build(deps): bump the minor-and-patch group across 1 directory with 21 updates

[dependabot]

Bumps the minor-and-patch group with 21 updates in the / directory:

Package	From	To
@graphql-codegen/cli	7.2.0	7.3.1
@j178/prek	0.4.13	0.5.0
knip	6.32.2	6.33.0
@cloudflare/sandbox	0.12.6	0.12.9
better-auth	1.6.28	1.7.2
cloudflare	7.0.0	7.1.0
graphql-yoga	5.21.3	5.22.0
hono	4.13.2	4.13.5
xstate	5.32.5	5.32.6
wrangler	4.123.0	4.127.1
@assistant-ui/react	0.15.14	0.15.17
@hugeicons/core-free-icons	4.2.3	4.3.0
@hugeicons/react	1.1.9	1.1.10
@tanstack/react-query	5.101.4	5.102.8
lucide-react	1.31.0	1.37.0
react-router-dom	7.18.2	7.18.3
streamdown	2.5.0	2.6.0
@types/react-dom	19.2.4	19.2.5
@vitejs/plugin-react	6.0.5	6.1.1
vite	8.2.1	8.2.2
@ag-ui/core	0.0.57	0.0.59

Updates @graphql-codegen/cli from 7.2.0 to 7.3.1

Changelog

Sourced from @​graphql-codegen/cli's changelog.

7.3.1

Patch Changes

• #10924 0c8f5ba Thanks @​eddeee888! - Fix profiler output not being written to the filesystem in watch mode (--profile --watch)

  The profiler trace was only written on the non-watch code path, after the watch-mode early return, so a profiled watch session never produced a codegen-*.json file.

  The profiler now writes a fresh trace file after the initial run and after every rebuild, with each file containing only that run's events. A failed rebuild does not produce a trace and its events are discarded so they don't leak into the next successful run.

  The Profiler now owns its own trace lifecycle:

  • a new clear() method starts a new trace
  • a new outputName property provides the filename for the current trace (null for the noop profiler)
  • filename generation was removed from CodegenContext

• Updated dependencies [0c8f5ba]:

  • @​graphql-codegen/plugin-helpers@​7.2.1

7.3.0

Minor Changes

• #10921 58cdb31 Thanks @​eddeee888! - Extend overwrite with overwrite.removeStaleFiles and overwrite.updateExistingFiles

  overwrite was being used to both remove stale files in watch mode and update existing files. Some plugins such as Server Preset may dynamically return files to write between watch runs (for performance purposes).

  The overwrite can now take an object with overwrite.removeStaleFiles and overwrite.updateExistingFiles fields to allow granular control over actions.

  This is not a breaking change because overwrite=true|false still works.

Patch Changes

• Updated dependencies [58cdb31]:
  • @​graphql-codegen/plugin-helpers@​7.2.0

Commits

• a2e1d5c chore(release): update monorepo packages versions (#10925)
• 0c8f5ba Implement rolling profiler output for watch mode (#10924)
• 6aa476a Upcoming Release Changes (#10923)
• 58cdb31 Add overwrite.updateExistingFiles and overwrite.removeStaleFiles (#10921)
• See full diff in compare view

Updates @j178/prek from 0.4.13 to 0.5.0

Release notes

Sourced from @​j178/prek's releases.

0.5.0

Release Notes

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from PATH, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See toolchain management and language_version for the full source-selection behavior. (#2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

• Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#2617)
• PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#2620)
• The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#2623)
• prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#2619)

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.5.0

Released on 2026-08-27.

Highlights

Choose where hook toolchains come from

language_version now accepts a source preference alongside the version request, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use managed (the default) or system to choose which source prek tries first while still allowing fallback and downloads. Use only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from PATH, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See toolchain management and language_version for the full source-selection behavior. (#2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

• Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#2617)
• PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#2620)
• The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#2623)
• prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#2619)

Enhancements

... (truncated)

Commits

• 67f8535 Bump version to 0.5.0 (#2631)
• 4546bef Remove legacy init-template-dir command (#2623)
• e63bd4b Remove hook marker schema 0 (#2622)
• 8c433ae Remove config-tracking cache bootstrap (#2621)
• 62ca460 Remove PREK_MAX_CONCURRENCY (#2620)
• e2468ea Remove legacy update aliases (#2619)
• 795c3a4 Group run options in CLI help (#2629)
• b27eb6e Document prek run architecture (#2630)
• 7dd9aa9 Avoid persisting docs workflow credentials (#2627)
• 23815bd Remove the @builtin group selector (#2628)
• Additional commits viewable in compare view

Updates knip from 6.32.2 to 6.33.0

Release notes

Sourced from knip's releases.

Release 6.33.0

• Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
• Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
• Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
• Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
• Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
• Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
• fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!
• Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)
• Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)
• Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)
• Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)
• Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)
• Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)
• Update dependencies (28510146c2b97d88f7188f1239b9307aac7dbf0c)
• Replace non-breaking space in module graph comment (4e22bfcd09deccc92ed158f5554fe3e03f3a2c51)
• Update fix format test for oxfmt package.json key sorting (65011bf6054d03fb5580f3381867b07d1b8a9a0c)
• fix(webpack): resolve entry descriptors using import field (#1981) (cad8910e7fb89c2510fc9f5885289335dd4e60da) - thanks @​DreamLongYT!
• fix: count enum element access as a whole-object read (#1958) (5a47d603aa23b388ae7ce4fe301656f1abc43b14) - thanks @​addielaruee!
• Resolve oxlint/vite-plus import resolvers from settings (#1983) (c1165b70efe27398b86fa50bcea7d85c253d3ee7) - thanks @​DreierF!
• fix(nuxt): resolve string extends configs (#1984) (4a5d7068d6264ea45c78c832abe7ba052763517e) - thanks @​DreamLongYT!
• Wrap up webpack entry resolution (505decdb821f9b76d194742cee7e98c75ef7d8e9)
• Keep element access precise for number-like enum member names (bcbac3a8b8283da3b32256584b3cc6569ae5c02f)
• Resolve Object.* enum enumeration through import aliases (347967daaed817ca20e1ad6148388a66ec8b421b)
• Resolve named string-key access on namespace-qualified enums (2ac1fbc1e92f3dae662ca4d4701cf010346be49a)
• Normalize line endings in nuxt-config-string fixture (9fe2b2b2db8690685ec7c6cf8b3d39b9ed7b3fdc)
• Resolve nuxt layer sources from all extends entry shapes (db136151d9f98801837b33646ef7b02ae7b5a86d)
• Report unused exports behind Vitest module promise mocks (resolve #1966) (74954c219367ca1577184cca08c30dbb3fb6222e)
• Check line endings against .gitattributes in pnpm run ci (ddc9fd0cc3328260665203c8573702bb6c9d0dd6)

Release 6.32.3

• Update sentry production snapshot (9f18cba93c91de8554636b13692d6e7a937b7697)
• Pin TypeScript ecosystem test (de5162952d223050f3135afb02d4e8de6d46f381)
• Update query snapshot (f6964dd577d8f7967f9be6778f5c3953632e3c96)
• fix(tsup): match config files with .cts and .mts extensions (#1938) (68d6f52f7913cfa1e36618e6b03f90734da34149) - thanks @​codeAnqiang-ma!
• fix(lefthook): match all config file names and extensions (#1940) (4015ae0330c78e97360a2c8f697d17f82c5c24ae) - thanks @​codeAnqiang-ma!
• fix(binaries): resolve missing pnpm subcommands (#1945) (deedbf69dcbd6a59d6705a72cadb4e40ad9c8029) - thanks @​marcalexiei!
• Fix nested gitignore negation inside ignored dot-directories (#1913) (#1942) (0201641af48f52edfbe72076118944ee6273718e) - thanks @​DSeaStar!
• fix(webdriver-io): match all supported config file extensions (#1948) (dc7aca5a865d1762a41dd97493b73398ec3abc19) - thanks @​solomonaustin!
• Resolve vitest include patterns relative to test.dir (#1929) (ee555d227208dd6a34e002318bd6710dedb4d5ca) - thanks @​kirthi-b!
• Change GitHub stars badge style to flat (#1967) (ff0d791e8130430524dc88c4df73ad87f82879f7) - thanks @​DreamLongYT!
• Ignore printf as global binary (#1972) (a0c0b0805a8a26a6efdedfe2561b168da2a22b68) - thanks @​taracutie!
• fix: add bun 1.4 dedupe subcommand (#1969) (d1d5d4276ece6daf2215f5ff3f4224b5b50dcac3) - thanks @​NimmLor!
• Resolve Vitest mocks from test root (e655b0ba0192546a2688d702323c8e7c58fecde1)
• Resolve local Vitest reporters from test root (resolve #1953) (f4ff31ad0385c5955627ec1b3bed2bc0000b14fe)

Commits

• fb25ece Release knip@6.33.0
• 74954c2 Report unused exports behind Vitest module promise mocks (resolve #1966)
• db13615 Resolve nuxt layer sources from all extends entry shapes
• 9fe2b2b Normalize line endings in nuxt-config-string fixture
• 2ac1fbc Resolve named string-key access on namespace-qualified enums
• 347967d Resolve Object.* enum enumeration through import aliases
• bcbac3a Keep element access precise for number-like enum member names
• 505decd Wrap up webpack entry resolution
• 4a5d706 fix(nuxt): resolve string extends configs (#1984)
• c1165b7 Resolve oxlint/vite-plus import resolvers from settings (#1983)
• Additional commits viewable in compare view

Updates @cloudflare/sandbox from 0.12.6 to 0.12.9

Release notes

Sourced from @​cloudflare/sandbox's releases.

@​cloudflare/sandbox@​0.12.9

Patch Changes

• #877 664d8e3 Thanks @​scuffi! - Allow mounted R2 buckets to open object keys containing spaces, symbols, percent signs, and non-ASCII characters.

@​cloudflare/sandbox@​0.12.8

Patch Changes

• #879 8534aef Thanks @​scuffi! - Enforce source mount prefixes for server-side copies between R2 bindings.

@​cloudflare/sandbox@​0.12.7

Patch Changes

• 23a08e4 Thanks @​ghostwriternr! - Ensure stable releases advance npm's latest tag only after all release artifacts pass verification.

Commits

• 1339396 Version Packages (#885)
• 664d8e3 Fix R2 mount object key decoding (#877)
• 310b4ff Promote public refs to 0.12.8 (#882)
• ca0b013 Version Packages (#881)
• 8534aef Fix R2 copy source prefix scoping (#879)
• 6abf639 Retry stable release reinspection
• 6ac5165 Promote public refs to 0.12.7 (#871)
• 9bf17d1 Version Packages
• 3d261f0 Promote public refs to 0.12.6
• 23a08e4 Fix promotion branch creation
• Additional commits viewable in compare view

Updates better-auth from 1.6.28 to 1.7.2

Release notes

Sourced from better-auth's releases.

v1.7.2

better-auth

Bug Fixes

• Fixed permanent user bans to clear expiration dates from previous temporary bans. (#10823)
• Fixed client types with more plugins being assignable to types declaring fewer plugins. (#10907)
• Added warnings for invalid signed session data in the cookie cache. (#10934)
• Fixed disabled MyISAM indexes from satisfying migration index checks. (#10877)
• Fixed programmatic migrations on Cloudflare D1 while preserving existing-index validation. (#10875)
• Allowed ~ in relative callback URLs validated by trusted-origin checks. (#10041)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Allowed same-origin form submissions with Referrer-Policy: no-referrer while continuing to reject untrusted origins. (#10959)
• Improved getTestInstance performance with a faster default password hasher. (#10879)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed async context loss in Cloudflare Workers bundles with multiple runtime conditions. (#10855)
• Fixed auth request logs to respect the configured logger, log level, and disabled setting. (#10939)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Standardized built-in placeholder emails to the namespaced {identifier}@{namespace}.placeholder.invalid format. (#10982)
• Added synchronous and optional access to the current auth endpoint context. (#10938)

