[otaki0413]

Why

Bring main's toolchain current for packages that already clear the one-day release-age gate, and move the Workers compatibility date only as far as the changelog allows.

minimumReleaseAge stays 1440 in pnpm-workspace.yaml. Versions were rechecked against the npm registry at 2026-11-05T01:28:25Z (10:28 JST). A release had to be at least 1440 minutes old to be selected. vite-plus and the catalog vite alias stay on 1.4.0.

Version changes

Package	From	To	Published (UTC)	Age at check
wrangler	4.156.0	4.157.0	2026-11-03T11:47:33Z	2261 min
@cloudflare/vite-plugin	1.66.0	1.67.0	2026-11-01T23:45:33Z	4423 min
@vitejs/plugin-react	6.1.2	6.2.1	2026-11-02T09:18:16Z	3850 min
tailwindcss	4.3.3	4.3.4	2026-11-02T21:30:42Z	3118 min
@tailwindcss/vite	4.3.3	4.3.4	2026-11-02T21:30:06Z	3118 min
packageManager (pnpm)	12.16.1	12.17.0	2026-10-30T14:23:51Z	7865 min

@cloudflare/vite-plugin@1.67.0 peers on wrangler@^4.156.1. The install resolves that peer to the direct wrangler@4.157.0 and workerd@1.20261103.1. Lockfile follow-ons from those bumps are miniflare@5.20261101.0-beta and miniflare@5.20261103.0-beta, plus removal of the lightningcss@1.32.0 graph that Tailwind 4.3.3 pulled in.

pnpm@12.17.0 is a stable GitHub release (not deprecated). npm's latest / latest-12 dist-tag was still 12.16.1 at check time, and next-12 was already 12.18.0. 12.17.0 is the newest published 12.x that clears the gate.

Left unchanged

• vite-plus 1.4.0 and catalog vite (@voidzero-dev/vite-plus-core@1.4.0). 1.5.0 was published 2026-11-04T04:36:04Z (vite-plus) and 2026-11-04T04:32:10Z (vite-plus-core), about 1252–1256 minutes old. Both clear the gate at 2026-11-05 13:36 JST. Not bumped.
• pnpm@12.18.0, published 2026-11-05T00:56:16Z, about 32 minutes old.
• @types/node stays 26.6.6 (the Node 26 line from chore: require Node.js 26 LTS #439, and the newest 26.x on npm).
• Direct dependencies already at the newest stable release: @tanstack/react-router@1.170.46, @tanstack/react-router-devtools@1.167.2, @tanstack/react-start@1.169.4, @tanstack/intent@0.5.6, react@19.3.1, react-dom@19.3.1, @types/react@19.3.0, @types/react-dom@19.3.0, typescript@7.0.2.

pnpm exec intent list was run before the edits. The 26 installed skills are TanStack Router and Start framework skills. None match a dependency bump or a Workers compatibility-date change, so none were loaded.

compatibility_date

wrangler.jsonc compatibility_date: 2026-09-16 → 2026-11-05.

Sources: Compatibility dates and the compatibility flags history (newest flags first). A date enables every flag whose default date is on or before that day.

The only flag that becomes default between 2026-09-16 and 2026-11-05 is durable_object_io_tasks_prevent_eviction (default as of 2026-10-01). Changelog: pending service-binding requests, Durable Object RPC or fetch(), container.monitor(), ctx.waitUntil(), and pending timers keep a Durable Object in memory for up to 15 minutes after the client disconnects. Without the flag, an object with no connected client can be evicted while that work is still pending.

This app is not affected. wrangler.jsonc has no Durable Object bindings, classes, or migrations. The Vite build's flattened config has durable_objects.bindings: [] and migrations: []. nodejs_compat stays explicit. That flag has been the default since 2026-08-04, which is already before 2026-09-16, so this date move does not change Node.js compatibility. spec_compliant_dispatch_exceptions defaulted on 2026-09-15 and was already in effect.

Stopped at 2026-11-05 rather than 2026-11-17. The next defaults all land on 2026-11-17 and would change runtime behavior I cannot verify for TanStack Start on the Cloudflare Vite plugin:

• cache_option_preserves_cache_control — fetch cache: "no-cache" / "no-store" no longer rewrites the origin Cache-Control stored by Cloudflare's cache.
• new_module_registry — validates import attributes, changes require() of ES modules and of graphs that use top-level await, and provides import.meta.url, import.meta.main, and import.meta.resolve().
• pipe_to_backward_propagation — pipeTo() / pipeThrough() reject when the destination errors or closes, instead of resolving.
• enable_request_signal — the incoming Request.signal aborts when the client disconnects. It does not enable request_signal_passthrough.

Later defaults, also not adopted: python_shared_standard_library (2026-11-19), nodejs_process_version_24 (2026-11-24), temporal and wasm_source_url_support (2026-12-01).

worker-configuration.d.ts was regenerated with Wrangler 4.157.0 (workerd@1.20261103.1). The header now records 2026-11-05 nodejs_compat. The new runtime types add ExecutionContext.mapVirtualHost and TailStream streamDiagEvent, and make ContainerStartupOptions.enableInternet, ScriptVersion.id, and onset attributes optional.

Verification

Node v26.13.0 (CI node-version), pnpm 12.17.0.

pnpm install — exit 0. Lockfile updated; supply-chain policy check passed.

pnpm check — exit 0.

pass: All 16 files are correctly formatted (1404ms, 4 threads)
pass: Found no warnings, lint errors, or type errors in 7 files (2.2s, 4 threads)

pnpm test — exit 0.

Test Files  1 passed (1)
     Tests  1 passed (1)

pnpm build — exit 0. Client and server (workerd) bundles built. The build printed a non-failing vite:css-post SOURCEMAP_BROKEN warning.

pnpm exec vp run cf-typegen --check — exit 0.

✨ Types at worker-configuration.d.ts are up to date.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T01:32:42.472542Z	f3abaed	PR opened
🔒 Security Review	✅ Completed 2026-11-05T01:34:19.843436Z	f3abaed	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.