Skip to content

⬆️ deps: Update dependencies (non-major) - #55

Merged
zrr1999 merged 1 commit into
mainfrom
renovate/dependencies-(non-major)
Jul 27, 2026
Merged

⬆️ deps: Update dependencies (non-major)#55
zrr1999 merged 1 commit into
mainfrom
renovate/dependencies-(non-major)

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@lucide/astro (source) 1.25.0 → 1.27.0 age confidence
oxlint (source) 1.74.0 → 1.75.0 age confidence
pnpm (source) 11.15.1 → 11.17.0 age confidence
react (source) 19.2.7 → 19.2.8 age confidence
react-dom (source) 19.2.7 → 19.2.8 age confidence
satori ^0.28.0 → ^0.29.0 age confidence
vite (source) 0.2.5 → 0.2.6 age confidence
vite-plus (source) 0.2.5 → 0.2.6 age confidence
wrangler (source) 4.112.0 → 4.114.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

lucide-icons/lucide (@​lucide/astro)

v1.27.0: Version 1.27.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

v1.26.0: Version 1.26.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.25.0...1.26.0

oxc-project/oxc (oxlint)

v1.75.0

Compare Source

🚀 Features
  • dd18383 linter/node: Implement no-top-level-await rule (#​24634) (Connor Shea)
  • 16a65f2 linter/react: Implement function-component-definition rule (#​24471) (Cole Ellison)
  • 7f1f585 linter: Reuse jest/padding-around-test-blocks for vitest/padding-around-test-blocks (#​24519) (Mikhail Baev)
  • 99978a8 linter/import/consistent-type-specifier-style: Support prefer-top-level-if-only-type-imports option (#​24502) (camc314)
🐛 Bug Fixes
  • 8694167 linter/eslint/prefer-destructuring: Handle typed declarations (#​24616) (camc314)
pnpm/pnpm (pnpm)

v11.17.0: pnpm 11.17

Compare Source

Minor Changes

  • Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #​13220.

    pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.

    Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.

Patch Changes

  • The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.

  • Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. packages/foo) through a pnpr server #​13232.

  • Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #​13164.

  • Revert script ordering change for pnpm run --sequential /regex/

  • Support the from-git argument in the pnpm version command.

  • When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.

Platinum Sponsors
Bit
OpenAI
Gold Sponsors
Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v11.16.0: pnpm 11.16

Compare Source

Minor Changes

  • The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at 1100.0.0 with a minor changeset is therefore published as 1100.0.0 rather than skipping straight to 1100.1.0.

  • Added a --changeset flag to pnpm update. Set update.changeset to true in pnpm-workspace.yaml to enable this behavior by default, and use --no-changeset to override the setting for one update. After the update completes, pnpm writes a .changeset/pnpm-update-<suffix>.md file declaring a patch bump for every workspace package whose dependencies or optionalDependencies were changed by the update and a major bump when peerDependencies changed, including packages that consume an updated catalog entry via the catalog: protocol. Private packages, packages without a name, and packages listed in the ignore array of .changeset/config.json are skipped. If .changeset/config.json does not exist, a warning is printed and no changeset is generated.

  • Added GitHub Actions dependencies to pnpm outdated and interactive pnpm update. Non-interactive updates can include them with --include-github-actions or by setting update.githubActions to true in pnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.

  • Added update and audit settings sections to pnpm-workspace.yaml, superseding the awkwardly named updateConfig, auditConfig, and top-level auditLevel settings:

    update:
  ignoreDeps: # was updateConfig.ignoreDependencies
    - webpack
    - "@&#8203;babel/*"

audit:
  level: high # was auditLevel
  ignore: # was auditConfig.ignoreGhsas
    - GHSA-xxxx-yyyy-zzzz

    update.ignoreDeps lists dependency name patterns that pnpm update and pnpm outdated should skip. audit.level and audit.ignore tune pnpm audit.

    The deprecated updateConfig, auditConfig, and auditLevel settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.

Patch Changes

  • Fixed pnpm add --save-exact/--save-prefix and pnpm update writing a package's version with the peerDependencies range's prefix (e.g. ^19.2.7 instead of the requested 19.2.7) whenever the same package also appeared in peerDependencies. A real dependencies/devDependencies/optionalDependencies entry now takes precedence over a same-named peerDependencies entry when computing the current specifiers #​13108.

Platinum Sponsors

Bit
OpenAI

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx
react/react (react)

v19.2.8

Compare Source

react/react (react-dom)

v19.2.8

Compare Source

vercel/satori (satori)

v0.29.0

Compare Source

Features

v0.28.2

Compare Source

Bug Fixes

v0.28.1

Compare Source

Bug Fixes
  • render text matching Object.prototype property names as glyphs (#​761) (504b4c9)
voidzero-dev/vite-plus (vite)

v0.2.6: vite-plus v0.2.6: Stable type-aware linting and more reliable task caching

Compare Source

This release moves Vite+'s type-aware linting to the stable tsgolint 7 engine, updates the bundled build and formatting tools, strengthens vp run caching and workspace discovery, and removes the redundant vp build startup banner.

Highlights
  • Move bundled type-aware linting to stable tsgolint 7, and update Vite 8.1.4 -> 8.1.5, Rolldown 1.1.5 -> 1.2.0, tsdown 0.22.7 -> 0.22.13, Oxlint 1.73.0 -> 1.75.0, oxlint-tsgolint 0.24.0 -> 7.0.2001, and Oxfmt 0.58.0 -> 0.60.0 (#​2214), by @​voidzero-guard[bot]
  • Improve vp run reliability by caching much larger automatically tracked input sets, discovering npm workspaces whose patterns start with ./, and providing more accurate error messages (vite-task#554, vite-task#547, vite-task#552, #​2215), by @​wan9chi and @​liangmiQwQ
  • Remove the redundant Vite startup banner from vp build output and fail fast when upstream Vite changes invalidate Vite+ branding patches (#​2200, #​2205), by @​liangmiQwQ
Refactor
Docs
  • Fix broken documentation anchors and add Migration Rules to the Migrate sidebar (#​2203), by @​charpeni
Chore
  • Stabilize vp create build-approval snapshots by removing package-age timing from those fixtures (#​2224), by @​wan9chi
  • Remove the temporary release workflow dispatch used for the previous release (#​2193), by @​wan9chi
  • Share package-manager fixtures across CLI tests (#​2197), by @​jong-kyung
  • Remove stale raw Oxlint and Oxfmt development dependencies that bypassed repository editor configuration (#​2187), by @​liangmiQwQ
Bundled Versions
Tool Version Source
vite 8.1.5 5e7fe12
rolldown 1.2.0 03e1e34
tsdown 0.22.13 npm
vitest 4.1.10 npm
oxlint 1.75.0 npm
oxlint-tsgolint 7.0.2001 npm
oxfmt 0.60.0 npm
Upgrade
vp upgrade
New Contributors

Welcome @​charpeni.

Full Changelog: voidzero-dev/vite-plus@v0.2.5...v0.2.6

Published Packages
  • @voidzero-dev/vite-plus-core@0.2.6
  • vite-plus@0.2.6
Installation

macOS/Linux:

curl -fsSL https://vite.plus | bash

Windows:

irm https://vite.plus/ps1 | iex

Or download and run vp-setup.exe from the assets below.

View the full commit: cd064c6

Docker:

docker run --rm -it -v "$PWD:/app" -w /app ghcr.io/voidzero-dev/vite-plus:0.2.6 vp build

Run any vp command without installing it; see the Docker guide for more.

cloudflare/workers-sdk (wrangler)

v4.114.0

Compare Source

Minor Changes

  • #​14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

    wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

    You can explore this data two ways:

    • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
    • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

    While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

  • #​14373 246ce92 Thanks @​Jacroney! - Improve the D1 database-limit error message

    When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

  • #​14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260721.1 ^5.20260722.1
    workerd 1.20260721.1 1.20260722.1

  • #​14788 8416b33 Thanks @​chinesepowered! - Fix grammar in the container image-too-large error

    The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."

