fix(deps): update all non-major dependencies - #7
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
September 12, 2026 15:56
bbde33c to
b4beac2
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 19, 2026 15:10
b4beac2 to
723da0a
Compare
Author
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.20260822.1→5.20260919.110.9.0→10.11.017.11.0→17.12.04.13.3→4.13.83.9.6→3.9.88.67.0→8.70.04.125.0→4.135.0Release Notes
cloudflare/workerd (@cloudflare/workers-types)
v5.20260919.1Compare Source
v5.20260918.1Compare Source
v5.20260917.1Compare Source
v5.20260916.1Compare Source
v5.20260915.1Compare Source
v5.20260914.1Compare Source
v5.20260911.1Compare Source
v5.20260910.1Compare Source
v5.20260908.1Compare Source
v5.20260907.1Compare Source
v5.20260906.1Compare Source
v5.20260905.1Compare Source
v5.20260904.1Compare Source
v5.20260903.1Compare Source
v5.20260902.1Compare Source
v5.20260901.1Compare Source
v5.20260831.1Compare Source
v5.20260830.1Compare Source
v5.20260829.1Compare Source
v5.20260828.1Compare Source
v5.20260827.1Compare Source
v5.20260826.1Compare Source
v5.20260825.1Compare Source
v5.20260823.1Compare Source
eslint/eslint (eslint)
v10.11.0Compare Source
v10.10.0Compare Source
v10.9.1Compare Source
sindresorhus/globals (globals)
v17.12.0Compare Source
50a2119__webpack_layer__global (#351)779a11ahonojs/hono (hono)
v4.13.8Compare Source
What's Changed
Full Changelog: honojs/hono@v4.13.7...v4.13.8
v4.13.7Compare Source
v4.13.6Compare Source
v4.13.5Compare Source
v4.13.4Compare Source
prettier/prettier (prettier)
v3.9.8Compare Source
v3.9.7Compare Source
🔗 Changelog
typescript-eslint/typescript-eslint (typescript-eslint)
v8.70.0Compare Source
🩹 Fixes
❤️ Thank You
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.69.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
v8.68.0Compare Source
This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.
See GitHub Releases for more information.
You can read about our versioning strategy and releases on our website.
cloudflare/workers-sdk (wrangler)
v4.135.0Compare Source
Minor Changes
#15609
1f070c8Thanks @emily-shen! - Build Containers when emitting experimental Build OutputWrangler and the Cloudflare Vite plugin now build Dockerfile-backed Container images when experimental Build Output is enabled. Container configs are emitted under
.cloudflare/output/v0/containerswith local image references, while existing registry references pass through unchanged.#15329
c4c9b75Thanks @akshitsinha! - Evaluate Flagship flags locally during developmentFlagship bindings now use the local Miniflare store by default in Wrangler and the Vite plugin, keeping development offline and isolated from production flags. Set
remote: trueon a binding to continue using its remote app.Use
wrangler flagship flags pull <APP_ID>to seed the store from a remote app. Flag management commands also accept--localto read and update the local store directly.#15701
643e5ccThanks @WillTaylorDev! - Pass Preview intent todefineWorkerand upload its resolved configurationPreview builds now evaluate programmatic Worker configuration with
ctx.isPreviewset totrueand record that intent in Build Output. The shared Preview uploader deploys the resolved bindings and settings while preserving configured Preview base values when it creates a Preview.Patch Changes
#15705
a0485d5Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#15587
629ddefThanks @Kuldeeep18! - Fix duration calculation for running workflow instances, steps, and attempts inwrangler workflows instances describewrangler workflows instances describepreviously distorted the elapsed duration of in-progress instances, steps, and attempts across non-UTC timezones by stripping" GMT"fromtoUTCString(), causingnew Date(...)to parse the timestamp in the local client timezone. The duration is now correctly computed against the current time.Updated dependencies [
a0485d5]:v4.134.0Compare Source
Minor Changes
#15684
6874aa9Thanks @Ankcorn! - Add support for configuring real-time Issues withobservability.issues.enabledWrangler now validates and uploads the Issues setting alongside the existing logs and traces observability options. The experimental configuration format supports the equivalent
observability.issues.enabledoption.#15681
d96b319Thanks @podonnell-dev! - Markwrangler previewcommands as open betaWrangler now labels Preview commands as open beta in help output and command warnings, matching the feature's public availability.
#15673
2b39fc2Thanks @ghostwriternr! - Support explicit named Container image selection in Wrangler local developmentWrangler builds or pulls named images configured through Wrangler JSON or TOML and exposes their local tags through
ctx.container.images. Pass one of those references toctx.container.start({ image })to select the image.This extends the experimental Durable Object-managed Containers interface. Named images are opt-in and do not become the Container's default image. A Container without a default image must supply an image or full Container snapshot when starting.
Patch Changes
#15689
876eea1Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
Updated dependencies [
2298cf1,876eea1]:v4.133.0Compare Source
Minor Changes
#15600
bac0c6aThanks @podonnell-dev! - Add placement configuration for PreviewsYou can now configure
placementin thepreviewsblock. Preview-specific placement overrides the top-level placement configuration for Preview Defaults and deployments.#15600
bac0c6aThanks @podonnell-dev! - Improve onboarding guidance for Previews (whenpreviewsblock is missing from configuration file)When a local
previewsblock is absent, Wrangler writes the Preview Base configuration to the local config file. When no Preview Base configuration exists, Wrangler prints a placeholder configuration derived from production bindings and warns against reusing production binding configuration.Patch Changes
#15483
71b6f10Thanks @tpmmorris! - Align Local Explorer Workflow instance status requests with productionLocal Explorer and Wrangler local mode now use the production-compatible
statusrequest field for pausing, resuming, restarting, and terminating Workflow instances. Direct Local Explorer API consumers must replace the previousactionfield withstatus.Successful Local Explorer status updates now return the production-compatible instance
statusand responsetimestampinstead of the local-onlyresult.successacknowledgement.#15665
ad23e6eThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#15655
be2437aThanks @WillTaylorDev! - Send exports with Worker Preview deploymentswrangler previewdropped theexportsblock from deployment requests. Durable Objects reached throughctx.exportshad no Preview namespace, and cache settings for each entrypoint were lost too.Updated dependencies [
71b6f10,ad23e6e,6f3d7b5]:v4.132.0Compare Source
Minor Changes
#14587
76c0ce6Thanks @MattieTK! - Categorise the positional path argument towrangler deployandwrangler versions uploadin command telemetryCommand telemetry now records a coarse category for the entry-point/assets positional (
wrangler deploy <path>) undersanitizedArgs.path, so we can understand whether people pass a file, a directory, or a relational reference such as.or../example. The possible values arefile,directory,current-dir,parent-relative, andnot-found, ornullwhen no positional is provided. The raw path is never sent — only the category.#15597
a83d7acThanks @skepticfx! - Configure application-wide logs for experimental Durable Object-managed ContainersSet
containers[].observability.enabledorcontainers[].observability.logs.enabledwhen usingscheduling_policy: "durable_object". Normal deployments create missing applications and update explicitly configured log settings without a Container rollout. Omitted settings preserve the application configuration; root Worker observability is not inherited for this policy.Version uploads may initialize missing applications but preserve existing settings. Deploying or rolling back Worker versions also preserves existing application settings, and
--containers-rollout=noneskips their updates.#15597
a83d7acThanks @skepticfx! - Support per-image build options for experimental Durable Object-managed ContainersSet
build_contextandbuild_varsalongsidedockerfilein a Container's namedimagesentries. Context paths resolve relative to the Wrangler configuration file and default to the Dockerfile's directory. Build variables are passed as Docker build arguments. Entries using the same Dockerfile with different contexts or variables are built separately.{ "containers": [ { "class_name": "Sandbox", "scheduling_policy": "durable_object", "images": { "app": { "dockerfile": "./docker/Dockerfile", "build_context": ".", "build_vars": { "APP_ENV": "production" } } } } ] }#15638
