[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vitest-plugin (source)	1.4.11 → 1.6.0
hono (source)	4.13.14 → 4.13.16

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vitest-plugin)

v1.6.0

Compare Source

Minor Changes

• #​16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

  Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

  In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

• #​16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #​16700 dc35efb Thanks @​cjol! - Bump bundled devalue from 5.6.3 to 5.9.3 to pick up security fixes

  devalue is bundled into these packages, which use it to serialise values between Node.js and workerd. Version 5.6.3 is affected by several published advisories, and 5.9.3 includes their fixes. Serialisation behaviour does not change.

• #​16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #​16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, fa3edb3, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:

  • wrangler@​4.158.0
  • miniflare@5.20261104.0-beta

v1.5.1

Compare Source

Patch Changes

• #​16670 b14b9dc Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16609 da26b7f Thanks @​gpanders! - Fix tests failing to start with resolve.preserveSymlinks in isolated node_modules layouts

  With resolve.preserveSymlinks: true in a pnpm project, tests failed to start with No such module ".../node_modules/vitest/dist/chai", because a package's own dependencies are linked only next to its real path. Packages linked from a store inside node_modules now load from their real paths, and other files keep their symlinked paths.

• Updated dependencies [b14b9dc, 44d1ee4, b14b9dc, d2eda1c, 2750917, 34f34b3]:

  • miniflare@5.20261103.0-beta
  • wrangler@​4.157.0

v1.5.0

Compare Source

Minor Changes

• #​16424 1598fd3 Thanks @​edmundhung! - Promote experimental.newConfig to a stable config option

  The experimental experimental.newConfig option is now the stable config option. Pass config: true to cloudflareTest() to load your Worker's bindings, entrypoint and compatibility settings from cloudflare.config.ts in the project root, or pass the path of a cloudflare.config.ts elsewhere:

  cloudflareTest({ config: true });
  cloudflareTest({ config: "./worker/cloudflare.config.ts" });

  config can't be combined with wrangler. miniflare options are merged over the Worker from cloudflare.config.ts, with miniflare values taking precedence. Config functions receive Vitest's mode as ctx.mode, which defaults to test and can be changed with --mode.

  If you're moving from experimental.newConfig, secrets are now read from Vite's envDir instead of the directory containing cloudflare.config.ts, and remote bindings authenticate with cf instead of Wrangler.

Patch Changes

• #​16642 d38cb02 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-02

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16623 51bbf8b Thanks @​petebacondarwin! - Deprecate shared tooling helper exports from Miniflare

  Miniflare continues to export getNodeCompat, NodeJSCompatMode, and getFreshSourceMapSupport for compatibility. These exports are deprecated and now use the implementations in @cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:

  import {
    getNodeCompat,
    type NodeJSCompatMode,
  } from "@cloudflare/workers-utils/node-compat";
  import { getFreshSourceMapSupport } from "@cloudflare/workers-utils/sourcemap";

  Wrangler and the Cloudflare Vite and Vitest plugins now use the shared helpers directly. The helpers retain their behavior and can be imported without loading the Workers runtime.

  The deprecated Miniflare exports will be removed in a later release, allowing downstream tools such as cf to migrate and release independently first.

• Updated dependencies [d38cb02, d38cb02, 51bbf8b, e5b1798]:

  • miniflare@5.20261102.0-beta
  • wrangler@​4.156.2

v1.4.12

Compare Source

Patch Changes

• #​16635 76e18a8 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-01

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• Updated dependencies [effe4ed, 76e18a8, 76e18a8, 009ca6e, 5740867, d174de8, aece4df, 2667a9f, ed7fb41, f9dbb22]:

  • wrangler@​4.156.1
  • miniflare@5.20261101.0-beta

honojs/hono (hono)

v4.13.16

Compare Source

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

---

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

• fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in #​5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

Compare Source

What's Changed

• fix(auth): escape backslashes in the WWW-Authenticate realm by @​yusukebe in #​5590
• docs(contributing): drop the note about linking a fork branch by @​yusukebe in #​5593
• fix(context): allow c.header() after the response body is consumed by @​yusukebe in #​5587

Full Changelog: honojs/hono@v4.13.14...v4.13.15

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cloudflare/​vitest-plugin@​1.4.11 ⏵ 1.6.0			+1	+1
	hono@​4.13.14 ⏵ 4.13.16	+1		+1

View full report