fix(deps): update all non-major dependencies#42
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
stubidp | 9e1c7d7 | Jun 19 2026, 05:09 PM |
e7b7516 to
2f5e0a4
Compare
7dc2965 to
8070196
Compare
63d91c7 to
7fb8943
Compare
9241784 to
53a276b
Compare
53a276b to
9e1c7d7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.20260530.1→4.20260619.14.3.0→4.3.124.12.4→24.13.24.1.7→4.1.912.10.0→12.11.110.4.1→10.5.09.8.4→9.8.58.21.0→8.22.03.8.3→3.8.44.3.0→4.3.18.60.0→8.61.14.1.7→4.1.94.95.0→4.103.0Release Notes
cloudflare/workerd (@cloudflare/workers-types)
v4.20260619.1Compare Source
v4.20260617.1Compare Source
v4.20260616.1Compare Source
v4.20260615.1Compare Source
v4.20260613.1Compare Source
v4.20260612.1Compare Source
v4.20260611.1Compare Source
v4.20260610.1Compare Source
v4.20260609.1Compare Source
v4.20260608.1Compare Source
v4.20260607.1Compare Source
v4.20260606.1Compare Source
v4.20260605.1Compare Source
v4.20260604.1Compare Source
v4.20260603.1Compare Source
v4.20260602.1Compare Source
v4.20260601.1Compare Source
v4.20260531.1Compare Source
tailwindlabs/tailwindcss (@tailwindcss/cli)
v4.3.1Compare Source
Added
--silentoption to suppress output in@tailwindcss/cli(#20100)Fixed
Module#registerHooksinstead ofModule#registeron Node 26+ (#20028)@applyto be used with CSS mixins (#19427)not-*correctly negates@containerqueries, includingstyle(…)queries (#20059)drop-shadow-*color utilities work with custom shadow values containingcalc(…)(#20080)@tailwindcss/vite(#20103)@tailwindcss/webpackcan be installed in Rspack projects without requiringwebpackas a peer dependency (#20027)calc(…)expressions (e.g.px-[calc(1rem+0px)]→px-[calc(1rem+0)]) (#20127)left-[99999px]→left-[99999px], notleft-24999.75) (#20130)@tailwindcss/cliin--watchmode recovers when a tracked dependency is deleted and restored (#20137)@tailwindcss/clibinaries are ignored when scanning for class candidates (#20139)addClass(…)andremoveClass(…)calls (#20198)@variantto be used insideaddBase(#19480)@sourceglobs with symlinks are preserved (#20203)@sourcerules can re-include files excluded by earlier@source notrules (#20203)@utilityrules (#20205)inset-shadow-noneand other inset shadows work correctly (#20208)@sourcedirectories are scanned even when ignored by git (#20214)@sourceglobs ending in**/*preserve dynamic path segments to avoid scanning too many files (#20217)calc(…)divisions when the result would require high precision (e.g.w-[calc(100%/3.5)]→w-[calc(100%/3.5)], notw-[28.571428571428573%]) (#20221)@tailwindcss/postcss(#20228)Changed
0instead ofcalc(var(--spacing) * 0)for spacing utilities likem-0andleft-0(#20196)var(--spacing)instead ofcalc(var(--spacing) * 1)for spacing utilities likem-1andleft-1(#20196)vitest-dev/vitest (@vitest/coverage-v8)
v4.1.9Compare Source
🐞 Bug Fixes
importOriginalwith optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #10546 (a5180)View changes on GitHub
v4.1.8Compare Source
🐞 Bug Fixes
cdpAPI whenallowWrite/allowExec: false[backport to v4] - by @hi-ogawa and Codex in #10450 (e4067)View changes on GitHub
WiseLibs/better-sqlite3 (better-sqlite3)
v12.11.1Compare Source
What's Changed
Full Changelog: WiseLibs/better-sqlite3@v12.11.0...v12.11.1
v12.10.1Compare Source
What's Changed
Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1
eslint/eslint (eslint)
v10.5.0Compare Source
Features
5ca8c52feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)b565783feat: report no-with violations at the with keyword (#20971) (Pixel998)2ce032ffeat: report max-lines-per-function violations at function head (#20966) (Pixel998)732cb3efeat: report max-nested-callbacks violations at function head (#20967) (Pixel998)f9c138afeat: report max-depth violations on keywords (#20943) (Pixel998)bdb496cfeat: correct max-depth handling for else-if chains (#20944) (Pixel998)c296873feat: update error loc inmax-statementsto function header (#20907) (Taejin Kim)Documentation
8ae1b5bdocs: Update README (GitHub Actions Bot)ca7eb90docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)f99b47adocs: Update README (GitHub Actions Bot)acf03d4docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)Chores
b18bf58chore: update ecosystem plugins (#20959) (ESLint Bot)c2d1444refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)243b8c5chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)217b2a9test: add unit tests for ParserService (#20949) (Taejin Kim)72003e7test: add location information to error messages inmax-statements(#20945) (lumir)7797c26refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)67c46fachore: update ecosystem plugins (#20938) (ESLint Bot)95d8c7achore: update dependency @eslint/json to v2 (#20934) (renovate[bot])cf9e496chore: update @arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)fb6d396test: run type tests with TypeScript 7 (#20868) (sethamus)panva/node-oidc-provider (oidc-provider)
v9.8.5Compare Source
Fixes
Documentation
brianc/node-postgres (pg)
v8.22.0Compare Source
prettier/prettier (prettier)
v3.8.4Compare Source
diff
Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @byplayer)
Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.