  • #​14809 4683ff8 Thanks @​jamesopstad! - Ignore the removed legacy_env field when reading a redirected configuration

    Older versions of tools such as the Vite plugin can generate a redirected configuration (.wrangler/deploy/config.json) that still includes the removed legacy_env field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips legacy_env from redirected configurations. User-authored configurations still report an error so that the field can be removed.

  • #​14593 02232f3 Thanks @​spk-ai! - Fix dev proxy silently hanging or returning a misleading 503 on network errors for non-root-path requests

    During wrangler dev, a transient network error on any request path other than / could be misclassified as the worker being reloaded, even when it wasn't: GET/HEAD requests would silently hang (with nothing logged) until the client timed out, and other methods would receive a misleading Your worker restarted mid-request 503. Such errors are now reported and surfaced immediately when the worker has not actually changed.

  • #​14797 f8a8c2c Thanks @​roerohan! - Explain how to provision Flagship bindings if app_id missing in remote development

    Wrangler now reports that a Flagship binding without an app_id must first be created with wrangler flagship apps create.

  • Updated dependencies [c38a2c3, c079ba3, 95b026e, c4bacec, 3203b5d]:

    • miniflare@​4.20260722.0

v4.113.0

Compare Source

Minor Changes

  • #​14471 f03b108 Thanks @​DiogoSantoss! - Apply Email Routing addresses during Worker trigger deployment

    Worker trigger deployment now reconciles the Worker's Email Routing rules with the top-level addresses config. This runs for wrangler deploy, wrangler triggers deploy, and clients of @cloudflare/deploy-helpers. After the Worker uploads, or when wrangler triggers deploy runs after a version promotion, the deploy helper asks the Email Routing API for a plan, renders the changes grouped by zone (+ added, ~ updated, - deleted, ! conflict), prompts once for destructive changes in interactive mode, and applies accepted changes through the per-zone rule endpoints. Purely additive plans apply without a prompt, while non-interactive destructive plans fail without modifying rules.

  • #​14679 deae171 Thanks @​dario-piotrowicz! - Add exclude_packages option to dependencies_instrumentation configuration

    The dependencies_instrumentation config object now accepts an optional exclude_packages field — an array of package name patterns (with glob-style * wildcards) to exclude from the dependency metadata collected during deploy and version uploads.

    // wrangler.json
{
  "dependencies_instrumentation": {
    "exclude_packages": ["@&#8203;internal/*", "secret-tool"]
  }
}

  • #​14721 4e92e32 Thanks @​dmmulroy! - Support Artifacts sources when creating Queue event subscriptions

    wrangler queues subscription create now accepts the artifacts and artifacts.repo source types supported by the Cloudflare API.

  • #​13352 d1d6945 Thanks @​penalosa! - Expand automatic resource provisioning to Queue, Dispatch Namespace, and Flagship bindings

    Deployments can now omit the resource name or ID for these bindings. Wrangler will inherit the existing binding on subsequent deploys, create a deterministically named resource automatically, or offer existing resources during an interactive deploy with automatic creation disabled.

  • #​14688 a0c8bb1 Thanks @​NuroDev! - Print Local Explorer API details for headless agent-driven wrangler dev sessions

    When wrangler dev is started in a headless AI agent environment, Wrangler now prints the Local Explorer API URL and basic resource routes so agents can inspect local Workers and bindings without relying on the interactive UI.

  • #​14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

    Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

    // cloudflare.config.ts
import { defineSettings, defineWorker } from "wrangler/experimental-config";
import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };

export const settings = defineSettings({
	accountId: "<your-account-id>",
});

export default defineWorker({
	name: "my-worker",
	entrypoint,
	compatibilityDate: "2026-05-18",
});

    This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

  • #​14595 2b390d7 Thanks @​colinhacks! - Recognise nub as a package manager

    wrangler now detects nub — from its npm_config_user_agent and an installed nub binary — and autoconfig detects nub projects by their nub.lock, alongside npm, pnpm, yarn, and bun.

  • #​14742 34430b3 Thanks @​pombosilva! - Add support for redacting sensitive Workflows step output in local dev.

    Steps configured with sensitive: "output" now have their output redacted to [REDACTED] in step logs and step-output responses when running Workflows locally, matching production behavior. The real value is still passed to downstream steps, and step errors are never redacted.

Patch Changes

  • #​14715 42af66d Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260714.1 ^5.20260721.1
    workerd 1.20260714.1 1.20260721.1

  • #​14744 a0a091b Thanks @​penalosa! - Drop the "Experimental:" prefix from the resource provisioning header now that automatic provisioning is generally available. The deploy output now reads The following bindings need to be provisioned:.

  • #​14720 0df3d43 Thanks @​penalosa! - Fix remote binding previews for accounts without a workers.dev subdomain

    Wrangler now automatically registers a workers.dev subdomain when one is required to start a remote binding preview.

  • #​14773 d83a476 Thanks @​chinesepowered! - Fix stray characters in the Workers Sites asset-key-too-long error

    The error thrown when an asset path key exceeds the 512-character limit ended with a stray ", copy-paste artifact, so the message printed to users terminated with ...#kv-limits", and the trailing documentation URL was malformed. The message now ends cleanly at the URL.

  • #​14766 4815711 Thanks @​gianghungtien! - Report the Worker's error for HEAD requests instead of an internal JSON parse error

    A Worker that threw on a HEAD request (for example curl -I) logged SyntaxError: Unexpected end of JSON input from miniflare's internals rather than the actual error, and dispatchFetch() rejected with that same misleading error. workerd drops response bodies for HEAD requests, so the serialised error never reached the code that revives it.

    The error is now also carried in a header, which survives HEAD, so the original message and source-mapped stack are reported for every method. When no payload is available the reporting degrades to a plain error rather than surfacing a parse failure.

  • #​14448 c82d96b Thanks @​GregBrimble! - Use the new PATCH APIs for versioned secret commands

    Wrangler now updates versioned Worker secrets by patching the latest Worker version instead of downloading the latest version contents and uploading a full replacement version. This avoids reconstructing Worker configuration in Wrangler, which should reduce bugs when Workers use less common features. For example, this avoids regressions like the previous placement preservation bug fixed in #​13843.

  • #​14617 f75ae5d Thanks @​martijnwalraven! - Derive nodejsCompatMode from the effective compatibility inputs in unstable_startWorker()

    The CLI computes the node-compat mode from the effective compatibility date and flags (args.* ?? parsedConfig.*), but the programmatic path used input.build.nodejsCompatMode raw — leaving it unset meant a worker's nodejs_compat flag (from its config file or from input-level compatibilityFlags) was silently ignored, so bundling failed to resolve node builtins that wrangler dev handles. startWorker now derives the mode the same way when the caller does not provide one: input-level compatibilityDate/compatibilityFlags first, then the resolved config, with no-bundle taken from the resolved build.bundle semantics. Passing an explicit null still disables it.

  • Updated dependencies [42af66d, 4815711, 34430b3]:

    • miniflare@​4.20260721.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@cursor
cursor Bot requested a review from zrr1999 July 27, 2026 02:15
cursor[bot]
cursor Bot reviewed Jul 27, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk: medium. This multi-package non-major bump (vite-plus, pnpm, React, wrangler, and related lockfile changes) has monorepo-wide blast radius and exceeds the low-risk auto-approval threshold. Left a non-blocking comment and assigned a reviewer for human review.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Approver

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 27, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 zrr-website-root 48e4a9b Commit Preview URL

Branch Preview URL		 Jul 27 2026, 02:15 AM

@zrr1999
zrr1999 merged commit 58146b3 into main Jul 27, 2026
4 checks passed
@zrr1999
zrr1999 deleted the renovate/dependencies-(non-major) branch July 27, 2026 02:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cursor cursor[bot] cursor[bot] left review comments
@zrr1999 zrr1999 Awaiting requested review from zrr1999

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zrr1999