Skip to content

chore(deps): bump the npm-minor-patch group across 1 directory with 7 updates - #23

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-61126ef12c
Open

chore(deps): bump the npm-minor-patch group across 1 directory with 7 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-61126ef12c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 7 updates in the / directory:

Package From To
drizzle-zod 0.5.1 0.8.3
hono 4.12.29 4.12.32
@cloudflare/vitest-pool-workers 0.16.20 0.19.0
@types/node 26.1.1 26.1.2
tsx 4.22.3 4.23.1
vitest 4.1.7 4.1.10
wrangler 4.105.0 4.115.0

Updates drizzle-zod from 0.5.1 to 0.8.3

Commits

Updates hono from 4.12.29 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

  • ci: enable reports for type & bundle size check in honojs/hono#5148
  • fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
  • fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
  • test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
  • fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
  • fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

Full Changelog: honojs/hono@v4.12.29...v4.12.30

Commits
  • 26d8e42 4.12.32
  • 402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
  • c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
  • a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
  • 44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
  • e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
  • bf8608c ci: enable reports for type & bundle size check (#5148)
  • cadff88 4.12.31
  • 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
  • aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
  • Additional commits viewable in compare view

Updates @cloudflare/vitest-pool-workers from 0.16.20 to 0.19.0

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.19.0

Minor Changes

  • #14879 e6480e3 Thanks @​dmmulroy! - Add a verbose option to cloudflareTest() and cloudflarePool() configuration

    Set verbose: false to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to true to preserve existing output.

Patch Changes

  • #14821 edc203e Thanks @​mishushakov! - Ignore workerd's disconnected: peer disconnected without gracefully ending TLS session exception logs

    When tests make real fetch() calls to external TLS endpoints, servers and load balancers routinely close idle keepalive connections without sending a TLS close_notify. No request fails — the connection is idle — but workerd logs a kj/compat/tls.c++ exception with a full stack trace each time, flooding otherwise green test runs. This is the TLS sibling of the disconnected: ... messages already in the ignore list, so filter it the same way.

  • Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

    • wrangler@4.115.0
    • miniflare@4.20260722.1

@​cloudflare/vitest-pool-workers@​0.18.8

Patch Changes

@​cloudflare/vitest-pool-workers@​0.18.7

Patch Changes

  • #14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

  • #14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

  • #14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

  • #14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

    The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

    These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

  • Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

    • miniflare@4.20260721.0
    • wrangler@4.113.0

@​cloudflare/vitest-pool-workers@​0.18.6

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.19.0

Minor Changes

  • #14879 e6480e3 Thanks @​dmmulroy! - Add a verbose option to cloudflareTest() and cloudflarePool() configuration

    Set verbose: false to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to true to preserve existing output.

Patch Changes

  • #14821 edc203e Thanks @​mishushakov! - Ignore workerd's disconnected: peer disconnected without gracefully ending TLS session exception logs

    When tests make real fetch() calls to external TLS endpoints, servers and load balancers routinely close idle keepalive connections without sending a TLS close_notify. No request fails — the connection is idle — but workerd logs a kj/compat/tls.c++ exception with a full stack trace each time, flooding otherwise green test runs. This is the TLS sibling of the disconnected: ... messages already in the ignore list, so filter it the same way.

  • Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

    • wrangler@4.115.0
    • miniflare@4.20260722.1

0.18.8

Patch Changes

0.18.7

Patch Changes

  • #14713 de34449 Thanks @​allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.

  • #14713 de34449 Thanks @​allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.

  • #14739 5eac99e Thanks @​Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.

  • #14763 538e867 Thanks @​gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

    The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

    These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.

  • Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:

    • miniflare@4.20260721.0
    • wrangler@4.113.0

... (truncated)

Commits
  • 760a85b Version Packages (#14824)
  • e6480e3 [vitest-pool-workers] Make workerd verbose logging configurable (#14879)
  • edc203e [vitest-pool-workers] Ignore workerd's ungraceful TLS disconnect exception lo...
  • 16b3d5a Version Packages (#14799)
  • 7b3fea6 fix(vitest-pool-workers): tolerate dispose rejections in pool worker stop() (...
  • 88f42e7 Version Packages (#14740)
  • 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
  • 538e867 [vitest-pool-workers] Treat webSocket* as optional Durable Object handlers ...
  • de34449 [vitest-pool-workers] Fix module fallback failure on non-ASCII workspace path...
  • 5eac99e [vitest-pool-workers] Support streaming tails to the main worker (#14739)
  • Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

Updates tsx from 4.22.3 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

  • support tsImport after global preload (8d4ffc2)
  • watch: avoid clearing piped output (95d0672)
  • watch: treat script and dependency paths literally (79fddde)

Performance Improvements

  • index transform cache lazily (e818ad6)
  • load esbuild lazily in CLI (d067938)
  • map Node TypeScript formats directly (cdcc623)
  • use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

Features

This release is also available on:

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

  • isolate hook state per async module.register() registration (a305f36)

This release is also available on:

... (truncated)

Commits
  • 79fddde fix(watch): treat script and dependency paths literally
  • e818ad6 perf: index transform cache lazily
  • cdcc623 perf: map Node TypeScript formats directly
  • d067938 perf: load esbuild lazily in CLI
  • 95d0672 fix(watch): avoid clearing piped output
  • 6fd4607 docs: add per-page metadata
  • f4176d8 docs: generate sitemap
  • 8d4ffc2 fix: support tsImport after global preload
  • f0e89b2 docs: document Node's public type-stripping API vs internal loader path
  • f8992f1 perf: use sync module hooks on Node v22.22.3+
  • Additional commits viewable in compare view

Updates vitest from 4.1.7 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • See full diff in compare view

Updates wrangler from 4.105.0 to 4.115.0

Release notes

Sourced from wrangler's releases.

wrangler@4.115.0

Minor Changes

  • #14807 4dfb96e Thanks @​oOPa! - Add hidden --jurisdiction option to wrangler kv namespace create for internal testing

    This option creates a KV namespace within a specific jurisdiction (for example us, eu, or fedramp), backing it with jurisdiction-scoped storage. It is experimental and currently gated to allow-listed accounts, so it is hidden from --help until the feature is generally available.

  • #14280 465c0fb Thanks @​tahmid-23! - Add experimental local_dev.experimental_s3_credentials to r2_buckets config

    When set, the R2 bucket is served over a local S3-compatible API at /cdn-cgi/local/r2/s3/<bucket-id> during local development, authenticated with the configured AWS SigV4 credentials. <bucket-id> is the bucket's bucket_name, or the binding name if bucket_name is not set:

    {
  "r2_buckets": [
    {
      "binding": "BUCKET",
      "bucket_name": "my-bucket",
      "local_dev": {
        "experimental_s3_credentials": {
          "accessKeyId": "local-access-key-id",
          "secretAccessKey": "local-secret-access-key"
        }
      }
    }
  ]
}

  • #14877 552bcfc Thanks @​jasoncabot! - Respect and surface the Retry-After header on Cloudflare API responses

    Previously, if a Wrangler command (e.g. wrangler versions upload, wrangler deploy) hit the Cloudflare API's rate limit, the resulting error gave no indication of how long to wait before trying again, and 429 responses weren't retried at all (only 5xx errors were, with a fixed linear backoff).

    Now:

    • 429 Too Many Requests responses are automatically retried, alongside the existing 5xx retry behaviour.
    • If a retried response includes a Retry-After header, Wrangler waits for that duration instead of the default backoff, and logs a message indicating how long it's waiting. To avoid blocking for an excessive amount of time, waits longer than 60 seconds fail fast instead — the surfaced Retry-After value lets the caller schedule its own retry.
    • If a retryable error is ultimately surfaced to the user (e.g. because retries were exhausted), the error message includes a note with the Retry-After duration, and the command-failed entry written to the Wrangler output file (WRANGLER_OUTPUT_FILE_PATH/WRANGLER_OUTPUT_FILE_DIRECTORY) gains a retry_after_ms field. This lets scripts and CI/CD pipelines calling Wrangler repeatedly (for example, wrangler versions upload on every commit) read the wait duration directly instead of regex-parsing stderr.

    APIError.isRetryable() is unchanged (still 5xx only); retryOnAPIFailure() separately retries 429s. retryAfterMs, when present, is honoured for any retried error, not just 429s.

    retryAfterMs is also now populated on APIErrors raised from direct R2 object requests, the Browser Rendering API, and errors surfaced from commands using the official cloudflare SDK client.

  • #14712 6e0bf6e Thanks @​mack-erel! - Support connect() on remote VPC Network and VPC Service bindings in local development

    Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported. Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development.

    This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required.

Patch Changes

... (truncated)

Commits
  • 760a85b Version Packages (#14824)
  • ee4472a [wrangler] Remove jurisdiction field from kv_namespaces in wrangler config (#...
  • 552bcfc [wrangler] Respect and surface 429 errors from HTTP requests (#14877)
  • e353367 fix output comparisons for e2e tests (#14884)
  • 4dfb96e [wrangler] Support jurisdictions for KV namespaces (#14807)
  • 09b8a44 [wrangler] Split cloudchamber curl headers on the first colon only (#14815)
  • 465c0fb [miniflare] Expose R2 via an S3-compatible API locally (#14280)
  • b737676 [wrangler] Derive old log file age from filename timestamp (#14801)
  • 16b3d5a Version Packages (#14799)
  • 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-minor-patch group across 1 directory with 7…
e469bc9 
… updates

Bumps the npm-minor-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [drizzle-zod](https://github.com/drizzle-team/drizzle-orm) | `0.5.1` | `0.8.3` |
| [hono](https://github.com/honojs/hono) | `4.12.29` | `4.12.32` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.16.20` | `0.19.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.3` | `4.23.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.7` | `4.1.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.105.0` | `4.115.0` |



Updates `drizzle-zod` from 0.5.1 to 0.8.3
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](https://github.com/drizzle-team/drizzle-orm/commits)

Updates `hono` from 4.12.29 to 4.12.32
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.29...v4.12.32)

Updates `@cloudflare/vitest-pool-workers` from 0.16.20 to 0.19.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.19.0/packages/vitest-pool-workers)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.22.3 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.3...v4.23.1)

Updates `vitest` from 4.1.7 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `wrangler` from 4.105.0 to 4.115.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.115.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: drizzle-zod
  dependency-version: 0.8.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: hono
  dependency-version: 4.12.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.19.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: wrangler
  dependency-version: 4.115.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 1, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) August 1, 2026 05:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants