chore(deps): bump the all-deps group across 1 directory with 8 updates

[dependabot]

Bumps the all-deps group with 8 updates in the / directory:

Package	From	To
marked	18.0.2	18.0.3
vinext	0.0.44	0.0.47
@cloudflare/vite-plugin	1.33.1	1.35.0
@cloudflare/workers-types	4.20260424.1	4.20260504.1
@vitejs/plugin-rsc	0.5.24	0.5.25
oxfmt	0.46.0	0.47.0
oxlint	1.61.0	1.62.0
wrangler	4.84.1	4.87.0

Updates marked from 18.0.2 to 18.0.3

Release notes

Sourced from marked's releases.

v18.0.3

18.0.3 (2026-05-01)

Bug Fixes

• avoid task checkbox for setext heading text (#3960) (2608e81)

Commits

• e8dc395 chore(release): 18.0.3 [skip ci]
• 2608e81 fix: avoid task checkbox for setext heading text (#3960)
• dba76f6 chore(deps-dev): bump eslint from 10.2.0 to 10.2.1 (#3953)
• 015f1eb chore(deps-dev): bump typescript from 6.0.2 to 6.0.3 (#3954)
• 17c06e9 chore: fix building license for docs (#3952)
• 55a54b5 chore: Rename LICENSE.md to LICENSE for better compatibility with Bazel tooli...
• See full diff in compare view

Updates vinext from 0.0.44 to 0.0.47

Release notes

Sourced from vinext's releases.

v0.0.47

What's Changed

New Features

• Added React-based runtime error overlay for better development experience

Bug Fixes

• Fixed layout segment configuration not being properly applied to pages in App Router
• Fixed routing issues where inherited slot parameters were incorrectly matched against request URL instead of route path
• Fixed parallel slots not being properly mirrored to descendant sub-pages
• Fixed CLI validation to properly reject missing or malformed --port and --hostname values
• Fixed Google Fonts to be self-hosted in development mode instead of making external requests
• Fixed hydration errors in next/image component by adding proper error replay handling
• Fixed navigation to properly fall back to hard navigation when render errors tear down the component tree
• Fixed HMR to trigger full page reload when render errors destroy the browser root
• Fixed HMR timing issues by ensuring router state is ready before dispatching RSC updates
• Fixed ISR to properly honor route expiration ceilings

Performance

• Moved private Next.js instrumentation client out of Vite's dependency optimization for faster dev builds

Internal / Chores

• Refactored App RSC request lifecycle into typed handler for better maintainability
• Extracted response finalization logic into dedicated server module
• Extracted request normalization into separate typed server module
• Refactored browser navigation lifecycle controller for better separation of concerns
• Extracted page element building logic into typed helper modules
• Extracted app fallback renderer factory for better code organization
• Moved instrumentation lazy initialization to dedicated server module
• Extracted App Router route graph builder into separate module
• Moved route classification injection behind typed planner interface
• Added code review guidelines for AI agent
• Updated project README
• Added test coverage reporting for integration tests
• Removed obsolete code assertion tests and snapshots
• Fixed various linting issues

Contributors

@​NathanDrake2406 @​james-elicx @​Divkix

v0.0.46

What's Changed

... (truncated)

Commits

• fb342f5 refactor(app-rsc): move request lifecycle into typed handler (#1036)
• 38d5be5 chore: add code review comment guidelines to viguy agent (#1043)
• 74a0578 chore: tweak readme (#1042)
• 54a1286 fix(app): apply layout segment config to pages (#993)
• 01b64a1 refactor(app-rsc): extract response finalisation into server/app-rsc-response...
• 3cd2bfc fix(routing): match inherited slot params against routePath, not request.url ...
• fffda16 feat(dev): React-based runtime error overlay (#1029)
• 2cf2143 fix(routing): mirror inherited parallel slots to descendant sub-pages (#1039)
• e51856b fix: validate CLI --port / --hostname values, reject missing/flags-as-values ...
• aba335d fix(dev): self-host Google Fonts in dev mode (#1038)
• Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.33.1 to 1.35.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.35.0

Minor Changes

• #13618 c07d0cb Thanks @​jamesopstad! - Support V2 protocol for module fallback service

  When the new_module_registry compatibility flag is set, requests sent to unsafeModuleFallbackService() use a different protocol. The Vite plugin now supports both protocols in its handling of additional module types.

Patch Changes

• #13363 6457fb3 Thanks @​courtney-sims! - Prepares router-worker for a more gradual rollout by refactoring and separating out the invocation from the business logic. In the future, this will provide space for us to route requests to new versions of router-worker based on their plan, but should make no functional difference today.

• Updated dependencies [22e1a61, 00523c8, b5ac54b, e653edf, e1eff94, 1c4d850, 6d28037, 9a1f014, e539008, 0bf64a7, 0827815, b04eedf, 6457fb3, c07d0cb, e539008]:

  • miniflare@4.20260430.0
  • wrangler@4.87.0

@​cloudflare/vite-plugin@​1.34.0

Minor Changes

• #13666 edcff69 Thanks @​edmundhung! - Add tunnel: true to the cloudflare() Vite plugin for sharing your local dev and preview servers via Cloudflare Quick Tunnels

  You can now expose your local dev server publicly by setting tunnel: true:

  cloudflare({
    tunnel: true,
  });

  You can also enable tunnel sharing dynamically using an environment variable:

  cloudflare({
    tunnel: process.env.ENABLE_DEV_TUNNEL === "true",
  });

  This starts a Cloudflare Quick Tunnel that gives you a random *.trycloudflare.com URL to share. The tunnel stops automatically when the dev or preview session ends. Quick tunnels don't require a Cloudflare account or any configuration.

  A warning is shown when Server-Sent Events (SSE) responses are detected through the tunnel, since quick tunnels don't support SSE.

Patch Changes

• Updated dependencies [ea943ff, 21b87b2, 62e9f2a, 9eb9e69, 2dc6175, 0a5db08, 033d6ec, ae8eae3, f2e2241, 4f6ed93, ed2f4ec, ef24ff2, 92bb8a5, 6d27479, f2e2241, 118027d, fcc491a, e6c437a, e867ac2]:
  • wrangler@4.86.0
  • miniflare@4.20260426.0

@​cloudflare/vite-plugin@​1.33.2

Patch Changes

• #13636 1d54fb7 Thanks @​edmundhung! - Stop denying vite.config.* files from Vite dev server access

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.35.0

Minor Changes

• #13618 c07d0cb Thanks @​jamesopstad! - Support V2 protocol for module fallback service

  When the new_module_registry compatibility flag is set, requests sent to unsafeModuleFallbackService() use a different protocol. The Vite plugin now supports both protocols in its handling of additional module types.

Patch Changes

• #13363 6457fb3 Thanks @​courtney-sims! - Prepares router-worker for a more gradual rollout by refactoring and separating out the invocation from the business logic. In the future, this will provide space for us to route requests to new versions of router-worker based on their plan, but should make no functional difference today.

• Updated dependencies [22e1a61, 00523c8, b5ac54b, e653edf, e1eff94, 1c4d850, 6d28037, 9a1f014, e539008, 0bf64a7, 0827815, b04eedf, 6457fb3, c07d0cb, e539008]:

  • miniflare@4.20260430.0
  • wrangler@4.87.0

1.34.0

Minor Changes

• #13666 edcff69 Thanks @​edmundhung! - Add tunnel: true to the cloudflare() Vite plugin for sharing your local dev and preview servers via Cloudflare Quick Tunnels

  You can now expose your local dev server publicly by setting tunnel: true:

  cloudflare({
    tunnel: true,
  });

  You can also enable tunnel sharing dynamically using an environment variable:

  cloudflare({
    tunnel: process.env.ENABLE_DEV_TUNNEL === "true",
  });

  This starts a Cloudflare Quick Tunnel that gives you a random *.trycloudflare.com URL to share. The tunnel stops automatically when the dev or preview session ends. Quick tunnels don't require a Cloudflare account or any configuration.

  A warning is shown when Server-Sent Events (SSE) responses are detected through the tunnel, since quick tunnels don't support SSE.

Patch Changes

• Updated dependencies [ea943ff, 21b87b2, 62e9f2a, 9eb9e69, 2dc6175, 0a5db08, 033d6ec, ae8eae3, f2e2241, 4f6ed93, ed2f4ec, ef24ff2, 92bb8a5, 6d27479, f2e2241, 118027d, fcc491a, e6c437a, e867ac2]:
  • wrangler@4.86.0
  • miniflare@4.20260426.0

1.33.2

... (truncated)

Commits

• 47cf644 Version Packages (#13714)
• 0827815 [wrangler] Add safe telemetry labels for user errors (#13722)
• c07d0cb Support V2 protocol for module fallback service in Miniflare and Vite plugin ...
• 6457fb3 WC-4891: Add loopback to router worker (#13363)
• 87b094e Version Packages (#13665)
• 730ead5 feat(vite-plugin-cloudflare): vite preview tunnel support (#13702)
• edcff69 feat(vite-plugin-cloudflare): add quick tunnel support (#13666)
• 547ce78 [vite-plugin] fix flaky abort signal E2E test (#13697)
• a3f6481 Version Packages (#13625)
• 48c61b6 Use the date that the plugin is built as the default compatibility date (#13653)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 4.20260424.1 to 4.20260504.1

Commits

• See full diff in compare view

Updates @vitejs/plugin-rsc from 0.5.24 to 0.5.25

Release notes

Sourced from @​vitejs/plugin-rsc's releases.

plugin-rsc@0.5.25

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-rsc's changelog.

0.5.25 (2026-04-27)

Bug Fixes

• deps: update all non-major dependencies (#1196) (323ccd7)
• rsc: fix server css hmr with cssLinkPrecedence: false (#1188) (f4647c4)
• rsc: include bundled server CSS when cssCodeSplit is false (#1192) (2845b9f)

Miscellaneous Chores

• deps: update vite 8.0.10 (#1198) (a7506e1)

Tests

• assert new minified error message on react canary (#1199) (cbac17c)

Commits

• ab01352 release: plugin-rsc@0.5.25
• f4647c4 fix(rsc): fix server css hmr with cssLinkPrecedence: false (#1188)
• 2845b9f fix(rsc): include bundled server CSS when cssCodeSplit is false (#1192)
• 323ccd7 fix(deps): update all non-major dependencies (#1196)
• a7506e1 chore(deps): update vite 8.0.10 (#1198)
• cbac17c test: assert new minified error message on react canary (#1199)
• See full diff in compare view

Updates oxfmt from 0.46.0 to 0.47.0

Commits

• d82f698 release(apps): oxlint v1.62.0 && oxfmt v0.47.0 (#21838)
• See full diff in compare view

Updates oxlint from 1.61.0 to 1.62.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

• 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
• 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
• bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
• 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
• 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
• 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
• ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

• 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
• 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
• 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
• 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
• a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
• ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
• 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
• ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
• e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
• 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
• 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
• fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
• ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
• dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
• 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
• cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

• 25d577e language_server: Start tools in parallel (#15500) (Sysix)
• 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
• 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
• 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
• 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
• 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

• 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
• 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
• a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
• 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
• 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
• 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.62.0] - 2026-04-27

🚀 Features

• 348f46c linter: Add respectEslintDisableDirectives option (#21384) (Christian Vuerings)

🐛 Bug Fixes

• 8c425db linter: Allow string for jest version in config schema (#21649) (camc314)

