Skip to content

chore(deps): update all non-major dependencies#4343

Merged
pi0 merged 1 commit into
mainfrom
renovate/all-minor-patch
Jun 17, 2026
Merged

chore(deps): update all non-major dependencies#4343
pi0 merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Jun 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/workers-types ^4.20260609.1 → ^4.20260613.1 age confidence
@scalar/api-reference (source) ^1.59.2 → ^1.59.3 age confidence
@types/node (source) ^25.9.2 → ^25.9.3 age confidence
@typescript/native-preview (source) 7.0.0-dev.20260609.1 → 7.0.0-dev.20260614.1 age confidence
@​vercel/queue ^0.3.0 → ^0.3.1 age confidence
giget ^3.2.0 → ^3.3.0 age confidence
miniflare (source) ^4.20260609.0 → ^4.20260611.0 age confidence
motion-v ^2.2.1 → ^2.3.0 age confidence
nypm ^0.6.6 → ^0.6.7 age confidence
pnpm (source) 11.5.2 → 11.6.0 age confidence
rolldown (source) ^1.1.0 → ^1.1.1 age confidence
rollup (source) ^4.61.1 → ^4.62.0 age confidence
semver ^7.8.3 → ^7.8.4 age confidence
shaders ^2.5.129 → ^2.5.130 age confidence
wrangler (source) ^4.99.0 → ^4.100.0 age confidence

Release Notes

cloudflare/workerd (@​cloudflare/workers-types)

v4.20260613.1

Compare Source

v4.20260612.1

Compare Source

v4.20260611.1

Compare Source

scalar/scalar (@​scalar/api-reference)

v1.59.3

Patch Changes

  • #​9396: Refactor URL redirects into a routing-agnostic, list-driven engine. Redirects now operate on the bare navigation id, so each rule works across hash, hash-base-path, and path routing automatically. Also redirect old models/<name> bookmarks to the configured models section slug when the section label is customized (e.g. schemas/).

  • #​9489: Do not render the info link list when no links are available.

  • #​9342: fix: resolve operations when OpenAPI path items use $ref

    Path entries and webhooks can reference components.pathItems instead of inlining operations. Navigation, mutators, search, and markdown export now resolve path-item references before reading HTTP methods and path-level parameters.

  • #​9498: Sync the SDK installation tabs with the operation code examples: picking a language under "Client Libraries" now switches every operation's code sample to that language's custom example

microsoft/typescript-go (@​typescript/native-preview)

v7.0.0-dev.20260614.1

Compare Source

v7.0.0-dev.20260613.1

Compare Source

v7.0.0-dev.20260612.1

Compare Source

v7.0.0-dev.20260611.2

Compare Source

v7.0.0-dev.20260610.1

Compare Source

cloudflare/workers-sdk (miniflare)

v4.20260611.0

Compare Source

Minor Changes

  • #​14119 2047a32 Thanks @​tahmid-23! - Add support for serving R2 bucket objects publicly via the dev server

    Each local R2 bucket is now exposed under /cdn-cgi/local/r2/public/<bucket-id>/<key> on the existing user-facing dev server. The <bucket-id> is the bucket's id when set, otherwise its binding name. Buckets with a remoteProxyConnectionString are not exposed. The endpoint supports GET and HEAD, range requests, conditional headers, and forwards stored HTTP metadata.

Patch Changes

  • #​14246 f3990b2 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260609.1 1.20260610.1

  • #​14256 4597f08 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260610.1 1.20260611.1
motiondivision/motion-vue (motion-v)

v2.3.0

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
pnpm/pnpm (pnpm)

v11.6.0

Compare Source

Minor Changes

  • pnpm install completes without re-resolving when pnpm-lock.yaml was deleted but node_modules is intact: the up-to-date check now treats the current lockfile (node_modules/.pnpm/lock.yaml) — the record of what the previous install materialized — as the wanted lockfile, verifies the manifests still match it, restores pnpm-lock.yaml from it, and reports "Already up to date". Previously this scenario triggered a full resolution and a re-verification of every locked package against the registry.

  • 615c669: Added support for configuring URL-scoped registry settings through npm_config_//… and pnpm_config_//… environment variables, for example:

    npm_config_//registry.npmjs.org/:_authToken=<token>
pnpm_config_//registry.npmjs.org/:_authToken=<token>

    This provides a file-free way to supply registry authentication. Because the registry a value applies to is encoded in the (trusted) environment variable name, it is host-scoped by construction and cannot be redirected to another registry by repository-controlled config. The environment value is treated as trusted config: it takes precedence over a project/workspace .npmrc but is still overridden by command-line options. When the same key is provided through both prefixes, pnpm_config_ wins.

  • Raised the default network concurrency from min(64, max(cpuCores * 3, 16)) to min(96, max(cpuCores * 3, 64)). Package downloads are I/O-bound, not CPU-bound, so deriving the floor from the core count left machines with few cores (for example 4-vCPU CI runners) downloading only 16 tarballs at a time and unable to saturate a low-latency registry. The networkConcurrency setting still overrides the default.

Patch Changes
  • Improved the warning printed when a project .npmrc uses an environment variable in a registry/proxy URL or in registry credentials. The message now explains why the setting was ignored and how to migrate it to a trusted source — for example by moving the line to the user-level ~/.npmrc or running pnpm config set "<key>" <value> — with a link to https://pnpm.io/npmrc. The pnpm config set example is only suggested when the key has no ${...} placeholder, so the snippet is always safe to copy-paste.
  • Print a "Lockfile passes supply-chain policies (verified 2h ago)" message when lockfile verification is skipped because a cached verdict for the same lockfile content and policy is reused. Previously the cached short-circuit was completely silent, which made it look like the policy gate never ran #​12324.
  • Platform-specific optional dependencies are now skipped even when their os/cpu/libc fields are missing from the registry metadata or the lockfile. Some registries strip these fields from the package metadata, which made pnpm download and install the binaries of every platform regardless of supportedArchitectures. The missing platform fields of an optional dependency are now inferred from its name (e.g. @nx/nx-win32-arm64-msvc → os: win32, cpu: arm64), so foreign-platform binaries are skipped without even downloading them #​11702.

v11.5.3

Compare Source

Patch Changes

  • Stopped expanding environment variables in repository-controlled registry/proxy request destinations and registry credential values from .npmrc, and in workspace registry URLs from pnpm-workspace.yaml. Move dynamic registry URL and token configuration to trusted user, global, CLI, or environment config.

  • Resolve package-manager bootstrap dependencies with trusted user or CLI registry and network config, and reject package-manager env-lockfile records that do not use registry package paths with integrity-only resolutions before auto-switch execution.

  • Avoid writing packageManagerDependencies to pnpm-lock.yaml when package manager policy is set to onFail: ignore or pmOnFail: ignore #​12228.

  • Avoid running dependency-status auto-install when the dependency status is unavailable without a project manifest.

  • Using the $ version reference syntax in overrides (e.g. "react": "$react") now prints a deprecation warning. The syntax still works, but catalogs are the recommended way to keep an overridden version in sync with the rest of the workspace. Reference a catalog entry with the catalog: protocol instead.

  • Fixed pnpm config get globalconfig to return the global config.yaml path again pnpm/pnpm#11962.

  • Fixed bare --color so it does not consume the following CLI flag, allowing command shorthands like --parallel to expand correctly and forms like pnpm --color with current <command> to dispatch the inner command instead of failing with MISSING_WITH_CURRENT_CMD.

  • Fix pnpm install ignoring enableGlobalVirtualStore toggle by including it in the workspace state settings check #​12142.

  • Security: pnpm now verifies the npm registry signature of a package-manager binary before spawning it, so a cloned repository cannot make pnpm download and execute an arbitrary native binary.

