chore(deps): update npm minor and patch dependencies by renovate[bot] · Pull Request #996 · JSONbored/loopover

renovate · 2026-06-22T07:37:06Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vitest-pool-workers (source)	`^0.16.10` → `^0.16.17`
@eslint/js (source)	`^9.32.0` → `^9.39.4`
@hookform/resolvers (source)	`^5.2.2` → `^5.4.0`
@lovable.dev/vite-plugin-dev-server-bridge	`1.0.1` → `1.0.2`
@lovable.dev/vite-plugin-hmr-gate	`1.0.1` → `1.1.0`
@lovable.dev/vite-tanstack-config	`^2.1.1` → `^2.5.3`
@radix-ui/react-accordion (source)	`^1.2.12` → `^1.2.14`
@radix-ui/react-alert-dialog (source)	`^1.1.15` → `^1.1.17`
@radix-ui/react-aspect-ratio (source)	`^1.1.8` → `^1.1.10`
@radix-ui/react-avatar (source)	`^1.1.11` → `^1.2.0`
@radix-ui/react-checkbox (source)	`^1.3.3` → `^1.3.5`
@radix-ui/react-collapsible (source)	`^1.1.12` → `^1.1.14`
@radix-ui/react-context-menu (source)	`^2.2.16` → `^2.3.1`
@radix-ui/react-dialog (source)	`^1.1.15` → `^1.1.17`
@radix-ui/react-dropdown-menu (source)	`^2.1.16` → `^2.1.18`
@radix-ui/react-hover-card (source)	`^1.1.15` → `^1.1.17`
@radix-ui/react-label (source)	`^2.1.8` → `^2.1.10`
@radix-ui/react-menubar (source)	`^1.1.16` → `^1.1.18`
@radix-ui/react-navigation-menu (source)	`^1.2.14` → `^1.2.16`
@radix-ui/react-popover (source)	`^1.1.15` → `^1.1.17`
@radix-ui/react-progress (source)	`^1.1.8` → `^1.1.10`
@radix-ui/react-radio-group (source)	`^1.3.8` → `^1.4.1`
@radix-ui/react-scroll-area (source)	`^1.2.10` → `^1.2.12`
@radix-ui/react-select (source)	`^2.2.6` → `^2.3.1`
@radix-ui/react-separator (source)	`^1.1.8` → `^1.1.10`
@radix-ui/react-slider (source)	`^1.3.6` → `^1.4.1`
@radix-ui/react-slot (source)	`^1.2.4` → `^1.3.0`
@radix-ui/react-switch (source)	`^1.2.6` → `^1.3.1`
@radix-ui/react-tabs (source)	`^1.1.13` → `^1.1.15`
@radix-ui/react-toggle (source)	`^1.1.10` → `^1.1.12`
@radix-ui/react-toggle-group (source)	`^1.1.11` → `^1.1.13`
@radix-ui/react-tooltip (source)	`^1.2.8` → `^1.2.10`
@tailwindcss/vite (source)	`^4.2.1` → `^4.3.1`
@tanstack/react-query (source)	`^5.83.0` → `^5.101.0`
@tanstack/react-router (source)	`^1.168.25` → `^1.170.16`
@tanstack/react-start (source)	`^1.167.50` → `^1.168.26`
@tanstack/router-plugin (source)	`^1.167.28` → `^1.168.18`
@testing-library/dom	`^10.4.0` → `^10.4.1`
@testing-library/react	`^16.1.0` → `^16.3.2`
@types/node (source)	`^24.10.1` → `^24.13.2`
@types/node (source)	`^22.16.5` → `^22.19.21`
@types/react (source)	`^19.2.0` → `^19.2.17`
@types/react-dom (source)	`^19.2.0` → `^19.2.3`
@vitejs/plugin-react (source)	`^5.0.4` → `^5.2.0`
@vitest/coverage-v8 (source)	`^4.1.7` → `^4.1.9`
agents (source)	`^0.13.3` → `^0.16.2`
date-fns	`^4.1.0` → `^4.4.0`
drizzle-kit (source)	`^0.31.7` → `^0.31.10`
drizzle-orm (source)	`^0.45.0` → `^0.45.2`
eslint (source)	`^9.32.0` → `^9.39.4`
eslint-config-prettier	`^10.1.1` → `^10.1.8`
eslint-plugin-prettier	`^5.2.6` → `^5.5.6`
eslint-plugin-react-refresh	`^0.4.20` → `^0.5.3`
hono (source)	`^4.12.23` → `^4.12.26`
lucide-react (source)	`^0.575.0` → `^0.577.0`
node-addon-api	`^8.5.0` → `^8.8.0`
node-gyp	`^12.1.0` → `^12.4.0`
npm (source)	`10.9.2` → `10.9.8`
playwright (source)	`^1.56.1` → `^1.61.0`
prettier (source)	`^3.7.3` → `^3.8.4`
react (source)	`^19.2.0` → `^19.2.7`
react-dom (source)	`^19.2.0` → `^19.2.7`
react-hook-form (source)	`^7.77.0` → `^7.79.0`
react-resizable-panels (source)	`^4.6.5` → `^4.11.2`
tailwind-merge	`^3.5.0` → `^3.6.0`
tailwindcss (source)	`^4.2.1` → `^4.3.1`
tw-animate-css	`^1.3.4` → `^1.4.0`
typescript (source)	`^5.8.3` → `^5.9.3`
typescript-eslint (source)	`^8.56.1` → `^8.61.1`
vite-tsconfig-paths	`^6.0.2` → `^6.1.1`
vitest (source)	`^4.1.7` → `^4.1.9`
wrangler (source)	`^4.95.0` → `^4.102.0`

Dependency PRs must keep npm run test:ci passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.

GitHub Actions updates must remain SHA-pinned.

Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs).

Release Notes

cloudflare/workers-sdk (@cloudflare/vitest-pool-workers)

`v0.16.17`

Compare Source

Patch Changes

#14347 673b09e Thanks @jamesopstad! - Update undici from 7.24.8 to 7.28.0
#14314 5c3bb11 Thanks @harryzcy! - Bump esbuild to 0.28.1

This update includes several bug fixes from esbuild versions 0.27.3 through 0.28.1. See the esbuild changelog for details.
Updated dependencies [673b09e, e930bd4, f6e49dd, 5c3bb11, 296ad65, 594544d, a79b899, 5dfb788, ca61558, 36777db]:
- miniflare@4.20260617.0
- wrangler@4.102.0

Patch Changes

#14152 3d7992e Thanks @petebacondarwin! - Fix module resolution failing when project path contains spaces

When a project lived under a directory with spaces (e.g. /Users/me/Documents/Master CMS/project), the vitest pool would fail with No such module "threads.js" before any test executed. The module fallback service now uses the rawSpecifier from workerd's fallback request to correctly decode file:// URLs, avoiding the double-encoding of spaces (%20 → %2520) that occurred when workerd resolved these URLs as relative paths.
#14105 337e912 Thanks @dario-piotrowicz! - Remove trailing periods from URLs in terminal output

URLs printed to the terminal with a sentence-ending period (e.g. https://example.com/path.) would include the period when clicked in some terminal emulators, causing 404 errors. This removes trailing periods from all URLs displayed in CLI output across wrangler, miniflare, vitest-pool-workers, and workers-utils.
#14112 3a746ac Thanks @penalosa! - Pin non-bundled runtime dependencies to exact versions

Dependencies that are not bundled into a package's published output are installed directly into consumers' dependency trees, so they are now pinned to exact versions instead of semver ranges. This closes a supply-chain gap where an unpinned external dependency could resolve to a compromised upstream release on a fresh install. A new pnpm check:pinned-deps lint enforces this for all published packages (and for the shared pnpm catalog) going forward.
#14061 da8e306 Thanks @Vardiak! - Preserve Durable Object WebSocket handler invocation order

Durable Object WebSocket events could begin executing out of order in the Workers Vitest integration when several events arrived while the test wrapper was resolving user code.

Handler invocation now preserves arrival order while still allowing asynchronous handler completion to run concurrently.
Updated dependencies [b210c5e, aec1bb8, e06cbb7, 9a26191, 5565823, 4ef790b, 890fca7, 6fc9777, 337e912, 8e7b74f, e86489a, 42288d4, 65b5f9e, 3a746ac, 64ef9fd, 94b29f7]:
- wrangler@4.97.0
- miniflare@4.20260601.0

`v0.16.11`

Compare Source

Patch Changes

#14087 e3c862a Thanks @edmundhung! - Fix Durable Object RPC dispatch for constructors that return proxies

Durable Object RPC methods mediated by a returned Proxy are now resolved through that proxy after validating prototype exposure. This allows wrappers that bind methods to the underlying instance to use private fields and methods in Vitest, while matching workerd's rejection of constructor-assigned RPC overrides.
Updated dependencies [e3c862a, cbb39bd, cbb39bd, 408432a, 1103c07, 7bb5c7a, 5b5cbd3, e3c862a, e3c862a, 97d7d81, c647ccc, e3c862a, e3c862a, e3c862a, e3c862a, e3c862a, b64b7e4, e3c862a, e3c862a, e4c8fd9, 2dffeeb, e3c862a, e3c862a, 4c0da7b, 972d13d, 13cbadb, 59e43e4]:
- miniflare@4.20260529.0
- wrangler@4.96.0

eslint/eslint (@eslint/js)

`v9.39.4`

Compare Source

Bug Fixes

f18f6c8 fix: update dependency minimatch to ^3.1.5 (#20564) (Milos Djermanovic)
a3c868f fix: update dependency @eslint/eslintrc to ^3.3.4 (#20554) (Milos Djermanovic)
234d005 fix: minimatch security vulnerability patch for v9.x (#20549) (Andrej Beles)
b1b37ee fix: update ajv to 6.14.0 to address security vulnerabilities (#20538) (루밀LuMir)

Documentation

4675152 docs: add deprecation notice partial (#20520) (Milos Djermanovic)

Chores

b8b4eb1 chore: update dependencies for ESLint v9.39.4 (#20596) (Francesco Trotta)
71b2f6b chore: package.json update for @eslint/js release (Jenkins)
1d16c2f ci: pin Node.js 25.6.1 (#20563) (Milos Djermanovic)

`v9.39.3`

Compare Source

Bug Fixes

791bf8d fix: restore TypeScript 4.0 compatibility in types (#20504) (sethamus)

Chores

8594a43 chore: upgrade @eslint/js@9.39.3 (#20529) (Milos Djermanovic)
9ceef92 chore: package.json update for @eslint/js release (Jenkins)
af498c6 chore: ignore /docs/v9.x in link checker (#20453) (Milos Djermanovic)

`v9.39.2`

Compare Source

Bug Fixes

5705833 fix: warn when eslint-env configuration comments are found (#20381) (sethamus)

Build Related

506f154 build: add .scss files entry to knip (#20391) (Milos Djermanovic)

Chores

7ca0af7 chore: upgrade to @eslint/js@9.39.2 (#20394) (Francesco Trotta)
c43ce24 chore: package.json update for @eslint/js release (Jenkins)
[`4

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Phoenix)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

superagent-security · 2026-06-22T07:37:50Z

Superagent didn't find any vulnerabilities or security issues in this PR.

cloudflare-workers-and-pages · 2026-06-22T07:38:09Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	`281ed62`	Commit Preview URL Branch Preview URL	Jun 22 2026, 08:30 AM

codecov · 2026-06-22T07:38:47Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.61%. Comparing base (38d8641) to head (281ed62).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #996   +/-   ##
=======================================
  Coverage   96.61%   96.61%           
=======================================
  Files         110      110           
  Lines       15079    15079           
  Branches     5451     5451           
=======================================
  Hits        14569    14569           
  Misses        106      106           
  Partials      404      404

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The 2.5.3 bump pulls nitro v3, which dropped the zero-config Cloudflare default and retargets the UI build to Node (emits to .output/node_modules/.nitro instead of apps/gittensory-ui/dist), breaking the preview artifact + Workers deploy. Pin to the known-good 2.1.1 so the build keeps producing dist; the rest of this bulk minor/patch update lands unchanged. The lovable-config/nitro v3 upgrade needs a deliberate, separately tested build-output migration.

JSONbored · 2026-06-22T08:29:03Z

Pushed a fix so this bulk bump is safe to merge: held @lovable.dev/vite-tanstack-config at 2.1.1. The proposed 2.5.3 pulls nitro v3, which dropped the zero-config Cloudflare default and retargets the UI build to Node — emitting to node_modules/.nitro / .output instead of apps/gittensory-ui/dist, which broke Build UI preview artifact + Workers Builds: gittensory-ui. Reproduced locally; pinning back to 2.1.1 restores dist output. All ~27 other minor/patch bumps land unchanged. The lovable-config/nitro v3 upgrade should be done as a deliberate, separately-tested build-output migration.

ghost · 2026-06-22T08:30:32Z

reviewbot — ⏳ Waiting for CI to finish before the gate review.

renovate Bot requested a review from JSONbored as a code owner June 22, 2026 07:37

renovate Bot assigned JSONbored Jun 22, 2026

JSONbored added dependencies Pull requests that update a dependency file ci and removed ci labels Jun 22, 2026

JSONbored mentioned this pull request Jun 22, 2026

test(signals): fix drifted queue-health fixture dates (unblocks main CI) #1003

Merged

chore(deps): update npm minor and patch dependencies

34ff816

renovate Bot force-pushed the renovate/npm-minor-patch branch from 34f8dd8 to 34ff816 Compare June 22, 2026 08:23

dosubot Bot added the size:XS label Jun 22, 2026

github-actions Bot deployed to preview/pr-996 June 22, 2026 08:30 View deployment

ghost added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jun 22, 2026

ghost added the reviewbot-review label Jun 22, 2026

JSONbored merged commit 9df11d0 into main Jun 22, 2026
19 checks passed

JSONbored deleted the renovate/npm-minor-patch branch June 22, 2026 08:31

ghost removed the reviewbot-review label Jun 22, 2026

Navigation Menu

Uh oh!

chore(deps): update npm minor and patch dependencies - #996

chore(deps): update npm minor and patch dependencies#996
JSONbored merged 2 commits into
mainfrom
renovate/npm-minor-patch

renovate Bot commented Jun 22, 2026

Uh oh!

superagent-security Bot commented Jun 22, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jun 22, 2026 •

edited

Loading

Uh oh!

JSONbored commented Jun 22, 2026

Uh oh!

ghost commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jun 22, 2026

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Bug Fixes

Documentation

Chores

Bug Fixes

Chores

Bug Fixes

Build Related

Chores

Configuration

Uh oh!

superagent-security Bot commented Jun 22, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

codecov Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

JSONbored commented Jun 22, 2026

Uh oh!

ghost commented Jun 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

cloudflare-workers-and-pages Bot commented Jun 22, 2026 •

edited

Loading

codecov Bot commented Jun 22, 2026 •

edited

Loading