Skip to content

fix(deps): update all non-major dependencies#1168

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#1168
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Mar 30, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/vite-plugin (source) ^1.30.0 → ^1.30.2 age confidence
@rolldown/pluginutils (source) 1.0.0-rc.10 → 1.0.0-rc.12 age confidence
oxfmt (source) ^0.41.0 → ^0.42.0 age confidence
pnpm (source) 10.32.1 → 10.33.0 age confidence
react-router (source) 7.13.1 → 7.13.2 age confidence
rolldown (source) 1.0.0-rc.10 → 1.0.0-rc.12 age confidence
srvx (source) ^0.11.12 → ^0.11.13 age confidence
tsdown (source) ^0.21.4 → ^0.21.7 age confidence
typescript-eslint (source) ^8.57.1 → ^8.58.0 age confidence
vite (source) ^8.0.1 → ^8.0.3 age confidence
vitest (source) ^4.1.0 → ^4.1.2 age confidence
wrangler (source) ^4.76.0 → ^4.78.0 age confidence

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.30.2

Compare Source

Patch Changes

v1.30.1

Compare Source

Patch Changes

  • #​12851 86a40f0 Thanks @​jamesopstad! - Fix a bug that prevented using subpath imports for additional module types

    You can now use subpath imports for additional module types (.html, .txt, .sql, .bin, .wasm) by defining them in your package.json imports field:

    // package.json
{
  "imports": {
    "#templates/page": "./src/templates/page.html"
  }
}
    import page from "#templates/page";

export default {
  fetch() {
    return new Response(page, {
      headers: { "Content-Type": "text/html" },
    });
  },
} satisfies ExportedHandler;

  • Updated dependencies [593c4db, b8f3309, 451dae3, 5aaaab2, 5aaaab2, f8516dd, 9c9fe30, 379f2a2, c2e9163, 6a6449e, 9a1cf29, 875da60]:

    • wrangler@​4.77.0
    • miniflare@​4.20260317.2
rolldown/rolldown (@​rolldown/pluginutils)

v1.0.0-rc.12

Compare Source

🚀 Features
  • chunk-optimizer: skip circular dependency check when strict execution order is enabled (#​8886) by @​hyf0
🐛 Bug Fixes
🚜 Refactor
  • treeshake: migrate SideEffectDetector to Oxc's MayHaveSideEffects trait (#​8624) by @​Dunqing
🧪 Testing
  • make dev server tests deterministic by replacing fixed sleeps with event-driven polling (#​8561) by @​Boshen
⚙️ Miscellaneous Tasks

v1.0.0-rc.11

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks
❤️ New Contributors
oxc-project/oxc (oxfmt)

v0.42.0

Compare Source

🚀 Features
  • 416865a formatter,oxfmt: Add doc comments for JsdocConfig (#​20644) (leaysgur)
  • 4fec907 formatter: Add JSDoc comment formatting support (#​19828) (Dunqing)
pnpm/pnpm (pnpm)

v10.33.0

Compare Source

remix-run/react-router (react-router)

v7.13.2

Compare Source

Patch Changes

  • Fix clientLoader.hydrate when an ancestor route is also hydrating a clientLoader (#​14835)

  • Fix type error when passing Framework Mode route components using Route.ComponentProps to createRoutesStub (#​14892)

  • Fix percent encoding in relative path navigation (#​14786)

  • Add future.unstable_passThroughRequests flag (#​14775)

    By default, React Router normalizes the request.url passed to your loader, action, and middleware functions by removing React Router's internal implementation details (.data suffixes, index + _routes query params).

    Enabling this flag removes that normalization and passes the raw HTTP request instance to your handlers. This provides a few benefits:

    • Reduces server-side overhead by eliminating multiple new Request() calls on the critical path
    • Allows you to distinguish document from data requests in your handlers base don the presence of a .data suffix (useful for observability purposes)

    If you were previously relying on the normalization of request.url, you can switch to use the new sibling unstable_url parameter which contains a URL instance representing the normalized location:

    // ❌ Before: you could assume there was no `.data` suffix in `request.url`
export async function loader({ request }: Route.LoaderArgs) {
  let url = new URL(request.url);
  if (url.pathname === "/path") {
    // This check will fail with the flag enabled because the `.data` suffix will
    // exist on data requests
  }
}

// ✅ After: use `unstable_url` for normalized routing logic and `request.url`
// for raw routing logic
export async function loader({ request, unstable_url }: Route.LoaderArgs) {
  if (unstable_url.pathname === "/path") {
    // This will always have the `.data` suffix stripped
  }

  // And now you can distinguish between document versus data requests
  let isDataRequest = new URL(request.url).pathname.endsWith(".data");
}

  • Internal refactor to consolidate framework-agnostic/React-specific route type layers - no public API changes (#​14765)

  • Sync protocol validation to rsc flows (#​14882)

  • Add a new unstable_url: URL parameter to route handler methods (loader, action, middleware, etc.) representing the normalized URL the application is navigating to or fetching, with React Router implementation details removed (.datasuffix, index/_routes query params) (#​14775)

    This is being added alongside the new future.unstable_passthroughRequests future flag so that users still have a way to access the normalized URL when that flag is enabled and non-normalized request's are being passed to your handlers. When adopting this flag, you will only need to start leveraging this new parameter if you are relying on the normalization of request.url in your application code.

    If you don't have the flag enabled, then unstable_url will match request.url.

rolldown/tsdown (tsdown)

v0.21.7

Compare Source

   🚀 Features
  • Add module option for attw and publint to allow passing imported modules directly  -  by @​sxzz (31e90)
   🐞 Bug Fixes
  • deps: Add skipNodeModulesBundle dep subpath e2e tests and fix docs  -  by @​sxzz (deff7)
    View changes on GitHub

v0.21.6

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v0.21.5

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
typescript-eslint/typescript-eslint (typescript-eslint)

v8.58.0

Compare Source

🚀 Features
❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.2

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

vitejs/vite (vite)

v8.0.3

Compare Source

Features
Bug Fixes
  • html: cache unfiltered CSS list to prevent missing styles across entries (#​22017) (5464190)
  • module-runner: handle non-ascii characters in base64 sourcemaps (#​21985) (77c95bf)
  • module-runner: skip re-import if the runner is closed (#​22020) (ee2c2cd)
  • optimizer: scan is not resolving sub path import if used in a glob import (#​22018) (ddfe20d)
  • ssr: ssrTransform incorrectly rewrites meta identifier inside import.meta when a binding named meta exists (#​22019) (cff5f0c)
Miscellaneous Chores
Tests

v8.0.2

Compare Source

Features
Bug Fixes
Miscellaneous Chores
vitest-dev/vitest (vitest)

v4.1.2

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#​9975).

   🐞 Bug Fixes
    View changes on GitHub

v4.1.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
cloudflare/workers-sdk (wrangler)

v4.78.0

Compare Source

Minor Changes

  • #​13031 eeaa473 Thanks @​WalshyDev! - Add support for Cloudflare Access Service Token authentication via environment variables

    When running wrangler dev with remote bindings behind a Cloudflare Access-protected domain, Wrangler previously required cloudflared access login which opens a browser for interactive authentication. This does not work in CI/CD environments.

    You can now set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate using an Access Service Token instead:

    export CLOUDFLARE_ACCESS_CLIENT_ID="<your-client-id>.access"
export CLOUDFLARE_ACCESS_CLIENT_SECRET="<your-client-secret>"
wrangler dev

    Additionally, when running in a non-interactive environment (CI) without these credentials, Wrangler now throws a clear, actionable error instead of hanging on cloudflared access login.

  • #​13027 9fcdfca Thanks @​G4brym! - feat: Add ai_search_namespaces and ai_search binding types

    Two new binding types for AI Search:

    • ai_search_namespaces: Namespace binding — namespace is required and auto-provisioned at deploy time if it doesn't exist (like R2 buckets)
    • ai_search: Single instance binding bound directly to a pre-existing instance in the default namespace

    Both are remote-only in local dev.

  • #​12874 53ed15a Thanks @​xortive! - Add Workers VPC service support for Hyperdrive origins

    Hyperdrive configs can now connect to databases through Workers VPC services using the --service-id option:

    wrangler hyperdrive create my-config --service-id <vpc-service-uuid> --database mydb --user myuser --password mypassword

    This enables Hyperdrive to connect to databases hosted in private networks that are accessible through Workers VPC TCP services.

  • #​12852 6b50bfa Thanks @​Carolx715! - Add interactive data catalog validation to R2 object and lifecycle commands.

    When performing R2 operations that could affect data catalog state (object put, object delete, lifecycle add, lifecycle set), Wrangler now validates with the API and prompts users for confirmation if a conflict is detected. For bulk put operations, Wrangler prompts upfront before starting the batch. Users can bypass prompts with --force (-y). In non-interactive/CI environments, the operation proceeds automatically.

  • #​13030 0386553 Thanks @​natewong1313! - Add local mode support for Stream bindings

    Miniflare and wrangler dev now support using Cloudflare Stream bindings locally.

    Supported operations:

    • upload() — upload video via URL
    • video(id).details(), .update(), .delete(), .generateToken()
    • videos.list()
    • captions.generate(), .list(), .delete()
    • downloads.generate(), .get(), .delete()
    • watermarks.generate(), .list(), .get(), .delete()

    The following are not yet supported in local mode and will throw:

    • createDirectUpload()
    • Caption upload via File
    • Watermark generation via File

    Data is persisted across restarts by default. You must set streamPersist: false in Miniflare options to disable persistence.

  • #​12874 53ed15a Thanks @​xortive! - Add --cert-verification-mode option to wrangler vpc service create and wrangler vpc service update

    You can now configure the TLS certificate verification mode when creating or updating a VPC connectivity service. This controls how the connection to the origin server verifies TLS certificates.

    Available modes:

    • verify_full (default) -- verify certificate chain and hostname
    • verify_ca -- verify certificate chain only, skip hostname check
    • disabled -- do not verify the server certificate at all
    wrangler vpc service create my-service --type tcp --tcp-port 5432 --ipv4 10.0.0.1 --tunnel-id <tunnel-uuid> --cert-verification-mode verify_ca

    This applies to both TCP and HTTP VPC service types. When omitted, the default verify_full behavior is used.

  • #​12874 53ed15a Thanks @​xortive! - Add TCP service type support for Workers VPC

    You can now create TCP services in Workers VPC using the --type tcp option:

    wrangler vpc service create my-db --type tcp --tcp-port 5432 --ipv4 10.0.0.1 --tunnel-id <tunnel-uuid>

    This enables exposing TCP-based services like PostgreSQL, MySQL, and other database servers through Workers VPC.

Patch Changes

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 97dfc77 to 7e14521 Compare March 30, 2026 22:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants