fix(deps): update all non-major dependencies - #146
Open
khepri-bot[bot] wants to merge 1 commit into
Open
Conversation
khepri-bot
Bot
force-pushed
the
renovate/all-non-major-dependencies
branch
2 times, most recently
from
September 7, 2026 19:16
6810dce to
cf96dd6
Compare
khepri-bot
Bot
force-pushed
the
renovate/all-non-major-dependencies
branch
from
September 7, 2026 23:36
cf96dd6 to
8cdc9f9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.52.1→1.53.10.21.3→0.22.010.70.0→10.71.010.70.0→10.71.014.6.4→14.6.626.2.0→26.3.05.7.17→5.7.2220.11.2→20.11.611.22.0→11.24.01.9.14→1.9.158.2.1→8.2.24.1.10→4.1.114.123.0→4.125.0Release Notes
cloudflare/workers-sdk (@cloudflare/vite-plugin)
v1.53.1Compare Source
Patch Changes
59872c4,c68f9cb,99a1f49,5ae9d5b,4b52975,ce9b151,ef73a28,649f667,39dcea6,99a1f49,99a1f49,99a1f49,f2437e6,30c2d47]:v1.53.0Compare Source
Minor Changes
#15026
6529f0cThanks @petebacondarwin! - Allow containers to be attached to a Durable Object from itsexportsentryA container can now be linked to its Durable Object from the export side, using a new
containerfield that names an entry in thecontainersarray. As a resultcontainers[].class_nameis now optional — a container that is referenced this way only needs aname:{ "name": "my-worker", "main": "worker.js", "compatibility_date": "2026-07-01", "containers": [ { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 } ], "exports": { "MyContainerDO": { "type": "durable-object", "storage": "sqlite", "container": "my-container" } } }The existing
containers[].class_namedirection keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.containeris only valid on livedurable-objectexports (createdandexpecting-transfer) and requiresstorage: "sqlite". Wrangler now also reports an error when:containerreference names a container that does not existnameclass_namenames a Durable Object whosestorageislegacy-kvThat last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one
class_name, give each its own Durable Object class.Patch Changes
#15238
3a4fc6bThanks @jamesopstad! - Honoraccess.devwhen running Workers with@cloudflare/vite-plugin, soctx.access.getIdentity()returns the configured identity.#15028
d4f441fThanks @harshmathurx! - Handle Worker-side request body cancellation without surfacing stream controller errors in local dev.#15185
1f79aceThanks @jamesopstad! - Use a fixed default compatibility date rather than the current dateWhen no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date.
workerdonly accepts a compatibility date up to 7 days beyond its own release, so whenever aworkerdrelease was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.The default is now fixed at the release date of the
workerdversion that ships with each release, which leaves a week of headroom and updates asworkerdis upgraded.@cloudflare/vite-pluginpreviously inlined the date at which it was built. It now shares the same default.#15239
f431166Thanks @jamesopstad! - Prevent date-enabled Node.js compatibility from adding conflicting globals to generated runtime typesRuntime type generation now treats Node.js compatibility enabled by a compatibility date the same way as an explicit
nodejs_compatflag. Node.js globals continue to come from@types/nodeinstead of being generated asanydeclarations that override those types.#15196
8fb2b87Thanks @skepticfx! - Use the FedRAMP High managed container registry when Wrangler targets the FedRAMP High compliance regionContainer builds, pushes, deployments, image commands, and local development now select the corresponding production or staging FedRAMP registry and API from either
compliance_regionorCLOUDFLARE_COMPLIANCE_REGION.Updated dependencies [
bc5726b,1277a72,ba54f0d,6529f0c,b7422b0,186339c,4f922dc,4d74b8d,2e0c962,1f79ace,49f73de,7cee278,8777180,265256a,1f79ace,f431166,8fb2b87,75cf407]:cloudflare/workers-sdk (@cloudflare/vitest-pool-workers)
v0.22.0Compare Source
Minor Changes
#13830
49d4e00Thanks @penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14@cloudflare/vitest-pool-workerspreviously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.If you mock requests with MSW in your Worker tests, make sure you're on MSW
>= 2.14; older versions will no longer intercept requests. You can keep usingsetupServer()frommsw/node, or adopt the official@msw/cloudflareintegration viasetupNetwork(). See the updatedrequest-mockingexample fixture for the recommended pattern.Patch Changes
#15211
bc5726bThanks @nithin42! - Honoraccess.devwhen running Workers with@cloudflare/vitest-pool-workers, soctx.access.getIdentity()returns the configured identity just as it does withwrangler dev.#15156
3ddd3ceThanks @dario-piotrowicz! - Fix module resolution for relativerequire()inside CJS deps when the project path contains spacesWhen a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative
require()calls (e.g.require("./lib/impl.js")) would fail with "No such module" becauseworkerdpreserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.#15150
2cf3143Thanks @kkkhs! - Restore typedinject()keys incloudflareTest()pool optionsinject()insidecloudflareTest()options again infers the value type from the keys you declare in your VitestProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g.inject<number>("myPort").#15232
8777180Thanks @vicb! - Bumpcapnp-esto 0.0.16.#15185
1f79aceThanks @jamesopstad! - Use a fixed default compatibility date rather than the current dateWhen no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date.
workerdonly accepts a compatibility date up to 7 days beyond its own release, so whenever aworkerdrelease was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.The default is now fixed at the release date of the
workerdversion that ships with each release, which leaves a week of headroom and updates asworkerdis upgraded.@cloudflare/vite-pluginpreviously inlined the date at which it was built. It now shares the same default.Updated dependencies [
bc5726b,1277a72,ba54f0d,6529f0c,b7422b0,186339c,4f922dc,4d74b8d,2e0c962,1f79ace,49f73de,7cee278,8777180,265256a,1f79ace,f431166,8fb2b87,75cf407]:getsentry/sentry-javascript (@sentry/cloudflare)
v10.71.0Compare Source
Important Changes
The
enableLogsclient option now defaults totrue, so Sentry Logs work without any manual opt-in. Nothing is captured unless you call theSentry.logger.*APIs or add a log-forwarding integration (such asconsoleLoggingIntegration,pinoIntegration, or the winston transport), and you can setenableLogs: falseto opt out. Although a default change like this would normally land in a major release, we are shipping it in a minor after careful consideration, since it sends no data on its own and only takes effect once you actively use the logging APIs or a logging integration.Other Changes
scope.clear()method (#23231)Headersinstances (#23241)captureExceptionfrom scope, not fromClient(#23280)Internal Changes
Bundle size 📦
testing-library/user-event (@testing-library/user-event)
v14.6.6Compare Source
Bug Fixes
v14.6.5Compare Source
Bug Fixes
saadeghi/daisyui (daisyui)
v5.7.22Compare Source
Bug Fixes
v5.7.21Compare Source
Bug Fixes
fab-floweractions (#4683) (e4e6419)v5.7.20Compare Source
Bug Fixes
v5.7.19Compare Source
Bug Fixes
v5.7.18Compare Source
Bug Fixes
capricorn86/happy-dom (happy-dom)
v20.11.6Compare Source
👷♂️ Patch fixes
v20.11.5Compare Source
👷♂️ Patch fixes
querySelector<HTMLInputElement>(".my-input")) - By @cyphercodesv20.11.4Compare Source
👷♂️ Patch fixes
fetch()to match origins instead of host and protocol - By @rexxars in task #1490v20.11.3Compare Source
👷♂️ Patch fixes
pnpm/pnpm (pnpm)
v11.24.0: pnpm 11.24Compare Source
Minor Changes
Patch Changes
Fixed pnpm v11 incorrectly reporting
confirmModulesPurgeas unrecognized when set inpnpm-workspace.yaml. The Rust CLI now identifies the unsupported option as a pnpm v11 setting instead of suggesting an unrelated setting.pnpm install --frozen-lockfileno longer fails withERR_PNPM_FROZEN_LOCKFILE_WITH_OUTDATED_LOCKFILEwhen the pinned pnpm version recorded inpnpm-lock.yamlhas to be re-resolved before it can be installed. It runs the pnpm version the lockfile pins and leaves the lockfile unchanged #14124.Under
nodeLinker: hoisted, peer-resolution variants of an injected directory dependency (afile:snapshot) are materialized as separate copies again instead of collapsing onto the first-seen variant. Each copy keeps its own peer-resolved dependency set, so a project pinning one peer version no longer resolves another project's variant — Bit root components with conflicting peers across injected copies rely on this.Fixed
pnpm install --merge-git-branch-lockfiles --frozen-lockfilefailing withERR_PNPM_OUTDATED_LOCKFILEwhen a branch lockfile predates the removal of a dependency, or its move to another dependency group #13966. A dependency that no project declares anymore is no longer reinstated by the merge, and the packages it was the only path to are dropped with it.Batch workspace publishing accepts a shared scope-specific credential, rejects mismatched credentials for a registry before publishing, and runs the
publishandpostpublishscripts after each completed registry group pnpm/pnpm#14101.The Rust CLI now honors five settings it recognized but ignored:
updateNotifier,legacyDirFiltering,initAuthorName/initAuthorEmail/initAuthorUrl,initLicense, andinitVersion.pnpm installandpnpm addcheck once a day for a newer pnpm and print how to get it (turn it off withupdateNotifier: false); a{<dir>}filter selector can go back to matching the subtree below the directory withlegacyDirFiltering: true; andpnpm initwrites the configured author, license, and version into thepackage.jsonit scaffolds.PNPM_CONFIG_INIT_VERSIONis now read as well.maxsockets, npm's spelling ofmaxSockets, is no longer ignored: both spellings are read frompnpm-workspace.yaml, the global config file, the environment, and the command line, in that increasing order of precedence — a value passed on the command line now wins even when the two sides spelled the setting differently.A
lastUpdateChecktimestamp dated in the future — after a clock change, a restored snapshot, or a hand-edited state file — no longer silences the update check until that time comes around.legacyDirFilteringno longer reaches the workspace-root selectors pnpm generates for itself: the!{<workspace-root>}exclusion a recursiverun/exec/add/testappends, and the{<workspace-root>}inclusion--workspace-rootappends. Read as subtree matches they named every project below the root, so a recursive command under the setting selected nothing at all, and--workspace-rootpulled in every project below the root instead of the root alone #14101.pnpm install --frozen-lockfileno longer fails whenpnpm-lock.yamlrecords the pinned pnpm version alongside an engine package the running pnpm does not install it from. An entry pinning another version is still refused, and a plain install rewrites the block #14124.v11.23.0: pnpm 11.23Compare Source
Minor Changes
pnpm config getandpnpm config listnow show the settings pnpm acts on under their documented names:registriesshows the registries pnpm resolves from, merged across every source (.npmrc,pnpm-workspace.yaml, the global config, CLI flags), in the shape the setting is written in: keyed by registry URL, with the default registry declared as the bare@scope. Built-in routes are included — the@jsrscope and thenpmjsandghprefixes — unless pointed elsewhere. Previouslypnpm config get registriesprintedundefined.updateandauditshow the effective sections, whichever spelling set them. The deprecated internal spellings (updateConfig,auditConfig,auditLevel) are no longer listed.catalogsshows the complete resolved catalog set — the singularcatalogblock is itsdefaultentry — whichever spelling declared it.registryand@scope:registryentries show the merged routes rather than raw.npmrcvalues, so they always agree with theregistriesview.Settings that no supported pnpm version recognizes get their own warning. A key in the global config file that this version of pnpm does not read is no longer reported with advice to move it to a project-level
pnpm-workspace.yaml(where it would be ignored too); the warning now says the setting is not recognized by this version of pnpm, names the pnpm version that does read it when there is one (for example,globalShimsis a pnpm v12 setting), and suggests the closest real setting name when the key looks like a typo. Unrecognized and non-camelCase keys in a project'spnpm-workspace.yaml, previously ignored silently, are now reported the same way.pnpm config get <key>andpnpm get <key>no longer print config-load warnings, so a script capturing the value gets the value alone.The
importPackagepnpmfile hook is deprecated. pnpm now prints a warning when a pnpmfile defines it, and the hook will be removed in the next major version. It also opts the installation out of the parallel package importer, making installation slower. If you rely on this hook, comment on #14101.node_modules/.modules.yamlno longer records the registries an install resolved from, and the recorded copy is dropped from the file on the first install that rewrites it.It dated from the lockfile format that spelled a dependency's path relative to its registry, where reading an installed tree meant knowing the registries it was installed with. Dependency paths have not carried a registry for several major versions, and the recorded copy outlived its use:
pnpm list,pnpm why, and single-project installs preferred it over the project's own configuration, so a project whose registry had changed since its last install was still read through the old one.They now use the configured registries, like every other command already did.
When
enableGlobalVirtualStoreis on, every process pnpm spawns for the project (pnpm run,pnpm exec, lifecycle scripts) now receives aNODE_PATHpointing at the project's hoistednode_modules, plus aNODE_OPTIONS--importflag that registers a resolve hook restoringNODE_PATHlookups for ESM imports. Dependencies that import undeclared ("phantom") packages keep resolving under the global virtual store — for both CommonJS and ESM — without installing the@pnpm/plugin-esm-node-pathconfig dependency pnpm/pnpm#9618. Tools run bypnpm dlxresolve such dependencies too: the JS CLI passes them the same environment, while the Rust CLI's dlx cache is self-contained, so its layout already exposes them.A registry can now declare that its abbreviated metadata carries the
timefield, soresolutionMode: time-basedreads the full metadata document only from the registries that need it:registry.npmjs.orgomitstimefrom abbreviated metadata, so a time-based resolution has to fall back to the much larger full document. That fallback used to be all-or-nothing:registrySupportsTimeFieldanswered for every registry at once, so a project resolving from both the public registry and a Verdaccio instance either paid for full metadata everywhere or claimed atimefield npmjs does not serve. The answer is now per registry, andregistrySupportsTimeFieldremains the answer for every registry that does not declare one.The declaration is also sent to a pnpr server, which applies it to the resolution it runs on the client's behalf.
A pnpr resolve request now carries the client's registries the way the
registriessetting declares them — keyed by URL, with the scopes routed to each, the bare-specifier prefix each answers to, and each one'sserverType— in place of the prefix map it used to send.The server routes them through the same inversion the config reader runs, so a pnpr-served install resolves a scoped dependency from the registry that scope is routed to, which it previously could not: only the default registry and the prefix-addressed ones reached the server. A declared
serverTypereaches it too, so the tarball URLs pnpr omits from the lockfile match the ones the client reconstructs.Built-in scope routes the project has not pointed elsewhere are not declared, so a pnpr server's allowlist is not asked about
npm.jsr.ioon requests that resolve no JSR package.A registry a request only declares is no longer refused up front for being off the server's allowlist — a client describes its whole configuration, including scopes a given resolve never reaches, so a stray
@scope:registryin a developer's~/.npmrcno longer fails every install against a pnpr server that does not serve it. The boundary moves to the fetch itself: an origin the resolve does reach is refused before the request leaves the server, with the same message.This changes the resolve and verify-lockfile request bodies. A pnpr server and its clients have to be on matching versions; the protocol is still experimental and unversioned.
The
registriessetting now declares a registry once, keyed by its URL, with everything about that registry in the entry: how it lays out tarball URLs, the scopes routed to it, and the bare-specifier prefix it answers to.serverTypetells pnpm how the registry lays out its tarball URLs, which decides whether a URL can be omitted frompnpm-lock.yaml:npm— the registry behaves likeregistry.npmjs.org, which also serves a scoped package from its percent-encoded path. Declare this for a faithful mirror or caching proxy of the public registry so its tarball URLs can be omitted too.artifactory— JFrog Artifactory repeats the scope in a scoped package's tarball filename (@acme/widget/-/@acme/widget-1.0.0.tgz) where the npm registry strips it (@acme/widget/-/widget-1.0.0.tgz). Declaring it lets pnpm rebuild that URL, so it is omitted frompnpm-lock.yamlinstead of being written out for every scoped package pnpm/get-npm-tarball-url#16.scopeslists the@-prefixed scopes that resolve from this registry. A bare'@'is the scope-less default registry, the one theregistrysetting names.prefixis the alias a dependency addresses this registry by, as in"foo": "work:^1.0.0".The layout is never inferred from the registry URL, so nothing changes unless you declare it;
registry.npmjs.orgcontinues to behave asnpmwithout being declared. Because the lockfile depends onserverType, it is read frompnpm-workspace.yamlonly — aserverTypein the globalconfig.yamlis ignored, so one developer's machine cannot shape a lockfile their collaborators read back with a different layout. Credentials are rejected in this setting, in a key as well as in a field, and still belong in.npmrc. An entry that routes nothing to itself and matches no configured registry is reported as a warning rather than silently ignored.Migrating
The older
registriesshape, a map of<scope>: <url>strings, still works and needs no change:namedRegistriesis deprecated in favor of theprefixfield, and is still read for prefixesregistriesdoes not declare.toLockfileResolutionandisCanonicalRegistryTarballUrlnow take their registry and layout as an options object rather than positional arguments, so@pnpm/lockfile.utilsand@pnpm/resolving.tarball-urlget a major bump.An install that had to re-hash store files to verify them now reports it. If that cost more than a second, it says how long —
The integrity of N files was checked in 2.5s.— and if it was quick but covered more than a thousand files, it names the cause instead: their timestamps changed since the store recorded them, which a backup tool, an antivirus scan or a copied store can do.Added
virtualStoreType, which names where the virtual store lives — one store per machine, or one per project:It is the canonical spelling of
enableGlobalVirtualStore, which keeps working. When a project sets both,virtualStoreTypewins. It can also be set throughPNPM_CONFIG_VIRTUAL_STORE_TYPEand read back withpnpm config get virtualStoreType. The default is unchanged —project, so the shared store stays opt-in.The setting is independent of
nodeLinker.isolatedandpnpboth work with either store type, andhoistedwrites no virtual store at all, so it is unaffected.Patch Changes
pnpm add --allow-buildnow adds to theallowBuildsentries already inpnpm-workspace.yamlinstead of replacing them #13872.Kept pending build approvals available after removing an unrelated dependency.
pnpm approve-buildsnow removesonlyBuiltDependencies,onlyBuiltDependenciesFile,neverBuiltDependencies, andignoredBuiltDependenciesfrompnpm-workspace.yamlwhen it writesallowBuilds. Those settings were replaced byallowBuildsin pnpm 11 and silently ignored since, so a workspace migrated from pnpm 10 kept them around looking active.pnpm auditno longer reports a patched version that was never published or is deprecated. The inferred patched range (e.g.>=4.17.24from<=4.17.23) is now checked against the registry packument, and the report is corrected to the lowest non-deprecated published version that satisfies it (e.g.>=4.18.1when4.17.24does not exist and4.18.0is deprecated). When no published version satisfies the range, the report showsPatched versions: None. This also preventspnpm audit --fixfrom adding overrides orminimumReleaseAgeExcludeentries for patches that do not exist #13824.pnpm audit --fixandpnpm audit --fix updateno longer add aminimumReleaseAgeExcludeentry when the registry packument shows that the minimum patched version was never published. Previously such entries were written for versions that do not exist, which would have let a later publish of that version bypass theminimumReleaseAgegate #11563.The
--jsonoutput ofpnpm auditnow returnspatched_versions: nullfor advisories whose inferred patch is not available (never published, skipped, yanked, or deprecated), making it easier for tooling to distinguish "no fix available" from "fix available at version X".Fixed
pnpm patch-commitin project and edit paths containing non-ASCII characters.The package and bump pickers of
pnpm changenow size their page from the terminal height instead of always showing 7 rows. They fall back to 7 rows when the terminal height is unknownpnpm/pnpm#13815.Canceling a
pnpm changeprompt with Ctrl-c no longer prints a stack trace. It reportsChange canceledand exits with a success status, like the other interactive commands #13814.Re-fetch full registry metadata when
minimumReleaseAgeis enabled and an abbreviated packument'stimemap omits timestamps for some versions. This prevents mature versions from being filtered out and resolution from falling back to the lowest matching version pnpm/pnpm#13741.A config dependency carrying an inline integrity (the
<version>+<integrity>form, or the object form without atarball) now takes its tarball URL from the registry's packument instead of deriving it from the registry URL, so migrating one costs an extra metadata request. On a registry that serves tarballs from a path pnpm cannot derive, GitLab's group endpoint for one, installing such a config dependency failed with a 404 while the same package installed fine as a regular dependency #13765.Fixed
PNPM_CONFIG_NODE_VERSIONbeing ignored when setting the Node.js version used for compatibility checks.A custom fetcher can no longer replace the archive integrity that
pnpm-lock.yamlpins: the locked value is restored after acanFetchorfetchhook rewrites the resolution, and delegating a locked archive to a directory or git source now fails instead of installing unverified content.The Rust CLI now also loads the pnpmfiles named by the
pnpmfilesetting (a single path or an ordered list), and hands custom fetchers nativelocalTarballandremoteTarballcallbacks — including on a fresh install that has to compute a missing tarball integrity, which is then reused by later offline installs. File maps a fetcher returns are accepted only when they match what those native callbacks extracted.Fixed an issue where running
pnpm dedupe --checkin projects withnodeLinker: hoistedwould cause dependencies to be moved out ofnode_modulesintonode_modules/.ignored.pnpm deploy --prodandpnpm deploy --no-optionalno longer list the excluded dependency groups in the deployedpackage.jsonandpnpm-lock.yaml. The deployed lockfile referenced packages that the deploy left out of its graph, so installing in the deploy directory afterwards created dangling symlinks #13623.Don't treat files like
license16.jsonas a package license when deciding if the workspace LICENSE file should be included in the packed package.pnpm exec --recursive --no-reporter-hide-prefixno longer prints a blank prefixed line after each chunk of a command's output, and no longer splits a line in two when it straddles a chunk boundary.Fixed
404errors when installing from a registry that serves scoped packages only from a percent-encoded path, such as GitHub Enterprise Server. Outsideregistry.npmjs.org, a tarball URL that encodes the scope separator as%2for%2Fis no longer mistaken for one that pnpm can rebuild from the package name, version, and registry, so it is kept inpnpm-lock.yamland requested verbatim on the next install #13534.Fixed
trustPolicyExcludeandminimumReleaseAgeExcludebeing ignored when set to a singleConfiguration
📅 Schedule: (in timezone America/New_York)
* 0-8 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.