typescript-eslint/typescript-eslint (typescript-eslint)
v8.61.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.61.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.60.1Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
cloudflare/workers-sdk (wrangler)
v4.103.0Compare Source
Minor Changes
#14295
cfd6205Thanks @dario-piotrowicz! - Moveunstable_getWorkerNameFromProjectfrom wrangler to@cloudflare/workers-utilsThe
unstable_getWorkerNameFromProjectexport has been removed from thewranglerpackage. This function is now available asgetWorkerNameFromProject(without theunstable_prefix) from@cloudflare/workers-utils. If you were importing this function fromwrangler, update your import to use@cloudflare/workers-utilsinstead.#14295
cfd6205Thanks @dario-piotrowicz! - Remove experimental autoconfig exportsThe experimental autoconfig exports (
experimental_getDetailsForAutoConfig,experimental_runAutoConfig,experimental_AutoConfigFramework) have been removed. This logic has been moved to the@cloudflare/autoconfigpackage (without theexperimental_prefixes since the package itself is pre-v1).Patch Changes
#14366
c6579d3Thanks @jamesopstad! - Resolve relativecf-workerentrypoint imports relative to the importing moduleWhen loading the experimental
cloudflare.config.ts, a relative entrypoint imported withimport ... with { type: "cf-worker" }(e.g../src/index.ts) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.Bare specifiers (such as
@scope/pkg) and virtual modules (such asvirtual:foo) are still left unresolved so that consumers can apply their own resolution.#14316
444b75eThanks @matingathani! - Preventwrangler devcrash when source-mapping a truncated error chunkWhen a worker logs many errors in quick succession, the stderr chunks received by
wrangler devcan be truncated mid-stack-frame, leaving a call site with an invalid column number. The source map library throws in that case, which was crashing the wrangler process entirely. The error is now caught and the original (un-source-mapped) text is returned instead.#14118
b38823fThanks @aicayzer! - FixUint8Arraystep outputs in local Workflows being persisted with the full backingArrayBufferA
Uint8Arrayreturned from a Workflows step underwrangler devwas serialised together with its full underlyingArrayBuffer, causing a rawSQLITE_TOOBIGerror at view sizes well below the documented 1MiB step-output limit. For example, a 200KB view sliced from an 800KB buffer (a common pattern fromcrypto.getRandomValuesorarr.slice(...)on a larger pool) would fail. The view's bytes are now copied to a tight buffer before persistence, bringing local behaviour in line with production. Fixes #14101.Updated dependencies [
b38823f]:v4.102.0Compare Source
Minor Changes
#14340
f6e49ddThanks @emily-shen! - Addcf-wrangler builddelegate supportThe experimental
cf-wranglerdelegate binary now acceptsbuildand emits the Build Output API directory through Wrangler's new-config build path. This lets parent tools invoke Wrangler's build-output implementation withcf-wrangler buildinstead of shelling out through the public Wrangler CLI.#14324
36777dbThanks @jamesopstad! - Add experimental--experimental-cf-build-outputflag towrangler buildWhen used alongside
--experimental-new-config,wrangler buildnow emits a self-contained Build Output API directory under.cloudflare/output/v0/instead of delegating towrangler deploy --dry-run.Patch Changes
#14347
673b09eThanks @jamesopstad! - Update undici from 7.24.8 to 7.28.0#14346
e930bd4Thanks @haidargit! - Bumpwsfrom 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4pGHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high severity) reports a remote memory-exhaustion DoS in
ws@<8.21.0: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash awsserver or client via OOM. The fix shipped in ws@8.21.0 (commit2b2abd45, released 2026-05-22), which also introduces themaxBufferedChunksandmaxFragmentsoptions. This change bumps the workspace catalog entry so thatminiflare,wrangler, and@cloudflare/vite-pluginall pick up the patched release.#14314
5c3bb11Thanks @harryzcy! - Bump esbuild to 0.28.1This update includes several bug fixes from esbuild versions 0.27.3 through 0.28.1. See the esbuild changelog for details.
#14331
296ad65Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#14275
594544dThanks @alsuren! - Resolve auto-provisioned D1 bindings via the API in remote subcommandsRemote D1 subcommands (
d1 execute --remote,d1 export --remote,d1 info,d1 insights,d1 delete,d1 migrations apply --remote,d1 migrations list --remote,d1 time-travel) previously failed with:when the
[[d1_databases]]config entry only hadbindinganddatabase_name(the shapewrangler deploywrites for automatically-provisioned bindings). They now resolve the real database UUID viaGET /accounts/:accountId/d1/database/:name?fields=uuidand proceed as ifdatabase_idhad been set in config.If the config entry only has a
binding(nodatabase_name, nodatabase_id), the lookup uses the same namewrangler deploywould create via auto provisioning (<worker name>-<binding-lowercased-with-dashes>).Non-404 API failures (auth, rate-limit, server errors) now propagate verbatim instead of being masked as "database not found".
#14315
a79b899Thanks @matingathani! - Respectfind_additional_modules = falsewhenno_bundleis setWhen using
no_bundle = true, wrangler was always scanning for and attaching additional modules even iffind_additional_moduleswas explicitly set tofalsein the config. Additional modules are now only collected whenfind_additional_modulesis notfalse, consistent with the bundled code path.#14269
5dfb788Thanks @mattjohnsonpint! - Supportdev.pluginon typed services bindingsWrangler only honored
dev.pluginonunsafe.bindingsentries, so users authoring a service binding viaservices[]could not wire it to a local Miniflare plugin duringwrangler dev— they had to fall back tounsafe.bindingsand accept a "directly supported by wrangler" warning. Typed services bindings now accept the samedev: { plugin, options? }shape, route the binding through Miniflare's external-plugin pathway inwrangler dev, and strip the field at deploy time. Validation rejects malformeddevshapes.#14328
ca61558Thanks @edevil! - Mention temporary preview accounts inwrangler whoamioutput when unauthenticatedWhen you run
wrangler whoamiwithout being logged in, Wrangler now also tells you that you can deploy without logging in by running a command likewrangler deploy --temporaryto use a temporary preview account.Updated dependencies [
673b09e,e930bd4,5c3bb11,296ad65]:v4.101.0Compare Source
Minor Changes
#14276
32f9307Thanks @dario-piotrowicz! - Graduate autoconfig from experimental to stableThe
--experimental-autoconfigand--x-autoconfigdeploy CLI flags have been replaced with--autoconfig.Note that the
--autoconfigflag defaults totrueand that it can be used to disable Wrangler's auto-configuration logic by setting it tofalsevia--autoconfig=falseor--no-autoconfig#14287
41f391fThanks @edmundhung! - Add per-Worker resource accessors tocreateTestHarness()createTestHarness()now provides methods for accessing configured KV namespaces, R2 buckets, D1 databases, and Durable Object namespaces. Useserver.getWorker(name)to access resources scoped to that specific Worker:#14264
21dbc12Thanks @dario-piotrowicz! - Suggest Cloudflare skills installation after commands instead of beforeThe automatic prompt to install Cloudflare skills for detected AI coding agents no longer runs before every Wrangler command. Instead, Wrangler now suggests installing skills, when appropriate, after some commands complete successfully. Commands that output JSON suppress the suggestion to keep their output clean. The
--install-skillsflag remains available on all commands to explicitly run the skills installation flow before the command executes, without prompting.As before, Wrangler asks the skills installation question at most once. The skills install metadata file is now written before the confirmation prompt is shown, so even if the user interrupts the process (e.g. CTRL+C, closing the terminal) during the prompt, the question is recorded as unanswered and will not reappear on subsequent runs.