For detailed changes, see CHANGELOG

@better-auth/oauth-provider

Bug Fixes

• Fixed Client ID Metadata Document registration when clients share at least one supported grant with the server. (#11010)
• Improved validation of relative callback and redirect URLs with paths, queries, and fragments. (#10979)
• Fixed relative redirect URLs containing fragments. (#10983)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Fixed one-to-one Drizzle relations when usePlural is enabled. (#10941)
• Added validation for missing Drizzle schema fields in compound where clauses. (#10859)

For detailed changes, see CHANGELOG

@better-auth/kysely-adapter

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.2

Patch Changes

• #10875 d5d889b Thanks @​bytaesu! - Fix programmatic migrations failing on Cloudflare D1 while preserving existing-index validation across supported databases.

• #10982 b4ad5a1 Thanks @​bytaesu! - Built-in placeholder emails now consistently use the namespaced {identifier}@{namespace}.placeholder.invalid format.

• #10934 c7a5c1a Thanks @​bytaesu! - Cookie-cache reads now warn when signed session data is invalid instead of silently appearing as a signed-out session.

• #10879 78f0c39 Thanks @​starslingdev! - Test suites using getTestInstance now run faster because the shared fixture avoids production password-hashing costs by default. Custom emailAndPassword.password implementations continue to take precedence.

• #10823 ce8a3ab Thanks @​sosyz! - Ensure permanently banning a user clears any expiration from a previous temporary ban.

• #10907 a021eaf Thanks @​heliohm! - A client created with more plugins is again assignable to a client type declaring fewer plugins, as in 1.6.

• #10959 c8dcfa5 Thanks @​bytaesu! - Allow same-origin form submissions from pages using Referrer-Policy: no-referrer while continuing to reject untrusted request origins.

• #10979 fced1a5 Thanks @​bytaesu! - Allow relative callback and redirect URLs to use standard path, query, and fragment syntax while preserving open-redirect protections.

• #10041 f6891a2 Thanks @​GautamBytes! - Allow ~ in relative callback URLs validated by trusted origin checks.

• #10877 649818a Thanks @​bytaesu! - Prevent disabled MyISAM indexes from satisfying migration index checks.

• Updated dependencies [557e19b, 64da15b, d5d889b, b4ad5a1, ea77118, 5aea9f7, fced1a5, e1d4011]:

  • @​better-auth/core@​1.7.2
  • @​better-auth/kysely-adapter@​1.7.2
  • @​better-auth/drizzle-adapter@​1.7.2
  • @​better-auth/memory-adapter@​1.7.2
  • @​better-auth/mongo-adapter@​1.7.2
  • @​better-auth/prisma-adapter@​1.7.2
  • @​better-auth/telemetry@​1.7.2

1.7.1

Patch Changes

• #10863 845bbd1 Thanks @​gustavovalverde! - auth migrate no longer attempts to add a required column with no default value to a table that already has rows. It stops with an error naming the column and the backfill to run first. Previously the generated statement failed on SQLite, Postgres, and SQL Server; on MySQL it filled the new column with an empty string for every existing row and reported success. If auth migrate already ran against a MySQL database on 1.7, run the check in the upgrade guide's account identity section.

  getMigrations throws the new UnsafeMigrationError (exported from better-auth/db/migration) for this refusal, so callers can distinguish it from other migration errors such as an index-definition conflict.

  auth generate still emits the statements for external migration tooling, with a comment banner naming any column that needs a manual backfill first.

  A required field whose database column is still nullable logs a warning instead of blocking the migration.

  A CLI command that fails now prints its error and exits with a non-zero code instead of an unhandled promise rejection.

• Updated dependencies []:

  • @​better-auth/core@​1.7.1
  • @​better-auth/drizzle-adapter@​1.7.1

... (truncated)

Commits

• ba12fcd chore: release v1.7.2 (#10870)
• 79904f0 fix(origin-check): support fragments in relative redirect URLs (#10983)
• c8dcfa5 fix(origin-check): validate null origins using fetch metadata (#10959)
• e1d4011 fix(logger): respect configured logger in auth request context (#10939)
• 557e19b refactor(context): clarify auth endpoint context access (#10938)
• b4ad5a1 refactor: centralize placeholder email generation (#10982)
• fced1a5 fix(origin-check): improve relative callback URL validation (#10979)
• f6891a2 fix(origin-check): allow tilde in relative callback URLs (#10041)
• ce8a3ab fix(admin): ban without a duration should clear the previous expiration (#10823)
• a021eaf fix(client): a client with more plugins fits a narrower client type again (#1...
• Additional commits viewable in compare view

Updates cloudflare from 7.0.0 to 7.1.0

Release notes

Sourced from cloudflare's releases.

v7.1.0

7.1.0 (2026-08-17)

---

Breaking Changes

Resource Restructuring

• cloudforceOne.threatEvents.indicatorTypes has been renamed to cloudforceOne.threatEvents.indicators

Removed Methods

• intel.attackSurfaceReport.issues.dismiss() -- removed along with IssueDismissResponse type
• moq.relays.tokens.rotate() -- removed along with TokenRotateResponse type

Return Type Changes

Resource	Method	Old Return Type	New Return Type
zones.ct.alerting	edit()	AlertingEditResponse	CTAlertingSubscription
zones.ct.alerting	get()	AlertingGetResponse	CTAlertingSubscription
mtlsCertificates	list()	MTLSCertificatesSinglePage	MTLSCertificateListResponsesSinglePage
mtlsCertificates	delete()	MTLSCertificate	MTLSCertificateDeleteResponse
mtlsCertificates	get()	MTLSCertificate	MTLSCertificateGetResponse
hostnames.settings.tls	get()	TLSGetResponsesSinglePage	Setting
hyperdrive.configs	list()	HyperdrivesSinglePage	HyperdrivesV4PagePaginationArray

Removed Types

• AlertingEditResponse, AlertingGetResponse (on zones.ct.alerting) -- replaced by CTAlertingSubscription
• MTLSCertificate, MTLSCertificatesSinglePage (on mtlsCertificates) -- replaced by per-method response types
• Host, Status, ValidationMethod (on ssl.certificatePacks)
• CertificateAuthority (on acm.totalTLS)
• HostnameAssociation (on certificateAuthorities.hostnameAssociations)
• Status (on customCertificates)
• TLSGetResponse, TLSGetResponsesSinglePage (on hostnames.settings.tls)

Endpoint Changes

Resource	Method	Old Endpoint	New Endpoint
accounts.subscriptions	create()	POST /accounts/{account_id}/subscriptions	POST /{accounts_or_zones}/{account_or_zone_id}/subscriptions
accounts.subscriptions	get()	GET /accounts/{account_id}/subscriptions	GET /{accounts_or_zones}/{account_or_zone_id}/subscriptions
loadBalancers	create(), update(), list(), delete(), edit(), get()	/zones/{zone_id}/load_balancers/...	/{accounts_or_zones}/{account_or_zone_id}/load_balancers/...
billing.usage	paygo()	GET /accounts/{account_id}/paygo-usage	GET /accounts/{account_id}/billable-usage
hostnames.settings.tls	get()	GET /zones/{zone_id}/hostnames/settings/{setting_id}	GET /zones/{zone_id}/hostnames/settings/{setting_id}/{hostname}

---

... (truncated)

Changelog

Sourced from cloudflare's changelog.

7.1.0 (2026-08-17)

Full Changelog: v7.0.0...v7.1.0

---

Breaking Changes

Resource Restructuring

• cloudforceOne.threatEvents.indicatorTypes has been renamed to cloudforceOne.threatEvents.indicators

Removed Methods

• intel.attackSurfaceReport.issues.dismiss() -- removed along with IssueDismissResponse type
• moq.relays.tokens.rotate() -- removed along with TokenRotateResponse type

Return Type Changes

Resource	Method	Old Return Type	New Return Type
zones.ct.alerting	edit()	AlertingEditResponse	CTAlertingSubscription
zones.ct.alerting	get()	AlertingGetResponse	CTAlertingSubscription
mtlsCertificates	list()	MTLSCertificatesSinglePage	MTLSCertificateListResponsesSinglePage
mtlsCertificates	delete()	MTLSCertificate	MTLSCertificateDeleteResponse
mtlsCertificates	get()	MTLSCertificate	MTLSCertificateGetResponse
hostnames.settings.tls	get()	TLSGetResponsesSinglePage	Setting
hyperdrive.configs	list()	HyperdrivesSinglePage	HyperdrivesV4PagePaginationArray

Removed Types

• AlertingEditResponse, AlertingGetResponse (on zones.ct.alerting) -- replaced by CTAlertingSubscription
• MTLSCertificate, MTLSCertificatesSinglePage (on mtlsCertificates) -- replaced by per-method response types
• Host, Status, ValidationMethod (on ssl.certificatePacks)
• CertificateAuthority (on acm.totalTLS)
• HostnameAssociation (on certificateAuthorities.hostnameAssociations)
• Status (on customCertificates)
• TLSGetResponse, TLSGetResponsesSinglePage (on hostnames.settings.tls)

Endpoint Changes

Resource	Method	Old Endpoint	New Endpoint
accounts.subscriptions	create()	POST /accounts/{account_id}/subscriptions	POST /{accounts_or_zones}/{account_or_zone_id}/subscriptions
accounts.subscriptions	get()	GET /accounts/{account_id}/subscriptions	GET /{accounts_or_zones}/{account_or_zone_id}/subscriptions
loadBalancers	create(), update(), list(), delete(), edit(), get()	/zones/{zone_id}/load_balancers/...	/{accounts_or_zones}/{account_or_zone_id}/load_balancers/...
billing.usage	paygo()	GET /accounts/{account_id}/paygo-usage	GET /accounts/{account_id}/billable-usage
hostnames.settings.tls	get()	GET /zones/{zone_id}/hostnames/settings/{setting_id}	GET /zones/{zone_id}/hostnames/settings/{setting_id}/{hostname}

---

... (truncated)

Commits

• f41ff03 Merge pull request #2797 from cloudflare/release/v7.1.0
• 8139442 chore: bump CI node version to 20 for build and lint jobs
• a670e70 release: 7.1.0
• 933ad59 Build SDK
• 05c85e2 Build SDK
• 8f5a5fa Build SDK
• 2768a88 chore: revert api_version commit
• a0799e9 chore: adjust formatting for test file
• d5dbfd3 chore: update release-please version to generated
• c07fe80 chore: update release-please version to generated
• Additional commits viewable in compare view

Updates graphql-yoga from 5.21.3 to 5.22.0

Changelog

Sourced from graphql-yoga's changelog.

5.22.0

Minor Changes

• #4545 94ebe5b Thanks @​egoodwinx! - Update to support graphql-js 17

  Bump package versions, fix expected typing, and update compatability with subscribe.

Patch Changes

• Updated dependencies [94ebe5b]:
  • @​envelop/core@​5.6.0

Commits

• 0c6025d Upcoming Release Changes (#4562)
• 94ebe5b chore(deps): support graphql-js v17 (#4545)
• See full diff in compare view

Updates hono from 4.13.2 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267
• fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222
• fix(client): skip undefined header and cookie values in honojs/hono#5244
• fix(client): skip an undefined entry inside a query array in honojs/hono#5272
• fix(client): skip an undefined entry inside a form array in honojs/hono#5280
• fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256
• fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255
• fix(client): omit empty query delimiter in honojs/hono#5283
• fix(request): drop stale content length for cloned FormData in honojs/hono#5282
• fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288
• fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246
• fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

• fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227
• fix(etag): copy pending stream bytes in honojs/hono#5239
• fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234
• fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235
• docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248
• fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

• 06880c4 4.13.5