Skip to content

chore(deps): update all non-major dependencies#766

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#766
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Mar 27, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@azure/cosmos (source) ^4.9.1 → ^4.9.2 age confidence
@azure/identity (source) ^4.13.0 → ^4.13.1 age confidence
@cloudflare/workers-types ^4.20260317.1 → ^4.20260329.1 age confidence
@electric-sql/pglite (source) ^0.4.0 → ^0.4.2 age confidence
@libsql/client (source) ^0.17.0 → ^0.17.2 age confidence
@planetscale/database ^1.19.0 → ^1.20.1 age confidence
@types/jsdom (source) ^28.0.0 → ^28.0.1 age confidence
@typescript/native-preview (source) ^7.0.0-dev.20260319.1 → ^7.0.0-dev.20260330.1 age confidence
@upstash/redis (source) ^1.36.2 → ^1.37.0 age confidence
@vercel/blob (source) ^2.3.1 → ^2.3.2 age confidence
@vitest/coverage-v8 (source) ^4.1.0 → ^4.1.2 age confidence
ioredis ^5.9.3 → ^5.10.1 age confidence
ioredis ^5.10.0 → ^5.10.1 age confidence
jsdom ^29.0.0 → ^29.0.1 age confidence
lru-cache ^11.2.6 → ^11.2.7 age confidence
mlly ^1.8.1 → ^1.8.2 age confidence
mongodb ^7.1.0 → ^7.1.1 age confidence
oxfmt (source) ^0.41.0 → ^0.42.0 age confidence
oxlint (source) ^1.56.0 → ^1.57.0 age confidence
pnpm (source) 10.32.1 → 10.33.0 age confidence
pnpm (source) 10.30.2 → 10.33.0 age confidence
vite (source) ^8.0.1 → ^8.0.3 age confidence
vitest (source) ^4.1.0 → ^4.1.2 age confidence
wrangler (source) ^4.75.0 → ^4.78.0 age confidence

Release Notes

Azure/azure-sdk-for-js (@​azure/cosmos)

v4.9.2

Compare Source

cloudflare/workerd (@​cloudflare/workers-types)

v4.20260329.1

Compare Source

electric-sql/pglite (@​electric-sql/pglite)

v0.4.2

Compare Source

Patch Changes
  • 41632c4: Allow passing initdb.wasm asset for bundlers that need it.

v0.4.1

Patch Changes
  • 37fb39e: clear timers on exit; remove pglite-socket dependency on pglite-postgis
tursodatabase/libsql-client-ts (@​libsql/client)

v0.17.2

Compare Source

v0.17.1

Compare Source

planetscale/database-js (@​planetscale/database)

v1.20.1

Compare Source

What's Changed

Full Changelog: planetscale/database-js@v1.20.0...v1.20.1

v1.20.0

Compare Source

What's Changed

New Contributors

Full Changelog: planetscale/database-js@v1.19.0...v1.20.0

microsoft/typescript-go (@​typescript/native-preview)

v7.0.0-dev.20260330.1

Compare Source

v7.0.0-dev.20260329.1

Compare Source

v7.0.0-dev.20260328.1

Compare Source

v7.0.0-dev.20260327.2

Compare Source

v7.0.0-dev.20260326.1

Compare Source

v7.0.0-dev.20260325.1

Compare Source

v7.0.0-dev.20260324.1

Compare Source

v7.0.0-dev.20260323.1

Compare Source

v7.0.0-dev.20260322.1

Compare Source

v7.0.0-dev.20260321.1

Compare Source

v7.0.0-dev.20260320.1

Compare Source

upstash/redis-js (@​upstash/redis)

v1.37.0

Compare Source

Minor Changes
Patch Changes

v1.36.4

Compare Source

What's Changed

New Contributors

Full Changelog: upstash/redis-js@v1.36.3...v1.36.4

v1.36.3

Compare Source

What's Changed

Full Changelog: upstash/redis-js@v1.36.2...v1.36.3

vercel/storage (@​vercel/blob)

v2.3.2

Compare Source

Patch Changes
  • c9d9a1a: Apply ifMatch/allowOverwrite validation to handleUpload and generateClientTokenFromReadWriteToken. When ifMatch is set via onBeforeGenerateToken or direct token generation, allowOverwrite is now implicitly enabled. Explicitly passing allowOverwrite: false with ifMatch throws a clear error.
  • 6dcecb8: Make ifMatch imply allowOverwrite: true on put(). Previously, using ifMatch without explicitly setting allowOverwrite: true would cause the server to send conflicting conditional headers to S3, resulting in 500 errors. Now the SDK implicitly enables allowOverwrite when ifMatch is set, and throws a clear error if allowOverwrite: false is explicitly combined with ifMatch.
vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.2

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#​9975).

   🐞 Bug Fixes
    View changes on GitHub

v4.1.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
luin/ioredis (ioredis)

v5.10.1

Compare Source

Bug Fixes

v5.10.0

Compare Source

Features

5.9.3 (2026-02-12)

Bug Fixes
  • autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
  • fix issue with moved command for replicas (#​2064) (de4eed4)
  • types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.3 (2026-02-12)

Bug Fixes
  • autopipelining to route writes to masters with scaleReads (#​2072) (8adb1ae)
  • fix issue with moved command for replicas (#​2064) (de4eed4)
  • types: optional properties on RedisOptions allow explicit undefined (#​2066) (0a1a898)

5.9.2 (2026-01-15)

Bug Fixes
Reverts

5.9.1 (2026-01-08)

Bug Fixes
jsdom/jsdom (jsdom)

v29.0.1

Compare Source

isaacs/node-lru-cache (lru-cache)

v11.2.7

Compare Source

unjs/mlly (mlly)

v1.8.2

Compare Source

compare changes

🩹 Fixes
  • Extract variable names ignoring function calls (#​336)
  • Generic angle bracket parsing (#​341)
📖 Documentation
🏡 Chore
❤️ Contributors
mongodb/node-mongodb-native (mongodb)

v7.1.1

Compare Source

The MongoDB Node.js team is pleased to announce version 7.1.1 of the mongodb package!

Release Notes

Tighten OIDC ALLOWED_HOSTS wildcard matching

The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.

Fixed TCP keep-alive and no-delay settings not being applied on TLS connections

Due to a Node.js bug, tls.connect() silently ignores keepAlive, keepAliveInitialDelay, and noDelay options passed through its constructor. This could cause idle connections - particularly through cloud load balancers like Azure (240s idle timeout) or AWS PrivateLink/NLB - to be dropped unexpectedly due to missing TCP keep-alive probes.

The driver now explicitly calls setKeepAlive() and setNoDelay() on the socket after creation, ensuring these settings are always applied regardless of whether TLS is used.

Bug Fixes

Documentation

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

oxc-project/oxc (oxfmt)

v0.42.0

Compare Source

🚀 Features
  • 416865a formatter,oxfmt: Add doc comments for JsdocConfig (#​20644) (leaysgur)
  • 4fec907 formatter: Add JSDoc comment formatting support (#​19828) (Dunqing)
oxc-project/oxc (oxlint)

v1.57.0

Compare Source

pnpm/pnpm (pnpm)

v10.33.0

Compare Source

vitejs/vite (vite)

v8.0.3

Compare Source

Features
Bug Fixes
  • html: cache unfiltered CSS list to prevent missing styles across entries (#​22017) (5464190)
  • module-runner: handle non-ascii characters in base64 sourcemaps (#​21985) (77c95bf)
  • module-runner: skip re-import if the runner is closed (#​22020) (ee2c2cd)
  • optimizer: scan is not resolving sub path import if used in a glob import (#​22018) (ddfe20d)
  • ssr: ssrTransform incorrectly rewrites meta identifier inside import.meta when a binding named meta exists (#​22019) (cff5f0c)
Miscellaneous Chores
Tests

v8.0.2

Compare Source

Features
Bug Fixes
Miscellaneous Chores
cloudflare/workers-sdk (wrangler)

v4.78.0

Compare Source

Minor Changes

  • #​13031 eeaa473 Thanks @​WalshyDev! - Add support for Cloudflare Access Service Token authentication via environment variables

    When running wrangler dev with remote bindings behind a Cloudflare Access-protected domain, Wrangler previously required cloudflared access login which opens a browser for interactive authentication. This does not work in CI/CD environments.

    You can now set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate using an Access Service Token instead:

    export CLOUDFLARE_ACCESS_CLIENT_ID="<your-client-id>.access"
export CLOUDFLARE_ACCESS_CLIENT_SECRET="<your-client-secret>"
wrangler dev

    Additionally, when running in a non-interactive environment (CI) without these credentials, Wrangler now throws a clear, actionable error instead of hanging on cloudflared access login.

  • #​13027 9fcdfca Thanks @​G4brym! - feat: Add ai_search_namespaces and ai_search binding types

    Two new binding types for AI Search:

    • ai_search_namespaces: Namespace binding — namespace is required and auto-provisioned at deploy time if it doesn't exist (like R2 buckets)
    • ai_search: Single instance binding bound directly to a pre-existing instance in the default namespace

    Both are remote-only in local dev.

  • #​12874 53ed15a Thanks @​xortive! - Add Workers VPC service support for Hyperdrive origins

    Hyperdrive configs can now connect to databases through Workers VPC services using the --service-id option:

    wrangler hyperdrive create my-config --service-id <vpc-service-uuid> --database mydb --user myuser --password mypassword

    This enables Hyperdrive to connect to databases hosted in private networks that are accessible through Workers VPC TCP services.

  • #​12852 6b50bfa Thanks @​Carolx715! - Add interactive data catalog validation to R2 object and lifecycle commands.

    When performing R2 operations that could affect data catalog state (object put, object delete, lifecycle add, lifecycle set), Wrangler now validates with the API and prompts users for confirmation if a conflict is detected. For bulk put operations, Wrangler prompts upfront before starting the batch. Users can bypass prompts with --force (-y). In non-interactive/CI environments, the operation proceeds automatically.

  • #​13030 0386553 Thanks @​natewong1313! - Add local mode support for Stream bindings

    Miniflare and wrangler dev now support using Cloudflare Stream bindings locally.

    Supported operations:

    • upload() — upload video via URL
    • video(id).details(), .update(), .delete(), .generateToken()
    • videos.list()
    • captions.generate(), .list(), .delete()
    • downloads.generate(), .get(), .delete()
    • watermarks.generate(), .list(), .get(), .delete()

    The following are not yet supported in local mode and will throw:

    • createDirectUpload()
    • Caption upload via File
    • Watermark generation via File

    Data is persisted across restarts by default. You must set streamPersist: false in Miniflare options to disable persistence.

  • #​12874 53ed15a Thanks @​xortive! - Add --cert-verification-mode option to wrangler vpc service create and wrangler vpc service update

    You can now configure the TLS certificate verification mode when creating or updating a VPC connectivity service. This controls how the connection to the origin server verifies TLS certificates.

    Available modes:

    • verify_full (default) -- verify certificate chain and hostname
    • verify_ca -- verify certificate chain only, skip hostname check
    • disabled -- do not verify the server certificate at all
    wrangler vpc service create my-service --type tcp --tcp-port 5432 --ipv4 10.0.0.1 --tunnel-id <tunnel-uuid> --cert-verification-mode verify_ca

    This applies to both TCP and HTTP VPC service types. When omitted, the default verify_full behavior is used.

  • #​12874 53ed15a Thanks @​xortive! - Add TCP service type support for Workers VPC

    You can now create TCP services in Workers VPC using the --type tcp option:

    wrangler vpc service create my-db --type tcp --tcp-port 5432 --ipv4 10.0.0.1 --tunnel-id <tunnel-uuid>

    This enables exposing TCP-based services like PostgreSQL, MySQL, and other database servers through Workers VPC.

Patch Changes

  • #​13039 bc24ec8 Thanks @​petebacondarwin! - fix: Angular auto-config now correctly handles projects without SSR configured

    Previously, running wrangler deploy (or wrangler setup) on a plain Angular SPA (created with ng new without --ssr) would crash with Cannot set properties of undefined (setting 'experimentalPlatform'), because the auto-config code unconditionally assumed SSR was configured.

    Angular projects without SSR are now treated as assets-only deployments: no wrangler.jsonc main entry is generated, angular.json is not modified, no src/server.ts is created, and no extra dependencies are installed.

  • #​13036 0b4c21a Thanks @​pbrowne011! - Fix wrangler deploy --dry-run skipping asset build-artifact validation checks

    Previously, --dry-run skipped the entire asset sync step, which meant it also skipped validation that runs during asset manifest building. This included the check that errors when a _worker.js file or directory would be uploaded as a public static asset (which can expose private server-side code), as well as the per-file size limit check.

    With this fix, --dry-run now runs buildAssetManifest against the asset directory when assets are configured, performing the same file-system validation as a real deploy without uploading anything or making any API calls.

