Skip to content

chore(deps): update npm minor and patch dependencies - #3741

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-minor-patch
Closed

chore(deps): update npm minor and patch dependencies#3741
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/vitest-pool-workers (source) ^0.16.17 → ^0.18.0 age confidence
@hono/node-server ^1.13.7 → ^1.19.14 age confidence
@hono/node-server ^2.0.6 → ^2.0.8 age confidence
@​lovable.dev/vite-plugin-dev-server-bridge 1.0.2 → 1.0.3 age confidence
@​lovable.dev/vite-plugin-hmr-gate 1.1.0 → 1.1.2 age confidence
@​lovable.dev/vite-tanstack-config 2.5.3 → 2.6.5 age confidence
@opentelemetry/exporter-trace-otlp-http (source) ^0.219.0 → ^0.220.0 age confidence
@opentelemetry/resources (source) ^2.8.0 → ^2.9.0 age confidence
@opentelemetry/sdk-trace-node (source) ^2.8.0 → ^2.9.0 age confidence
@radix-ui/react-accordion (source) ^1.2.14 → ^1.2.15 age confidence
@radix-ui/react-alert-dialog (source) ^1.1.17 → ^1.1.18 age confidence
@radix-ui/react-aspect-ratio (source) ^1.1.10 → ^1.1.11 age confidence
@radix-ui/react-avatar (source) ^1.2.0 → ^1.2.1 age confidence
@radix-ui/react-checkbox (source) ^1.3.5 → ^1.3.6 age confidence
@radix-ui/react-collapsible (source) ^1.1.14 → ^1.1.15 age confidence
@radix-ui/react-context-menu (source) ^2.3.1 → ^2.3.2 age confidence
@radix-ui/react-dialog (source) ^1.1.17 → ^1.1.18 age confidence
@radix-ui/react-dropdown-menu (source) ^2.1.18 → ^2.1.19 age confidence
@radix-ui/react-hover-card (source) ^1.1.17 → ^1.1.18 age confidence
@radix-ui/react-label (source) ^2.1.10 → ^2.1.11 age confidence
@radix-ui/react-menubar (source) ^1.1.18 → ^1.1.19 age confidence
@radix-ui/react-navigation-menu (source) ^1.2.16 → ^1.2.17 age confidence
@radix-ui/react-popover (source) ^1.1.17 → ^1.1.18 age confidence
@radix-ui/react-progress (source) ^1.1.10 → ^1.1.11 age confidence
@radix-ui/react-radio-group (source) ^1.4.1 → ^1.4.2 age confidence
@radix-ui/react-scroll-area (source) ^1.2.12 → ^1.2.13 age confidence
@radix-ui/react-select (source) ^2.3.1 → ^2.3.2 age confidence
@radix-ui/react-separator (source) ^1.1.10 → ^1.1.11 age confidence
@radix-ui/react-slider (source) ^1.4.1 → ^1.4.2 age confidence
@radix-ui/react-switch (source) ^1.3.1 → ^1.3.2 age confidence
@radix-ui/react-tabs (source) ^1.1.15 → ^1.1.16 age confidence
@radix-ui/react-toggle (source) ^1.1.12 → ^1.1.13 age confidence
@radix-ui/react-toggle-group (source) ^1.1.13 → ^1.1.14 age confidence
@radix-ui/react-tooltip (source) ^1.2.10 → ^1.2.11 age confidence
@sentry/node (source) ^10.62.0 → ^10.63.0 age confidence
@sentry/opentelemetry (source) ^10.62.0 → ^10.63.0 age confidence
@tailwindcss/vite (source) ^4.3.1 → ^4.3.2 age confidence
@tanstack/react-query (source) ^5.101.0 → ^5.101.2 age confidence
@tanstack/react-router (source) ^1.170.16 → ^1.170.17 age confidence
@tanstack/react-start (source) ^1.168.26 → ^1.168.27 age confidence
@tanstack/router-plugin (source) ^1.168.18 → ^1.168.19 age confidence
@types/node (source) ^22.10.2 → ^22.20.0 age confidence
@types/node (source) ^22.10.0 → ^22.20.0 age confidence
@types/node (source) ^22.19.21 → ^22.20.0 age confidence
agents (source) ^0.16.2 → ^0.17.3 age confidence
hono (source) ^4.6.14 → ^4.12.27 age confidence
hono (source) ^4.12.26 → ^4.12.27 age confidence
js-yaml ^4.2.0 → ^4.3.0 age confidence
motion ^12.40.0 → ^12.42.2 age confidence
node-addon-api ^8.8.0 → ^8.9.0 age confidence
playwright (source) ^1.61.0 → ^1.61.1 age confidence
prettier (source) 3.8.4 → 3.9.4 age confidence
prettier (source) ^3.8.4 → ^3.9.4 age confidence
react-hook-form (source) ^7.79.0 → ^7.80.0 age confidence
react-resizable-panels (source) ^4.11.2 → ^4.12.0 age confidence
tailwindcss (source) ^4.3.1 → ^4.3.2 age confidence
tar ^7.5.16 → ^7.5.19 age confidence
tsx (source) ^4.22.4 → ^4.22.5 age confidence
typescript (source) ^5.7.2 → ^5.9.3 age confidence
typescript (source) ^5.6.3 → ^5.9.3 age confidence
typescript-eslint (source) ^8.61.1 → ^8.62.1 age confidence
vite (source) ^8.0.16 → ^8.1.3 age confidence
wrangler (source) ^4.102.0 → ^4.107.0 age confidence

Dependency PRs must keep npm run test:ci passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.

GitHub Actions updates must remain SHA-pinned.

Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs).

Release Notes

cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.18.0

Compare Source

Minor Changes

  • #​14382 fd92d56 Thanks @​petebacondarwin! - Add support for declarative Durable Object exports

    wrangler deploy now accepts an exports map in wrangler.json as a declarative alternative to the legacy migrations array.

    Each entry in exports is keyed by Durable Object class name. type carries the export kind (currently always "durable-object"); the state field carries the lifecycle and defaults to "created" (live) when omitted:

    {
  "exports": {
    // Provision a new Durable Object class (`MyDO`)
    "MyDO": { "type": "durable-object", "storage": "sqlite" },
    // Delete Durable Object class (`OldGone`)
    "OldGone": { "type": "durable-object", "state": "deleted" },
    // Rename a Durable Object class (from `OldName` to `NewName`)
    "OldName": {
      "type": "durable-object",
      "state": "renamed",
      "renamed_to": "NewName"
    },
    "NewName": { "type": "durable-object", "storage": "sqlite" },
    // Transfer a Durable Object (`Outgoing`) to a new Worker (`target-worker`)
    "Outgoing": {
      "type": "durable-object",
      "state": "transferred",
      "transferred_to": "target-worker"
    },
    // Prepare to receive the transfer of a Durable Object (`Incoming`) from another Worker (`source-worker`)
    "Incoming": {
      "type": "durable-object",
      "state": "expecting-transfer",
      "storage": "sqlite",
      "transfer_from": "source-worker"
    }
  }
}

    When a Worker declares Durable Object class bindings but no lifecycle for them (neither a migrations array nor an exports map), wrangler warns and now suggests a declarative exports entry for each class (previously it suggested a legacy migrations block).

    The deployment response now surfaces the server's reconciliation result — created namespaces, applied tombstones, structured per-scenario info entries, and a removable_entries hint for stale tombstones that are safe to delete from the config. Blocking errors return the structured per-class detail with scenario tags, suggested remediation, and any referencing-script context.

    wrangler versions upload also forwards exports. Declarative exports lifecycle changes are reconciled when the version is deployed (wrangler versions deploy or wrangler deploy), so a versions upload payload can declare new classes in exports without immediately provisioning them. An actor binding (durable_objects.bindings) to a class declared only in exports on the same versions upload is rejected with a clear error (code 100406) — the binding cannot be resolved until the namespace is provisioned. Either stage the new class via ctx.exports.X (no binding required) on versions upload and add the binding at deploy time, or use wrangler deploy to provision and bind in one step (the same constraint applies to the migrations flow).

    Multi-version deploys (wrangler versions deploy A@50% B@50%) where the selected versions disagree on declarative exports are rejected server-side with a clear message: deploy the version that changes exports at 100% first, then run the percentage-split deploy. This prevents traffic on one branch routing to code that references unprovisioned or just-deleted DO namespaces. Single-version (100%) deploys are unaffected.

    Local development (wrangler dev, vite dev and unstable_startWorker) reads Durable Object SQLite storage settings from the new exports field, so applications using the declarative flow get correct local-dev storage without needing to also declare a migrations block.

    @cloudflare/vitest-pool-workers also picks up Durable Object configuration from exports, so tests against an exports-only Worker run with the correct local SQLite storage and can reach unbound Durable Object classes via ctx.exports.X.

    wrangler types is also aware of exports. Live entries (including expecting-transfer, the receiving side of a two-phase transfer) are added to Cloudflare.GlobalProps.durableNamespaces, which types ctx.exports.X for unbound Durable Objects declared only via exports.

Patch Changes

v0.17.0

Compare Source

Minor Changes

  • #​14490 75d8cb0 Thanks @​petebacondarwin! - Make Workflow introspector get() async

    The introspectWorkflow(...).get() method now returns a promise, so callers must await it:

    const introspector = await introspectWorkflow(env.MY_WORKFLOW);

// Before
const instances = introspector.get();

// After
const instances = await introspector.get();

    This aligns Workflow introspection with the shared implementation used by createTestHarness().

Patch Changes

  • #​14490 75d8cb0 Thanks @​petebacondarwin! - Support require("./x.wasm?module") in CommonJS dependencies

    Previously, only literal await import("./x.wasm?module") specifiers were rewritten through the static analysis path added in #​11094. CommonJS dependencies that use require("./x.wasm?module") reach the module-fallback service at runtime, where the ?module suffix went unhandled. The fallback either failed with No such module "<abs>/x.wasm?module" or, when a CompiledWasm rule was configured, attempted to evaluate the WebAssembly bytes as JavaScript.

    However, these require()s work in deployed workers because esbuild's bundler statically rewrites these require() calls into ES dynamic imports. vitest-pool-workers' Vite-based pipeline doesn't do that rewrite and instead defers to the module-fallback at runtime.

    The module-fallback now strips ?module from the resolved target and synthesizes a CommonJS wrapper that re-requires the underlying .wasm by absolute path, exposing it on default to match what workerd produces for CompiledWasm modules.

  • Updated dependencies [75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, f10d4ad, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, d292046, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, 75d8cb0, e0cc2cb, 75d8cb0, 75d8cb0, 75d8cb0]:

    • wrangler@​4.106.0
    • miniflare@​4.20260630.0

v0.16.20

Compare Source

Patch Changes

  • #​14398 c5014cc Thanks @​apeacock1991! - Add evictDurableObject and evictAllDurableObjects test helpers to cloudflare:test

    These helpers let you exercise how a Durable Object behaves across evictions in your tests. Eviction is graceful: durable storage is preserved, in-memory state is reset by tearing down the instance, hibernatable WebSockets are hibernated rather than closed, and eviction waits for in-flight requests to drain.

    import { evictDurableObject, evictAllDurableObjects } from "cloudflare:test";
import { env } from "cloudflare:workers";

const id = env.COUNTER.idFromName("my-counter");
const stub = env.COUNTER.get(id);

// Evict the Durable Object instance pointed to by a specific stub
await evictDurableObject(stub);
await evictDurableObject(stub, { webSockets: "close" });

// Evict all currently-running Durable Objects in evictable namespaces
await evictAllDurableObjects();

  • #​14394 8a5cf8c Thanks @​Partha-Shankar! - fix(d1): escape migrationsTableName and filenames in SQLite queries

    D1 migration commands in both wrangler and @cloudflare/vitest-pool-workers interpolated the migrationsTableName config value and migration filenames directly into SQL strings without any escaping. This meant:

    • A table name such as my"table would produce invalid SQL in CREATE TABLE, SELECT, and INSERT statements, and
    • A migration filename containing an apostrophe (e.g. what's-new.sql) would break the INSERT INTO ... VALUES ('...') statement appended after each migration in wrangler.

    Both identifiers are now properly escaped before interpolation: migrationsTableName is wrapped in double-quotes with internal double-quotes doubled (SQL-standard identifier quoting), and migration filenames used as string literals have their single-quotes doubled before insertion.

  • Updated dependencies [5f40dd5, 34e0cef, 3b743c1, daa5389, 8a5cf8c]:

    • wrangler@​4.105.0
    • miniflare@​4.20260625.0

v0.16.19

Compare Source

Patch Changes

v0.16.18

Compare Source

Patch Changes
honojs/node-server (@​hono/node-server)

v2.0.8

Compare Source

What's Changed

Full Changelog: honojs/node-server@v2.0.7...v2.0.8

open-telemetry/opentelemetry-js (@​opentelemetry/exporter-trace-otlp-http)

v0.220.0

Compare Source

radix-ui/primitives (@​radix-ui/react-accordion)

v1.2.15

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-collapsible@1.1.15, @radix-ui/react-collection@1.1.11
radix-ui/primitives (@​radix-ui/react-alert-dialog)

v1.1.18

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dialog@1.1.18
radix-ui/primitives (@​radix-ui/react-aspect-ratio)

v1.1.11

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-avatar)

v1.2.1

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-checkbox)

v1.3.6

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-collapsible)

v1.1.15

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-context-menu)

v2.3.2

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-menu@2.1.19
radix-ui/primitives (@​radix-ui/react-dialog)

v1.1.18

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-focus-scope@1.1.11, @radix-ui/react-portal@1.1.13
radix-ui/primitives (@​radix-ui/react-dropdown-menu)

v2.1.19

  • Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.
Other updates
  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-menu@2.1.19
radix-ui/primitives (@​radix-ui/react-hover-card)

v1.1.18

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-popper@1.3.2, @radix-ui/react-portal@1.1.13
radix-ui/primitives (@​radix-ui/react-label)

v2.1.11

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-menubar)

v1.1.19

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-menu@2.1.19, @radix-ui/react-collection@1.1.11, @radix-ui/react-roving-focus@1.1.14
radix-ui/primitives (@​radix-ui/react-navigation-menu)

v1.2.17

  • Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.
Other updates
  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-collection@1.1.11, @radix-ui/react-visually-hidden@1.2.7
radix-ui/primitives (@​radix-ui/react-popover)

v1.1.18

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-focus-scope@1.1.11, @radix-ui/react-popper@1.3.2, @radix-ui/react-portal@1.1.13
radix-ui/primitives (@​radix-ui/react-progress)

v1.1.11

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-radio-group)

v1.4.2

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-roving-focus@1.1.14
radix-ui/primitives (@​radix-ui/react-scroll-area)

v1.2.13

  • Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.
Other updates
  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-select)

v2.3.2

  • Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.
Other updates
  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-focus-scope@1.1.11, @radix-ui/react-popper@1.3.2, @radix-ui/react-collection@1.1.11, @radix-ui/react-portal@1.1.13, @radix-ui/react-visually-hidden@1.2.7
radix-ui/primitives (@​radix-ui/react-separator)

v1.1.11

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-slider)

v1.4.2

  • Fixed infinite re-render loop in React 19 caused by unstable composed ref callback references.
Other updates
  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-collection@1.1.11
radix-ui/primitives (@​radix-ui/react-switch)

v1.3.2

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-tabs)

v1.1.16

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-roving-focus@1.1.14
radix-ui/primitives (@​radix-ui/react-toggle)

v1.1.13

  • Updated dependencies: @radix-ui/react-primitive@2.1.7
radix-ui/primitives (@​radix-ui/react-toggle-group)

v1.1.14

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-roving-focus@1.1.14, @radix-ui/react-toggle@1.1.13
radix-ui/primitives (@​radix-ui/react-tooltip)

v1.2.11

  • Updated dependencies: @radix-ui/react-primitive@2.1.7, @radix-ui/react-dismissable-layer@1.1.14, @radix-ui/react-popper@1.3.2, @radix-ui/react-portal@1.1.13, @radix-ui/react-visually-hidden@1.2.7
getsentry/sentry-javascript (@​sentry/node)

v10.63.0

Compare Source

  • feat(browser): Add url.full attribute to resource spans (#​21846)
  • feat(core): Add extendIntegration method (#​21759)
  • feat(core): Add isTracingSuppressed to the async context strategy (#​21785)
  • feat(core): Pass normalizedRequest to the sampling context for root spans (#​21833)
  • feat(node): Add lru-memoizer diagnostics-channel integration to experimentalUseDiagnosticsChannelInjection (#​21786)
  • feat(node): Expose channel-based, streamlined fastifyIntegration (#​21706)
  • fix(browser): Defer sending session envelope until browser is idle (#​21844)
  • fix(core): Improve waiting for tracing channel bindings (#​21815)
  • fix(core): Serialize streamed span status message to sentry.status.message attribute (#​21811)
  • fix(nextjs): Don't inject trace meta tags when Cache Components is enabled (#​21141)
  • fix(opentelemetry): Strip leading

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Phoenix)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from JSONbored as a code owner July 6, 2026 07:02
@superagent-security

superagent-security Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@codecov

codecov Bot commented Jul 6, 2026

Copy link
Copy Markdown

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 gittensory-ui 643aa33 Commit Preview URL

Branch Preview URL		 Jul 06 2026, 07:45 AM

@loopover-orb loopover-orb Bot added gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. manual-review Gittensor contributor context labels Jul 6, 2026
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from 2ac231a to ec690ef Compare July 6, 2026 07:08
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from ec690ef to db05f63 Compare July 6, 2026 07:13
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch 2 times, most recently from f2819e8 to bbafdeb Compare July 6, 2026 07:17
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from bbafdeb to 5e162bf Compare July 6, 2026 07:23
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from 5e162bf to 2560730 Compare July 6, 2026 07:25
@jimcody1995 jimcody1995 mentioned this pull request Jul 6, 2026
Merged
10 tasks
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from 2560730 to cd2dd1a Compare July 6, 2026 07:36
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from cd2dd1a to f1fa670 Compare July 6, 2026 07:38
@kiannidev kiannidev mentioned this pull request Jul 6, 2026
Merged
2 tasks
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from f1fa670 to 0b00085 Compare July 6, 2026 07:40
@renovate
renovate Bot force-pushed the renovate/npm-minor-patch branch from 0b00085 to 643aa33 Compare July 6, 2026 07:42
@JSONbored JSONbored closed this Jul 6, 2026
@sentry sentry Bot mentioned this pull request Jul 7, 2026
Merged
24 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JSONbored JSONbored Awaiting requested review from JSONbored JSONbored is a code owner

Assignees

@JSONbored JSONbored

Labels

gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. manual-review Gittensor contributor context

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JSONbored