Commits

• d82f698 release(apps): oxlint v1.62.0 && oxfmt v0.47.0 (#21838)
• 348f46c feat(linter): add respectEslintDisableDirectives option (#21384)
• 8c425db fix(linter): allow string for jest version in config schema (#21649)
• See full diff in compare view

Updates wrangler from 4.84.1 to 4.87.0

Release notes

Sourced from wrangler's releases.

wrangler@4.87.0

Minor Changes

• #13726 b5ac54b Thanks @​penalosa! - Hard fail on Node.js < 22

  Wrangler no longer supports Node.js 20.x, as it reached end-of-life on 2026-04-30. The minimum supported Node.js version is now 22.0.0. See https://github.com/nodejs/release?tab=readme-ov-file#end-of-life-releases.

• #13717 9a1f014 Thanks @​NuroDev! - Add an experimental experimental_generateTypes() programmatic API.

  Wrangler now exposes experimental_generateTypes() from the package root so you can generate Worker types in code using the same logic as wrangler types. The API supports the same core type-generation options (include env/runtime toggles) and returns structured output with separate env and runtime content alongside the combined formatted output.

Patch Changes

• #13732 22e1a61 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260426.1	1.20260429.1

• #13754 00523c8 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20260429.1	1.20260430.1

• #13711 1c4d850 Thanks @​dario-piotrowicz! - fix: skip auto-config and OpenNext delegation when --config is explicitly provided

  When --config is passed to wrangler deploy, the user is explicitly targeting a specific Worker configuration. Previously, wrangler would ignore --config and delegate to opennextjs-cloudflare deploy if it detected an OpenNext project in the working directory, silently deploying the wrong Worker. Now, both auto-config detection and OpenNext delegation are skipped when --config is provided, matching the existing behavior for --script and --assets.

• #13735 6d28037 Thanks @​edmundhung! - Improve config-schema.json hover text in more editors

  Wrangler now emits markdownDescription in config-schema.json alongside the existing description field. Editors that support rich JSON Schema hovers can use that markdown directly instead of rendering escaped links and formatting.

• #13722 0827815 Thanks @​MattieTK! - Improve safe telemetry categorisation for user-facing Wrangler errors.

• #13116 e539008 Thanks @​dario-piotrowicz! - Allow getPlatformProxy and unstable_getMiniflareWorkerOptions to start when the assets directory does not exist yet

  Previously, getPlatformProxy would catch and swallow NonExistentAssetsDirError internally when the configured assets directory was absent on disk. This has been refactored so that the directory-existence check is skipped entirely for getPlatformProxy and unstable_getMiniflareWorkerOptions, since these APIs are typically used at dev time in frameworks where the assets directory is a build output that may not exist yet.

  wrangler dev, wrangler deploy, wrangler versions upload, and wrangler triggers deploy continue to require the assets directory to exist when specified.

• Updated dependencies [22e1a61, 00523c8, b5ac54b, e653edf, e1eff94, e539008, 0bf64a7, b04eedf, 6457fb3, c07d0cb]:

  • miniflare@4.20260430.0
  • @​cloudflare/kv-asset-handler@​0.5.0

wrangler@4.86.0

... (truncated)

Commits

• 47cf644 Version Packages (#13714)
• e653edf fix(miniflare): expose send_email in platform proxy (#13723)
• 0827815 [wrangler] Add safe telemetry labels for user errors (#13722)
• 9a1f014 feat(wrangler): Add programmatic type generation API (#13717)
• e539008 Allow users to run getPlatformProxy on static asset workers when the assets...
• 00523c8 Bump the workerd-and-workers-types group with 2 updates (#13754)
• 6d28037 fix(wrangler): emit markdownDescription in config schema (#13735)
• 22e1a61 Bump the workerd-and-workers-types group with 2 updates (#13732)
• b5ac54b Hard fail on Node.js < 22 (#13726)
• 0bf64a7 fix(miniflare): Skip creating hyperdrive proxy server for local database (#13...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.