Skip to content

fix(deps): update all non-major dependencies - #229

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#229
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented May 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/vite-plugin (source) ^1.36.3 → ^1.51.1 age confidence
@cloudflare/workers-types ^4.20260508.1 → ^4.20260702.1 age confidence
@hono/node-server ^1.19.14 → ^1.19.17 age confidence
@marsidev/react-turnstile ^1.5.0 → ^1.5.5 age confidence
@radix-ui/react-collapsible (source) ^1.1.12 → ^1.1.20 age confidence
@scalar/hono-api-reference (source) ^0.10.8 → ^0.11.13 age confidence
@simplewebauthn/server (source) ^13.3.0 → ^13.3.2 age confidence
@takumi-rs/image-response 1.1.2 → 1.8.7 age confidence
colorjs.io (source) ^0.6.1 → ^0.7.1 age confidence
dayjs (source) ^1.11.20 → ^1.11.21 age confidence
effect (source) >=3.21.0 → >=3.22.1 age confidence
esbuild ^0.28.0 → ^0.28.2 age confidence
evlog (source) ^2.13.0 → ^2.25.0 age confidence
flatted >=3.4.2 → >=3.4.4 age confidence
framer-motion ^12.38.0 → ^12.43.0 age confidence
fuse.js (source) ^7.3.0 → ^7.5.0 age confidence
hono (source) ^4.12.14 → ^4.13.1 age confidence
pg (source) ^8.20.0 → ^8.23.0 age confidence
pnpm (source) 10.33.0 → 10.34.5 age confidence
react-grab (source) ^0.1.32 → ^0.1.50 age confidence
react-hook-form (source) ^7.72.1 → ^7.85.0 age confidence
react-use ^17.6.0 → ^17.6.1 age confidence
react-virtuoso (source) ^4.18.5 → ^4.18.11 age confidence
satori ^0.26.0 → ^0.29.0 age confidence
sharp (source, changelog) ^0.34.5 → ^0.35.3 age confidence
swr (source) ^2.4.1 → ^2.5.0 age confidence
tsx (source) ^4.21.0 → ^4.23.11 age confidence
turbo (source) ^2.9.6 → ^2.10.9 age confidence
undici (source) ^7.25.0 → ^7.29.0 age confidence
vite (source) ^8.0.12 → ^8.2.1 age confidence
wrangler (source) ^4.90.0 → ^4.120.0 age confidence
zod (source) ^4.3.6 → ^4.4.3 age confidence

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.51.1

Compare Source

Patch Changes

  • #​15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture

    Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.

    Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.

    The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.

  • Updated dependencies [35c87e9, b4f0c97, 8cf78c8, a60ff4d, 99eb50c, 35c87e9]:

v1.51.0

Compare Source

Minor Changes

  • #​14941 266172b Thanks @​nickpatt! - Improve the Local Explorer's Observability views

    console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).

  • #​14996 ebd1dfd Thanks @​nickpatt! - Surface Local Explorer API to headless agents

    When a Vite dev or preview server with the Cloudflare plugin is started in a headless AI agent environment, the plugin now prints the Local Explorer API URL and useful resource routes to stdout so agents can discover and call them programmatically.

Patch Changes

v1.50.0

Compare Source

Minor Changes

  • #​14944 a249591 Thanks @​nickpatt! - Enable local observability capture by default in dev

    wrangler dev and the Vite plugin now capture request traces and console logs into the Local Explorer's Observability tab out of the box — previously this was opt-in behind X_LOCAL_OBSERVABILITY=true. Set X_LOCAL_OBSERVABILITY=false to opt out (for example if the extra per-worker collector/streaming-tail services cause trouble in a multi-process dev-registry setup).

Patch Changes

v1.49.1

Compare Source

Patch Changes

  • #​14586 5a56dda Thanks @​emily-shen! - Rewrite local testing paths (/cdn-cgi/*)

    Miniflare v5 moved its internal local testing endpoints to /cdn-cgi/local/* (and /__cf_local/* for endpoints that must remain reachable over tunnels) to prevent any potential collision with production routes. wrangler dev and the Vite plugin now transparently rewrite the old paths to the new ones, meaning you can continue to use the old paths without issue.

    These are the new paths:

    • /cdn-cgi/handler/scheduled → /cdn-cgi/local/scheduled
    • /cdn-cgi/handler/email → /cdn-cgi/local/email
    • /cdn-cgi/explorer/* → /cdn-cgi/local/explorer/*
    • /cdn-cgi/mf/scheduled → /cdn-cgi/local/scheduled (Note /cdn-cgi/mf/scheduled is already deprecated)
    • /cdn-cgi/mf/stream/* → /__cf_local/stream/*
    • /cdn-cgi/mf/imagedelivery/* → /__cf_local/imagedelivery/*

  • Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

v1.49.0

Compare Source

Minor Changes
  • #​14905 b21eac2 Thanks @​jamesopstad! - The experimental build output directory now includes the Worker's configuration at .cloudflare/output/v0/workers/default/config.json instead of .cloudflare/output/v0/workers/<worker-name>/worker.config.json
Patch Changes

v1.48.0

Compare Source

Minor Changes

  • #​14883 76e6014 Thanks @​jamesopstad! - Serve the bundled client HTML in dev when Vite's experimental.bundledDev is enabled

    Note that this feature is experimental and subject to change.

Patch Changes

  • #​14862 c232d05 Thanks @​petebacondarwin! - Destroy the client socket instead of crashing when a WebSocket upgrade fails

    If dispatchFetch rejected while a WebSocket upgrade was still in flight (for example when Miniflare is disposed during a dev server shutdown or restart), the error escaped the async upgrade handler as an unhandled rejection. This could terminate the dev server process and leaked the client socket. The upgrade handler now catches such failures and tears the socket down cleanly.

  • #​14837 de6a951 Thanks @​1rgs! - Fix compatibility with Vite's experimental.bundledDev option. Keep Miniflare, containers, and tunnels alive when a build runs in dev.

    The plugin used the buildEnd hook as its signal that the dev server was closing, and tore down its dev resources there. Vite's experimental.bundledDev runs a build pass during serve, which fires buildEnd while the dev server is still live — so Miniflare was disposed (the next request failed with Expected \miniflare` to be defined`), locally-built container images were removed, and any active tunnel was closed, all mid-serve.

    During serve, these resources are now torn down from a patched server.close. We will replace server patching with first-class APIs when they are added to Vite.

  • #​14851 fb89b72 Thanks @​exKAZUu! - Retry transient module-transport failures in the runner worker

    Each fetchModule invoke was a single fetch to the dev server with no retry. If that one fetch failed transiently (e.g. Network connection lost when workerd reuses a loopback connection that Node just closed), Vite's module runner cached the rejection and every request importing the affected module failed for the rest of the dev session. The invoke is an idempotent request for module code, so retry it up to three times before giving up.

  • Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

    • wrangler@​4.115.0
    • miniflare@​4.20260722.1

v1.47.0

Compare Source

Minor Changes

  • #​14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

    wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

    You can explore this data two ways:

    • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
    • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

    While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

  • #​14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

    Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

    The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

  • Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

    • wrangler@​4.114.0
    • miniflare@​4.20260722.0

v1.46.0

Compare Source

Minor Changes

  • #​14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

    Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

    // cloudflare.config.ts
import { defineSettings, defineWorker } from "wrangler/experimental-config";
import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };

export const settings = defineSettings({
	accountId: "<your-account-id>",
});

export default defineWorker({
	name: "my-worker",
	entrypoint,
	compatibilityDate: "2026-05-18",
});

    This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

Patch Changes

v1.45.1

Compare Source

Patch Changes

  • #​14610 e727842 Thanks @​martijnwalraven! - Keep watching config changes after a failed dev server restart

    Previously, when a config change made the dev server restart fail — for example because the updated Worker config was invalid — the plugin stopped watching config changes entirely: the change handler (covering the Worker config files, local dev vars, and the assets configuration) removed itself before restarting, and only a successfully created server would register a fresh one. Since Vite keeps the current server running when a restart fails, every subsequent config change (including the one that fixes the config) was silently ignored for the rest of the session.