#14042
7e63948Thanks @edevil! - Add a--temporaryflag that creates and uses a temporary Cloudflare preview account when you have no credentials, instead of starting the OAuth login flow.It's registered only on the commands the short-lived account token can serve — Workers (
deploy,versions upload, and related commands), KV, D1, Hyperdrive, Queues, and certificate commands — and is for unauthenticated use only: passing it while already authenticated (OAuth,CLOUDFLARE_API_TOKEN, or a global API key) errors rather than silently ignoring the flag. Before provisioning, Wrangler handles Cloudflare's Terms of Service and Privacy Policy (interactive terminals prompt foryes; non-interactive shells print a notice and continue). Wrangler then runs with the short-lived token and prints a claim URL so the account can be claimed before it expires. The cached account is cleared on successful login or logout.#14299
035917fThanks @petebacondarwin! - Send thelogin usertelemetry event whenwrangler login --scopes ...succeedswrangler loginwas already reporting thelogin userevent when called without--scopes, but the scoped login path returned early before the event could be sent. Both paths now report the event, so successful scoped logins are counted alongside unscoped ones.Patch Changes
#14271
27db82cThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#14298
2a6a26bThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#14317
9a424edThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#14282
ecfdd5aThanks @edmundhung! - Fixwrangler devasset fallback with custom routeswrangler devnow applies Workers Assets fallback behavior consistently when routes are configured, including SPA fallback and404-pagehandling.#13763
604be26Thanks @matingathani! - Show a clear error when deploying a service-worker format Worker with Durable Object migrations or bindings instead of an opaque API error#14240
1fb7ba5Thanks @ttoino! - Fixwrangler email sendingcommandsThe
email sendingcommands previously failed against the Cloudflare API. They now work as expected:email sending enable <domain>enables Email Sending for a domainemail sending disable <domain>disables Email Sending for a domainemail sending settings <domain>shows the Email Sending configuration for a domainemail sending dns get <domain>shows the DNS records to set up for a domainemail sending listpreviously listed zones. It now lists the domains that have Email Sending enabled — every enabled domain across your account by default, or just those under a specific domain when you pass a domain (or--zone-id).#13838
208b3bbThanks @matingathani! - Fix unhandled promise rejection when the worker entry point is deleted or moved duringwrangler devhot-reload — now logs a warning and skips the update instead of crashing#14241
8b2ce41Thanks @dario-piotrowicz! - Improve error messages for CLI flags, type generation, auth scopes, dev server tunnels, and compatibility flagsError messages across several areas now name the exact flags or values involved and suggest how to fix the problem:
kv key put,kv key get,kv key delete): error messages now include--prefixes and clear "Missing required option" / "Conflicting options" phrasing instead of the vague "Exactly one of the arguments ... is required".wrangler types --include-env=false --include-runtime=false: the error now names both flags and explains what each does.wrangler login --scopes: invalid scopes are individually identified instead of dumping the entire array.wrangler dev --tunnel --remote: the error now explains why tunnels require local mode and suggests two concrete fixes.nodejs_compat_populate_process_env/nodejs_compat_do_not_populate_process_env,global_navigator/no_global_navigator): errors now name the specific conflicting flags.#14228
3578919Thanks @dario-piotrowicz! - Improve Hyperdrive error messages for missing required optionsError messages thrown when creating or updating a Hyperdrive config with missing individual parameters (e.g.
--origin-host,--origin-port,--database,--origin-user,--origin-password,--origin-scheme,--access-client-id/--access-client-secret) now clearly state which option is missing, provide a usage example, and suggest--connection-stringas an alternative where applicable.#14304
ee82c76Thanks @emily-shen! - Skip resource provisioning for asset-only deploymentsPreviously, asset-only deployments would provision resources even when there was no user Worker script. On a subsequent deploy, we would re-attempt provisioning as the previous asset-only upload would/could not be bound to the previously provisioned resource. Provisioning would then error as the resource had already been created, blocking the deploy.
Updated dependencies [
0e055d3,27db82c,2a6a26b,9a424ed,41f391f]:v4.100.0Compare Source
Minor Changes
#14119
2047a32Thanks @tahmid-23! - Serve local R2 bucket objects publicly via the dev serverWhen running
wrangler devlocally, objects in each local R2 binding are now reachable under/cdn-cgi/local/r2/public/<bucket-id>/<key>on the existing dev server, simulating a public bucket. The<bucket-id>is the bucket'sbucket_namewhen set, otherwise itsbinding. Bindings configured withremote: trueare not exposed.#14202
e8561c2Thanks @jamesopstad! - Add experimental--x-new-configflag for authoring config in TypeScriptThis is an experimental, opt-in feature. When enabled,
wrangler dev,wrangler build,wrangler deploy,wrangler versions upload, andwrangler versions deployload the Worker's configuration from acloudflare.config.tsfile instead ofwrangler.json/wrangler.jsonc/wrangler.toml. Additionally, an optionalwrangler.config.tsfile can be provided for Wrangler-specific dev/build configuration.cloudflare.config.ts(required) — Worker runtime configuration (bindings, triggers, observability, placement, limits, compatibility, routes, etc.). Authored viadefineWorkerfromwrangler/experimental-config.wrangler.config.ts(optional) — Tooling / bundling / dev-server configuration (noBundle,minify,alias,define,rules,tsconfig,build,dev,assetsDirectory, etc.). Authored viadefineWranglerConfigfromwrangler/experimental-config.Per-environment configuration is via
ctx.modebranching inside the function form of either file.Example
cloudflare.config.ts:Example
wrangler.config.ts:Because this is experimental, the flag, the config formats, and the
wrangler/experimental-configexports may change in any release.Patch Changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.