fix(deps): update all non-major dependencies - #146
Open
khepri-bot[bot] wants to merge 1 commit into
Open
Conversation
khepri-bot
Bot
force-pushed
the
renovate/all-non-major-dependencies
branch
8 times, most recently
from
September 10, 2026 04:53
f126d4c to
a5d3e7c
Compare
khepri-bot
Bot
force-pushed
the
renovate/all-non-major-dependencies
branch
from
September 10, 2026 11:31
a5d3e7c to
3f2d521
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.52.1→1.54.11.54.6(+4)0.21.3→0.22.010.70.0→10.71.010.74.0(+2)10.70.0→10.71.010.74.0(+2)14.6.4→14.6.614.6.726.2.0→26.4.026.5.1(+2)5.7.17→5.7.225.7.32(+6)20.11.2→20.11.820.14.3(+16)24.19.0→24.20.024.21.01.9.14→1.9.158.2.1→8.2.28.3.04.123.0→4.127.04.130.0(+4)Release Notes
cloudflare/workers-sdk (@cloudflare/vite-plugin)
v1.54.1Compare Source
Patch Changes
412c79e,92874f6,fe265f8]:v1.54.0Compare Source
Minor Changes
#15134
c66d2d5Thanks @gpanders! - Enable FUSE-capable local container developmentMiniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with
/dev/fuseavailable, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.#15326
9fcb1c9Thanks @jamesopstad! - Record the selected mode in the Build Output Specification top-levelconfig.jsonThe mode a build was produced in is now written to
.cloudflare/output/v0/config.jsonas amodefield, alongside the account and compliance settings.Patch Changes
aa54b49,4a67a28,2d78137,04e8564,d1cc3af,693ca29,693ca29,693ca29,daefb3c,37ed753,f76b68e,ad89456,c809851,c66d2d5,693ca29,74de3ab,0cb8690,9fcb1c9,22182da,a4c3458,433fa98,d589d30,dd5148d,82d11fc]:v1.53.1Compare Source
Patch Changes
59872c4,c68f9cb,99a1f49,5ae9d5b,4b52975,ce9b151,ef73a28,649f667,39dcea6,99a1f49,99a1f49,99a1f49,f2437e6,30c2d47]:v1.53.0Compare Source
Minor Changes
#15026
6529f0cThanks @petebacondarwin! - Allow containers to be attached to a Durable Object from itsexportsentryA container can now be linked to its Durable Object from the export side, using a new
containerfield that names an entry in thecontainersarray. As a resultcontainers[].class_nameis now optional — a container that is referenced this way only needs aname:{ "name": "my-worker", "main": "worker.js", "compatibility_date": "2026-07-01", "containers": [ { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 } ], "exports": { "MyContainerDO": { "type": "durable-object", "storage": "sqlite", "container": "my-container" } } }The existing
containers[].class_namedirection keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.containeris only valid on livedurable-objectexports (createdandexpecting-transfer) and requiresstorage: "sqlite". Wrangler now also reports an error when:containerreference names a container that does not existnameclass_namenames a Durable Object whosestorageislegacy-kvThat last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one
class_name, give each its own Durable Object class.Patch Changes
#15238
3a4fc6bThanks @jamesopstad! - Honoraccess.devwhen running Workers with@cloudflare/vite-plugin, soctx.access.getIdentity()returns the configured identity.#15028
d4f441fThanks @harshmathurx! - Handle Worker-side request body cancellation without surfacing stream controller errors in local dev.#15185
1f79aceThanks @jamesopstad! - Use a fixed default compatibility date rather than the current dateWhen no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date.
workerdonly accepts a compatibility date up to 7 days beyond its own release, so whenever aworkerdrelease was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.The default is now fixed at the release date of the
workerdversion that ships with each release, which leaves a week of headroom and updates asworkerdis upgraded.@cloudflare/vite-pluginpreviously inlined the date at which it was built. It now shares the same default.#15239
f431166Thanks @jamesopstad! - Prevent date-enabled Node.js compatibility from adding conflicting globals to generated runtime typesRuntime type generation now treats Node.js compatibility enabled by a compatibility date the same way as an explicit
nodejs_compatflag. Node.js globals continue to come from@types/nodeinstead of being generated asanydeclarations that override those types.#15196
8fb2b87Thanks @skepticfx! - Use the FedRAMP High managed container registry when Wrangler targets the FedRAMP High compliance regionContainer builds, pushes, deployments, image commands, and local development now select the corresponding production or staging FedRAMP registry and API from either
compliance_regionorCLOUDFLARE_COMPLIANCE_REGION.Updated dependencies [
bc5726b,1277a72,ba54f0d,6529f0c,b7422b0,186339c,4f922dc,4d74b8d,2e0c962,1f79ace,49f73de,7cee278,8777180,265256a,1f79ace,f431166,8fb2b87,75cf407]:cloudflare/workers-sdk (@cloudflare/vitest-pool-workers)
v0.22.0Compare Source
Minor Changes
#13830
49d4e00Thanks @penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14@cloudflare/vitest-pool-workerspreviously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.If you mock requests with MSW in your Worker tests, make sure you're on MSW
>= 2.14; older versions will no longer intercept requests. You can keep usingsetupServer()frommsw/node, or adopt the official@msw/cloudflareintegration viasetupNetwork(). See the updatedrequest-mockingexample fixture for the recommended pattern.Patch Changes
#15211
bc5726bThanks @nithin42! - Honoraccess.devwhen running Workers with@cloudflare/vitest-pool-workers, soctx.access.getIdentity()returns the configured identity just as it does withwrangler dev.#15156
3ddd3ceThanks @dario-piotrowicz! - Fix module resolution for relativerequire()inside CJS deps when the project path contains spacesWhen a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative
require()calls (e.g.require("./lib/impl.js")) would fail with "No such module" becauseworkerdpreserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.#15150
2cf3143Thanks @kkkhs! - Restore typedinject()keys incloudflareTest()pool optionsinject()insidecloudflareTest()options again infers the value type from the keys you declare in your VitestProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g.inject<number>("myPort").#15232
8777180Thanks @vicb! - Bumpcapnp-esto 0.0.16.#15185
1f79aceThanks @jamesopstad! - Use a fixed default compatibility date rather than the current dateWhen no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date.
workerdonly accepts a compatibility date up to 7 days beyond its own release, so whenever aworkerdrelease was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.The default is now fixed at the release date of the
workerdversion that ships with each release, which leaves a week of headroom and updates asworkerdis upgraded.@cloudflare/vite-pluginpreviously inlined the date at which it was built. It now shares the same default.Updated dependencies [
bc5726b,1277a72,ba54f0d,6529f0c,b7422b0,186339c,4f922dc,4d74b8d,2e0c962,1f79ace,49f73de,7cee278,8777180,265256a,1f79ace,f431166,8fb2b87,75cf407]:getsentry/sentry-javascript (@sentry/cloudflare)
v10.71.0Compare Source
Important Changes
The
enableLogsclient option now defaults totrue, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call theSentry.logger.*APIs or add a log-forwarding integration (such asconsoleLoggingIntegration,pinoIntegration, or the winston transport), and you can setenableLogs: falseto opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.Other Changes
scope.clear()method (#23231)Headersinstances (#23241)captureExceptionfrom scope, not fromClient(#23280)Internal Changes
Bundle size 📦
testing-library/user-event (@testing-library/user-event)
v14.6.6Compare Source
Bug Fixes
v14.6.5Compare Source
Bug Fixes
saadeghi/daisyui (daisyui)
v5.7.22Compare Source
Bug Fixes
v5.7.21Compare Source
Bug Fixes
fab-floweractions (#4683) (e4e6419)v5.7.20Compare Source
Bug Fixes
v5.7.19Compare Source
Bug Fixes
v5.7.18Compare Source
Bug Fixes
capricorn86/happy-dom (happy-dom)
v20.11.8Compare Source
👷♂️ Patch fixes
adoptedStyleSheetarray should be validated - By @capricorn86 in task #2315v20.11.7Compare Source
👷♂️ Patch fixes
Document.adoptedStyleSheetsandShadowRoot.adoptedStyleSheetsshould validate it's value - By @capricorn86 in task #2313v20.11.6Compare Source
👷♂️ Patch fixes
v20.11.5Compare Source
👷♂️ Patch fixes
querySelector<HTMLInputElement>(".my-input")) - By @cyphercodesv20.11.4Compare Source
👷♂️ Patch fixes
fetch()to match origins instead of host and protocol - By @rexxars in task #1490v20.11.3Compare Source
👷♂️ Patch fixes
actions/node-versions (node)
v24.20.0: 24.20.0Compare Source
Node.js 24.20.0
vitejs/vite (vite)
v8.2.2Compare Source
Features
@vitejs/devtoolspeer range to v0.5.0 (#23302) (495d9ff)Bug Fixes
resolve.preserveSymlinkswhen resolving root (fix #23197) (#23198) (8413052)Documentation
Miscellaneous Chores
Code Refactoring
Tests
Build System
cloudflare/workers-sdk (wrangler)
v4.127.0Compare Source
Minor Changes
#15356
fe265f8Thanks @rubuy-74! - Add support for configuring a per-workflow max concurrency limit viaworkflows[].concurrency.limitin your Wrangler config.The limit is the maximum number of Workflow instances that can run concurrently. It is validated as a positive integer and persisted on deploy; the ceiling is enforced server-side. Concurrency is ignored in local development.
{ "workflows": [ { "binding": "MY_WORKFLOW", "name": "my-workflow", "class_name": "MyWorkflow", "concurrency": { "limit": 10 } } ] }Patch Changes
#15367
412c79eThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#15375
92874f6Thanks @WillTaylorDev! - Uploadwrangler previewmodules as multipart form datawrangler previewused to base64 the bundle, its modules, and any sourcemaps into a single JSON request body. Base64 inflates content by a third, so a Worker with a large sourcemap could exceed the API request size limit and fail to deploy.The preview deployment request is now
multipart/form-data. The deployment settings travel in ametadatapart and each module follows as its own part carrying raw bytes, matching howwrangler deployalready uploads a Worker.Updated dependencies [
412c79e]:v4.126.0Compare Source
Minor Changes
#15332
d1cc3afThanks @pombosilva! - Adddefault_retentionto Workflow bindings for configuring how long instances are retainedWorkflow instances are retained for an account-wide default period after they finish. You can now set a per-Workflow default in your Wrangler configuration, applied to instances that do not specify their own retention:
{ "workflows": [ { "binding": "MY_WORKFLOW", "name": "my-workflow", "class_name": "MyWorkflow", "default_retention": { "success_retention": "3 days", "error_retention": "7 days" } } ] }Each side is optional and accepts either a duration string such as
"3 days"or a whole number of milliseconds. Durations are interpreted by the Workflows API, which also caps them at your account's retention limit.#15064
693ca29Thanks @tpmmorris! - Include a chronological list of handler events in email test harness results, so programmatic local email tests can assert the order in which messages are received, forwarded, replied to, or rejected.#15065
ad89456Thanks @mtlemilio! - Add experimentalwrangler hyperdrive planetscale signaturefor provisioning Cloudflare-billed PlanetScale databaseswrangler hyperdrive planetscale signatureprints a signed authorization as JSON, proving to PlanetScale that Cloudflare will be billed for the database you are about to create:pscale database createdefaults to Vitess, so pass--engine postgresqlfor a Postgres database, and--format jsonis recommended when the output is consumed by an agent.This requires
pscalev0.313.0 or newer. Wrangler authorizes the Cloudflare billing side only, so your PlanetScale credentials stay between you andpscale.The signature is a cryptographically signed token that authorizes creating a database billed to your Cloudflare account. Treat it as a credential and do not share it. Piping it, as above, is recommended over passing it as a command line argument.
This command is experimental and its interface may change.
#15134
c66d2d5Thanks @gpanders! - Enable FUSE-capable local container developmentMiniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with
/dev/fuseavailable, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.#15326
9fcb1c9Thanks @jamesopstad! - Record the selected mode in the Build Output Specification top-levelconfig.jsonThe mode a build was produced in is now written to
.cloudflare/output/v0/config.jsonas amodefield, alongside the account and compliance settings.[#1496
Configuration
📅 Schedule: (in timezone America/New_York)
* 0-8 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.