Bump the minor-and-patch group across 1 directory with 8 updates by dependabot[bot] · Pull Request #54 · nyuchi/workspace-tools

dependabot · 2026-09-07T21:45:57Z

Bumps the minor-and-patch group with 8 updates in the / directory:

Package	From	To
@modelcontextprotocol/sdk	`1.29.0`	`1.30.0`
hono	`4.12.32`	`4.13.7`
jose	`6.2.3`	`6.2.11`
zod	`4.4.3`	`4.5.4`
@cloudflare/workers-types	`5.20260726.1`	`5.20260904.1`
@google/clasp	`3.3.0`	`3.4.1`
@types/google-apps-script	`2.0.11`	`2.0.12`
wrangler	`4.114.0`	`4.129.0`

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

fix(server): prioritize zod issues and format them by @mozmo15 in modelcontextprotocol/typescript-sdk#1503

chore(ci): switch publish to OIDC trusted publishing by @felixweinberger in modelcontextprotocol/typescript-sdk#1839

Add end-to-end test suite by @felixweinberger in modelcontextprotocol/typescript-sdk#2167

v1 stdio buffer limit by @KKonstantinov in modelcontextprotocol/typescript-sdk#2239

fix: support Zod 3.25 method literals by @mattzcarey in modelcontextprotocol/typescript-sdk#2368

Validate Content-Type by parsed media type instead of substring match (v1.x) by @felixweinberger in modelcontextprotocol/typescript-sdk#2444

fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @mattzcarey in modelcontextprotocol/typescript-sdk#2538

fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 by @arimu1 in modelcontextprotocol/typescript-sdk#2549

Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @felixweinberger in modelcontextprotocol/typescript-sdk#2547

chore: bump version to 1.30.0 by @felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

@mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503

@arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

2d889f2 chore: bump version to 1.30.0 (#2563)
e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
bb5a718 fix(deps): widen @hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
369513d fix: support Zod 3.25 method literals (#2368)
e7ee57c v1 stdio buffer limit (#2239)
c36e1ef Add end-to-end test suite (#2167)
bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
9edbab7 fix(server): prioritize zod issues and format them (#1503)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @modelcontextprotocol/sdk since your current version.

Updates hono from 4.12.32 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297

fix(client): normalize root WebSocket URLs in honojs/hono#5291

fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300

chore: bump editorconfig-checker in honojs/hono#5336

refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

eebdf7b 4.13.7
2b8ed40 Merge commit from fork
cac0c4d 4.13.6
dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
ec648d6 chore: bump editorconfig-checker (#5336)
e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
499c35e fix(client): normalize root WebSocket URLs (#5291)
50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
06880c4 4.13.5
531e9c5 Merge commit from fork
Additional commits viewable in compare view

Updates jose from 6.2.3 to 6.2.11

Release notes

Sourced from jose's releases.

v6.2.11

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

jwks: compact JWK Set shape validation (930c7df), references Array#every

jwks: compact local key selection (4cb5ae5)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.11 (2026-09-04)

Documentation

render subpath indexes as tables (94589ee)

shorten API index descriptions (681482f)

Refactor

model JWE key management modes (e01dda6)

types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

jose: consume serialization members once (9bee285)

jose: reject empty protected and JWE AAD members (8da4145)

jose: validate serialized header values (b711d8f)

jwe: conceal invalid decrypted CEK lengths (41fafe0)

jwe: enforce AES-GCM tag boundaries (9a5b744)

jwe: validate explicit encryption parameters (7a02697)

jwk: accept empty octet-sequence keys (3f871e7)

jwk: normalize key resolution inputs (f54ee7b)

jwks: enforce verification key metadata (f9ba510)

jwks: order overlapping remote reloads (9a1a913)

jwks: reject invalid remote duration values (7bdb9e5)

jwk: validate ext and key_ops parameters (4d91c37)

jws: reject mixed payload encoding modes (dc69713)

jws: validate unencoded payload strings (541f282)

jwt: enforce explicit verification policies (b347182)

jwt: prevent replacing protected headers (ae07d09)

jwt: reject invalid duration inputs (282f9aa)

jwt: validate builder claim values (ea03f83)

jwt: validate unsecured protected headers (230c14e)

key: validate generation and import options (15d880e)

reject mixed b64 modes for empty General JWS payloads (61a2ef7)

x509: reject DER truncated past its outer length (d8db9f6)

Documentation

jwks: correct cache timestamp units (01a44d9)

Refactor

jose: share binary input validation (eedb124)

jose: share compact token processing internals (85e30ed)

jwe: consolidate CBC decryption failures (1ee6f61)

jwe: specialize compact processing (a998927)

jwe: streamline single-recipient encryption (290aaa6)

... (truncated)

Commits

f5e5606 chore(release): 6.2.11
d60f1b4 chore: bump packages
55b970f refactor(types): reduce declaration repetition
681482f docs: shorten API index descriptions
33c8817 build: verify published subpath contract
542829d build: compact emitted ESM syntax
94589ee docs: render subpath indexes as tables
a778a0b test: cover root exports and algorithm facades
e01dda6 refactor: model JWE key management modes
920bc40 ci: test trigger-ci pushes
Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.5.4

Release notes

Sourced from zod's releases.

v4.5.4

Commits:

84e416fbf4740527bbc8f319634f4e1b065bb42c fix(v4): stop the cycle walk from firing a default factory (#6500)

e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653 4.5.4

v4.5.3

Commits:

e6b6ab347675cd2bd54b1bdbed16f98c59be82a9 docs(blog): widen the z.compile example to a 20-property schema

87d6464418582bb96fc665a01f852ca6da324ad0 fix(docs): drop the OG description when the title wraps past two lines

99fce394a026823e602b9c30d8d5d9f5f1932ce7 bench(v4): z.compile() against zod-compiler (#6499)

e3a695b6bf3f0d591ea682816e3cdaea04b0f967 docs(v4): record the email regex and container output-shape findings under Open

7e24a24288183ce02554f1ded7775d0650a7b7e6 docs(blog): drop the reading time and put a GitHub link in the navbar

eab51ff3592b2d11d863f4ee4d5452f31a3de1b6 fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)

v4.5.2

Commits:

a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)

d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)

212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)

e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)

fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator

6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)

6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution

019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates

652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller

571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card

9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm

8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.
npm install zod@latest
At a glance:

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD

... (truncated)

Commits

e8e206f 4.5.4
84e416f fix(v4): stop the cycle walk from firing a default factory (#6500)
1a16102 4.5.3
eab51ff fix(v4): emit record numeric keys as strings in toJSONSchema (#6497)
7e24a24 docs(blog): drop the reading time and put a GitHub link in the navbar
e3a695b docs(v4): record the email regex and container output-shape findings under Open
99fce39 bench(v4): z.compile() against zod-compiler (#6499)
87d6464 fix(docs): drop the OG description when the title wraps past two lines
e6b6ab3 docs(blog): widen the z.compile example to a 20-property schema
9a193aa 4.5.2
Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260726.1 to 5.20260904.1

Commits

See full diff in compare view

Updates @google/clasp from 3.3.0 to 3.4.1

Release notes

Sourced from @google/clasp's releases.

v3.4.1

3.4.1 (2026-08-28)

Bug Fixes

files: prevent rootDir double application during pull, clone, and create (13d3322)

v3.4.0

3.4.0 (2026-08-20)

Features

cli: add global --allow-symlinks option for shared symlinked folders/files (78d7104)

commands: surface security warnings for skipped files and enforce strict deletion boundaries (f2d835d)

implement PKCE support in OAuth flows (#1142) (1a1665e)

Bug Fixes

auth: remove hardcoded OAuth client secret from published npm package (CWE-798) (#1139) (a678e92)

auth: restore OAuth client secret for desktop public client compatibility (be27aaf)

auth: secure credential file writing with symlink protection and permissions (378c1a6)

core: secure file system crawling, atomic writes, and structured security reporting (aa4cfeb)

create-script: accept --type webapp and --type api as standalone aliases (#1155) (34a468e), refs #1154

deps: update google-auth-library and googleapis to resolve Node 22+/25+ compatibility issues (87a3759)

mcp: validate projectDir against permitted base paths (CWE-22 path traversal) (#1141) (1e8132c)

prevent OAuth CSRF via missing state parameter in authorization flow (#1135) (8dac6c2)

Print help instead of throwing error on unknown commands (#1157) (39a9c12)

security: clean up CSRF demo script and harden path boundary & test mocks (0a28a48)

security: prevent path traversal via srcDir in .clasp.json (#1140) (408448e)

security: validate sourceDir MCP parameter and use realpath in WriteFiles (#1144) (4eb9dca)

Changelog

Sourced from @google/clasp's changelog.

3.4.1 (2026-08-28)

Bug Fixes

files: prevent rootDir double application during pull, clone, and create (13d3322)

3.4.0 (2026-08-20)

Features

cli: add global --allow-symlinks option for shared symlinked folders/files (78d7104)

commands: surface security warnings for skipped files and enforce strict deletion boundaries (f2d835d)

implement PKCE support in OAuth flows (#1142) (1a1665e)

Bug Fixes

auth: secure credential file writing with symlink protection and permissions (378c1a6)

core: secure file system crawling, atomic writes, and structured security reporting (aa4cfeb)

create-script: accept --type webapp and --type api as standalone aliases (#1155) (34a468e), refs #1154

deps: update google-auth-library and googleapis to resolve Node 22+/25+ compatibility issues (87a3759)

mcp: validate projectDir against permitted base paths (CWE-22 path traversal) (#1141) (1e8132c)

prevent OAuth CSRF via missing state parameter in authorization flow (#1135) (8dac6c2)

Print help instead of throwing error on unknown commands (#1157) (39a9c12)

security: clean up CSRF demo script and harden path boundary & test mocks (0a28a48)

security: prevent path traversal via srcDir in .clasp.json (#1140) (408448e)

security: validate sourceDir MCP parameter and use realpath in WriteFiles (#1144) (4eb9dca)

Commits

e9441e5 chore(master): release 3.4.1 (#1167)
b907723 test(commands): normalize stubbed localPath in unsafe deletion test
af0332f test(commands): normalize path separators in pull tests for Windows compatibi...
13d3322 fix(files): prevent rootDir double application during pull, clone, and create
efd0524 chore(master): release 3.4.0 (#1138)
ec5608c test(core): normalize localPath in files_security tests for Windows compatibi...
6b6c742 Regenerate package-lock.json
be55a0d chore(deps): update minor/patch dependencies and fix transitive audit vulnera...
87a3759 fix(deps): update google-auth-library and googleapis to resolve Node 22+/25+ ...
378c1a6 fix(auth): secure credential file writing with symlink protection and permiss...
Additional commits viewable in compare view

Updates @types/google-apps-script from 2.0.11 to 2.0.12

Commits

See full diff in compare view

Updates wrangler from 4.114.0 to 4.129.0

Release notes

Sourced from wrangler's releases.

wrangler@4.129.0

Minor Changes

#15460 93d72a5 Thanks @QnJ1c2kNCg! - Support gzip compression for JSON Pipelines sinks

Pipelines is in open beta. wrangler pipelines sinks create and the interactive setup flow now pass the selected JSON compression to the Pipelines API. JSON sinks accept uncompressed or gzip, while Parquet retains its existing compression options and zstd default.

#15358 d2d8eea Thanks @pombosilva! - Add a --json flag to the wrangler workflows commands

Every wrangler workflows command now accepts --json, which emits the raw API payload instead of the human-readable rendering. The formatted output remains the default, so existing usage is unaffected:

wrangler workflows instances list my-workflow --json

The JSON output carries raw values rather than a serialisation of the formatted view: ISO timestamps instead of locale-formatted dates, plain status strings instead of emojified labels, and no presentation-only derived fields.

Patch Changes

#15469 d40a634 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260831.1 ^5.20260902.1

workerd 1.20260831.1 1.20260902.1

#15481 7c1b2a6 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260902.1 ^5.20260903.1

workerd 1.20260902.1 1.20260903.1

#15472 f6fb347 Thanks @emily-shen! - Tolerate missing permissions during wrangler delete cleanup checks

wrangler delete now warns and continues when it cannot inspect Worker dependencies or clean up legacy Workers Sites KV namespaces because of missing permissions. The Worker delete request itself still fails normally if the token cannot delete the Worker.

#15472 f6fb347 Thanks @emily-shen! - Tolerate missing resource permissions during resource provisioning

When Wrangler cannot check whether a bound resource exists because the API returns a 403, it now skips automatic provisioning for that resource type and continues the deploy. The deploy may still fail later if the resource is missing.

#15476 dc24057 Thanks @christhorwarth! - Fix remote development with static assets for API tokens using granular Worker permissions

Wrangler now creates Workers.dev preview sessions through the Worker-scoped endpoint and derives the preview hostname from the session response. This avoids requiring account-level Workers subdomain access.

Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6]:

miniflare@5.20260903.0-alpha

... (truncated)

Commits

Bumps the minor-and-patch group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` | | [hono](https://github.com/honojs/hono) | `4.12.32` | `4.13.7` | | [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.11` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260726.1` | `5.20260904.1` | | [@google/clasp](https://github.com/google/clasp) | `3.3.0` | `3.4.1` | | [@types/google-apps-script](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/google-apps-script) | `2.0.11` | `2.0.12` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.114.0` | `4.129.0` | Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0) Updates `hono` from 4.12.32 to 4.13.7 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.32...v4.13.7) Updates `jose` from 6.2.3 to 6.2.11 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.3...v6.2.11) Updates `zod` from 4.4.3 to 4.5.4 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.4) Updates `@cloudflare/workers-types` from 5.20260726.1 to 5.20260904.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `@google/clasp` from 3.3.0 to 3.4.1 - [Release notes](https://github.com/google/clasp/releases) - [Changelog](https://github.com/google/clasp/blob/master/CHANGELOG.md) - [Commits](google/clasp@v3.3.0...v3.4.1) Updates `@types/google-apps-script` from 2.0.11 to 2.0.12 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/google-apps-script) Updates `wrangler` from 4.114.0 to 4.129.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.129.0/packages/wrangler) --- updated-dependencies: - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: hono dependency-version: 4.13.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: jose dependency-version: 6.2.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: zod dependency-version: 4.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@cloudflare/workers-types" dependency-version: 5.20260904.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@google/clasp" dependency-version: 3.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@types/google-apps-script" dependency-version: 2.0.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: wrangler dependency-version: 4.129.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-09-07T21:46:49Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	nyuchi-tools	`987e167`	Sep 07 2026, 09:46 PM

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026

dependabot Bot requested a review from bryanfawcett as a code owner September 7, 2026 21:45

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026

Navigation Menu

Uh oh!

Bump the minor-and-patch group across 1 directory with 8 updates - #54

Bump the minor-and-patch group across 1 directory with 8 updates#54
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-f927485557

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 7, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
`@cloudflare/workers-types`	^5.20260831.1	^5.20260902.1
workerd	1.20260831.1	1.20260902.1

Dependency	From	To
`@cloudflare/workers-types`	^5.20260902.1	^5.20260903.1
workerd	1.20260902.1	1.20260903.1

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

1.30.0

What's Changed

New Contributors

v4.13.7

Security fixes

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

v4.13.6

What's Changed

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v6.2.11

Documentation

Refactor

v6.2.10

Fixes

Documentation

Refactor

6.2.11 (2026-09-04)

Documentation

Refactor

6.2.10 (2026-08-21)

Fixes

Documentation

Refactor

v4.5.4

Commits:

v4.5.3

Commits:

v4.5.2

Commits:

v4.5.1

Commits:

v4.5.0

v3.4.1

3.4.1 (2026-08-28)

Bug Fixes

v3.4.0

3.4.0 (2026-08-20)

Features

Bug Fixes

3.4.1 (2026-08-28)

Bug Fixes

3.4.0 (2026-08-20)

Features

Bug Fixes

wrangler@4.129.0

Minor Changes

Patch Changes

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`hono/jsx` renders plain strings unescaped in boundary components, leading to XSS

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

cloudflare-workers-and-pages Bot commented Sep 7, 2026 •

edited

Loading