[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vitest-plugin (source)	1.4.7 → 1.4.11
hono (source)	4.13.13 → 4.13.14

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vitest-plugin)

v1.4.11

Compare Source

Patch Changes

• #​15565 142230d Thanks @​luccamordente! - Flush console.log() calls made from another I/O context without waiting for the runner's next message

  Vitest awaits every RPC call it made before it reports a test file as finished. A console.log() from another I/O context (a handler reached through SELF, a queue consumer, a waitUntil() callback) is buffered and sent with the runner's next message, so a log with nothing from the runner following it — the last batch of a queue consumed as the file ends, for example — left the run waiting on itself: the file's tests passed and vitest never finished. The buffer is now flushed from the runner's context as soon as a log is buffered.

• #​16013 8b64bec Thanks @​swalker326! - Fix Durable Object self-references in tests and container validation

  Durable Object bindings that explicitly name the Worker itself now resolve to the test runner in @cloudflare/vitest-plugin, for both cloudflare.config.ts and Wrangler configuration files. Named Wrangler environments use their effective Worker name, keeping bindings to the base Worker external. Container validation also accepts these self-references, using the effective deployment name to distinguish local and external bindings.

  Explicit binding targets remain intact during configuration conversion, so deploying with --name or a CI name override preserves the intended Durable Object target.

• Updated dependencies [ec0bea4, b4653b4, 25802bc, 25802bc, 15fbaed, d8899ac, 8b64bec]:

  • wrangler@​4.156.0
  • miniflare@5.20261023.3-beta

v1.4.10

Compare Source

Patch Changes

• Updated dependencies [a95d647, c7a3373, c7a3373, c7a3373, c7a3373, c7a3373]:
  • miniflare@5.20261023.2-beta
  • wrangler@​4.155.0

v1.4.9

Compare Source

Patch Changes

• Updated dependencies [0968b08, f3c13b3]:
  • miniflare@5.20261023.1-beta
  • wrangler@​4.154.0

v1.4.8

Patch Changes

• #​16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #​16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• #​16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

  • miniflare@5.20261023.0-beta
  • wrangler@​4.153.0

honojs/hono (hono)

v4.13.14

Compare Source

What's Changed

• docs(contributing): ask for issues instead of RPs #​5526
• docs(readme): sync the contributing list with CONTRIBUTING.md #​5527
• fix(adapters): accept Hono v5 prereleases in the hono peer range #​5537
• chore: unified oxfmt and oxlint config #​5518
• docs(readme): remove the deepwiki badge #​5548
• fix(serve-static): only serve GET and HEAD requests #​5514
• fix(build): keep barrel imports in the bundled d.ts #​5557
• fix(jsx): preserve self-closing void elements in cloneElement #​5314
• fix(css): keep "//" inside an unquoted url() when minifying #​5450
• fix(css): keep the descendant combinator before a pseudo-class when minifying #​5451
• fix(serve-static): respect q-values in Accept-Encoding for precompressed files #​5436
• fix(helper/route): match regex params in basePath() the same way as the router #​5498
• fix(trie-router): keep first value for duplicate path params #​5423
• fix(hono-base): disallow getPath when strict is false #​5563
• fix(css): Fix multiline CSS handling in style replacement #​5405
• feat(bearer-auth): allow MessageFunction to return a Response #​5269
• fix(utils/url): preserve encoded duplicate query order #​5495

Full Changelog: honojs/hono@v4.13.13...v4.13.14

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cloudflare/​vitest-plugin@​1.4.7 ⏵ 1.4.11	+1		+1	+1
	hono@​4.13.13 ⏵ 4.13.14	+1

View full report