Skip to content

fix(deps): update all non-major dependencies#1218

Merged
hi-ogawa merged 1 commit into
mainfrom
renovate/all-minor-patch
May 11, 2026
Merged

fix(deps): update all non-major dependencies#1218
hi-ogawa merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 11, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@cloudflare/vite-plugin (source) ^1.35.0 → ^1.36.3 age confidence devDependencies minor
@rolldown/pluginutils (source) 1.0.0-rc.18 → 1.0.0 age confidence dependencies patch
@tailwindcss/vite (source) ^4.2.4 → ^4.3.0 age confidence devDependencies minor
@types/estree (source) ^1.0.8 → ^1.0.9 age confidence pnpm-workspace.overrides patch
@types/estree (source) ^1.0.8 → ^1.0.9 age confidence devDependencies patch
@types/node (source) ^24.12.2 → ^24.12.3 age confidence devDependencies patch
fs-extra ^11.3.4 → ^11.3.5 age confidence devDependencies patch
oxfmt (source) ^0.47.0 → ^0.48.0 age confidence devDependencies minor
pnpm (source) 10.33.2 → 10.33.4 age confidence packageManager patch
pnpm/action-setup v6.0.5 → v6.0.6 age confidence action patch
react-router (source) 7.14.2 → 7.15.0 age confidence dependencies minor
rolldown (source) 1.0.0-rc.18 → 1.0.0 age confidence devDependencies patch
tailwindcss (source) ^4.2.4 → ^4.3.0 age confidence devDependencies minor
tsdown (source) ^0.21.10 → ^0.22.0 age confidence devDependencies minor
vite (source) ^8.0.10 → ^8.0.11 age confidence devDependencies patch
wrangler (source) ^4.87.0 → ^4.90.0 age confidence devDependencies minor

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.36.3

Compare Source

Patch Changes

v1.36.2

Compare Source

Patch Changes
  • Updated dependencies [dd3baf3, 5cf6f81]:
    • wrangler@​4.89.1
    • miniflare@​4.20260507.1

v1.36.1

Compare Source

Patch Changes

  • #​13802 a7fd465 Thanks @​deodad! - Fix .dev.vars written for vite preview to round-trip values containing quotes

    When the plugin emits dist/<env>/.dev.vars for vite preview, it previously wrote each value as a double-quoted dotenv string with " escaped to \". dotenv (the parser wrangler uses) does not unescape \" inside double-quoted values, so values containing " arrived at the worker with literal backslashes still in them.

    The plugin now quotes strings using the first quote character that does not appear in the value (with the priority order: single → backtick → double), all of which dotenv strips correctly. If a value contains every supported quote character it throws instead of silently corrupting the value.

  • Updated dependencies [2284f20, 332f527, 039bada, 18e833d, b6cea17, 1a54ac5, 53e846a, f3fed88, beff19c, af42fed, 1a54ac5]:

    • miniflare@​4.20260507.0
    • wrangler@​4.89.0

v1.36.0

Compare Source

Minor Changes

  • #​13810 2b8c0cc Thanks @​jamesopstad! - Stabilize the secrets configuration property

    The secrets property in the Wrangler config file is no longer experimental and will no longer emit an experimental warning when used. Required secrets are validated during local development and deploy, and used as the source of truth for type generation.

    {
  "secrets": {
    "required": ["API_KEY", "DB_PASSWORD"]
  }
}
Patch Changes
rolldown/rolldown (@​rolldown/pluginutils)

v1.0.0

Compare Source

🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
⚙️ Miscellaneous Tasks
tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.0

Compare Source

Added
  • Add @container-size utility (#​18901)
  • Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#​19981, #​20019)
  • Add scrollbar-gutter-* utilities (#​20018)
  • Add zoom-* utilities (#​20020)
  • Add tab-* utilities (#​20022)
  • Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#​19996)
  • Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#​19996)
  • Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#​19989)
Fixed
  • Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#​19949)
  • Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#​19965)
  • Ensure CSS files containing @variant are processed by @tailwindcss/vite (#​19966)
  • Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#​19980)
  • Canonicalization: preserve significant _ whitespace in arbitrary values (#​19986)
  • Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#​19986)
  • Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#​19988)
  • Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#​19991)
  • Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#​19918)
  • Allow multiple @utility definitions with the same name but different value types (#​19777)
  • Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#​19707)
  • Ensure start and end legacy utilities without values do not generate CSS (#​20003)
  • Ensure --value(…) is required in functional @utility definitions (#​20005)
  • Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#​20011)
jprichardson/node-fs-extra (fs-extra)

v11.3.5

Compare Source

  • Fix ensureLink*/ensureSymlink* identical file detection on Windows (#​1068)
  • Fix error handling in timestamp preservation code (#​1065, #​1069)
  • Fix potential file descriptor leak on error in synchronous timestamp preservation code (#​1066)
oxc-project/oxc (oxfmt)

v0.48.0

Compare Source

pnpm/pnpm (pnpm)

v10.33.4: pnpm 10.33.4

Compare Source

Patch Changes

  • Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

    A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.

  • Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #​11341.

Platinum Sponsors

Bit

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v10.33.3

Compare Source

pnpm/action-setup (pnpm/action-setup)

v6.0.6

Compare Source

What's Changed
  • fix: bin_dest output points to self-updated pnpm, not bootstrap by @​zkochan in #​249

Full Changelog: pnpm/action-setup@v6.0.5...v6.0.6

remix-run/react-router (react-router)

v7.15.0

Compare Source

Minor Changes

  • Stabilize unstable_defaultShouldRevalidate as defaultShouldRevalidate on <Link>, <Form>, useLinkClickHandler, useSubmit, fetcher.submit, and setSearchParams (a993f09)

    • ⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

  • Stabilize the instrumentation APIs. unstable_instrumentations is now instrumentations and unstable_pattern is now pattern (a993f09)

    • The unstable_ServerInstrumentation, unstable_ClientInstrumentation, unstable_InstrumentRequestHandlerFunction, unstable_InstrumentRouterFunction, unstable_InstrumentRouteFunction, and unstable_InstrumentationHandlerResult types have had their unstable_ prefixes removed
    • ⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

  • Stabilize unstable_mask as mask on <Link>, useLinkClickHandler, and useNavigate, and rename the corresponding Location.unstable_mask field to Location.mask (a993f09)

    • ⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

  • Stabilize the unstable_normalizePath option on staticHandler.query and staticHandler.queryRoute as normalizePath (a993f09)

    • ⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

  • Stabilize future.unstable_passThroughRequests as future.v8_passThroughRequests (a993f09)

    • ⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

  • Remove unstable_subResourceIntegrity from the runtime FutureConfig type; the flag is now controlled by the top-level subResourceIntegrity option in react-router.config.ts (a993f09)

    • ⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

  • Stabilize unstable_url as url on loader, action, and middleware function args (a993f09)

    • ⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly

  • Stabilize unstable_useTransitions as useTransitions on <BrowserRouter>, <HashRouter>, <HistoryRouter>, <MemoryRouter>, <Router>, <RouterProvider>, <HydratedRouter>, and useLinkClickHandler (a993f09)

    • ⚠️ This is a breaking change if you have already opted into the unstable version - you will need to update your code accordingly
Patch Changes

  • Add nonce to <Scripts> <link rel="modulepreload"> elements (if provided) (af5d49b)

  • Fix a bug with unstable_defaultShouldRevalidate={false} where parent routes that did not export a shouldRevalidate function could be incorrectly included in the single fetch call for new child route data (#​15012)

  • Improve server-side route matching performance by pre-computing flattened/cached route branches (#​14967) (af5d49b)

    • Performance benchmarks showed roughly a 10-15% improvement in server-side request handling performance

  • Mark mask as an optional field in Location for easier mocking in unit tests (#​14999)

  • Cache flattened/ranked route branches to optimize server-side route matching (#​14967)

  • Improve route matching performance in Framework/Data Mode (#​14971) (af5d49b)

    • Avoiding unnecessary calls to matchRoutes in data router scenarios
      • This includes adding back the optimization that was removed in 7.6.0 (#​13562)
      • The issues that prompted the revert have been addressed by using the available router matches but always updating match.route to the latest route in the manifest
    • Leverage pre-computed pre-computing flattened/cached route branches during client side route matching
    • Performance benchmarks showed roughly a 15-30% improvement in server-side request handling performance
rolldown/tsdown (tsdown)

v0.22.0

Compare Source

   🚨 Breaking Changes
  • Drop Node.js < 22.18.0 support, make unrun optional, add tsx config loader  -  by @​sxzz (a1042)
  • dts: Auto-enable dts when tsconfig declaration is true  -  by @​sxzz in #​872 (085f0)
  • publint: Use pkg from publint results, require publint v0.3.8+  -  by @​sxzz (413bb)
   🚀 Features
   🐞 Bug Fixes

🔄 Migration Guide

Node.js version

Upgrade to Node.js 22.18.0 or later. Bun and Deno remain supported (experimental).

unrun is no longer bundled

If your environment relies on the unrun config loader (i.e. you're on a Node version without native TypeScript support and use the default auto loader), install it manually:

npm i -D unrun

# or, alternatively, the new tsx loader:
npm i -D tsx

If you use Node.js 22.18.0+ with native TypeScript support, no change is needed — the auto loader will pick native.

dts auto-enabled from tsconfig

If your tsconfig.json has compilerOptions.declaration: true but you do not want tsdown to emit .d.ts files, opt out explicitly:

// tsdown.config.ts
export default defineConfig({
  dts: false,
})
exports.bin auto-detection

Any entry chunk containing a shebang (e.g. #!/usr/bin/env node) now causes tsdown to write a bin field in package.json automatically. The semantics differ slightly from explicit bin: true:

Value Single shebang Multiple shebangs No shebangs
(unset) Auto-set bin Warn, skip Silent
true Auto-set bin Throw Warn
false No bin No bin No bin

To opt out entirely:

export default defineConfig({
  exports: { bin: false },
})
Links
vitejs/vite (vite)

v8.0.11

Compare Source

Features
Bug Fixes
Documentation
Miscellaneous Chores
Code Refactoring
Tests
cloudflare/workers-sdk (wrangler)

v4.90.0

Compare Source

Minor Changes

  • #​12279 248bc08 Thanks @​penalosa! - Add deprecation warning for delivery_delay in queue producer bindings

    The delivery_delay setting in [[queues.producers]] was silently having no effect since 2024. This change adds a deprecation warning when the setting is used, informing users that queue-level settings should be configured using wrangler queues update instead. The setting will be removed in a future version.

Patch Changes

  • #​13853 8852b0c Thanks @​gpanders! - Fix Containers SSH config

  • #​13858 e414e56 Thanks @​penalosa! - Fix wrangler whoami and account selection failing for Account API Tokens

    The /memberships fallback for Account API Tokens was checking for code 9109, but /memberships actually returns 9106 for that case. Correct the code so the fallback to /accounts triggers as intended.

  • Updated dependencies []:

    • miniflare@​4.20260507.1

v4.89.1

Compare Source

Patch Changes

  • #​13824 dd3baf3 Thanks @​emily-shen! - Fix container deployment being skipped for Workers for Platforms user workers

    Previously, deploying a worker with --dispatch-namespace would early-exit before calling deployContainers(), meaning container-app registration that links the image to the Durable Object namespace was never executed for WfP user workers. Container deployment now runs before the WfP early exit.

  • Updated dependencies [5cf6f81]:

    • miniflare@​4.20260507.1

v4.89.0

Compare Source

Minor Changes

  • #​13055 f3fed88 Thanks @​GregBrimble! - Introducing the cache configuration option for Workers.

    You can now set { cache: { enabled: true } } in your Wrangler configuration file to enable a HTTP cache in front of your Worker's fetch handler. This is also supported in [previews] configuration — previews.cache overrides the top-level cache setting for preview deployments, and falls back to the top-level value when absent. More information can be found in our documentation.

  • #​13776 1a54ac5 Thanks @​petebacondarwin! - wrangler dev and other Miniflare-backed commands now run the local workerd runtime with TZ=UTC to match production

    Previously, wrangler dev (and other commands that spin up Miniflare, such as wrangler kv, wrangler d1, wrangler r2, wrangler check) inherited the host machine's timezone, so Date and Intl APIs inside a Worker observed the developer's local timezone during local development but UTC in production. This caused subtle, hard-to-debug differences between local and deployed behaviour.

    Local development now matches production. Code that previously relied on the host timezone during wrangler dev will need to either accept UTC (the production behaviour) or explicitly construct dates/formatters with the desired timezone.

Patch Changes

  • #​13829 2284f20 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260504.1 1.20260506.1

  • #​13841 332f527 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260506.1 1.20260507.1

  • #​13777 18e833d Thanks @​matingathani! - fix: throw a clear error when _routes.json contains invalid JSON instead of silently skipping it

  • #​13751 b6cea17 Thanks @​matingathani! - fix: ensure wrangler types --check --env-file does not falsely report stale types when .dev.vars exists

  • #​13775 53e846a Thanks @​maxwellpeterson! - Fix wrangler preview not propagating the assets binding to preview deployments

    Previously, wrangler preview would upload the asset manifest correctly but the resulting preview deployment had no ASSETS binding (or whatever name was configured under assets.binding). Workers reading from the binding would see undefined and fail at runtime.

    The fix emits the assets binding into the deployment's env map alongside other bindings, mirroring wrangler deploy.

  • #​13770 beff19c Thanks @​petebacondarwin! - Only show accounts available for the current login auth in wrangler whoami and the interactive account picker

    Wrangler now lists the intersection of /accounts and /memberships instead of either endpoint alone, dropping accounts the active OAuth token or API token has no membership in. The accounts field of wrangler whoami --json is filtered the same way. When /memberships is inaccessible to the current auth (e.g. Account API Tokens) Wrangler falls back to /accounts so those tokens continue to work as before.

  • #​13832 af42fed Thanks @​gpanders! - Show containers ssh in wrangler containers --help and in wrangler containers ssh --help

    The containers ssh command was previously hidden, so it did not appear in the list of subcommands shown by wrangler containers --help, and its description was omitted from wrangler containers ssh --help. The command is now listed with its description in both places.

  • Updated dependencies [2284f20, 332f527, 039bada, 1a54ac5]:

    • miniflare@​4.20260507.0

v4.88.0

Compare Source

Minor Changes

  • #​13760 e07825a Thanks @​danielgek! - Add builtin storage option to wrangler ai-search create.

    wrangler ai-search create now supports a third storage type, builtin, in addition to r2 and web-crawler. When --type builtin is selected (or chosen interactively), Wrangler creates the instance using Cloudflare-managed storage by omitting type and source from the API request — the API treats an absent type as builtin storage. Builtin instances do not accept --source, --prefix, --include-items, or --exclude-items.

  • #​13721 58899d8 Thanks @​danielgek! - Add optional custom_metadata step to wrangler ai-search create

    The wrangler ai-search create interactive wizard now lets you declare custom metadata fields that the new AI Search instance should index. Each field is a field_name paired with a data_type (text, number, boolean, or datetime).

    You can provide fields up-front via the new repeatable --custom-metadata flag using field_name:data_type syntax:

    wrangler ai-search create my-instance \
  --type r2 --source my-bucket \
  --custom-metadata title:text \
  --custom-metadata views:number

    For larger schemas, use --custom-metadata-schema to point at a JSON file containing an array of { field_name, data_type } objects:

    wrangler ai-search create my-instance \
  --type r2 --source my-bucket \
  --custom-metadata-schema schema.json
    [
  { "field_name": "title", "data_type": "text" },
  { "field_name": "views", "data_type": "number" }
]

  • #​13701 18b9d5b Thanks @​dario-piotrowicz! - Prompt for missing

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@hi-ogawa
Copy link
Copy Markdown
Contributor

hi-ogawa commented May 11, 2026

tsdown dropped node 20 support, so CI failing. It's EOL so probably our CI should move to node 22, 24, 26.

@hi-ogawa hi-ogawa mentioned this pull request May 11, 2026
Merged
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 2feab61 to 4efb41e Compare May 11, 2026 03:42
@hi-ogawa hi-ogawa merged commit 2b8df67 into main May 11, 2026
23 checks passed
@hi-ogawa hi-ogawa deleted the renovate/all-minor-patch branch May 11, 2026 04:03
@hi-ogawa hi-ogawa mentioned this pull request May 11, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hi-ogawa