fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #286 · cerberauth/nacho

renovate · 2026-05-18T01:58:25Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	`5.20260801.1` → `5.20260920.1`
@hookform/resolvers (source)	`5.5.7` → `5.9.1`
@next/mdx (source)	`16.2.12` → `16.3.5`
@plausible-analytics/tracker (source)	`0.4.5` → `0.4.6`
@types/node (source)	`24.13.3` → `24.13.6`
@types/react (source)	`19.2.18` → `19.3.0`
@types/react-dom (source)	`19.2.4` → `19.3.0`
eslint-config-next (source)	`16.2.12` → `16.3.5`
lucide-react (source)	`1.28.0` → `1.47.0`
nanoid	`6.0.0` → `6.0.1`
prettier (source)	`3.5.2` → `3.9.8`
react (source)	`19.2.8` → `19.3.0`
react-dom (source)	`19.2.8` → `19.3.0`
react-hook-form (source)	`7.83.0` → `7.88.0`
sugar-high (source)	`1.2.1` → `1.3.0`
tailwind-merge (source)	`3.6.0` → `3.7.0`
tsx (source)	`4.23.1` → `4.23.15`
wrangler (source)	`4.118.0` → `4.135.0`
zod (source)	`4.4.3` → `4.6.5`

Release Notes

cloudflare/workerd (@cloudflare/workers-types)

react-hook-form/resolvers (@hookform/resolvers)

`v5.9.1`

Compare Source

`v5.9.0`

Compare Source

Features

update joi to v18 (#873) (c8159ae)

`v5.8.0`

Compare Source

`v5.7.1`

Compare Source

`v5.7.0`

Compare Source

Features

support vine v4 (#867) (4cfba18)

`v5.6.0`

Compare Source

`v5.5.8`

Compare Source

Bug Fixes

Zod resolver drops validation errors for special root field names (#869) (2f28787)

vercel/next.js (@next/mdx)

`v16.3.5`

Compare Source

The following bug fixes have been backported. It does not include all pending features/changes on canary.

next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
next/image: Reject empty images when reading/writing to the disk cache (#98186)
Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
Add CSP nonce to script tags of loading and template files (#98403)
Fix use cache prerender signal retention (#98448)

`v16.3.4`

Compare Source

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
Fix build error when aliasing typescript to @typescript/typescript6 (#97997)
Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @eps1lon, @mischnic, and @timneutkens for helping!

`v16.3.3`

Compare Source

This release contains security fixes for the following advisories:

Critical:

`v16.3.2`

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

[backport] Scope app-entry export validation to files inside the app directory (#97357)
[backport] Fix catch-all index page being served for every other slug (#97416)
[16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
[16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
[16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
[16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @lubieowoce, @unstubbable, @timneutkens, @mischnic, and @eps1lon for helping!

`v16.3.1`

Compare Source

What's Changed

[16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @lukesandberg in #96653
[16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @lukesandberg in #96655
[16.x] [turbopack] Collapse nested promises in the analyzer by @sampoder in #96675
[16.x] fix(next/image): preserve image response after optimization by @styfle in #96733
[16.3.x] Default deploy e2e tests to the repo next version by @eps1lon in #96900
[backport] Bump @swc/helpers by @mischnic in #96885
[backport] [turbopack] Raise registration calls in hoisted modules to the top by @lukesandberg in #97308
[backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @lukesandberg in #97302
[backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @lukesandberg in #97317
[backport] Restore the live headers() view of the incoming request by @unstubbable in #97311
[backport] Allow literal exports in 'use cache' files by @unstubbable in #97312
[backport] Keep the dev validation worker alive across HMR updates by @unstubbable in #97315
[backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @unstubbable in #97314
[backport] Encode the cache item name built by unstable_cache by @unstubbable in #97313
[16.3] [ci] Use OIDC tokens to read private preview builds by @eps1lon in #97258
[backport] [test] Compile the middleware redirect routes up front in dev by @lukesandberg in #97328
[backport] Fix Nav Inspector request loop on repeat captures by @acdlite in #97326
[backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @acdlite in #97325
[backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @lukesandberg in #97304
[backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @gaojude in #97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

`v16.3.0`

Compare Source

Core Changes

Update vendored lodash to 4.17.23 to fix CVE-2025-13465: #91558
Fix invalid HTML response for route-level RSC requests in deployment adapter: #91541
Normalize encoded dynamic placeholders in app routes: #91603
Fix(pages-router): restore Content-Length and ETag for /_next/data/ JSON responses: #90304
Update tokio from 1.43.0 to 1.47.3: #90945
[turbopack] Simplify snapshotting logic: #91178
Turbopack: enable server HMR for app route handlers: #91466
turbo-tasks-backend: batch find_and_schedule_dirty using for_each_task_meta: #91497
[turbopack] Use bail! instead of panic! for duplicate module ident error: #91636
Skip loadBindings() Lightning CSS check during next start: #91538
turbo-tasks-backend: batch schedule dirty tasks in aggregation_update: #91461
Turbopack: Add importModule() support to webpack loaders: #89630
turbo-persistence: fix mmap page alignment and improve error context in MetaFile::open_internal: #91640
turbopack-css: demote recoverable CSS parse warnings to Warning severity: #91524
feat(node-streams): add config flag, define-env, and env precedence test: #90427
Rename /_next/webpack-hmr to /_next/hmr: #91415
Add per-slot error attribution for instant validation using slot markers and config depth preference: #91610
Handle encoded params further: #91627
[turbopack] Respect {eval:true} in worker_threads constructors: #91666
Fix missing route in otel spans without base-server: #91665
[turbopack] Optimize compaction cpu usage: #91468
Fix layout segment optimization: move app-page imports to server-utility transition: #91701
Fix server actions in standalone mode with cacheComponents: #91711
turbo-persistence: remove Unmergeable mmap advice: #91713
turbopack: move "compact database" tracing span to backend layer: #91693
Turbopack: lazy require metadata and handle TLA: #91705
Fix adapter outputs for dynamic metadata routes: #91680
Turbopack: fix webpack loader runner layer: #91727
[turbopack] Remove incorrect debug_assert in try_read_task_cell: #91699
Add module count field to module graph tracing spans: #91697
turbopack-cli: add --persistent-caching flag for filesystem-backed cache: #91657
Turbopack: pull in updated vercel/nft tests: #91651
[turbopack] Improve regressed build speed on cross-compiled MUSL: #91477
[Segment Bundling] [Scaffolding] Ensure inlining hint correctness: #91320
[Segment Bundling] [Scaffolding] Track which segments can be omitted from prefetch: #91438
Avoid deprecated TS node10 moduleResolution defaults: #91847
[turbopack] Rebuild the docker build scripts: #91799
Fix TS6 baseUrl deprecation for extended tsconfig: #91855
Add next internal post-build CLI command for Turbopack database compaction: #91336
Turbopack: Define Effect as a trait instead of a closure: #89080
Turbopack: Implement TraceRawVcs and NonLocalValue correctly for Effects: #89133
turbo-tasks-backend: improve print_cache_item_size instrumentation: #91742
Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset): #91832
Use charCodeAt for normalizePathTrailingSlash: #91380
Turbopack: Only patch lockfile when bindings fails to load: #91379
[create-next-app] Skip interactive prompts when CLI flags are provided: #91840
[devtools] Make instant navs panel draggable: #91914
[Segment Bundling] Bundle static prefetches based on size: #91439
turbo-tasks-backend: assert non-transient task_ids in track_modification: #91924
fix(turbopack): preserve resolveExtensions priority in read_matches fast path: #91856
turbopack: Remove Vc::resolve(), migrate all callsites to Vc::to_resolved(): #91725
turbo-tasks: add hashed cell mode for hash-based change detection without cell data: #91576
[cna] Upgrade to Biome 2.4 with Tailwind support: #86065
[devtools] Show AggregateError.errors in the error overlay: #91835
Narrow the opengraph-image function return type: #91893
[experiment] Add useOffline flag with offline retry behavior: #92011
adapters: remove unused suffix code: #91997
[experiment] Add useOffline hook to expose offline state to userland: #92012
[turbopack] Don't use turborepo to build the docker image: #92029
Use RcStr directly in napi(object) structs instead of converting to String: #92014
Rename SingleModuleReference::asset to SingleModuleReference::module: #92028
Revert "turbo-tasks: add hashed cell mode for hash-based change detection without cell data": #92103
[ftl] Include cause of route types: #92056
fix: handle file:// URLs from import.meta.resolve in cache handler path (fixes #73796): #90370
Turbopack: exclude metadata routes from server HMR: #92034
next.config.js: Accept an option for serverFastRefresh: #91968
TURBOPACK: support parse windows absolute path with single slash: #92076
Enable varyParams tracking for Cached Navigations: #92113
telemetry: set turboFlag correctly: #92149
Instant Validation: Allow unconfigured slots to render optionally: #92126
Turbopack: statically evaluate path.sep: #92150
Turbopack: use same hash for immutable-static-hashes.json: #92157
[turbopack] replace regex with indexof: #92023
Turbopack: createRequire(new URL("...", import.meta.url)): #92153
Add PPR evals and fix env loading for agent-eval 0.9.5: #92063
Turbopack: support targeting even older browsers: #91563
Add rust-fingerprint task and SCCACHE passthrough env: #92167
Improve error message for deprecated experimental.dynamicIO config: #92081
[turbopack] Fix CSS HMR on Safari: #92123
simplify session dependent tasks and add TTL support: #91729
disable bmi2 in qfilter: #92177
Improve revalidateTag JSDoc to include guidance about required second parameter: #92176
fix: pin 19 actions to commit SHA, extract 7 expressions to env vars: #92016
partial fallbacks: adapter support for intermediate shells: #91902
Turbopack: trace fs.readdir calls: #92148
feat: add NEXT_HASH_SALT env var for content-hash filename salting: #91871
Fix DashMap read-write self-deadlock in task_cache causing hangs: #92210
[turbopack] use a single query parameter for cache busting: #92214
Generate a CLI warning if using Rosetta 2 on Apple Silicon: #92220
remove the loop from StaticSortedFile::lookup: #91688
Add telemetry for adapterPath config usage: #92228
Node.js streams: First pass: #90500
fix: preserve HTTP access fallbacks during prerender recovery: #92231
Remove unnecessary ALS re-exports from entry-base.ts: #91527
Allow multi-level .localhost subdomains in dev origin check: #92262
turbo-tasks-backend: stability fixes for task cancellation and error handling: #92254
Add MCP get_compilation_issues tool and NAPI method: #92062
Add view transitions eval (agent-043): #92260
[turbopack] optimize RcStr parsing: #91773
Ensure app-page reports stale ISR revalidation errors via onRequestError: #92282
Move streamToUint8Array back to node-web-streams-helper.ts: #92263
Revert "simplify session dependent tasks and add TTL support (#91729)": #92320
fix: add @deprecated annotation to experimental.useCache: #92316
Improve existing dev server error message to suggest using it: #92317
Restart the next dev server if .next is deleted: #92135
Update Rust toolchain to nightly-2026-04-02: #92288
Turbopack: Remove FileSystemPath::value_to_string in favor of ValueToStringRef::to_string_ref: #92284
[turbopack] use zero copy qfilter deserialization: #90574
feat: add experimental.swcEnvOptions for SWC preset-env configuration: #92272
Turbopack: Dedupe our two filesystempath extension/extension_ref functions: #92048
turbo-tasks: replace async resolve fns with custom Future types (ResolveRawVcFuture, ResolveVcFuture, ToResolvedVcFuture): #91554
next-core: deduplicate output assets and detect content conflicts on emit: #92292
Handle edge runtime in places that import node:stream: #92354
Fix fallback route params case in app-page handler: #91737
use sorted inserts to improve builder performance: #91553
Allow for parsing app route strings with and without slot names.: #92327
fix(server-hmr): metadata routes overwrite page runtime HMR handler: #92273
turbo-persistence: optimize file syncing: #90542
Turbopack: Remove turbo_tasks::apply_effects, use Effects::apply instead: #91858
Turbopack: Add a check for node version before allowing workerThreads: #91614
turbo-persistence: skip BlockCache for uncompressed (mmap-backed) blocks: #92390
Include more context in macOS Rosetta 2 warning message: #92436
change the process name of builds: #92411
turbo-persistence: pin referenced BlockCache entries to prevent eviction: #92361
Fix styled-jsx race condition: styles lost due to concurrent rendering: #92459
turbo-tasks: fix hashed cell mode crash on task error (re-land #91576): #92108
Fix sst inspect tool to respect CURRENT and stale sst files: #92414
Optimize how we track data for persistence: #89370
[turbopack] add family name to many spans: #92415
Route Handlers: Fix devRequestTimingInternalsEnd and Turbopack server HMR: #92271
next-routing: middleware matching and app request URL normalization: #91859
turbo-persistence: Use AtomicBool for is_empty() to avoid lock contention: #92481
fix: mention params and searchParams in blocking-route error messages: #92360
CPU prof: Write profiles to .next-profiles instead of .next/cpu-profiles: #92078
Turbopack: Write trace file to .next-profiles: #92189
feat: generate root params types: #91019
fix: resolve function configs in unstable_getResponseFromNextConfig: #92501
Node.js streams: Fork points: #92252
Turbopack: Add --internal-trace cli flag: #92190
Fix minimumReleaseAgeExclude for React and friends: #92535
Add experimental unstable_io() API behind experimental.unstableIO flag: #92521
Update React from 74568e86-20260328 to 404b38c7-20260408: #92536
Turbopack: switch from immutable token to path prefix: #92164
[build info]: distinguish between PPR and fully static routes in gSP: #92518
[build info]: omit symbol from top level gSP route: #92525
turbo-tasks-backend: prevent duplicate task restores with restoring bits: #92389
Add next internal upload-trace: #92191
Request logging: Fix generate-params time being included in next.js time: #91386
fix: scope "Pages Router only" comment to default export in next/error: #92566
Turbopack Build: Remove dev fouc from production bundle: #80935
Turbopack: Improve unable to resolve next error: #91394
fix(hmr): reconnect WebSocket after sleep/wake: #91416
Handle target option in React Compiler for Pages + React 18: #91500
Replace wasmer with wasmtime for SWC plugin WASM engine: #91533
turbopack: fix incremental build when module factories are restored from persistent cache: #92569
[turbopack] Rust dependency caching via sccache: #91873
trace: detect rage restarts and deleted .next dirs: #92489
[turbopack] fix a debug_assert failure: #92581
Don't swallow strings thrown in Server Components: #92592
Fix NextFontIssue IssueStage: CodeGen → Resolve: #92588
Node.js streams: Add forkpoint for CacheComponents: #92444
Resolve compilerOptions.paths in tsconfigs without compilerOptions.baseUrl: #92277
Turbopack: extract inline base64 decode helper to shared @turbopack/base64 module: #92549
Add codemod command to middleware deprecation warning: #92532
turbopack: move CSS module composes validation from code generation to resolving: #92582
Drop turbo_tasks::function from ValueDebug trait items: #92593
[partial fallbacks]: enable by default: #92627
Turbopack: fix filesystem watcher config not applying follow_symlinks(false): #92631
Turbopack: cut number of client references in half: #92607
Remove a ton of turbo task functions from Issue trait items: #92623
feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution: #91338
feat(turbopack): change DiskFileSystem root to Vc for portable cache: [#92603](htt

