Skip to content

⬆️ deps: Update dependencies (non-major) - #76

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dependencies-(non-major)
Open

⬆️ deps: Update dependencies (non-major)#76
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dependencies-(non-major)

Conversation

@renovate

@renovate renovate Bot commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@astrojs/mdx (source) 8.0.1 → 8.0.2 age confidence
@lucide/astro (source) 1.47.0 → 1.48.0 age confidence
caniuse-lite 1.0.30001810 → 1.0.30001812 age confidence
oxlint (source) 1.83.0 → 1.85.0 age confidence
pnpm (source) 11.27.1 → 11.28.0 age confidence
satori 0.33.4 → 0.33.5 age confidence
vitest (source) 5.0.1 → 5.0.2 age confidence
wrangler (source) 4.135.0 → 4.141.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

withastro/astro (@​astrojs/mdx)

v8.0.2

Compare Source

Patch Changes
lucide-icons/lucide (@​lucide/astro)

v1.48.0: Version 1.48.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.47.0...1.48.0

browserslist/caniuse-lite (caniuse-lite)

v1.0.30001812

Compare Source

oxc-project/oxc (oxlint)

v1.85.0

Compare Source

v1.84.0

Compare Source

pnpm/pnpm (pnpm)

v11.28.0

Compare Source

vercel/satori (satori)

v0.33.5

Compare Source

Bug Fixes
vitest-dev/vitest (vitest)

v5.0.2

Compare Source

   🐞 Bug Fixes
    View changes on GitHub
cloudflare/workers-sdk (wrangler)

v4.141.0

Compare Source

Minor Changes

  • #​15658 8280086 Thanks @​jqmmes! - Add Durable Objects code update strategies to Worker deployments

    Use --durable-objects-code-update-mode immediate with wrangler deploy, wrangler versions deploy, and wrangler rollback to update code without waiting for active instances to hibernate. Use --durable-objects-code-update-mode deferred 30s to set a maximum delay, or configure durable_objects.code_update_strategy with mode and max_delay. When unset, the strategy defaults to deferred with a 5-minute maximum delay; delays cannot exceed 24 hours and must use millisecond precision.

  • #​15800 bd56b98 Thanks @​Refaerds! - Add Browser Run as an event source for Queue subscriptions

    You can now create Queue subscriptions with --source browserRun.

Patch Changes

v4.140.0

Compare Source

Minor Changes
Patch Changes

v4.139.0

Compare Source

Minor Changes

  • #​15792 479e1e8 Thanks @​flakey5! - Configure SSH for experimental Durable Object-managed Containers

    Set containers[].ssh and containers[].authorized_keys when using scheduling_policy: "durable_object". These are application-wide settings that follow the same rules as the existing Durable Object-managed Container settings: normal deployments create missing applications and update explicitly configured values, while omitted settings preserve the existing application configuration.

    // wrangler.jsonc
{
  "containers": [
    {
      "name": "sandbox",
      "class_name": "Sandbox",
      "scheduling_policy": "durable_object",
      "ssh": { "enabled": true },
      "authorized_keys": [
        { "name": "laptop", "public_key": "ssh-ed25519 AAAA..." }
      ]
    }
  ]
}

  • #​15648 52c0e9f Thanks @​tpmmorris! - Expose configured Cron Triggers to local development consumers

    Wrangler now passes the active environment's exact Cron Trigger expressions to Miniflare so Local Explorer can display them. Headless agent sessions also advertise the Local Explorer scheduled invocation API.

  • #​15786 bdda4c3 Thanks @​ThomasRubini! - Support UDP connect handlers in local development

    The experimental connect configuration now accepts protocol: "udp", with optional idle_timeout_ms and max_pending_bytes settings. UDP datagrams are delivered to the Worker's connect() handler using workerd's value-mode socket streams, and can be tested with Miniflare#dispatchConnect({ protocol: "udp" }).

  • #​15779 fc3cbaa Thanks @​Naapperas! - Support workflow entries in the exports configuration map

    A Worker can now declare the Workflows it defines in exports, keyed by the WorkflowEntrypoint class name:

    {
  "exports": {
    "MyWorkflow": {
      "type": "workflow",
      "name": "my-workflow",
      "limits": { "steps": 100 },
      "schedules": "0 * * * *"
    }
  }
}

    A workflow export accepts the same settings as a workflows binding: limits, concurrency, schedules, and default_retention. wrangler deploy and wrangler versions upload send these entries to the upload API by name, and wrangler deploy and wrangler triggers deploy provision the Workflow with its settings, just as they do for workflows bindings owned by the Worker. A Workflow may be declared both as a binding and as an export, as long as both declarations use the same class and do not set the same setting to different values. A binding to another Worker's Workflow cannot share a name with an export. @cloudflare/config adds the matching exports.workflow() helper. Local development does not yet act on these entries.

Patch Changes

  • #​15796 be72815 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260921.1 ^5.20260923.1
    workerd 1.20260921.1 1.20260923.1

  • #​14847 940c692 Thanks @​TheSaiEaranti! - Emulate the deterministic-ID uniqueness contract in the local Workflows binding

    The local Workflows binding now matches the documented production behavior for deterministic instance IDs: create({ id }) with an ID that already exists throws (instance.already_exists) and retains the existing instance, and createBatch() skips IDs that already exist or repeat within the batch, excluding them from the result instead of creating duplicate executions. Previously both paths silently created duplicates, so code relying on deterministic IDs for idempotency (for example a Queue consumer creating one workflow per message) appeared to work locally while double-executing workflow bodies.

  • #​15803 cd60c9c Thanks @​pmiguel! - Show --jurisdiction in help for wrangler kv namespace create

    The option was supported but omitted from the command's help output. Users can now discover how to create KV namespaces in a specific jurisdiction.

  • #​15838 15799d4 Thanks @​oddharsh! - Update smol-toml to 1.9.0 to fix slow parsing of very large TOML files

    Parse time for TOML config files now grows linearly with their size, instead of with its square: a 40,000-line file that took 259 ms to parse now takes 17 ms, while typical wrangler.toml files parse in the same time as before. This addresses the GHSA-r4xh-jqrq-34v2 advisory against earlier versions of the parser.

    Some TOML syntax errors now point at the character that caused them. For example, a wrangler.toml containing INVALID "FILE is now reported as illegal character in key at the ", rather than incomplete key-value at the start of the line.

  • Updated dependencies [52c0e9f, 44f5295, be72815, 940c692, bdda4c3, fc3cbaa]:

v4.138.0

Compare Source

Minor Changes

  • #​15776 b03f960 Thanks @​edevil! - Add event-code support to temporary Worker deployments

    Use wrangler deploy --temporary --event-code <code> to provision an account for an event. Wrangler requires explicit server acknowledgement before caching the account and keeps the event code out of its cache and telemetry.

  • #​15817 6e77c53 Thanks @​jamesopstad! - Allow framework commands to produce Preview Build Output with the experimental config

    When cf previews deploy invokes a framework build command, Preview intent is now preserved. Function-based cloudflare.config.ts files receive isPreview: true, and generated Build Output is marked as a Preview build.

Patch Changes

v4.137.0

Compare Source

Minor Changes

  • #​15778 cd7508c Thanks @​jamesopstad! - Generate types during development and supported builds with Vite's experimental.newConfig option or Wrangler's --experimental-new-config flag (and --experimental-cf-build-output for builds)

    When Wrangler's --experimental-new-config flag or Vite's experimental.newConfig option is enabled, inferred configuration and runtime declarations are now kept in .cloudflare/types/index.d.ts. Vite refreshes them during development and production builds. Wrangler refreshes them during development and when building with both --experimental-new-config and --experimental-cf-build-output. In the experimental wrangler.config.ts format, the types option is now top-level because it applies to both commands.

Patch Changes

  • #​15765 1bdb96d Thanks @​th0m! - Prepare the required egress sidecar for local Containers without configured images

    Wrangler dev and Vite dev/preview now pull the required sidecar for Durable Object-managed Containers that select their application image at start time. Previously, these Containers failed to start unless the sidecar image was already cached in Docker.

