fix(wrangler): use lstat so the asset walker skips symlinks as intended

[evilgensec]

What this changes

The Workers and Pages asset walkers intend to skip symbolic links:

if (filestat.isSymbolicLink()) {
  return;
}

but they call stat() first, which dereferences the symlink, so isSymbolicLink() always returns false. As a result, symlinked entries inside an assets directory are followed and their targets are collected/uploaded as assets instead of being skipped. Per the Node docs, Stats.isSymbolicLink() is only meaningful after lstat() (after stat() the link has already been resolved).

The fix

Switch both walkers to lstat() so the existing isSymbolicLink() skip logic works as intended. No behavior change for regular files or directories.

• packages/deploy-helpers/src/deploy/helpers/assets.ts
• packages/wrangler/src/pages/validate.ts

A changeset is included (patch for wrangler and @cloudflare/deploy-helpers).

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 9126a1f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
wrangler	Patch
@cloudflare/deploy-helpers	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• @cloudflare/wrangler

Show detailed file reviewers

• .changeset/asset-walker-lstat-symlink.md: [@cloudflare/wrangler]
• packages/deploy-helpers/src/deploy/helpers/assets.ts: [@cloudflare/wrangler]
• packages/wrangler/src/tests/pages/project-validate.test.ts: [@cloudflare/wrangler]
• packages/wrangler/src/pages/validate.ts: [@cloudflare/wrangler]

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.