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Only on Sunday and Saturday (* * * * 0,6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cloudflare-workers-and-pages · 2026-05-18T01:59:32Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	nacho	`16728d1`	Sep 20 2026, 09:49 AM

renovate · 2026-09-15T20:17:21Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-20T09_47_48_954Z-debug-0.log

renovate Bot changed the title ~~chore(deps): update dependency @cloudflare/workers-types to v4.20260518.1~~ chore(deps): update all non-major dependencies May 18, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 7bbe034 to b87d77c Compare May 22, 2026 00:39

renovate Bot changed the title ~~chore(deps): update all non-major dependencies~~ fix(deps): update all non-major dependencies May 22, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 12 times, most recently from ca6b014 to 01a2d65 Compare May 29, 2026 02:12

renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from b617bf0 to 41285b8 Compare June 2, 2026 19:11

renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from 8e57f76 to cb88382 Compare June 16, 2026 02:00

renovate Bot force-pushed the renovate/all-minor-patch branch 11 times, most recently from 8c8b3c2 to 18481ae Compare June 23, 2026 18:15

renovate Bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from a1e954f to 8baf2df Compare June 26, 2026 01:50

fix(deps): update all non-major dependencies

16728d1

Navigation Menu

fix(deps): update all non-major dependencies - #286

fix(deps): update all non-major dependencies#286
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented May 18, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented May 18, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Sep 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Features

Bug Fixes

Credits

Core Changes

Credits

What's Changed

Core Changes

Configuration

Uh oh!

cloudflare-workers-and-pages Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

renovate Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 18, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented May 18, 2026 •

edited

Loading

renovate Bot commented Sep 15, 2026 •

edited

Loading