rewriter": {
@@ -8076,13 +8076,13 @@
         "@miniflare/core": "2.6.0",
         "@miniflare/shared": "2.6.0",
         "html-rewriter-wasm": "^0.4.1",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       },
       "devDependencies": {
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/http-server": {
@@ -8095,7 +8095,7 @@
         "@miniflare/web-sockets": "2.6.0",
         "kleur": "^4.1.4",
         "selfsigned": "^2.0.0",
-        "undici": "5.5.1",
+        "undici": "5.8.2",
         "ws": "^8.2.2",
         "youch": "^2.2.2"
       },
@@ -8104,7 +8104,7 @@
         "@types/node-forge": "^0.10.4"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/jest": {
@@ -8167,7 +8167,7 @@
         "react-dom": "^18.1.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       },
       "peerDependencies": {
         "jest": ">=27"
@@ -9137,7 +9137,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/miniflare": {
@@ -9162,7 +9162,7 @@
         "kleur": "^4.1.4",
         "semiver": "^1.1.0",
         "source-map-support": "^0.5.20",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       },
       "bin": {
         "miniflare": "bootstrap.js"
@@ -9173,7 +9173,7 @@
         "open": "^8.4.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       },
       "peerDependencies": {
         "@miniflare/storage-redis": "2.6.0",
@@ -9198,13 +9198,13 @@
       "license": "MIT",
       "dependencies": {
         "@miniflare/shared": "2.6.0",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       },
       "devDependencies": {
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/runner-vm": {
@@ -9218,7 +9218,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/scheduler": {
@@ -9234,7 +9234,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/shared": {
@@ -9249,7 +9249,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/shared-test": {
@@ -9265,7 +9265,7 @@
         "ws": "^8.2.2"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/sites": {
@@ -9283,7 +9283,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/storage-file": {
@@ -9298,7 +9298,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/storage-memory": {
@@ -9312,7 +9312,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/storage-redis": {
@@ -9329,7 +9329,7 @@
         "@types/ioredis": "^4.27.2"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/watcher": {
@@ -9343,7 +9343,7 @@
         "@miniflare/shared-test": "2.6.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     },
     "packages/web-sockets": {
@@ -9353,7 +9353,7 @@
       "dependencies": {
         "@miniflare/core": "2.6.0",
         "@miniflare/shared": "2.6.0",
-        "undici": "5.5.1",
+        "undici": "5.8.2",
         "ws": "^8.2.2"
       },
       "devDependencies": {
@@ -9361,7 +9361,7 @@
         "@types/ws": "^8.2.0"
       },
       "engines": {
-        "node": ">=16.7"
+        "node": ">=16.13"
       }
     }
   },
@@ -10461,7 +10461,7 @@
         "@miniflare/web-sockets": "2.6.0",
         "@types/http-cache-semantics": "^4.0.1",
         "http-cache-semantics": "^4.1.0",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       }
     },
     "@miniflare/cli-parser": {
@@ -10491,7 +10491,7 @@
         "dotenv": "^10.0.0",
         "kleur": "^4.1.4",
         "set-cookie-parser": "^2.4.8",
-        "undici": "5.5.1",
+        "undici": "5.8.2",
         "urlpattern-polyfill": "^4.0.3"
       }
     },
@@ -10504,7 +10504,7 @@
         "@miniflare/shared": "2.6.0",
         "@miniflare/shared-test": "2.6.0",
         "@miniflare/storage-memory": "2.6.0",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       }
     },
     "@miniflare/html-rewriter": {
@@ -10514,7 +10514,7 @@
         "@miniflare/shared": "2.6.0",
         "@miniflare/shared-test": "2.6.0",
         "html-rewriter-wasm": "^0.4.1",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       }
     },
     "@miniflare/http-server": {
@@ -10527,7 +10527,7 @@
         "@types/node-forge": "^0.10.4",
         "kleur": "^4.1.4",
         "selfsigned": "^2.0.0",
-        "undici": "5.5.1",
+        "undici": "5.8.2",
         "ws": "^8.2.2",
         "youch": "^2.2.2"
       }
@@ -10544,7 +10544,7 @@
       "requires": {
         "@miniflare/shared": "2.6.0",
         "@miniflare/shared-test": "2.6.0",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       }
     },
     "@miniflare/runner-vm": {
@@ -10632,7 +10632,7 @@
         "@miniflare/shared": "2.6.0",
         "@miniflare/shared-test": "2.6.0",
         "@types/ws": "^8.2.0",
-        "undici": "5.5.1",
+        "undici": "5.8.2",
         "ws": "^8.2.2"
       }
     },
@@ -14713,7 +14713,7 @@
         "open": "^8.4.0",
         "semiver": "^1.1.0",
         "source-map-support": "^0.5.20",
-        "undici": "5.5.1"
+        "undici": "5.8.2"
       }
     },
     "minimatch": {
@@ -16034,9 +16034,9 @@
       }
     },
     "undici": {
-      "version": "5.5.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.5.1.tgz",
-      "integrity": "sha512-MEvryPLf18HvlCbLSzCW0U00IMftKGI5udnjrQbC5D4P0Hodwffhv+iGfWuJwg16Y/TK11ZFK8i+BPVW2z/eAw=="
+      "version": "5.8.2",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.8.2.tgz",
+      "integrity": "sha512-3KLq3pXMS0Y4IELV045fTxqz04Nk9Ms7yfBBHum3yxsTR4XNn+ZCaUbf/mWitgYDAhsplQ0B1G4S5D345lMO3A=="
     },
     "unique-string": {
       "version": "2.0.0",
diff --git a/package.json b/package.json
index 9daab7da2..75e327294 100644
--- a/package.json
+++ b/package.json
@@ -50,7 +50,7 @@
     "which": "^2.0.2"
   },
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "volta": {
     "node": "18.2.0"
diff --git a/packages/cache/package.json b/packages/cache/package.json
index f0d56c69e..b7b2716ea 100644
--- a/packages/cache/package.json
+++ b/packages/cache/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
@@ -38,7 +38,7 @@
     "@miniflare/core": "2.6.0",
     "@miniflare/shared": "2.6.0",
     "http-cache-semantics": "^4.1.0",
-    "undici": "5.5.1"
+    "undici": "5.8.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.6.0",
diff --git a/packages/cli-parser/package.json b/packages/cli-parser/package.json
index 90c37e0f7..2ed9754ae 100644
--- a/packages/cli-parser/package.json
+++ b/packages/cli-parser/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/core/package.json b/packages/core/package.json
index 6166958cf..9266f6d43 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
@@ -45,7 +45,7 @@
     "dotenv": "^10.0.0",
     "kleur": "^4.1.4",
     "set-cookie-parser": "^2.4.8",
-    "undici": "5.5.1",
+    "undici": "5.8.2",
     "urlpattern-polyfill": "^4.0.3"
   },
   "devDependencies": {
diff --git a/packages/core/src/plugins/core.ts b/packages/core/src/plugins/core.ts
index 1a935b1e6..bb724f0f1 100644
--- a/packages/core/src/plugins/core.ts
+++ b/packages/core/src/plugins/core.ts
@@ -420,7 +420,7 @@ export class CorePlugin extends Plugin<CoreOptions> implements CoreOptions {
     const crypto = createCrypto(!this.globalRandom);
 
     // `(De)CompressionStream`s were added in Node.js 17.0.0, and added to the
-    // global scope in Node.js 18.0.0. Our minimum supported version is 16.7.0,
+    // global scope in Node.js 18.0.0. Our minimum supported version is 16.13.0,
     // so we implement basic versions ourselves, preferring Node's if available.
     const CompressionStreamImpl =
       webStreams.CompressionStream ?? CompressionStream;
diff --git a/packages/core/src/standards/http.ts b/packages/core/src/standards/http.ts
index 91166a4bc..a7858414d 100644
--- a/packages/core/src/standards/http.ts
+++ b/packages/core/src/standards/http.ts
@@ -309,11 +309,11 @@ export class Body<Inner extends BaseRequest | BaseResponse> {
       busboy.on("file", (name, value, info) => {
         const { filename, encoding, mimeType } = info;
         const base64 = encoding.toLowerCase() === "base64";
-        const chunks: Buffer[] = [];
+        const chunks: Uint8Array[] = [];
         let totalLength = 0;
         value.on("data", (chunk: Buffer) => {
           if (base64) chunk = Buffer.from(chunk.toString(), "base64");
-          chunks.push(chunk);
+          chunks.push(new Uint8Array(chunk));
           totalLength += chunk.byteLength;
         });
         value.on("end", () => {
diff --git a/packages/core/src/standards/streams.ts b/packages/core/src/standards/streams.ts
index 68df624ab..5ecff4c3d 100644
--- a/packages/core/src/standards/streams.ts
+++ b/packages/core/src/standards/streams.ts
@@ -159,7 +159,7 @@ function createTransformerFromTransform(transform: Transform): Transformer {
 }
 
 // `(De)CompressionStream`s were added in Node.js 17.0.0. Our minimum supported
-// version is 16.7.0, so we implement basic versions ourselves, preferring to
+// version is 16.13.0, so we implement basic versions ourselves, preferring to
 // use Node's if available.
 
 export class CompressionStream extends TransformStream<Uint8Array, Uint8Array> {
diff --git a/packages/durable-objects/package.json b/packages/durable-objects/package.json
index e6d0003e7..d179a4472 100644
--- a/packages/durable-objects/package.json
+++ b/packages/durable-objects/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
@@ -38,7 +38,7 @@
     "@miniflare/core": "2.6.0",
     "@miniflare/shared": "2.6.0",
     "@miniflare/storage-memory": "2.6.0",
-    "undici": "5.5.1"
+    "undici": "5.8.2"
   },
   "devDependencies": {
     "@miniflare/cache": "2.6.0",
diff --git a/packages/html-rewriter/package.json b/packages/html-rewriter/package.json
index 8eeb510c4..46bf36709 100644
--- a/packages/html-rewriter/package.json
+++ b/packages/html-rewriter/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
@@ -38,7 +38,7 @@
     "@miniflare/core": "2.6.0",
     "@miniflare/shared": "2.6.0",
     "html-rewriter-wasm": "^0.4.1",
-    "undici": "5.5.1"
+    "undici": "5.8.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.6.0"
diff --git a/packages/html-rewriter/test/rewriter.spec.ts b/packages/html-rewriter/test/rewriter.spec.ts
index 46da0a6bd..1b6a3624c 100644
--- a/packages/html-rewriter/test/rewriter.spec.ts
+++ b/packages/html-rewriter/test/rewriter.spec.ts
@@ -704,6 +704,8 @@ test.serial(
       })
       .transform(new Response(inputStream));
     t.is(await res.text(), "<p>test</p>");
+    // TODO: try remove this, we shouldn't need it
+    await setTimeout();
     t.true(freed.freed);
   }
 );
diff --git a/packages/http-server/package.json b/packages/http-server/package.json
index af1fdfc55..f4bb6c49d 100644
--- a/packages/http-server/package.json
+++ b/packages/http-server/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
@@ -40,7 +40,7 @@
     "@miniflare/web-sockets": "2.6.0",
     "kleur": "^4.1.4",
     "selfsigned": "^2.0.0",
-    "undici": "5.5.1",
+    "undici": "5.8.2",
     "ws": "^8.2.2",
     "youch": "^2.2.2"
   },
diff --git a/packages/jest-environment-miniflare/package.json b/packages/jest-environment-miniflare/package.json
index de6b12285..5e7786fe3 100644
--- a/packages/jest-environment-miniflare/package.json
+++ b/packages/jest-environment-miniflare/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/kv/package.json b/packages/kv/package.json
index fe1d26c3b..2319e8b1c 100644
--- a/packages/kv/package.json
+++ b/packages/kv/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/miniflare/bootstrap.js b/packages/miniflare/bootstrap.js
index 571e41c1c..afcf1b193 100755
--- a/packages/miniflare/bootstrap.js
+++ b/packages/miniflare/bootstrap.js
@@ -6,8 +6,8 @@ const semiver = require("semiver");
 
 // Miniflare makes extensive use of new Web Standards added in recent versions
 // of Node.js (streams, crypto, Blob, EventTarget). The most recent thing
-// Miniflare uses is the "stream/consumers" module, which was added in 16.7.0.
-const MIN_NODE_VERSION = "16.7.0";
+// Miniflare uses is release >=5.7.0 of undici, which requires Node >=16.8.
+const MIN_NODE_VERSION = "16.13.0";
 
 async function main() {
   // @ts-expect-error require doesn't give the correct types
diff --git a/packages/miniflare/package.json b/packages/miniflare/package.json
index 69b14df08..9180b1a7a 100644
--- a/packages/miniflare/package.json
+++ b/packages/miniflare/package.json
@@ -22,7 +22,7 @@
     "bootstrap.js"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
@@ -64,7 +64,7 @@
     "kleur": "^4.1.4",
     "semiver": "^1.1.0",
     "source-map-support": "^0.5.20",
-    "undici": "5.5.1"
+    "undici": "5.8.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.6.0",
diff --git a/packages/r2/package.json b/packages/r2/package.json
index c2584d2a7..e2f20556d 100644
--- a/packages/r2/package.json
+++ b/packages/r2/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
@@ -36,7 +36,7 @@
   },
   "dependencies": {
     "@miniflare/shared": "2.6.0",
-    "undici": "5.5.1"
+    "undici": "5.8.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.6.0"
diff --git a/packages/runner-vm/package.json b/packages/runner-vm/package.json
index 17819fdf1..c7d296a9f 100644
--- a/packages/runner-vm/package.json
+++ b/packages/runner-vm/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/scheduler/package.json b/packages/scheduler/package.json
index 1f008f465..2c0830ff1 100644
--- a/packages/scheduler/package.json
+++ b/packages/scheduler/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/shared-test/package.json b/packages/shared-test/package.json
index 4d993119a..f0bfda711 100644
--- a/packages/shared-test/package.json
+++ b/packages/shared-test/package.json
@@ -18,7 +18,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "repository": {
     "type": "git",
diff --git a/packages/shared/package.json b/packages/shared/package.json
index ff5faae85..a7d5d84f9 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/sites/package.json b/packages/sites/package.json
index 7cf2cee33..c88480024 100644
--- a/packages/sites/package.json
+++ b/packages/sites/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/storage-file/package.json b/packages/storage-file/package.json
index e2add17a0..566053e43 100644
--- a/packages/storage-file/package.json
+++ b/packages/storage-file/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/storage-memory/package.json b/packages/storage-memory/package.json
index b468a4c60..593ea8764 100644
--- a/packages/storage-memory/package.json
+++ b/packages/storage-memory/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/storage-redis/package.json b/packages/storage-redis/package.json
index 2ff4d57f7..50333b75c 100644
--- a/packages/storage-redis/package.json
+++ b/packages/storage-redis/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/watcher/package.json b/packages/watcher/package.json
index 5005417a8..cd33858db 100644
--- a/packages/watcher/package.json
+++ b/packages/watcher/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
diff --git a/packages/web-sockets/package.json b/packages/web-sockets/package.json
index 182f94668..76c122826 100644
--- a/packages/web-sockets/package.json
+++ b/packages/web-sockets/package.json
@@ -17,7 +17,7 @@
     "dist/src"
   ],
   "engines": {
-    "node": ">=16.7"
+    "node": ">=16.13"
   },
   "publishConfig": {
     "access": "public"
@@ -37,8 +37,8 @@
   "dependencies": {
     "@miniflare/core": "2.6.0",
     "@miniflare/shared": "2.6.0",
-    "ws": "^8.2.2",
-    "undici": "5.5.1"
+    "undici": "5.8.2",
+    "ws": "^8.2.2"
   },
   "devDependencies": {
     "@miniflare/shared-test": "2.6.0",
diff --git a/scripts/scaffold.mjs b/scripts/scaffold.mjs
index e99f03ccd..10458ac5e 100644
--- a/scripts/scaffold.mjs
+++ b/scripts/scaffold.mjs
@@ -41,7 +41,7 @@ async function scaffoldPackage(unscopedPkgName) {
     types: "./dist/src/index.d.ts",
     files: ["dist/src"],
     engines: {
-      node: ">=16.7",
+      node: ">=16.13",
     },
     publishConfig: { access: "public" },
     repository: {