fa79b26Thanks @G4brym! - Support AI Search bindings in Worker Previewswrangler previewnow acceptsai_searchandai_search_namespacesentries in thepreviewsblock and includes them in Preview deployment bindings. This lets Workers that use AI Search instance or namespace bindings attach existing resources to Preview deployments, including preview-specific instance or namespace names.These bindings are non-inheritable: declare them explicitly under
previews. They attach to existing AI Search resources; preview does not provision new isolated instances or namespaces.#15256
16d1310Thanks @theoephraim! - [private beta]: Add--secrets-fileand--varflags towrangler previewLike
wrangler deployandwrangler versions upload,wrangler previewnow accepts a--secrets-fileflag pointing to a JSON or .env format file, and--var KEY:VALUEpairs that are injected into the Preview deployment as plain text variables. CLI vars override same-named vars from thepreviewssection of your config file, and secrets from the file take precedence over both:wrangler preview --secrets-file .env.preview --var API_URL:https://api.example.com#15453
ca71205Thanks @G4brym! - Remove the gated Web Search binding and Wrangler commandThe unreleased search binding and its experimental command have been removed from Wrangler, Miniflare, and configuration APIs.
#15597
a83d7acThanks @skepticfx! - Allow experimental Durable Object-managed Containers to link by name through exportsContainers using
scheduling_policy: "durable_object"can now specifynameand link fromexports.<Class>.containerwithout repeatingclass_name. Deploy and version upload resolve that link for image preparation, Worker metadata, and Container application creation.Patch Changes
#14775
1be7b97Thanks @dario-piotrowicz! - Sync Local Explorer endpoint lists across agent hintsThe Local Explorer endpoint list is now consistent across the three places it appears: the AGENTS.md template in
create-cloudflare, the runtime agent hint inwrangler dev, and the Vite plugin agent hint. All three now include theobservability/clearendpoint, use the canonical/cdn-cgi/local/explorerpath, and have cross-reference comments pointing to each other.#15409
b149147Thanks @tpmmorris! - Fix per-query overrides forwrangler ai-search search--score-threshold,--max-num-results,--filter, and--rerankingare now sent using the AI Search request schema, so the service applies them to searches instead of ignoring them.#15633
7db596cThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#14906
a0856daThanks @exKAZUu! - Surface the original error message, name and stack when the dev server reports an internal errorPreviously
wrangler devcould exit with an empty✘ [ERROR]log that gave no indication of what went wrong (e.g.Network connection lost., see #14641). These errors now include their original message, name and stack, so the failure is actually diagnosable.#15179
cb0955fThanks @rioaguspermana! - Treat 502, 503, and 504 as gateway errors during asset upload retriesPages and Workers asset uploads now retry more patiently when the Cloudflare API responds with a 502, 503 or 504 gateway error, reducing concurrency and waiting longer between attempts instead of failing the deploy quickly.
#15399
982b806Thanks @tpmmorris! - Improve over-limitrun_worker_firsterrors when duplicate rules are presentThe error now reports distinct and duplicate-entry counts and lists duplicated rules, making it clear when removing redundant entries can bring the configuration within the limit.
#12369
ffabe74Thanks @43081j! - Replaceexecawithtinyexecfor running subprocesses, shrinking the bundled Wrangler output.#15633
7db596cThanks @dependabot! - Preserve service-worker middleware error propagation with spec-compliant event dispatchWrangler's synthetic service-worker events now propagate listener exceptions to middleware without changing the behavior of user-created
EventTargetinstances.#15400
e03822aThanks @james-elicx! - Reduce the size of Wrangler's published packageExclude test-only, build-only, and obsolete template files from the npm package while retaining all runtime templates.
#15631
c4a6279Thanks @petebacondarwin! - Restore static asset upload concurrency after gateway errorsStatic asset uploads previously remained at concurrency one for the rest of the deployment after any 524 response, which could make large deployments exceed the upload session lifetime. Successful uploads now restore the session's original concurrency gradually while retaining gateway throttling. Requests that were already in flight when throttling began do not restore capacity, so a burst of stale successes cannot immediately undo backpressure.
Updated dependencies [
7db596c,e35c4a1,d3565a5,ca71205,1015cfb,982b806,641df47]:v4.131.2Compare Source
Patch Changes
8997652]:v4.131.1Compare Source
Patch Changes
#15592
945aaa3Thanks @WillTaylorDev! - Add a provisioning delay note when custom domain Preview URLs changeWrangler now explains that DNS and TLS certificate provisioning may continue after a deploy adds a custom domain or enables its Preview URLs. Stable redeploys don't repeat the note.
This assumes that a request which matches the stored custom domain state doesn't restart provisioning. The client infers this from the API changeset and current domain record because this repository can't verify the backend behavior.
#15592
945aaa3Thanks @WillTaylorDev! - Clarify production status labels for custom domain routesWrangler now prefixes explicit custom domain production states with
production:so they match Preview labels. The updated labels appear in deployed trigger output andWRANGLER_OUTPUT_FILE_PATH.#15602
47d906fThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#15592
945aaa3Thanks @WillTaylorDev! - Avoid replacement prompts for custom domains already on the WorkerWrangler now updates Preview settings without asking to replace a custom domain when that domain already belongs to the deployed Worker. It still asks before replacing domains attached to another Worker.
#15592
945aaa3Thanks @WillTaylorDev! - Explain how to enable Preview URLs when a Preview deployment has nonewrangler previewnow shows URL shapes and configuration snippets for Workers.dev and custom domains. The custom domain snippet preserves every configured route, and the guidance distinguishes missing settings from disabled ones.This changes a private beta feature. The warning also makes clear that
wrangler deploypublishes code from the current checkout.Updated dependencies [
47d906f,c2699bf]:v4.131.0Compare Source
Minor Changes
#15480
36aed7fThanks @skepticfx! - Add Durable Object-managed Containers to top-level container configurationWrangler now accepts
scheduling_policy: "durable_object"in the top-levelcontainersarray and creates its namespace-backed application after the Worker upload resolves the Durable Object namespace ID. The namespace ID is also the application ID, so repeated deploys idempotently ensure the same application without name-based lookup, modification, or a Containers rollout.Durable Object-managed entries accept
class_name,scheduling_policy, an optionalname, and an optional namedimagesmap. Scheduler-only fields are rejected. Each image provides either a localdockerfileor a digest-pinned managed-registryimage. Wrangler builds or resolves each image, waits while Cloudflare prepares it for the Containers runtime, and uploads the resulting references with the Worker version for access throughctx.container.imagesandenv.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Local development support for these entries is deferred to a follow-up.Existing scheduler-backed entries and Durable Object migrations continue to work unchanged.
With
--containers-rollout=none, existing Workers retain their deployed Container metadata and image binding even when localcontainersis omitted or empty; local scheduler edits are also ignored. The upload stops if the deployed versions cannot be recovered. Existing Workers for Platforms dispatch scripts reject this flag before upload because their API does not expose enough metadata to preserve Container associations safely. First deployments can still skip Container preparation and rollout. Without this flag, removing managed Containers, including by omittingcontainersentirely, clears the experimental image binding even withkeep_vars.versions deployvalidates the selected versions before changing traffic and creates their Durable Object-managed applications only after deployment succeeds. Bothdeployandversions deployreport partial completion if application creation fails afterward, with instructions to retry the same command.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGESis a temporary, reserved Wrangler binding until native Container image metadata is available. Its class keys identify managed applications duringversions deploy, including classes with empty image maps. User configuration cannot declare a binding with this name; existing versions that already use it are treated as Container configuration.#15493
493e635Thanks @GregBrimble! - Removewrangler preview settingscommandsThe private-beta
wrangler preview settingsandwrangler preview settings updatecommands are no longer available.Patch Changes
#15411
0b43395Thanks @xgame92! - Failwrangler versions uploadearly when a Worker has a pending Durable Object migrationWrangler now directs users to run
wrangler deployto apply the migration instead of sending a version upload request that the API will reject.#15518
9d75006Thanks @taylorlee! - Detect named-only module Worker entrypoints correctlyWrangler now distinguishes named-only module Workers from legacy Service Workers that happen to have named exports. A default export identifies a module Worker; otherwise, legacy
addEventListenerregistration identifies Service Worker format.#15581
b605aa6Thanks @MattieTK! - Correct Pages-to-Workers delegation analytics for forced and ineligible commandsThe legacy
forcedresult counted every agent-driven Pages command using--force, including commands that could never have been delegated. Wrangler now emitseligible_forcedonly when--forceprevents an otherwise eligible delegation, and records other agent commands asineligiblewith a bounded reason and whether force was used.#15432
f45b596Thanks @razethion! - Prevent delayed internal errors from fetch-only remote bindingsFetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.
#15585
f69f95aThanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#15554
bff525dThanks @XiaoZ-0218! - Add the missingtransferred_classesmigration to the config schemaDurableObjectMigrationdescribednew_classes,new_sqlite_classes,renamed_classesanddeleted_classes, but nottransferred_classes.normalizeAndValidateConfighas always validated that key, and the deploy path forwards it to the API along with the rest of the step, so Transfer migrations worked — butconfig-schema.jsonis generated from the type, so an editor resolving$schemareported a valid, documented migration as an unknown key.Adding the field to the type puts it in the generated schema. No runtime change.
#15584
96688b3Thanks @Svector-anu! - Bumpshell-quoteto 1.9.0+ to pick up two disclosed advisoriesshell-quote@1.8.1is affected by a ReDoS inparse()(CVE-2026-13311 / GHSA-395f-4hp3-45gv — an unauthenticated attacker who can feed a string intoparse()can block the event loop for tens of seconds with plain space-separated input, no shell metacharacters required) and by an object-token escaping bug inquote()(CVE-2026-9277 / GHSA-w7jw-789q-3m8p), both fixed upstream in1.9.0. Wrangler'sparse()wrapper (src/utils/shell-quote.ts) is reachable frompages dev/initcommand-line parsing, so the ReDoS applies; thequote()call site only ever passes string arguments, so the object-token issue was not reachable here, but there is no reason to stay on a vulnerable range once a patch exists.#15563
ed5797aThanks @Bortlesboat! - Encode filenames in Pages HTML redirectsFix
wrangler pages devreturning a 502 response when redirecting HTML paths containing Unicode characters. Keep reserved characters in filenames encoded in the redirect destination and preserve the request query string.#14889
128235aThanks @chinesepowered! - Fixwrangler types --strict-vars=falseemitting invalid TypeScript for an empty array varA var whose value was an empty array produced
()[], which is a syntax error. Because this lands in the generatedworker-configuration.d.ts, it did not just break that one line — the whole file failed to parse, so no binding types resolved at all. An empty array now generatesunknown[].#15494
f8aea7eThanks @GregBrimble! - Usepreviews_base_configfor Preview configurationPreview commands now read the Worker Previews Base configuration from the
previews_base_configAPI field.#15569
24ef86bThanks @RealBhupesh! - Fixwrangler workflows instances describecrashing on dynamic retry delaysThe Workflows API serializes function retry delays as
"[dynamic]". The describe command previously parsed that as a duration, produced an Invalid Date, and threwRangeError: Invalid time valuebefore printing remaining steps. It now rendersunknown (dynamic delay)and also tolerates attempts whoseendtimestamp is missing.Updated dependencies [
f45b596, [f69f95a](https://redirect.github.com/cloudflare/woConfiguration
📅 Schedule: (UTC)
* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.