  • #​15712 f5605f5 Thanks @​alsuren! - Match D1 SQL statement splitting to the local SQLite runtime

    Wrangler now uses SQLite's statement-completion state machine when splitting D1 SQL files. This keeps trigger, quoted identifier, comment, and keyword handling consistent with local execution.

v4.136.3

Compare Source

Patch Changes

  • #​15662 59267fc Thanks @​oddharsh! - Update smol-toml to 1.8.0

    This updates the bundled TOML parser that reads wrangler.toml to a version that addresses two advisories against 1.5.2: GHSA-7w5x-hrqm-74c2 (a value followed by a comment with no trailing newline, such as a=[1 #, put the parser in an infinite loop) and GHSA-v3rj-xjv7-4jmq (thousands of consecutive comment lines overflowed the stack). On the old version, wrangler deploy against a wrangler.toml ending in a=[1 # never returned; it now fails with Invalid TOML document: cannot find end of structure.

  • #​15760 6906bf0 Thanks @​yomna-shousha! - Warn when wrangler preview returns only non-custom-domain URLs even though custom-domain Preview URLs are configured.

  • #​15761 354ebdb Thanks @​podonnell-dev! - Fix Preview output artifacts to always include the resolved parent Worker name

    Preview artifacts now use Wrangler's resolved Worker name instead of relying on the Preview API response to include it.

  • Updated dependencies []:

v4.136.2

Compare Source

Patch Changes

  • #​15762 ad20547 Thanks @​podonnell-dev! - Fix wrangler types generating runtime headers with trailing whitespace

    Runtime type headers without compatibility flags now end at the compatibility date, keeping generated types reproducible when tools remove trailing whitespace.

  • #​15703 02c1d83 Thanks @​KianNH! - Improve Container image listing and deletion

    List all image pages using read-only credentials, validate tags before deletion, and report successful deletion when the garbage-collection request fails.

  • #​15700 275184d Thanks @​KianNH! - Fix Container SSH connection setup and shutdown

    Prevent SSH connections from stalling during setup and ensure proxy processes exit when sessions close.

  • #​15759 bd59eca Thanks @​petebacondarwin! - Show valid sha256-prefixed tags in Container image listings

    Container image listings now distinguish valid OCI tags such as sha256-release from synthetic digest entries such as sha256:<digest>.

  • Updated dependencies []:

v4.136.1

Compare Source

Patch Changes

  • #​15744 0ed4c54 Thanks @​podonnell-dev! - Improve wrangler preview onboarding guidance

    Wrangler now displays placeholder replacement guidance directly beneath the suggested Preview configuration instead of as a separate warning. JSON output continues to include the guidance in its structured onboarding messages.

  • #​15678 703922d Thanks @​christhorwarth! - Read workers.dev URLs from the Worker resource during deployment

    Wrangler no longer requires account-level subdomain permission to display Worker and version-preview URLs. It now uses the Worker-scoped URL fields while preserving account-level registration for accounts without a workers.dev subdomain.

  • Updated dependencies [14d946d]:

v4.136.0

Compare Source

Minor Changes

  • #​15713 3c75cad Thanks @​jamesopstad! - Identify experimental Build Output resource configs by filename and location

    The root remains config.json, Worker configs are now worker.config.json, and Container configs are now container.config.json. Resource configs no longer contain top-level type discriminators, while settings and build context are stored together in the root config.

  • #​15713 3c75cad Thanks @​jamesopstad! - Define experimental Cloudflare configuration with a single default export

    Experimental cloudflare.config.ts files now define settings and resources together in a default-exported defineConfig() call. Add a Worker under worker, add Containers to the containers array, or omit both to provide settings only.

    import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };

export default defineConfig({
	accountId: "...",
	complianceRegion: "public",
	worker: {
		name: "my-worker",
		compatibilityDate: "2026-09-18",
		entrypoint,
	},
});

  • #​15720 35668d7 Thanks @​alexkli! - Add experimental --zone and --zone-id flags to wrangler deploy and wrangler triggers deploy to attach a zone to routes passed via --route

    Routes passed on the command line were always sent to the Cloudflare API as bare patterns. Zones with an SSL for SaaS entitlement reject such routes with error 10082 ("When using wildcard host ssl for saas entitlement you must specify the zone per route using zone_id or zone_name"), and until now the only way to set a zone was in the config file, which --route overrides.

    The new flags are experimental and must be enabled with --experimental-route-zones (alias --x-route-zones). Pass a single zone to apply it to all routes, or one zone per route in the same order as the --route flags:

    wrangler deploy --x-route-zones --route "app.example.com/*" --route "api.example.com/*" --zone example.com

    wrangler deploy --x-route-zones --route "a.example.com/*" --zone example.com --route "b.example.net/*" --zone example.net

    --zone sets zone_name and --zone-id sets zone_id on each route. The two flags cannot be combined, and passing more than one zone requires exactly one per --route. Routes without zone flags behave exactly as before.

  • #​15699 45b3b81 Thanks @​skepticfx! - Remove the experimental Container image environment binding

    Durable Object-managed Containers now use ctx.container.images without Wrangler generating env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Update code using the experimental environment binding to read ctx.container.images and regenerate your Worker types.

    Version deployments identify managed applications from native named images, and --containers-rollout=none preserves native Container metadata. Containers without named images must first be provisioned with wrangler deploy; versions upload verifies that their applications already exist. The old binding is no longer read or reserved, including on previously uploaded versions. keep_vars retains existing variables as usual; redeploy without it to remove an existing experimental binding.

  • #​15702 8235e6a Thanks @​podonnell-dev! - Return structured configuration errors from wrangler preview --json

    When a Worker is missing its Preview configuration, JSON mode now returns an error, a suggested_config patch, and any associated onboarding messages without interactive output or terminal formatting. This changes the private-beta Preview command to make automated onboarding reliable.

  • #​15577 731a2ee Thanks @​sdnts! - Add support for jurisdictions to Queues subcommands

Patch Changes

  • #​15711 91e2f86 Thanks @​ghostwriternr! - Allow local Container images without exposed ports

    Wrangler and the Cloudflare Vite plugin no longer reject images that omit Docker EXPOSE metadata. Local Containers can run command-only workloads or serve traffic through workerd without declaring an unused image port.

  • #​15740 c5913a6 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260918.1 ^5.20260921.1
    workerd 1.20260918.1 1.20260921.1

  • #​15471 0751490 Thanks @​edmundhung! - Fix cf builds for static projects that serve assets from the project root

    The experimental Build Output path now omits the reserved .cloudflare directory when the project root is used for static assets. This prevents recursive output copying in Wrangler while preserving the existing behaviour for other asset directories.

  • #​15440 43b1f85 Thanks @​HuzaifaAbdulRehman! - Rebase absolute non-JavaScript module specifiers when preserve_file_names is enabled

    With preserve_file_names set, a non-JS module imported by an absolute path kept that path as its module name. The build machine's filesystem layout ended up inside the deployed Worker, and the module was never written to --outdir. A local dry run reported success while the upload failed server-side with error code 10021. Tooling that rewrites externals to absolute paths hits this, which is how it was found in @opennextjs/cloudflare with WASM imports.

    Absolute specifiers are now rebased to ./<basename>, which is what the hashed branch of the same code already does minus the hash prefix. Relative specifiers keep the behaviour they had.

  • Updated dependencies [c5913a6, 3c75cad]:

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 zrr-website-slides 9728e10 Commit Preview URL

Branch Preview URL		 Sep 28 2026, 01:35 AM

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 zrr-website-blog 9728e10 Commit Preview URL

Branch Preview URL		 Sep 28 2026, 01:37 AM

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 zrr-website-root 9728e10 Commit Preview URL

Branch Preview URL		 Sep 28 2026, 01:38 AM

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants