Skip to content

chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates#19

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-0e37c399d5
Open

chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates#19
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-0e37c399d5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 6 updates in the / directory:

Package From To
drizzle-zod 0.5.1 0.8.3
hono 4.12.29 4.12.32
@cloudflare/vitest-pool-workers 0.16.20 0.18.8
tsx 4.22.3 4.23.1
vitest 4.1.7 4.1.10
wrangler 4.105.0 4.114.0

Updates drizzle-zod from 0.5.1 to 0.8.3

Commits

Updates hono from 4.12.29 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

  • ci: enable reports for type & bundle size check in honojs/hono#5148
  • fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
  • fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
  • test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
  • fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
  • fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

Full Changelog: honojs/hono@v4.12.29...v4.12.30

Commits
  • 26d8e42 4.12.32
  • 402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
  • c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
  • a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
  • 44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
  • e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
  • bf8608c ci: enable reports for type & bundle size check (#5148)
  • cadff88 4.12.31
  • 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
  • aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
  • Additional commits viewable in compare view

Updates @cloudflare/vitest-pool-workers from 0.16.20 to 0.18.8

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.18.8

Patch Changes

@​cloudflare/vitest-pool-workers@​0.18.7

Patch Changes

  • #14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

  • #14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

  • #14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

  • #14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

    The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

    These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

  • Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

    • miniflare@4.20260721.0
    • wrangler@4.113.0

@​cloudflare/vitest-pool-workers@​0.18.6

Patch Changes

@​cloudflare/vitest-pool-workers@​0.18.5

Patch Changes

@​cloudflare/vitest-pool-workers@​0.18.4

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.18.8

Patch Changes

0.18.7

Patch Changes

  • #14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

  • #14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

  • #14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

  • #14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

    The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

    These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

  • Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

    • miniflare@4.20260721.0
    • wrangler@4.113.0

0.18.6

Patch Changes

0.18.5

Patch Changes

... (truncated)

Commits
  • 16b3d5a Version Packages (#14799)
  • 7b3fea6 fix(vitest-pool-workers): tolerate dispose rejections in pool worker stop() (...
  • 88f42e7 Version Packages (#14740)
  • 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
  • 538e867 [vitest-pool-workers] Treat webSocket* as optional Durable Object handlers ...
  • de34449 [vitest-pool-workers] Fix module fallback failure on non-ASCII workspace path...
  • 5eac99e [vitest-pool-workers] Support streaming tails to the main worker (#14739)
  • 82918ad Version Packages (#14699)
  • 4e62bba fix(vitest-pool-workers): avoid hanging on broken DO logs (#14678)
  • b449bb0 Version Packages (#14644)
  • Additional commits viewable in compare view

Updates tsx from 4.22.3 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

  • support tsImport after global preload (8d4ffc2)
  • watch: avoid clearing piped output (95d0672)
  • watch: treat script and dependency paths literally (79fddde)

Performance Improvements

  • index transform cache lazily (e818ad6)
  • load esbuild lazily in CLI (d067938)
  • map Node TypeScript formats directly (cdcc623)
  • use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

Features

This release is also available on:

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

  • isolate hook state per async module.register() registration (a305f36)

This release is also available on:

... (truncated)

Commits
  • 79fddde fix(watch): treat script and dependency paths literally
  • e818ad6 perf: index transform cache lazily
  • cdcc623 perf: map Node TypeScript formats directly
  • d067938 perf: load esbuild lazily in CLI
  • 95d0672 fix(watch): avoid clearing piped output
  • 6fd4607 docs: add per-page metadata
  • f4176d8 docs: generate sitemap
  • 8d4ffc2 fix: support tsImport after global preload
  • f0e89b2 docs: document Node's public type-stripping API vs internal loader path
  • f8992f1 perf: use sync module hooks on Node v22.22.3+
  • Additional commits viewable in compare view

Updates vitest from 4.1.7 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • See full diff in compare view

Updates wrangler from 4.105.0 to 4.114.0

Release notes

Sourced from wrangler's releases.

wrangler@4.114.0

Minor Changes

  • #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

    wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

    You can explore this data two ways:

    • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
    • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

    While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

  • #14373 246ce92 Thanks @​Jacroney! - Improve the D1 database-limit error message

    When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

  • #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260721.1 ^5.20260722.1
    workerd 1.20260721.1 1.20260722.1

  • #14788 8416b33 Thanks @​chinesepowered! - Fix grammar in the container image-too-large error

    The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."

  • #14809 4683ff8 Thanks @​jamesopstad! - Ignore the removed legacy_env field when reading a redirected configuration

    Older versions of tools such as the Vite plugin can generate a redirected configuration (.wrangler/deploy/config.json) that still includes the removed legacy_env field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips legacy_env from redirected configurations. User-authored configurations still report an error so that the field can be removed.

  • #14593 02232f3 Thanks @​spk-ai! - Fix dev proxy silently hanging or returning a misleading 503 on network errors for non-root-path requests

    During wrangler dev, a transient network error on any request path other than / could be misclassified as the worker being reloaded, even when it wasn't: GET/HEAD requests would silently hang (with nothing logged) until the client timed out, and other methods would receive a misleading Your worker restarted mid-request 503. Such errors are now reported and surfaced immediately when the worker has not actually changed.

  • #14797 f8a8c2c Thanks @​roerohan! - Explain how to provision Flagship bindings if app_id missing in remote development

    Wrangler now reports that a Flagship binding without an app_id must first be created with wrangler flagship apps create.

  • Updated dependencies [c38a2c3, c079ba3, 95b026e, c4bacec, 3203b5d]:

    • miniflare@4.20260722.0

wrangler@4.113.0

Minor Changes

... (truncated)

Commits
  • 16b3d5a Version Packages (#14799)
  • 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
  • 246ce92 [wrangler] Improve d1 create database-limit error message (#14373)
  • 02232f3 [wrangler] compare origins, not hrefs, when classifying dev proxy fetch error...
  • 8416b33 [wrangler] Fix grammar in container image-too-large error (#14788)
  • f8a8c2c [wrangler] Explain missing Flagship app ID (#14797)
  • 88f42e7 Version Packages (#14740)
  • 9e61971 unskip agent memory remote bindings test (#14786)
  • 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
  • 4815711 [miniflare] Report the Worker's error for HEAD requests (#14766)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 25, 2026
@dependabot dependabot Bot mentioned this pull request Jul 25, 2026
Closed
@github-actions
github-actions Bot enabled auto-merge (squash) July 25, 2026 14:30
@dependabot
chore(deps): bump the npm-minor-patch group across 1 directory with 6…
273100e 
… updates

Bumps the npm-minor-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [drizzle-zod](https://github.com/drizzle-team/drizzle-orm) | `0.5.1` | `0.8.3` |
| [hono](https://github.com/honojs/hono) | `4.12.29` | `4.12.32` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.16.20` | `0.18.8` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.3` | `4.23.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.7` | `4.1.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.105.0` | `4.114.0` |



Updates `drizzle-zod` from 0.5.1 to 0.8.3
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](https://github.com/drizzle-team/drizzle-orm/commits)

Updates `hono` from 4.12.29 to 4.12.32
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.29...v4.12.32)

Updates `@cloudflare/vitest-pool-workers` from 0.16.20 to 0.18.8
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.8/packages/vitest-pool-workers)

Updates `tsx` from 4.22.3 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.3...v4.23.1)

Updates `vitest` from 4.1.7 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `wrangler` from 4.105.0 to 4.114.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.114.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.18.8
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: drizzle-zod
  dependency-version: 0.8.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: hono
  dependency-version: 4.12.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: wrangler
  dependency-version: 4.114.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump the npm-minor-patch group with 6 updates chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates Jul 25, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-patch-0e37c399d5 branch from 773dfdc to 273100e Compare July 25, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants