Skip to content

build(deps-dev): bump the development group with 5 updates - #143

Merged
vincentkoc merged 2 commits into
mainfrom
dependabot/npm_and_yarn/development-55a5cbdb08
Oct 14, 2026
Merged

build(deps-dev): bump the development group with 5 updates#143
vincentkoc merged 2 commits into
mainfrom
dependabot/npm_and_yarn/development-55a5cbdb08

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the development group with 5 updates:

Package From To
vite 8.3.3 8.3.4
@cloudflare/vitest-plugin 1.3.7 1.4.0
@cloudflare/workers-types 5.20261008.1 5.20261011.1
wrangler 4.148.0 4.149.0
@types/node 26.6.4 26.6.5

Updates vite from 8.3.3 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)
Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)
Commits
  • b6c20f6 release: v8.3.4 (#23702)
  • b28db28 fix(server): match static aliases on path boundaries (#23643)
  • bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
  • fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
  • 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
  • 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
  • facc2fb fix: remove input option unescaping for now (#23694)
  • 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
  • cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
  • fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
  • Additional commits viewable in compare view

Updates @cloudflare/vitest-plugin from 1.3.7 to 1.4.0

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.4.0

Minor Changes

Patch Changes

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.4.0

Minor Changes

Patch Changes

Commits

Updates @cloudflare/workers-types from 5.20261008.1 to 5.20261011.1

Commits

Updates wrangler from 4.148.0 to 4.149.0

Release notes

Sourced from wrangler's releases.

wrangler@4.149.0

Minor Changes

  • #16036 9a58244 Thanks @​edevil! - Support temporary event accounts in R2 and Containers commands

    wrangler r2 and wrangler containers commands now accept the hidden --temporary flag, so accounts created for an event can manage buckets, objects and containers directly. Every command that supports --temporary now also accepts a hidden --event-code flag, so the first command a participant runs can create the event account:

    wrangler r2 bucket create my-bucket --temporary --event-code <code>

    R2 and Containers are only available on event accounts. R2 custom domains, Sippy, external container registries and wrangler cloudchamber commands still require a logged-in account.

Patch Changes

  • #16139 2d1d563 Thanks @​cpojer! - Update esbuild to 0.28.2

    Align esbuild dependency with tooling using the latest 0.28 patch so package managers can share one installation instead of downloading a second native binary.

  • #15632 85b14e7 Thanks @​petebacondarwin! - Honor Retry-After directives during static asset uploads

    Static asset uploads now pause retries and pending uploads until the latest outstanding deadline requested by the API. A per-request limiter also keeps gateway retries at the reduced concurrency after the pause ends, preventing a deployment from immediately overloading a constrained asset service again.

  • #16098 fe607f9 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    sharp 0.35.4 0.35.5

  • #16093 ad7ff45 Thanks @​DiogoSantoss! - Document that addresses catch-all entries must use the zone apex

    A *@domain entry in addresses must use the zone apex, such as *@example.com. The zone catch-all also receives mail for every subdomain in the zone that has no literal rule.

  • #16102 757faa6 Thanks @​tlq5l! - Keep Preview secrets when deploying to an existing Preview

    Secrets added to a Preview with wrangler preview secret put or wrangler preview secret bulk were lost the next time wrangler preview ran, because each new deployment was created from the Wrangler config, --var and --secrets-file values only.

    wrangler preview now carries over the secrets of the Preview's latest deployment. A value passed in this deployment (--secrets-file, --var or a previews binding with the same name) still replaces the existing secret, and wrangler preview secret delete removes one.

  • #15617 93c1069 Thanks @​jpatel3! - Stop the update check from recommending deprecated versions

    Previously, the "update available" notice shown by wrangler and @cloudflare/vite-plugin always pointed at whichever version was tagged latest on npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.

    The check now reads the npm registry directly instead of going through the update-check package, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.

  • #16003 6947df3 Thanks @​oddharsh! - Ship using and await using declarations to the runtime as written, for smaller Worker bundles

    Workers and Pages Functions that use explicit resource management no longer carry about 1 KB of bundled helper code to emulate it. workerd supports using and await using natively at every compatibility date, so wrangler deploy, wrangler versions upload and Pages Functions builds now leave these declarations untouched.

  • #15958 82acf3c Thanks @​breken-ai! - Apply each action's own condition in wrangler r2 bucket lifecycle add

... (truncated)

Commits
  • 84c4e95 Version Packages (#16099)
  • 82acf3c [wrangler] Apply each action's own condition in r2 bucket lifecycle add (#1...
  • 757faa6 [wrangler] Keep Preview secrets when deploying to an existing Preview (#16102)
  • 85b14e7 [deploy-helpers] respect Retry-After during asset uploads (#15632)
  • 6947df3 [wrangler][vite-plugin] Preserve using declarations when bundling (#16003)
  • 9a58244 [wrangler] Support temporary event accounts in R2 and Containers commands (#1...
  • See full diff in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@clawsweeper

clawsweeper Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Oct 14, 2026
@clawsweeper

clawsweeper Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge.

What this changes

This PR updates Vite, Cloudflare testing and deployment tools, Workers types, and Node types alongside the shared pnpm lockfile.

Example: An operator installs dependencies before running pnpm --dir apps/api run deploy:worker.

  • Before: The lockfile selects Wrangler 4.148.0.
  • After: The lockfile selects Wrangler 4.149.0.

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) A focused compatible refresh with passing current-head validation and no findings; runtime confidence rests on build and harness coverage.
Proof confidence 🦐 gold shrimp (3/6) This Dependabot maintenance PR is outside the ordinary contributor proof gate; current-head CI exercises installation, Vite builds, Wrangler type generation, and the Cloudflare Worker harness, while the full discussion supplies no application runtime media.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Developers and operators remain on older compatible build, test, and deployment tools.
Reason: The focused update incorporates upstream fixes and consolidates dependency resolutions within the established maintenance boundaries.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the compatible dependency updates remain absent from main, the earlier changelog finding is resolved, and all eight current-head checks pass with no actionable defect identified.

Priority: P3
Reviewed head: cc867ae3a1cfb7b4727256fa701c506d3b60ce88

Before merge

None.

Findings

None.

Tests

  • Missing end-to-end proof: Supplied validation covers builds, generated types, and the Worker test harness, but does not show a browser or Wrangler deployment smoke run.
Agent review details

How this fits together

Workspace manifests and the pnpm lockfile select tools that consume application source and produce dashboard assets, Worker bundles, generated types, and test results.

flowchart LR
 A[Workspace manifests] --> B[pnpm lockfile]
 B --> C[Vite]
 B --> D[Cloudflare test plugin]
 B --> E[Wrangler]
 C --> F[Dashboard assets]
 E --> G[Worker bundles]
Loading

Technical review

Best possible solution:

Land the compatible dependency refresh with its Unreleased changelog entry.

Do we have a high-confidence way to reproduce the issue?

This PR is dependency maintenance rather than a reported application bug; the version changes are directly verified in the pinned diff.

Is this the best way to solve the issue?

Updating the existing manifests and shared lockfile follows the established maintenance approach while preserving runtime support, security overrides, SDK contracts, and dependency cooldown.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against da61b70886ee.

Provenance checked

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

Likely related people:

  • Vincent Koc: Raw commit 4217033 adds packages/cli/package.json:17 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 4217033cddb0; files: packages/cli/package.json)

Review metrics

Metric Value Why it matters
Dependency metadata scope Manifests +6/-6; lockfile +150/-427; changelog +2; application source unchanged The lockfile reduction consolidates existing esbuild and Zod resolutions while refreshing the selected tools.

Labels

Label changes:

No label changes.

Label justifications:

  • P3: Routine compatible dependency maintenance with no demonstrated urgent regression or remaining correctness finding.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (2 earlier review cycles)
  • reviewed 2026-10-14T00:14:23.000Z sha 676a8c7 :: needs changes before merge. :: [P3] Document the deployment-tool update in Unreleased
  • reviewed 2026-10-14T04:35:44.660Z sha e61d12f :: needs maintainer review before merge. :: none

Reviewed October 14, 2026, 12:50 AM ET / 04:50 UTC (Revision 3).

@vincentkoc

vincentkoc commented Oct 14, 2026

Copy link
Copy Markdown
Member

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
Exact review queued.

Re-review progress:

@clawsweeper clawsweeper Bot added status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Oct 14, 2026
dependabot Bot and others added 2 commits October 14, 2026 12:45
@dependabot @vincentkoc
build(deps-dev): bump the development group with 5 updates
3322d22 
Bumps the development group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.3` | `8.3.4` |
| [@cloudflare/vitest-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-plugin) | `1.3.7` | `1.4.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261008.1` | `5.20261011.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.148.0` | `4.149.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.4` | `26.6.5` |


Updates `vite` from 8.3.3 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

Updates `@cloudflare/vitest-plugin` from 1.3.7 to 1.4.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-plugin/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-plugin@1.4.0/packages/vitest-plugin)

Updates `@cloudflare/workers-types` from 5.20261008.1 to 5.20261011.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `wrangler` from 4.148.0 to 4.149.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.149.0/packages/wrangler)

Updates `@types/node` from 26.6.4 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@cloudflare/vitest-plugin"
  dependency-version: 1.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261011.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: wrangler
  dependency-version: 4.149.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>
@vincentkoc
docs: note compatible deployment tool refresh
cc867ae
@vincentkoc
vincentkoc force-pushed the dependabot/npm_and_yarn/development-55a5cbdb08 branch from e61d12f to cc867ae Compare October 14, 2026 04:45
@vincentkoc

vincentkoc commented Oct 14, 2026

Copy link
Copy Markdown
Member

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🦞👀
Exact review queued.

Re-review progress:

vincentkoc
vincentkoc approved these changes Oct 14, 2026
View reviewed changes

@vincentkoc vincentkoc left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed exact cc867ae, including upstream dependency contracts, consuming paths, unchanged runtime floor/cooldown, and the deployment-tool changelog entry. Fresh CI passes; exact-head ClawSweeper review has no findings or remaining moves. Independent review confirmed the rebase adds only the already reviewed main workflow pins.

@vincentkoc
vincentkoc merged commit 112118d into main Oct 14, 2026
8 checks passed
@vincentkoc
vincentkoc deleted the dependabot/npm_and_yarn/development-55a5cbdb08 branch October 14, 2026 04:57
@clawsweeper clawsweeper Bot mentioned this pull request Oct 14, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vincentkoc vincentkoc vincentkoc approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vincentkoc