    This covers two paths that select an executable from repository-controlled input:

    • pacquet install engine — declaring pacquet (or @pnpm/pacquet) in configDependencies opts in to pnpm's Rust install engine. pnpm now verifies that the installed pacquet shim and the host's @pacquet/<platform>-<arch> binary carry a valid npm registry signature for their exact name@version, and refuses to run pacquet (failing the command) if the signature does not verify or cannot be checked. The only graceful fallback to pnpm's own engine is when pacquet has no binary for the current platform.
    • automatic version switch / self-update — the packageManager / devEngines.packageManager field makes pnpm download and run a specific pnpm version. pnpm now verifies the registry signature of pnpm, @pnpm/exe, and the host platform binary before installing/spawning them, and refuses to run an engine whose signature does not match a published, signed release. The check runs only on an actual download (store cache miss), so it does not add a network round trip to every command.

    In both cases the signature is verified over the installed integrity, against npm's public signing keys that ship embedded in the pnpm CLI (like corepack), so bytes substituted via a tampered lockfile or a repository-controlled registry fail verification — and a registry the user did not vouch for cannot supply its own signing keys. The signed packument is fetched from the configured registry, so an npm mirror works transparently. Verification fails closed: if it cannot be completed (for example, the registry is unreachable), the command fails rather than running an unverified binary. The embedded keys are kept current by a release-time check against npm's signing-keys endpoint.

  • Made peer-dependent deduplication deterministic. When a peer-suffixed package variant was a subset of two or more mutually incompatible larger variants, the variant it collapsed into depended on the order importers were resolved in, which varies between machines. This could resolve the same workspace to different lockfiles on different platforms and make pnpm dedupe --check alternate between passing and failing.

  • Reject invalid package names and versions from staged tarball manifests before deriving filenames for pnpm stage download.

  • Clarified in CLI help that the pnpm store is trusted shared state and store integrity checks are corruption detection, not a tamper boundary for untrusted store writers.

  • Reject reserved manifest bin names ("", ".", "..", and scoped forms such as @scope/..) when resolving a package's bins. These names previously passed the bin-name guard and, when joined to the global bin directory during global remove/update/add operations, could resolve to the global bin directory itself or its parent and have it recursively deleted.

  • Require trusted package identity before package-name allowBuilds entries can approve lifecycle scripts for git, git-hosted tarball, direct tarball, and local directory artifacts. To approve one of those artifacts explicitly, use its peer-suffix-free lockfile depPath as the allowBuilds key. Lockfile verification now rejects lockfiles where a registry-style dependency path (name@semver) is backed by a git, directory, or git-hosted tarball resolution (ERR_PNPM_RESOLUTION_SHAPE_MISMATCH), so the dependency path is a reliable artifact identity by the time scripts can run.

  • Security: pnpm now verifies the OpenPGP signature of a downloaded Node.js runtime's SHASUMS256.txt before trusting its integrity hashes.

    When a repository requests a Node.js runtime (e.g. via devEngines.runtime / useNodeVersion), the download mirror is repository-configurable through node-mirror:<channel>. The integrity of the downloaded binary was only checked against SHASUMS256.txt fetched from that same mirror — a circular check that a malicious mirror could satisfy by serving a tampered binary together with a matching SHASUMS256.txt. pnpm then executes the binary (for example to run lifecycle scripts).

    pnpm now fetches SHASUMS256.txt.sig and verifies the detached OpenPGP signature against the Node.js release team's public keys, which ship embedded in the pnpm CLI. A mirror that serves a tampered binary cannot also produce a valid signature, so the download fails to verify. The embedded keys are kept current by a release-time check against the canonical nodejs/release-keys list.

    The musl variants from the hardcoded unofficial-builds.nodejs.org mirror are not repository-configurable and are signed by a different key, so they continue to be trusted over TLS.

rolldown/rolldown (rolldown)

v1.1.1

Compare Source

🚀 Features
🐛 Bug Fixes
🚜 Refactor
📚 Documentation
⚡ Performance
🧪 Testing
⚙️ Miscellaneous Tasks
❤️ New Contributors
rollup/rollup (rollup)

v4.62.0

Compare Source

2026-06-13

Features
  • Ensure that shared dependencies between manual chunks and entry points receive a serparate chunk (#​6374)
Pull Requests
cloudflare/workers-sdk (wrangler)

v4.100.0

Compare Source

Minor Changes

  • #​14119 2047a32 Thanks @​tahmid-23! - Serve local R2 bucket objects publicly via the dev server

    When running wrangler dev locally, objects in each local R2 binding are now reachable under /cdn-cgi/local/r2/public/<bucket-id>/<key> on the existing dev server, simulating a public bucket. The <bucket-id> is the bucket's bucket_name when set, otherwise its binding. Bindings configured with remote: true are not exposed.

  • #​14202 e8561c2 Thanks @​jamesopstad! - Add experimental --x-new-config flag for authoring config in TypeScript

    This is an experimental, opt-in feature. When enabled, wrangler dev, wrangler build, wrangler deploy, wrangler versions upload, and wrangler versions deploy load the Worker's configuration from a cloudflare.config.ts file instead of wrangler.json / wrangler.jsonc / wrangler.toml. Additionally, an optional wrangler.config.ts file can be provided for Wrangler-specific dev/build configuration.

    • cloudflare.config.ts (required) — Worker runtime configuration (bindings, triggers, observability, placement, limits, compatibility, routes, etc.). Authored via defineWorker from wrangler/experimental-config.
    • wrangler.config.ts (optional) — Tooling / bundling / dev-server configuration (noBundle, minify, alias, define, rules, tsconfig, build, dev, assetsDirectory, etc.). Authored via defineWranglerConfig from wrangler/experimental-config.

    Per-environment configuration is via ctx.mode branching inside the function form of either file.

    Example cloudflare.config.ts:

    import { defineWorker, bindings } from "wrangler/experimental-config";
import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };

export default defineWorker((ctx) => ({
	name: "my-worker",
	entrypoint,
	compatibilityDate: "2026-05-18",
	env: {
		MY_KV: bindings.kv(),
		MY_TEXT: bindings.text(`The mode is ${ctx.mode}`),
	},
}));

    Example wrangler.config.ts:

    import { defineWranglerConfig } from "wrangler/experimental-config";

export default defineWranglerConfig({
  minify: true,
  assetsDirectory: "./public",
});

    Because this is experimental, the flag, the config formats, and the wrangler/experimental-config exports may change in any release.

Patch Changes

  • #​14185 98c9afe Thanks @​penalosa! - Use the shared env-credential resolver from @cloudflare/workers-auth

    No user-facing behaviour change. Credential resolution order (global API key + email → CLOUDFLARE_API_TOKEN → stored OAuth token) is preserved.

  • #​14184 e305126 Thanks @​penalosa! - Add an experimental cf-wrangler delegate entrypoint for projects that can't use @cloudflare/vite-plugin (service workers, old compatibility dates, Python, Rust, etc.).

    cf-wrangler dev starts the same local dev server as wrangler dev — it sits directly on wrangler's internal dev server, so the bundling and runtime behaviour are identical — but exposes a deliberately narrow CLI surface (--mode, --port, --host, --local) for a parent CLI to delegate to, and other dev server config options are read from the wrangler config file.

    This replaces the separate @cloudflare/wrangler-bundler package. This is an internal integration point and is not intended to be run directly by users.

  • #​14246 f3990b2 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260609.1 1.20260610.1

  • #​14256 4597f08 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260610.1 1.20260611.1

  • #​14243 25722ac Thanks @​com6056! - Fix a memory leak that could make long-running headless wrangler dev sessions unresponsive

    Long-running wrangler dev sessions with no DevTools attached (for example using the containers feature under sustained traffic) could gradually consume unbounded memory and eventually stop accepting connections. The inspector proxy now only enables network tracking while a DevTools client is connected, so the buildup no longer happens. Interactive debugging is unaffected. Fixes #​14191.

  • #​14230 41f75c0 Thanks @​dario-piotrowicz! - Improve D1 error messages for missing or conflicting options

    Error messages for d1 execute, d1 export, d1 time-travel restore, and d1 insights now clearly state which option is missing or conflicting, explain why the combination is invalid, and suggest how to fix the issue.

    Additionally, duration validation errors in d1 insights are now thrown as UserError instead of plain Error, ensuring they are displayed cleanly to users rather than as unexpected crashes.

  • #​14213 10b5538 Thanks @​dario-piotrowicz! - Improve authentication error messages with specific failure reasons

    When authentication fails (e.g. during wrangler dev --remote or when using remote bindings), the error message now explains exactly what went wrong -- whether no credentials were found, the token expired, or the environment is non-interactive -- and lists actionable steps to fix it, including a wrangler whoami tip.

    Previously, auth failures could produce multiple confusing errors (e.g. "Failed to fetch auth token: 400 Bad Request" followed by "Failed to start the remote proxy session"). Now a single, clear error is shown.

  • #​14233 818c105 Thanks @​dario-piotrowicz! - Improve R2 Sippy error messages

    Now error messages in wrangler r2 bucket sippy follow a consistent pattern: they describe what is missing, name the exact --flag to use, and provide context (e.g. example values, links to the dashboard). Previously, many errors said only "Error: must provide --flag." with no guidance on what the flag does or how to obtain the value.

  • #​14259 2ae6099 Thanks @​emily-shen! - Move worker build step earlier in deploy/upload step, before upload specific config validation

  • Updated dependencies [f3990b2, 4597f08, 2047a32]:

    • miniflare@​4.20260611.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "after 1am and before 5am"
  • Automerge
    • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot requested a review from pi0 as a code owner June 12, 2026 02:04
@vercel

vercel Bot commented Jun 12, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
nitro.build Ready Ready Preview, Comment Jun 17, 2026 2:34pm

Request Review

@pkg-pr-new

pkg-pr-new Bot commented Jun 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4343

commit: a4199f3

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 8dc60ad to bc7bd7c Compare June 13, 2026 00:43
@renovate renovate Bot changed the title chore(deps): update all non-major dependencies to ^2.3.0 chore(deps): update all non-major dependencies Jun 13, 2026
@socket-security

socket-security Bot commented Jun 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedrolldown@​1.1.1951007899100
Addedshaders@​2.5.13087100849680
Added@​types/​node@​25.9.31001008196100
Added@​typescript/​native-preview@​7.0.0-dev.20260614.110010082100100
Added@​scalar/​api-reference@​1.59.39910091100100
Addedwrangler@​4.100.0981009296100
Addedmotion-v@​2.3.010010010093100
Addedminiflare@​4.20260611.09910010096100
Added@​vercel/​queue@​0.3.19710010099100
Addedrollup@​4.62.09710010099100
Added@​cloudflare/​workers-types@​4.20260616.1100100100100100

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from bc7bd7c to ec82072 Compare June 13, 2026 05:55
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from ec82072 to a633ff8 Compare June 13, 2026 08:36
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from a633ff8 to 6286991 Compare June 13, 2026 14:17
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 6286991 to 83e05ff Compare June 14, 2026 02:48
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 83e05ff to 3702275 Compare June 14, 2026 09:49
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 3702275 to 1e90f2c Compare June 14, 2026 16:36
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 1e90f2c to ec2fde0 Compare June 14, 2026 21:29
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from ec2fde0 to 3c204be Compare June 15, 2026 00:55
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 3c204be to 14c4998 Compare June 15, 2026 05:52
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 14c4998 to 09b8927 Compare June 15, 2026 12:39
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 09b8927 to 23a308f Compare June 16, 2026 02:45
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 23a308f to 28d06b9 Compare June 16, 2026 17:02
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from 28d06b9 to a4199f3 Compare June 17, 2026 14:32
@pi0 pi0 merged commit e59431c into main Jun 17, 2026
13 checks passed
@pi0 pi0 deleted the renovate/all-minor-patch branch June 17, 2026 16:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pi0 pi0 Awaiting requested review from pi0 pi0 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pi0