  • #​13061 535582d Thanks @​petebacondarwin! - fix: resolve secondary worker types when environment overrides the worker name in multi-worker type generation

    When running wrangler types with multiple -c config flags and the secondary worker has named environments that override the worker name (e.g. a worker named do-worker with env staging whose effective name becomes do-worker-staging), service bindings and Durable Object bindings in the primary worker that reference do-worker-staging now correctly resolve to the typed entry point instead of falling back to an unresolved comment type such as DurableObjectNamespace /* MyClass from do-worker-staging */.

    The fix extends the secondary entries map to also register environment-specific worker names, so that lookups by the env-qualified name (e.g. do-worker-staging) resolve to the same source file as the base worker name.

  • #​13058 992f9a3 Thanks @​petebacondarwin! - fix: patch undici to prevent fetch() throwing on 401 responses with a request body

    Fetching with a request body (string, JSON, FormData, etc.) to an endpoint that returns a 401 would throw TypeError: fetch failed with cause expected non-null body source. This affected Unstable_DevWorker.fetch() and any other use of undici's fetch in wrangler.

    The root cause is isTraversableNavigable() in undici returning true unconditionally, causing the 401 credential-retry logic to run in Node.js where it should never apply (there is no browser UI to prompt for credentials). This is tracked upstream in nodejs/undici#4910. Until an upstream fix is released, we apply a patch to undici that returns false from isTraversableNavigable().

  • #​13017 91b7f73 Thanks @​petebacondarwin! - fix: prevent Docker container builds from spawning console windows on Windows

    On Windows, detached: true in child_process.spawn() gives each child process its own visible console window, causing many windows to flash open during wrangler deploy with [[containers]]. The detached option is now only set on non-Windows platforms (where it is needed for process group cleanup), and windowsHide: true is added to further suppress console windows on Windows.

  • #​12996 f6cdab2 Thanks @​guybedford! - Fix source phase imports in bundled and non-bundled Workers

    Wrangler now preserves import source syntax when it runs esbuild, including module format detection and bundled deploy output. This fixes both --no-bundle and bundled deployments for Workers that import WebAssembly using source phase imports.

  • #​12931 ce65246 Thanks @​dario-piotrowicz! - Improve error message when modules cannot be resolved during bundling

    When a module cannot be resolved during bundling, Wrangler now suggests using the alias configuration option to substitute it with an alternative implementation. This replaces esbuild's default suggestion to "mark the path as external", which is not a supported option in Wrangler.

    For example, if you try to import a module that doesn't exist:

    import foo from "some-missing-module";

    Wrangler will now suggest:

    To fix this, you can add an entry to "alias" in your Wrangler configuration
to substitute "some-missing-module" with an alternative implementation.
See https://developers.cloudflare.com/workers/wrangler/configuration/#bundling-issues

    This provides actionable guidance for resolving import errors.

  • #​13049 7a5be20 Thanks @​nikitassharma! - add library-push flag to containers registries credentials

    This flag is not available for public use.

  • #​13018 9c5ebf5 Thanks @​tgarg-cf! - Validate that queue consumers in wrangler config only use the "worker" type

    Previously, non-worker consumer types (e.g. http_pull) could be specified in the queues.consumers config. Now, wrangler will error if a consumer type other than "worker" is specified in the config file.

    To configure non-worker consumer types, use the wrangler queues consumer CLI commands instead (e.g. wrangler queues consumer http-pull add).

  • Updated dependencies [9fcdfca, 1faff35, f4ea4ac, 0386553]:

    • miniflare@​4.20260317.3

v4.77.0

Compare Source

Minor Changes

  • #​13023 593c4db Thanks @​jamesopstad! - Add wrangler versions upload support for the experimental secrets configuration property

    When the new secrets property is defined, wrangler versions upload now validates that all secrets declared in secrets.required are configured on the Worker

Configuration

📅 Schedule: Branch creation - "after 2am and before 3am" (UTC), Automerge - "after 1am and before 2am" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from pi0 as a code owner March 27, 2026 02:43
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 27, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.87%. Comparing base (b5b0449) to head (22a333e).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main     #766      +/-   ##
==========================================
+ Coverage   64.81%   64.87%   +0.06%     
==========================================
  Files          43       43              
  Lines        2234     2238       +4     
  Branches      522      523       +1     
==========================================
+ Hits         1448     1452       +4     
  Misses        678      678              
  Partials      108      108

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 1c3d60a to 910d4ff Compare March 30, 2026 10:51
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 910d4ff to 22a333e Compare March 30, 2026 19:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pi0 pi0 Awaiting requested review from pi0 pi0 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants