Repository navigation
fix(deps): update all non-major dependencies - #169
Merged
Merged
Conversation
khepri-bot
Bot
force-pushed
the
renovate/all-non-major-dependencies
branch
10 times, most recently
from
October 29, 2026 14:03
a3d6617 to
a4fec50
Compare
wgordon17
previously approved these changes
Oct 29, 2026
wgordon17
enabled auto-merge (squash)
October 29, 2026 17:51
khepri-bot
Bot
force-pushed
the
renovate/all-non-major-dependencies
branch
2 times, most recently
from
October 30, 2026 18:09
4ad6457 to
d974536
Compare
khepri-bot
Bot
force-pushed
the
renovate/all-non-major-dependencies
branch
from
October 30, 2026 22:29
d974536 to
2e25ff6
Compare
wgordon17
approved these changes
Oct 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
1.62.5→1.64.01.66.0(+1)1.4.0→1.4.41.4.11(+6)1.32.0→1.32.11.32.21.63.0→1.64.111.4.0→11.8.011.10.0(+1)11.4.0→11.8.011.10.0(+1)14.6.7→14.6.826.6.4→26.6.526.6.6v7.0.0→v7.1.05.7.47→5.7.506.2.5→6.2.66.2.78.0.3→8.0.412.9.1→12.14.012.16.1(+2)1.9.15→1.9.171.9.188.3.3→8.3.48.3.55.0.3→5.0.54.147.0→4.151.14.156.0(+6)4.6.6→4.6.7Release Notes
cloudflare/workers-sdk (@cloudflare/vite-plugin)
v1.64.0Compare Source
Minor Changes
#16245
d6b1c82Thanks @WalshyDev! - Generate source maps for Worker environments by defaultWorker builds now emit source maps unless Vite's
build.sourcemapor the Worker'supload_source_mapsis set, so deployed Workers get stack traces that point at the original source. The source maps are written next to the Worker bundle and included in Build Output; the client environment is unchanged, so no source maps are added to public assets. Setbuild.sourcemap: falsefor the Worker environment, orupload_source_maps: falsein the Worker config, to opt out.Patch Changes
f360829,d6b1c82,97b2fb1,97b2fb1,acd2822]:v1.63.2Compare Source
Patch Changes
#16025
61e07fdThanks @kohjunhao! - Fix optional Docker lookups printing Docker CLI errors during successful buildscf buildlooks for Container images left behind by earlier builds so it can remove them. This lookup is best effort, but when Docker could not be reached it still printed errors such asCannot connect to the Docker daemon, even when the build succeeded and no image needed Docker. Docker commands whose output Wrangler reads no longer forward the Docker CLI's error output to the terminal. If one of these commands fails in a way that stops the command, the error message still includes the Docker CLI's output.#16038
dc3e4dfThanks @dario-piotrowicz! - Use consumer-specific CLI names and commands in shared user-facing messagesShared deployment, container, configuration, and authentication helpers can now render commands and configuration filenames for their calling CLI while preserving Wrangler-compatible defaults. This prevents
cfworkflows from presenting Wrangler-branded guidance when an equivalentcfcommand exists.Updated dependencies [
fcf625d,091e5ec,5152bf8,9f87de8,daae435,18f061c,9be5ec7,61e07fd,cafd3f9,ea64ec4,d232454]:v1.63.1Compare Source
Patch Changes
#15617
93c1069Thanks @jpatel3! - Stop the update check from recommending deprecated versionsPreviously, the "update available" notice shown by
wranglerand@cloudflare/vite-pluginalways pointed at whichever version was taggedlateston npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.The check now reads the npm registry directly instead of going through the
update-checkpackage, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.#16003
6947df3Thanks @oddharsh! - Shipusingandawait usingdeclarations to the runtime as writtenWorker builds no longer lower explicit resource management into helper code, so Workers that use it ship about 1.7 KB less. workerd supports the syntax natively. On Vite 8 the plugin builds Workers at an
es2026target, so Oxc leaves the syntax alone. On Vite 6 and 7, where esbuild has noes2026target, the Worker environments tell esbuild thatusingis supported instead. Client builds keep their own targets: the plugin changes only the Worker environments.#16145
e820406Thanks @cpojer! - Honor the source-map setting in release buildsOmit the plugin's JavaScript and declaration source maps when building with
SOURCEMAPS=false, reducing the installed package size. Normal development builds keep source maps, and application source-map settings are unchanged.Updated dependencies [
2d1d563,85b14e7,e6f7663,fe607f9,ad7ff45,8de6b3c,ae29445,757faa6,cc8e969,417b186,93c1069,6947df3,82acf3c,9a58244]:v1.63.0Compare Source
Minor Changes
#16030
aa2f9b7Thanks @edmundhung! - Add email-protected Quick Tunnels to the Cloudflare Vite pluginSet
tunnel.allowedMailto a list of email addresses or domain patterns to require email authentication when exposing a Vite development or preview server through a Quick Tunnel.Patch Changes
b4e1299,b75421f,0ec13b7,2b1a0ca,c492d63,ba52118,946aaa7,48f3c04,14f0339,5606a74,4d308f6,f8cdcb9,e44cf6b,aa2f9b7,42c7219,2dde890,26e03e2,2dde890,0b51fec]:cloudflare/workers-sdk (@cloudflare/vitest-plugin)
v1.4.4Compare Source
Patch Changes
e1d1b77,e13d5cc,42c6912,4a5377f]:v1.4.3Compare Source
Patch Changes
#16248
ad01099Thanks @mattjohnsonpint! - Fix V8 coverage failing with Vitest 5.0.4Tests using V8 coverage with Vitest 5.0.4 no longer fail with an assertion error during teardown.
#16163
5f12934Thanks @edmundhung! - Fix Workers tests failing with Vitest's filesystem module cacheThis supports Vitest 4.1's
test.experimental.fsModuleCacheand Vitest 5'stest.fsModuleCache.v1.4.2Compare Source
Patch Changes
f360829,d6b1c82,97b2fb1,97b2fb1,acd2822]:v1.4.1Compare Source
Patch Changes
#15565
142230dThanks @luccamordente! - Flushconsole.log()calls made from another I/O context without waiting for the runner's next messageVitest awaits every RPC call it made before it reports a test file as finished. A
console.log()from another I/O context (a handler reached throughSELF, a queue consumer, awaitUntil()callback) is buffered and sent with the runner's next message, so a log with nothing from the runner following it — the last batch of a queue consumed as the file ends, for example — left the run waiting on itself: the file's tests passed and vitest never finished. The buffer is now flushed from the runner's context as soon as a log is buffered.#16013
8b64becThanks @swalker326! - Fix Durable Object self-references in tests and container validationDurable Object bindings that explicitly name the Worker itself now resolve to the test runner in
@cloudflare/vitest-plugin, for bothcloudflare.config.tsand Wrangler configuration files. Named Wrangler environments use their effective Worker name, keeping bindings to the base Worker external. Container validation also accepts these self-references, using the effective deployment name to distinguish local and external bindings.Explicit binding targets remain intact during configuration conversion, so deploying with
--nameor a CI name override preserves the intended Durable Object target.Updated dependencies [
ec0bea4,b4653b4,25802bc,25802bc,15fbaed,d8899ac,8b64bec]:modelcontextprotocol/typescript-sdk (@modelcontextprotocol/sdk)
v1.32.1Compare Source
What's Changed
Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1
microsoft/playwright (@playwright/test)
v1.64.1Compare Source
Bug Fixes
v1.64.0Compare Source
🧰 WebMCP
New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:
Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as
webmcp_<tool>. Pass--no-webmcpto opt out.playwright-cliexposes them as well:playwright-cli webmcp-list playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'🎬 Better videos
Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:
fpsoption in testOptions.video,recordVideoandscreencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
styleoption takes CSS declarations for thepointmarker, the targethighlightand the actiontitle. It replaces thefontSizeoption, which is now deprecated.quality.
playwright-cli.🎯 Test runner
New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain
npx playwright testrun just your favourite one:New
--shufflecommand line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.New
lockoption in test.describe.configure() adds test locks to all tests in a file or a group:New
typeoption oftoHaveScreenshotin testConfig.expect stores all unnamed screenshots as WebP:🪆 Locator.within()
New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":
Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:
New APIs
New page.getByRef() locates an element by its aria ref, such as
e2, reported by page.ariaSnapshot() in the'ai'mode.New option
includeShadowin page.content() and frame.content() serializes open shadow roots as declarative shadow DOM.New option
signCountsets the initial signature counter of a virtual credential. credentials.create() and credentials.get() return the currentsignCount, and it is saved and restored together with the credentials in the storage state.New fullConfig.filteredProjects lists the projects that were selected to run after applying the
--projectfilter. It is available in global setup and reporters.New apiRequestContext.addCookies(), apiRequestContext.cookies() and apiRequestContext.clearCookies() manage cookies of a request context, mirroring the BrowserContext methods:
Breaking changes⚠️
screenproperty is now forwarded from the device descriptors. If you use...devices['Desktop Chrome']and alike,window.screenand media queries now see the emulated screen size. You can opt-out by explicitly settingscreentoundefined:JSX in your test files now follows your
tsconfig.json. Playwright compiles JSX in test files according to thejsx,jsxFactory,jsxFragmentFactoryandjsxImportSourcetsconfig options, and defaults to the automatic runtime fromreact/jsx-runtime.--update-snapshots=missingnow passes the test run. Tests that only create missing snapshots now pass in the'missing'mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called'default'and behaves as before: missing snapshots are written and the test fails.Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with
visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().Browser Versions
This version was also tested against the following stable channels:
getsentry/sentry-javascript (@sentry/cloudflare)
v11.8.0Compare Source
Important Changes
feat(bundler-plugins): Release
@sentry/webpack-plugin,@sentry/vite-plugin,@sentry/rollup-pluginand@sentry/esbuild-pluginfrom the SDK repository (#25095)The four standalone bundler plugins now release together with the SDK, so their version jumps from 5.4.1 to the SDK version. Each package re-exports the matching
@sentry/bundler-pluginsentry point, which we recommend for new projects. The plugin options do not change, but the update brings these breaking changes:@sentry/webpack-pluginrequires webpack 5.1 or higher. The@sentry/webpack-plugin/webpack5entry point still works and exports the same plugin as@sentry/webpack-plugin.sentryCLI SDK instead of@sentry/cli. Sentry self-hosted 26.4.2 or higher is supported. Lower versions may continue to work.VERCEL_TARGET_ENV(production,previewor a custom name) as their environment, instead ofvercel-productionorvercel-preview. To keep the old value, setrelease.deploy.env.feat(server-utils): Instrument the OpenAI decisions API as
gen_ai.decidespans (#25285)OpenAI
decisions.createcalls now creategen_ai.decidespans.Other Changes
urlQueryParamsto the Referer header (#25324)mainis a package (#25343)output(#25312)sveltekit.endpointspan (#25376)Internal Changes
Work in this release was contributed by @kunal649 and @mketiku. Thank you for your contributions!
v11.7.0Compare Source
Important Changes
feat(cloudflare): Add opt-in cron monitoring for Cron Triggers (#25014)
The new
cronTriggersIntegrationsends check-ins for Cron Triggers. Each check-in includes the schedule fromcontroller.cron, so Sentry creates the monitor on the first run. The integration is opt-in, because monitors are billed.Cron Triggers have no names, so map each cron expression of your wrangler config to a monitor slug. With the Sentry Cloudflare Vite plugin, add the integration to
src/instrument.server.ts:The
monitorSlugfunction can also return monitor settings, for example{ monitorSlug: 'daily-report', maxRuntime: 30 }, orundefinedto send no check-ins for a trigger. WithoutmonitorSlug, the SDK derives the slug from the cron expression. If you deploy withwranglerdirectly, pass the same integration toSentry.withSentry.feat(node): Add neonIntegration for @neondatabase/serverless (#25164, #25176)
The new
neonIntegrationcreatesdbspans for queries of the@neondatabase/serverlessdriver: for the WebSocketClientandPool, and for the HTTPneon()function. This includes theneon-httpandneon-serverlessadapters of Drizzle. The integration is on by default when tracing is enabled.feat(node): Stop sending the process session once request sessions are tracked (#24915)
Node servers sent release health data two times: as request session aggregates, and as the process session of
processSessionIntegration. An error in a request also marked the process session as errored, so the SDK counted the error two times. Now the SDK drops the process session when it tracks the first request session. Scripts, CLIs and workers that do not serve requests keep the process session, and so do servers withhttpServerIntegration({ sessions: false }). This changes the release health numbers of Node servers, because they no longer send the errored or crashed update of the process session.feat(server-utils): Record decide calls as
gen_ai.decidespans (#25270, #25272, #25274, #25281)Vercel AI
experimental_decidecalls, Mastra classifier evaluations, TypeSafe and LangChain Jev calls, and Workers AI calls to TypeSafe Jev and Cloudflare Clef models now createdecide <model>spans with the opgen_ai.decide. Before, these spans had the opgen_ai.evaluate, which is now deprecated in the Sentry conventions. If you usegen_ai.evaluatein queries, alerts or dashboards, change it togen_ai.decide.fix(browser): Apply
urlQueryParamsto more URLs (#25262, #25289)The
dataCollection.urlQueryParamsoption now also filters the query parameters of these URLs:event.request.urlbrowser.*andresource.*span names withtraceLifecycle: 'static'lcp.urlandbrowser.web_vital.lcp.urlui.element.urlattribute ofelementTimingIntegrationBefore this fix, these URLs could send sensitive query values, for example
?jwt=..., to Sentry.fix(nextjs): Apply top-level
bundleSizeOptimizationsto webpack and Turbopack builds (#24818)The top-level
bundleSizeOptimizationsoption now removes unused SDK code in webpack and in Turbopack builds. Before, the tree-shaking options had no effect on Turbopack. Thewebpack.treeshakeoption is deprecated. It still works, but when you set both options,bundleSizeOptimizationstakes precedence.Other Changes
@nuxt/kit4.6 (#25138)spanclient report outcomes when discarding transactions (#25006)@sentry/server-runtime-injectionexternal on Nitro v3 (#24901)Internal Changes
@sentry/conventionsto 0.27.0 (#25264)Configuration
📅 Schedule: (in timezone America/New_York)
* 0-8 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.