Skip to content

chore(deps): update dependencies (non-major) - #50

Merged
JoeKarow merged 2 commits into
mainfrom
renovate/dependencies-(non-major)
Oct 20, 2026
Merged

chore(deps): update dependencies (non-major)#50
JoeKarow merged 2 commits into
mainfrom
renovate/dependencies-(non-major)

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/vitest-pool-workers (source) ^0.22.0 → ^0.23.0 age confidence
@redocly/openapi-core ^1.34.20 → ^1.34.21 age confidence
eslint (source) ^10.11.0 → ^10.13.0 age confidence
knip (source) ^6.39.0 → ^6.41.0 age confidence
prettier (source) ^3.9.9 → ^3.9.10 age confidence
typescript-eslint (source) ^8.71.0 → ^8.71.2 age confidence
vitest (source) ^4.1.11 → ^4.1.12 age confidence
wrangler (source) ^4.147.0 → ^4.151.1 age confidence

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

Redocly/redocly-cli (@​redocly/openapi-core)

v1.34.21

Compare Source

Patch Changes
eslint/eslint (eslint)

v10.13.0

Compare Source

Features

  • 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#​21238) (Irfan fandi)
  • a39d9fb feat: add globalThis to no-obj-calls (#​21382) (synthex-byte)
  • 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#​21399) (xbinaryx)

Bug Fixes

  • 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#​21389) (Daniel Pinto)

Documentation

  • 4783a68 docs: Update README (GitHub Actions Bot)
  • 43f0ac9 docs: clarify parameter description in getText (#​21287) (lumir)

Chores

v10.12.0

Compare Source

Features

  • 4618052 feat: handle astral letters in new-cap (#​21357) (sary)
  • 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#​21340) (electrohyun)

Bug Fixes

  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#​21373) (Daniel Pinto)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#​21332) (xbinaryx)
  • efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#​21360) (lumir)
  • 93de066 fix: prefer-exponentiation-operator autofix for async function base (#​21322) (Vladimir Babin)
  • 02e34ff fix: add missing space after else in curly autofix (#​21355) (Pixel)
  • b14b8bc fix: correct id-length message for long private names (#​21348) (Pixel)
  • 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#​21335) (xbinaryx)
  • 686630e fix: no-loss-of-precision false positive with 0.e5 (#​21337) (sethamus)

Documentation

  • 67eb586 docs: Update README (GitHub Actions Bot)
  • 5370d7e docs: clarify one-var separateRequires matches any require() call (#​21192) (sethamus)
  • 8816c1d docs: Update README (GitHub Actions Bot)
  • 3d2e7ce docs: fix typo in no-unused-expressions documentation (#​21346) (bytedoe)

Chores

  • 152067f chore: update ecosystem plugins (#​21362) (ESLint Bot)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#​21376) (renovate[bot])
  • bfaea12 perf: cache normalized config globals per languageOptions (#​21364) (James Ross)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#​21369) (Francesco Trotta)
  • d166567 chore: update dependency prettier to v3.9.9 (#​21371) (renovate[bot])
  • 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#​21359) (renovate[bot])
  • 39d79ba chore: update github/codeql-action action to v4.38.1 (#​21354) (renovate[bot])
  • 182a6e9 chore: update dependency prettier to v3.9.8 (#​21352) (renovate[bot])
  • f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#​21339) (Jarren)
  • b95fb6c chore: update dependency prettier to v3.9.7 (#​21347) (renovate[bot])
  • 3782dd4 chore: update ecosystem plugins (#​21342) (ESLint Bot)
webpro-nl/knip (knip)

v6.41.0: Release 6.41.0

Compare Source

v6.40.0: Release 6.40.0

Compare Source

prettier/prettier (prettier)

v3.9.10

Compare Source

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#​20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

typescript-eslint/typescript-eslint (typescript-eslint)

v8.71.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitest-dev/vitest (vitest)

v4.1.12

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
cloudflare/workers-sdk (wrangler)

v4.151.1

Compare Source

Patch Changes

  • #​15541 e13d5cc Thanks @​mack-erel! - Keep remote dev sessions alive through transient network failures

    wrangler dev --remote and getPlatformProxy() refresh their preview token before it expires, but a single failed refresh — for example while the network was briefly down — stopped refreshing for good, leaving the session broken until restart. A failed refresh now retries every minute until it succeeds. Rebuilds also no longer push the refresh past the session's expiry.

  • #​16284 42c6912 Thanks @​karloper! - Fix wrangler rollback reporting success after the changed secrets confirmation is declined

    Previously, declining the "The following secrets have changed…" confirmation printed "Aborting rollback..." and then also printed a success message and the target version as the "Current Version ID", even though no deployment was made and the original version was still live. Wrangler now stops after aborting, so the output matches what is actually deployed.

  • #​13742 4a5377f Thanks @​edmundhung! - Hide the wrangler dev hotkey bar when Turborepo does not forward input

  • Updated dependencies [e1d1b77]:

v4.151.0

Compare Source

Minor Changes

  • #​16245 d6b1c82 Thanks @​WalshyDev! - Include source maps by default in wrangler build --experimental-cf-build-output

    Build Output now matches wrangler deploy and wrangler versions upload, which upload source maps by default, so Workers built for tools like cf get stack traces that point at the original source. Source maps that can't be resolved are skipped rather than failing the build. Set upload_source_maps = false to opt out.

Patch Changes

  • #​16220 97b2fb1 Thanks @​FlorentCollin! - Support local D1 queries through the experimental d1_binding_jsrpc compatibility flag

    Local D1 bindings now implement the RPC query backend used by D1Database.query() and prepared-statement methods when the flag is enabled. Queries reuse local SQLite execution, including transactional batches, execution metadata, and session bookmarks, while bindings without the flag continue to use HTTP. Update the bundled workerd runtime to 1.20261012.1 and align the default compatibility date with that release.

  • Updated dependencies [f360829, 97b2fb1, 97b2fb1, acd2822]:

v4.150.0

Compare Source

Minor Changes

  • #​16231 091e5ec Thanks @​WalshyDev! - Upload source maps by default for wrangler deploy, wrangler versions upload and wrangler preview

    When upload_source_maps isn't set in config or via --upload-source-maps, Wrangler now generates and uploads source maps so stack traces in logs and wrangler tail point at your original source without extra setup. In this default mode, source maps that can't be resolved (for example inline data: maps or missing .map files from a custom build) are skipped rather than failing the upload. Setting upload_source_maps = true keeps the existing strict behaviour, and upload_source_maps = false (or --no-upload-source-maps for deploy and versions upload) opts out.

    wrangler build --experimental-cf-build-output is unchanged and still only includes source maps when upload_source_maps = true.

  • #​16128 daae435 Thanks @​redsteadz! - Stop wrangler deploy, wrangler versions upload and wrangler preview in projects that build for the Cloudflare CLI (cf)

    If your project builds through cf, deploying it with Wrangler reads a different configuration, so it could update the wrong Worker or fail without explaining why. These commands now stop before uploading anything, name the .cloudflare/output directory they found, and tell you to run cf deploy instead. If that directory is just left over from an earlier build, deleting it restores the Wrangler workflow.

    Ordinary Wrangler projects are unaffected, and --dry-run still works on deploy and versions upload. This is a new guard for the experimental Build Output Specification rather than a fix, and it gives three stable commands a failure mode they did not have before, so it is a minor.

Patch Changes

  • #​16161 fcf625d Thanks @​dario-piotrowicz! - Clarify the Worker not found error during CI deploy validation

    Wrangler now reports that the configured Worker could not be found in the account instead of incorrectly describing the failure as a name mismatch.

  • #​16156 18f061c Thanks @​armancharan! - Ignore .wrangler writes in the dev assets watcher

    wrangler dev reloaded in a loop when assets.directory was the project root, because the assets watcher treated wrangler's own writes under .wrangler as asset changes and dropped in-flight requests. The watcher now ignores the project's .wrangler directory and dev.persist, except when that path is the assets directory.

  • #​16025 61e07fd Thanks @​kohjunhao! - Fix optional Docker lookups printing Docker CLI errors during successful builds

    cf build looks for Container images left behind by earlier builds so it can remove them. This lookup is best effort, but when Docker could not be reached it still printed errors such as Cannot connect to the Docker daemon, even when the build succeeded and no image needed Docker. Docker commands whose output Wrangler reads no longer forward the Docker CLI's error output to the terminal. If one of these commands fails in a way that stops the command, the error message still includes the Docker CLI's output.

  • #​16151 cafd3f9 Thanks @​DevVettel! - Time out the OAuth token request instead of waiting indefinitely

    The request that exchanges an authorization code or refresh token for an access token had no timeout, so a stalled connection (for example behind an HTTP proxy) could leave wrangler login hanging silently for many minutes after the browser step had succeeded. The request now gives up after 30 seconds and reports that the Cloudflare auth server could not be reached.

  • #​15517 ea64ec4 Thanks @​xgame92! - Preserve binding options when provisioning resources through a redirected config

    Wrangler now writes provisioned resource identifiers to both the redirected and original config files without copying other binding options between them. This prevents generated relative paths such as D1 migrations_dir from replacing user-authored paths during Vite deployments.

  • #​16219 d232454 Thanks @​petebacondarwin! - Honor X-Forwarded-Proto for incoming development requests behind TLS-terminating proxies

    Miniflare now uses the original client protocol when constructing URLs for network requests. This also prevents Wrangler from downgrading HTTPS URLs in response headers such as Location and WWW-Authenticate when a tunnel forwards requests over HTTP. Explicit programmatic request URLs and configured upstream origins remain authoritative.

  • Updated dependencies [5152bf8, 9f87de8, 9be5ec7, d232454]:

v4.149.0

Compare Source

Minor Changes

  • #​16036 9a58244 Thanks @​edevil! - Support temporary event accounts in R2 and Containers commands

    wrangler r2 and wrangler containers commands now accept the hidden --temporary flag, so accounts created for an event can manage buckets, objects and containers directly. Every command that supports --temporary now also accepts a hidden --event-code flag, so the first command a participant runs can create the event account:

    wrangler r2 bucket create my-bucket --temporary --event-code <code>

    R2 and Containers are only available on event accounts. R2 custom domains, Sippy, external container registries and wrangler cloudchamber commands still require a logged-in account.

Patch Changes

  • #​16139 2d1d563 Thanks @​cpojer! - Update esbuild to 0.28.2

    Align esbuild dependency with tooling using the latest 0.28 patch so package managers can share one installation instead of downloading a second native binary.

  • #​15632 85b14e7 Thanks @​petebacondarwin! - Honor Retry-After directives during static asset uploads

    Static asset uploads now pause retries and pending uploads until the latest outstanding deadline requested by the API. A per-request limiter also keeps gateway retries at the reduced concurrency after the pause ends, preventing a deployment from immediately overloading a constrained asset service again.

  • #​16098 fe607f9 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    sharp 0.35.4 0.35.5

  • #​16093 ad7ff45 Thanks @​DiogoSantoss! - Document that addresses catch-all entries must use the zone apex

    A *@domain entry in addresses must use the zone apex, such as *@example.com. The zone catch-all also receives mail for every subdomain in the zone that has no literal rule.

  • #​16102 757faa6 Thanks @​tlq5l! - Keep Preview secrets when deploying to an existing Preview

    Secrets added to a Preview with wrangler preview secret put or wrangler preview secret bulk were lost the next time wrangler preview ran, because each new deployment was created from the Wrangler config, --var and --secrets-file values only.

    wrangler preview now carries over the secrets of the Preview's latest deployment. A value passed in this deployment (--secrets-file, --var or a previews binding with the same name) still replaces the existing secret, and wrangler preview secret delete removes one.

  • #​15617 93c1069 Thanks @​jpatel3! - Stop the update check from recommending deprecated versions

    Previously, the "update available" notice shown by wrangler and @cloudflare/vite-plugin always pointed at whichever version was tagged latest on npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.

    The check now reads the npm registry directly instead of going through the update-check package, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.

  • #​16003 6947df3 Thanks @​oddharsh! - Ship using and await using declarations to the runtime as written, for smaller Worker bundles

    Workers and Pages Functions that use explicit resource management no longer carry about 1 KB of bundled helper code to emulate it. workerd supports using and await using natively at every compatibility date, so wrangler deploy, wrangler versions upload and Pages Functions builds now leave these declarations untouched.

  • #​15958 82acf3c Thanks @​breken-ai! - Apply each action's own condition in wrangler r2 bucket lifecycle add

    When a lifecycle rule was added with both expiration and Infrequent Access transition flags, both actions read their condition from the same list of flags, which checked --expire-days first. --expire-days 365 --ia-transition-days 30 therefore transitioned objects after 365 days instead of 30, and --expire-date 2027-01-01 --ia-transition-days 30 deleted objects after 30 days instead of on the given date. Expiration now only reads --expire-days/--expire-date, and transition only reads --ia-transition-days/--ia-transition-date.

  • Updated dependencies [2d1d563, e6f7663, fe607f9, 8de6b3c, ae29445, cc8e969, 417b186]:

v4.148.0

Compare Source

Minor Changes

  • #​16051 b4e1299 Thanks @​devteamaegis! - Add --source-namespace and --source-repo-name to wrangler queues subscription create for the artifacts.repo source

    The Event Subscriptions API requires source.namespace and source.repo_name for artifacts.repo subscriptions, but Wrangler had no way to pass them, so --source artifacts.repo always failed with a validation error. Both flags are now required for this source, and wrangler queues subscription get shows the subscription's resource as <namespace>/<repo-name>.

  • #​15998 b75421f Thanks @​dario-piotrowicz! - Add assets.base_path support to Workers Assets

    Serve an asset directory from a public URL prefix without changing its on-disk layout:

    {
  "assets": {
    "directory": "./public",
    "base_path": "/docs"
  }
}

    Wrangler, preview, Miniflare, and generated build configuration preserve the explicitly selected value, while the Asset Worker normalizes it and strips the prefix only for asset lookup. Requests passed to a user Worker, request-facing headers, and redirects retain the public path. Relative pathname inputs are interpreted as root-relative prefixes, URL-shaped values are rejected, and omitting the option preserves existing root-path behavior.

    Authored _headers and _redirects rules continue to match full public paths. In particular, both the source and destination of an authored 200 asset rewrite must include the configured public prefix; Asset Worker-generated redirects are prefixed automatically.

  • #​16005 4d308f6 Thanks @​oOPa! - Add a --experimental-mode instant option to wrangler kv namespace create

    This lets entitled accounts create Workers KV Instant namespaces while the feature is in private beta.

  • #​16030 aa2f9b7 Thanks @​edmundhung! - Add email-protected Quick Tunnels to wrangler dev

    Pass one or more --tunnel-allowed-mail flags to require email authentication when exposing a local development server through a Quick Tunnel. Each value can be an exact email address or a domain pattern.

  • #​15283 2dde890 Thanks @​shubhxho! - Support deleting secrets with wrangler versions secret bulk

    Set a secret's value to null in JSON input to remove it from the new Worker version. Bulk output now distinguishes between created and deleted secrets, so retrying wrangler secret bulk with wrangler versions secret bulk preserves requested deletions. Deploy the new version with wrangler versions deploy to apply the changes to production traffic.

Patch Changes

  • #​15534 2b1a0ca Thanks @​vahidshaik1901! - Improve guidance for conflicting Wrangler configuration files

    When user and generated deploy configurations are found under different base paths, Wrangler now identifies the expected deploy configuration location, suggests how to resolve the conflict, and links to the relevant documentation.

  • #​16014 c492d63 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261001.1 ^5.20261005.1
    workerd 1.20261001.1 1.20261005.1

  • #​16079 ba52118 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261005.1 ^5.20261006.1
    workerd 1.20261005.1 1.20261006.1

  • #​15573 14f0339 Thanks @​xgame92! - Include default module rules in generated Worker types

    wrangler types now declares the built-in Text, Data, and WebAssembly module patterns even when they are not repeated in the Wrangler configuration, keeping generated types aligned with deployment behavior.

    Service-worker declaration files are emitted as global scripts so that the generated wildcard module types are visible to imports.

    Directory-specific rules retain their scope when TypeScript can represent it; ambiguous relative imports use a union of the possible deployed module types.

    When generating combined types for named environments, each environment's effective rules are resolved independently and differing import types are represented as unions.

  • #​15261 42c7219 Thanks @​ondraulehla! - Fix r2 object put and r2 bulk put storing a different key in local mode

    Keys that are not URL-safe were mangled on the way into local storage.

    • A key with a space or a non-ASCII character was stored under its percent-encoded name, so a later r2 object get for that key reported that the key does not exist.
    • Two keys that differ only after a

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@greptile-apps

greptile-apps Bot commented Oct 12, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs		 vc-bots 92a34d4 Oct 20 2026, 06:28 PM

@renovate
renovate Bot force-pushed the renovate/dependencies-(non-major) branch 7 times, most recently from e97ae1e to 190017f Compare October 18, 2026 17:50
@renovate
renovate Bot force-pushed the renovate/dependencies-(non-major) branch from 190017f to 5953eb2 Compare October 19, 2026 13:14
@renovate
renovate Bot force-pushed the renovate/dependencies-(non-major) branch from 5953eb2 to bd3693a Compare October 20, 2026 16:10
@renovate

renovate Bot commented Oct 20, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@JoeKarow
JoeKarow merged commit 0bfc54a into main Oct 20, 2026
2 checks passed
@JoeKarow
JoeKarow deleted the renovate/dependencies-(non-major) branch October 20, 2026 18:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JoeKarow JoeKarow JoeKarow approved these changes

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JoeKarow