    The handler now stays registered and guards against re-entrant restarts instead, so fixing the config restarts the dev server as expected.

  • #​14418 cb30df3 Thanks @​matthewdavidrodgers! - Improve routing performance for Workers with assets

    Reduce request handling latency by streamlining the router Worker's request path. The loopback infrastructure remains available for future use.

  • Updated dependencies [34e696d, d39ae01, 3de70df, c79504f, 9f04a7e, 9f04a7e, cb30df3, cb6c3f9, c7dbe1a, 3f3afbb, e6fbc4e, 4e1a7a7, 9f04a7e]:

    • miniflare@​4.20260714.0
    • wrangler@​4.112.0

v1.45.0

Compare Source

Minor Changes

  • #​14652 317ce1f Thanks @​jamesopstad! - Append Workers runtime types to the generated types when using experimental.newConfig, with a new types.includeRuntime option

    When using the experimental new config (cloudflare.config.ts), the plugin now appends the Workers runtime types (generated from your compatibility date and flags) to worker-configuration.d.ts, alongside the types inferred from your config. This is controlled by a new experimental.newConfig.types.includeRuntime option, which defaults to true.

    As part of this change, types are now generated only during vite dev (not vite build), since compatibility settings are resolved from the active dev session. This affects the experimental new config path only.

Patch Changes

  • #​14588 eb99ab1 Thanks @​emily-shen! - fix: Respect auth profiles when using remote bindings in the Vite plugin

    Auth profiles (configured via wrangler auth create and wrangler auth activate) were previously being ignored when using remote bindings with the Vite plugin. This is now fixed.

    Note that the profile directory is resolved based on the Vite project root.

  • #​14645 cbdd107 Thanks @​jamesopstad! - Fix load time crash on Node.js versions earlier than 22.15

    The plugin eagerly imported registerHooks from node:module, which only exists on Node.js v22.15.0+. registerHooks is now read lazily, meaning that missing support is only surfaced when using experimental.newConfig.

  • Updated dependencies [7692a61, ed33326, 018574b, eb99ab1, cdf3148, 7692a61, 7692a61, 3015320, 899c297, 9da77ac, 317ce1f]:

    • miniflare@​4.20260710.0
    • wrangler@​4.111.0

v1.44.0

Compare Source

Minor Changes

  • #​14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

    A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.

    await step.do(
  "call flaky API",
  {
    retries: {
      limit: 5,
      backoff: "constant",
      delay: ({ ctx }) => ctx.attempt * 1000,
    },
  },
  async () => {
    /* ... */
  }
);

    The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

Patch Changes

v1.43.3

Compare Source

Patch Changes

v1.43.2

Compare Source

Patch Changes

v1.43.1

Compare Source

Patch Changes

v1.43.0

Compare Source

Minor Changes

  • #​14382 fd92d56 Thanks @​petebacondarwin! - Add support for declarative Durable Object exports

    wrangler deploy now accepts an exports map in wrangler.json as a declarative alternative to the legacy migrations array.

    Each entry in exports is keyed by Durable Object class name. type carries the export kind (currently always "durable-object"); the state field carries the lifecycle and defaults to "created" (live) when omitted:

    {
  "exports": {
    // Provision a new Durable Object class (`MyDO`)
    "MyDO": { "type": "durable-object", "storage": "sqlite" },
    // Delete Durable Object class (`OldGone`)
    "OldGone": { "type": "durable-object", "state": "deleted" },
    // Rename a Durable Object class (from `OldName` to `NewName`)
    "OldName": {
      "type": "durable-object",
      "state": "renamed",
      "renamed_to": "NewName"
    },
    "NewName": { "type": "durable-object", "storage": "sqlite" },
    // Transfer a Durable Object (`Outgoing`) to a new Worker (`target-worker`)
    "Outgoing": {
      "type": "durable-object",
      "state": "transferred",
      "transferred_to": "target-worker"
    },
    // Prepare to receive the transfer of a Durable Object (`Incoming`) from another Worker (`source-worker`)
    "Incoming": {
      "type": "durable-object",
      "state": "expecting-transfer",
      "storage": "sqlite",
      "transfer_from": "source-worker"
    }
  }
}

    When a Worker declares Durable Object class bindings but no lifecycle for them (neither a migrations array nor an exports map), wrangler warns and now suggests a declarative exports entry for each class (previously it suggested a legacy migrations block).

    The deployment response now surfaces the server's reconciliation result — created namespaces, applied tombstones, structured per-scenario info entries, and a removable_entries hint for stale tombstones that are safe to delete from the config. Blocking errors return the structured per-class detail with scenario tags, suggested remediation, and any referencing-script context.

    wrangler versions upload also forwards exports. Declarative exports lifecycle changes are reconciled when the version is deployed (wrangler versions deploy or wrangler deploy), so a versions upload payload can declare new classes in exports without immediately provisioning them. An actor binding (durable_objects.bindings) to a class declared only in exports on the same versions upload is rejected with a clear error (code 100406) — the binding cannot be resolved until the namespace is provisioned. Either stage the new class via ctx.exports.X (no binding required) on versions upload and add the binding at deploy time, or use wrangler deploy to provision and bind in one step (the same constraint applies to the migrations flow).

    Multi-version deploys (wrangler versions deploy A@50% B@50%) where the selected versions disagree on declarative exports are rejected server-side with a clear message: deploy the version that changes exports at 100% first, then run the percentage-split deploy. This prevents traffic on one branch routing to code that references unprovisioned or just-deleted DO namespaces. Single-version (100%) deploys are unaffected.

    Local development (wrangler dev, vite dev and unstable_startWorker) reads Durable Object SQLite storage settings from the new exports field, so applications using the declarative flow get correct local-dev storage without needing to also declare a migrations block.

    @cloudflare/vitest-pool-workers also picks up Durable Object configuration from exports, so tests against an exports-only Worker run with the correct local SQLite storage and can reach unbound Durable Object classes via ctx.exports.X.

    wrangler types is also aware of exports. Live entries (including expecting-transfer, the receiving side of a two-phase transfer) are added to Cloudflare.GlobalProps.durableNamespaces, which types ctx.exports.X for unbound Durable Objects declared only via exports.

Patch Changes

v1.42.4

Compare Source

Patch Changes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@semanticdiff-com

semanticdiff-com Bot commented May 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Review changes with  SemanticDiff

Changed Files
File Status
  apps/web/package.json  8% smaller
  pnpm-workspace.yaml  1% smaller
  apps/backend/package.json  0% smaller
  package.json  0% smaller
  packages/api-contract/package.json  0% smaller
  pnpm-lock.yaml Unsupported file format

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from ba112ce to 59b756c Compare May 17, 2026 09:33
@github-actions

github-actions Bot commented May 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Preview Deployment

Name Link
Latest commit 0812a49
Preview URL https://dxrating-pr-229.galvin.workers.dev

Built and deployed to Cloudflare Workers.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 26 times, most recently from 210654d to 585ccca Compare May 24, 2026 06:57
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 18 times, most recently from 6bae244 to 47df4dd Compare June 4, 2026 08:52
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from 97dfe44 to 23e21d8 Compare June 7, 2026 04:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants