chore(deps): Bump the npm-minor-patch group with 7 updates by dependabot[bot] · Pull Request #137 · lukaso/released

dependabot · 2026-08-07T21:55:56Z

Bumps the npm-minor-patch group with 7 updates:

Package	From	To
@biomejs/biome	`2.5.6`	`2.5.7`
publint	`0.3.22`	`0.3.23`
tsx	`4.23.1`	`4.23.5`
hono	`4.12.32`	`4.12.34`
playwright	`1.61.1`	`1.62.1`
wrangler	`4.114.0`	`4.118.0`
@cloudflare/vitest-pool-workers	`0.18.8`	`0.20.1`

Updates @biomejs/biome from 2.5.6 to 2.5.7

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes
#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
The following code is also now invalid, because map(() => 42) returns 42:

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.7

Patch Changes
#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
The following code is also now invalid, because map(() => 42) returns 42:
type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;

... (truncated)

Commits

191d051 ci: release (#11119)
9847e68 feat(lint): add noNonScalableViewport rule (#11168)
e63354c feat(lint): add noExtendNative nursery rule (#11136)
2fa0a62 docs: rework CLI (#11134)
e007143 feat(lint): add nursery rule noTailwindArbitraryValue (#10094)
c171b3b feat(lint): add ignoreIfStatements option to useNullishCoalescing (#10822)
See full diff in compare view

Updates publint from 0.3.22 to 0.3.23

Changelog

Sourced from publint's changelog.

0.3.23

Patch Changes

#248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

#245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

Commits

See full diff in compare view

Updates tsx from 4.23.1 to 4.23.5

Release notes

Sourced from tsx's releases.

v4.23.5

4.23.5 (2026-08-02)

Bug Fixes

detect the Node inspector enabled via NODE_OPTIONS (3c1d051)

This release is also available on:

npm package (@latest dist-tag)

v4.23.4

4.23.4 (2026-08-02)

Bug Fixes

cli: allow async process.once() signal handlers to finish (#827) (2afc7bb)

This release is also available on:

npm package (@latest dist-tag)

v4.23.3

4.23.3 (2026-08-02)

Bug Fixes

preserve listenerCount overload semantics (#823) (b6574d4)

This release is also available on:

npm package (@latest dist-tag)

v4.23.2

4.23.2 (2026-08-02)

Bug Fixes

watch: exit with 128 + signal number when interrupted (#820) (0b00bc8)

This release is also available on:

npm package (@latest dist-tag)

Commits

c55004d test: remove legacy PTY retry
e368161 chore(deps): update pty-spawn to 1.1.1
8d39496 ci: validate GitHub Actions workflows
6fe724e test: clean up timed-out PTY attempts
e0a0536 ci: skip unused Windows Node cache
6d6dd84 ci: remove broken lock automation
3c1d051 fix: detect the Node inspector enabled via NODE_OPTIONS
40380a4 ci: lock down the release toolchain
f217b6b ci: restrict releases to public repository
2afc7bb fix(cli): allow async process.once() signal handlers to finish (#827)
Additional commits viewable in compare view

Updates hono from 4.12.32 to 4.12.34

Release notes

Sourced from hono's releases.

v4.12.34

Security fixes

This release includes fixes for the following security issues:

memo() retains SSR output across requests, leading to cross-user data disclosure

Affects: hono/jsx (server-side rendering). Fixes memo() reusing a retained render result across requests when props compare equal, where a component reading request-scoped values from ambient context — useContext(), useRequestContext(), or getContext() — could serve HTML rendered for another user's request, disclosing account data or request-scoped secrets such as CSRF tokens. GHSA-f23p-vx2j-j53r

ReDoS in CORS middleware via Access-Control-Request-Headers

Affects: hono/cors. Fixes a whitespace-tolerant regular expression with quadratic backtracking used to parse the Access-Control-Request-Headers preflight header when allowHeaders is not configured (the default), where a single preflight request carrying a long whitespace run could consume seconds of CPU and stall request processing. GHSA-8j4g-w8fx-2239

Algorithmic complexity DoS in Language Middleware

Affects: hono/language. Fixes quadratic string processing in language-tag normalization, where a crafted language tag with a large number of hyphen-separated subtags — supplied via a query parameter, cookie, or Accept-Language header — could cause excessive CPU consumption and block the event loop. GHSA-54fx-42gc-7vw4

Proxy Helper does not remove response headers listed in the Connection header

Affects: hono/proxy. Fixes proxy() forwarding response headers that the origin's Connection header designates as connection-scoped, where headers intended only for the immediate peer — per RFC 9110 Section 7.6.1 — could be exposed to clients, disclosing connection-scoped or internal metadata. GHSA-79qm-7rj5-m7r9

Users who use hono/jsx for server-side rendering, hono/cors, hono/language, or hono/proxy are strongly encouraged to upgrade to this version.

v4.12.33

What's Changed

fix(cookie): relax name validation when parsing Cookie header in honojs/hono#5164

chore: bump @hono/node-server in honojs/hono#5167

fix(jsx): handle useSyncExternalStore subscription and snapshot changes in honojs/hono#5166

chore: remove undici in favor of global fetch in honojs/hono#5168

Full Changelog: honojs/hono@v4.12.32...v4.12.33

Commits

734755a 4.12.34
9839ff3 chore: update bun.lock (#5182)
0c45036 Merge commit from fork
720b566 Merge commit from fork
f70e2c3 Merge commit from fork
93fc250 Merge commit from fork
51db313 4.12.33
aed1463 chore: remove undici in favor of global fetch (#5168)
224d2f5 fix(jsx): handle useSyncExternalStore subscription and snapshot changes (#5166)
df653ce chore: bump @hono/node-server (#5167)
Additional commits viewable in compare view

Updates playwright from 1.61.1 to 1.62.1

Release notes

Sourced from playwright's releases.

v1.62.1

Bug Fixes

#41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)

#41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)

#41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG

#42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62

#42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:
test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});
Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:
const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });
Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:
// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
66c5cc9 chore: mark v1.62.1 (#42020)
9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
e3950d9 chore: mark v1.62.0 (#41981)
f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
Additional commits viewable in compare view

Updates wrangler from 4.114.0 to 4.118.0

Release notes

Sourced from wrangler's releases.

wrangler@4.118.0

Minor Changes
#14057 cc63aae Thanks @matingathani! - Add --json flag to wrangler containers info for consistent JSON output with sibling commands list and instances

#14944 a249591 Thanks @nickpatt! - Enable local observability capture by default in dev

wrangler dev and the Vite plugin now capture request traces and console logs into the Local Explorer's Observability tab out of the box — previously this was opt-in behind X_LOCAL_OBSERVABILITY=true. Set X_LOCAL_OBSERVABILITY=false to opt out (for example if the extra per-worker collector/streaming-tail services cause trouble in a multi-process dev-registry setup).
#14919 e0bbf55 Thanks @avenceslau! - Add additional triggers to Workflows

Workers can now declaratively start a locally defined Workflow. Configure event subscriptions under triggers.events; Wrangler validates each target and updates the script's event triggers during deployment.
{
  "triggers": {
    "events": [
      {
        "type": "cf.artifacts.repo.pushed",
        "filter": {
          "namespace": "my-namespace",
          "repo_name": "my-repo"
        },
        "targets": [
          {
            "type": "workflow",
            "workflow_name": "my-workflow"
          }
        ]
      }
    ]
  }
}
Patch Changes

#14936 f92d1fc Thanks @petebacondarwin! - Fix jsx_fragment being ignored when wrangler dev runs a custom build

If your project uses a custom build and sets both jsx_factory and jsx_fragment, wrangler dev used your jsx_factory value for JSX fragments as well, so fragments compiled incorrectly. Your jsx_fragment value is now used.

#14936 f92d1fc Thanks @petebacondarwin! - Stop wrangler dev starting new work after you stop it or it reloads

Stopping wrangler dev, or having it reload after a configuration change, could still leave it starting work for the state it had just left behind: your custom build command could run once more after dev had stopped, a change to a file in your assets directory could be reported against configuration that had already been replaced, and in some cases the process could stay alive instead of exiting.

That work is now discarded, so stopping or reloading wrangler dev leaves nothing running behind it.

#14936 f92d1fc Thanks @petebacondarwin! - Stop wrangler dev from running custom builds concurrently

When several watched files changed at once — for example during a git pull or a "save all" — wrangler dev started a custom build for every file that changed, so multiple copies of your build command ran at the same time and fought over the same output files.

... (truncated)

Commits

95d9b12 Version Packages (#14946)
e0bbf55 [wrangler] Fix workflows errors messages (#14919)
38403cb [wrangler] Remove duplicated Workers + Assets deploy E2E (#14947)
cec9d88 [workers-auth] Validate account IDs before using them in API requests (#13746)
cc63aae [wrangler] fix(containers): add --json flag to wrangler containers info (#1...
f92d1fc [wrangler] Serialize custom build watcher events to avoid concurrent runs (#1...
17dca96 [wrangler] Fix circular dependency build warning between api/index.ts and bin...
fcb5402 Version Packages (#14939)
5a56dda Miniflare v5 alpha (#14586)
96fd16f Version Packages (#14898)
Additional commits viewable in compare view

Updates @cloudflare/vitest-pool-workers from 0.18.8 to 0.20.1

Release notes

Sourced from @cloudflare/vitest-pool-workers's releases.

@cloudflare/vitest-pool-workers@0.20.1

Patch Changes

Updated dependencies [cc63aae, f92d1fc, a249591, f92d1fc, f92d1fc, cec9d88, e0bbf55]:

wrangler@4.118.0

@cloudflare/vitest-pool-workers@0.20.0

Minor Changes

#14586 5a56dda Thanks @emily-shen! - Breaking change: Remove several options from the miniflare override options

The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

wrappedBindings

cacheWarnUsage

fetchMock: you should use outboundService instead

containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

#14586 5a56dda Thanks @emily-shen! - Preserve the deprecated Miniflare cache option

Vitest configurations using cache continue to work after the internal Miniflare v5 upgrade. The option is translated to cacheAPI; new configurations should use cacheAPI directly.

#14586 5a56dda Thanks @emily-shen! - Stop enabling Miniflare's removed unsafeStickyBlobs option

The pool no longer sets the unsafeStickyBlobs Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.

Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

miniflare@5.20260730.0-alpha

wrangler@4.117.0

@cloudflare/vitest-pool-workers@0.19.1

Patch Changes

Updated dependencies [01d7020, beec0fb, 48f0c6c, 8049ca4, d7f38c3, 1394867, cc54478, 5c25cfe, b21eac2, bb09f1b, 1f61001, 01d7020, e31ab0f]:

miniflare@4.20260730.0

wrangler@4.116.0

@cloudflare/vitest-pool-workers@0.19.0

Minor Changes

#14879 e6480e3 Thanks @dmmulroy! - Add a verbose option to cloudflareTest() and cloudflarePool() configuration

Set verbose: false to suppress verbose workerd runtime logs, such as caught Durable Object RPC errors. The option defaults to true to preserve existing output.

Patch Changes

... (truncated)

Changelog

Sourced from @cloudflare/vitest-pool-workers's changelog.

0.20.1

Patch Changes

Updated dependencies [cc63aae, f92d1fc, a249591, f92d1fc, f92d1fc, cec9d88, e0bbf55]:

wrangler@4.118.0

0.20.0

Minor Changes

#14586 5a56dda Thanks @emily-shen! - Breaking change: Remove several options from the miniflare override options

The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:

wrappedBindings

cacheWarnUsage

fetchMock: you should use outboundService instead

containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.

Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.

Patch Changes

#14586 5a56dda Thanks @emily-shen! - Preserve the deprecated Miniflare cache option

Vitest configurations using cache continue to work after the internal Miniflare v5 upgrade. The option is translated to cacheAPI; new configurations should use cacheAPI directly.

#14586 5a56dda Thanks @emily-shen! - Stop enabling Miniflare's removed unsafeStickyBlobs option

The pool no longer sets the unsafeStickyBlobs Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.

Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

miniflare@5.20260730.0-alpha

wrangler@4.117.0

0.19.1

Patch Changes

Updated dependencies [01d7020, beec0fb, 48f0c6c, 8049ca4, d7f38c3, 1394867, cc54478, 5c25cfe, b21eac2, bb09f1b, 1f61001, 01d7020, e31ab0f]:

miniflare@4.20260730.0

wrangler@4.116.0

0.19.0

Minor Changes

#14879 e6480e3 Thanks @dmmulroy! - Add a verbose option to cloudflareTest() and cloudflarePool() configuration

... (truncated)

Commits

95d9b12 Version Packages (#14946)
83a37e3 docs: point vitest-pool-workers BUILD section at the tsdown config (#14940)
fcb5402 Version Packages (#14939)
5a56dda Miniflare v5 alpha (#14586)
96fd16f Version Packages (#14898)
760a85b Version Packages (#14824)
e6480e3 [vitest-pool-workers] Make workerd verbose logging configurable (#14879)
edc203e [vitest-pool-workers] Ignore workerd's ungraceful TLS disconnect exception lo...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-minor-patch group with 7 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.6` | `2.5.7` | | [publint](https://github.com/publint/publint/tree/HEAD/packages/publint) | `0.3.22` | `0.3.23` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.5` | | [hono](https://github.com/honojs/hono) | `4.12.32` | `4.12.34` | | [playwright](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.1` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.114.0` | `4.118.0` | | [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.18.8` | `0.20.1` | Updates `@biomejs/biome` from 2.5.6 to 2.5.7 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.7/packages/@biomejs/biome) Updates `publint` from 0.3.22 to 0.3.23 - [Release notes](https://github.com/publint/publint/releases) - [Changelog](https://github.com/publint/publint/blob/master/packages/publint/CHANGELOG.md) - [Commits](https://github.com/publint/publint/commits/HEAD/packages/publint) Updates `tsx` from 4.23.1 to 4.23.5 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.1...v4.23.5) Updates `hono` from 4.12.32 to 4.12.34 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.32...v4.12.34) Updates `playwright` from 1.61.1 to 1.62.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.61.1...v1.62.1) Updates `wrangler` from 4.114.0 to 4.118.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.118.0/packages/wrangler) Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.20.1 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.1/packages/vitest-pool-workers) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: publint dependency-version: 0.3.23 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: tsx dependency-version: 4.23.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: hono dependency-version: 4.12.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: playwright dependency-version: 1.62.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: wrangler dependency-version: 4.118.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.20.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-08-07T21:56:03Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	released-web	`0fe8db0`	Aug 07 2026, 10:19 PM

github-actions · 2026-08-07T22:19:48Z

Preview deployed

Federated GitLab lookups (freedesktop / GNOME) degrade to the "use the CLI" card — the Anubis relay is off in preview. GitHub lookups, permalinks, and OG render work once INTERNAL_SECRET/GITHUB_TOKEN are set on the preview env.

lukaso-bot · 2026-08-07T22:21:24Z

liveapp adoption pass @ 0fe8db0: adopted — fix-forwarded undici to 7.29.0 and js-yaml to 4.3.1 (via pnpm.overrides) to clear 2 High CVEs blocking osv: GHSA-4cwx-7wf7-3272 (undici 7.28.0, CVSS 7.4) and GHSA-5p4m-2wfm-xmqj (js-yaml 4.3.0, CVSS 7.5). Both pre-existed in main's lockfile (pinned via overrides, so the npm-minor-patch group skipped them) and were blocking every open PR; not introduced by this bump. Local gate green: typecheck + test + build + lint + osv all pass; the repo pre-push osv hook also passed.
Note: the Workers Builds: released-web check fails identically and instantly (0s) on all open PRs while wrangler dry-run and the preview step pass — a repo-level Workers Builds config issue, not this bump, and not a required check.

lukaso-bot · 2026-08-07T22:29:55Z

Preview exercised (pr-137 deploy): /healthz ok, /version, homepage, /how-it-works all 200; OG /placeholder.png 200 PNG — the dep-bumped Worker boots and serves.

Required checks green (osv now pass after the undici 7.29.0 + js-yaml 4.3.1 pin bump). Mergeable. The only red is Workers Builds: released-web, a non-required check that fails 0s on every PR (redundant dashboard git-integration racing the working GitHub-Actions preview path).

Merge order: this first. Once it lands on main, rebasing #138 and #139 clears their shared-baseline osv failures (same 2 pre-existing CVEs); their own bumps are clean.

Same 2 pre-existing High CVEs as #137 (undici 7.28.0 GHSA-4cwx-7wf7-3272, js-yaml 4.3.0 GHSA-5p4m-2wfm-xmqj) in main's pinned deps — not introduced by the typescript 6→7 bump. Bumping the override floors clears them. Local gate green: osv + typecheck + build + test.

Same 2 pre-existing High CVEs as #137 (undici 7.28.0 GHSA-4cwx-7wf7-3272, js-yaml 4.3.0 GHSA-5p4m-2wfm-xmqj) in main's pinned deps — not introduced by the @cloudflare/workers-types 4→5 bump. Bumping the override floors clears them. Local gate green: osv + typecheck + build + test.

…h CVEs The osv gate fails on this branch for CVEs inherited from main, not from this PR's diff: - undici 7.28.0 -> 7.29.0 (GHSA-4cwx-7wf7-3272, High 7.4, +4 more) - js-yaml 4.3.0 -> 4.3.1 (GHSA-5p4m-2wfm-xmqj, High 7.5) - nanoid 3.3.16 -> 3.3.18 (GHSA-2v37-7h3g-55p8, High 8.2) undici and js-yaml match the floors PRs #137/#138/#139 already carry. nanoid is a newer advisory that none of them cover, so this is currently the only open PR that takes main to zero High. Lockfile-only resolution changes; all transitive. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

lukaso-bot · 2026-08-12T04:37:20Z

Heads-up on this trio (#137 / #138 / #139), since the three are read as a set:

A new High CVE landed after these PRs' osv checks last ran (2026-08-07), and none of the three cover it.

nanoid 3.3.16 → 3.3.17 — GHSA-2v37-7h3g-55p8, CVSS 8.2 High.

The green osv dependency scan on each of these PRs is therefore stale, not wrong-at-the-time: osv is queried live at run time, so a check that passed five days ago says nothing about advisories published since. Re-running any of them today would go red.

Practical consequence: merging #137, #138 or #139 alone leaves main at 1 High CVE, and main's own CI would then go red on it.

I've raised all three floors (undici ≥7.29.0, js-yaml ^4.3.1, nanoid ^3.3.17 → resolves 3.3.18) on #141, verified locally red → green:

before:  0 Critical, 3 High, 7 Medium, 1 Low  → ✗ must be resolved before merge
after:   0 Critical, 0 High, 3 Medium, 1 Low  → ✓ no High/Critical

So #141 is currently the only open PR that takes main to zero High. Nothing to change on this PR — its own dependency bump is unaffected, and its undici/js-yaml floors are byte-identical to #141's. Just flagging the merge-order implication so the CVE queue isn't assumed cleared by merging one of these.

No action needed from me here; leaving all three as-is rather than churning 30 green check-runs to re-add a floor #141 already carries.

osv-scanner gates on High/Critical. undici 7.28.0 (GHSA-4cwx-7wf7-3272, CVSS 7.4) and js-yaml 4.3.0 (GHSA-5p4m-2wfm-xmqj, CVSS 7.5) are pinned via pnpm.overrides, so Dependabot's npm-minor-patch group skipped them — they blocked this PR's osv gate and pre-date it on main. Raise the override floors to the patched versions (undici stays <8 for jsdom; js-yaml stays ^4). Co-Authored-By: Claude <noreply@anthropic.com>

Same 2 pre-existing High CVEs as #137 (undici 7.28.0 GHSA-4cwx-7wf7-3272, js-yaml 4.3.0 GHSA-5p4m-2wfm-xmqj) in main's pinned deps — not introduced by the @cloudflare/workers-types 4→5 bump. Bumping the override floors clears them. Local gate green: osv + typecheck + build + test.

Same 2 pre-existing High CVEs as #137 (undici 7.28.0 GHSA-4cwx-7wf7-3272, js-yaml 4.3.0 GHSA-5p4m-2wfm-xmqj) in main's pinned deps — not introduced by the typescript 6→7 bump. Bumping the override floors clears them. Local gate green: osv + typecheck + build + test.

lukaso-bot · 2026-08-12T23:27:41Z

liveapp: re-pushed this branch to retire a dead check, no content change.

The only red here was Workers Builds: released-web — a check run from the Cloudflare
dashboard git-integration that was removed on 2026-08-10 (Proposal #140, closed "Done").
That run is dated 2026-08-07 and can never re-run, so the X was permanent and cosmetic:
it would have sat red until merge, on a PR that was otherwise fully green.

Fix: amended the head commit (--amend --no-edit) so a fresh check suite is computed.
The tree is byte-identical — verified before and after the amend — so nothing about
the dependency update changed. The new head gets no Workers Builds check at all, which is
the same clean 10-check suite #141's head has had since the integration was removed.

While here, re-verified the CVE position on this branch with osv-scanner against the
current advisory set: 0 Critical, 0 High. Note that origin/main today scans
3 High (undici / js-yaml / nanoid) — this branch already carries the undici→7.29.0 and
js-yaml→4.3.1 override floors from the 2026-08-07 fix-forward, and resolves nanoid at
3.3.17+, so it is clean where main is not. Merging any of the four open PRs is what clears
main's three Highs.

dependabot · 2026-08-14T21:58:18Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

… cache-control (#141) ## The bug Every OG image in production ships a **merged** `cache-control` header. Live right now: ``` $ GET https://og.released.blabberate.com/placeholder.png cache-control: public, immutable, no-transform, max-age=31536000, public, max-age=60 ``` `workers-og` builds its response headers as ```js headers: { 'Content-Type': …, 'Cache-Control': 'public, immutable, no-transform, max-age=31536000', ...opts.headers } ``` Object spread is **case-sensitive**, so `renderImage`'s lowercase `'cache-control'` never replaced the library's capitalized `'Cache-Control'` default. Both keys reached `new Response`, where `Headers` merged them into one comma-joined value — and caches honor the **first** `max-age`. ## Why it matters The damage is on the **short**-cached cards. A placeholder render — cold lookup, upstream rate-limit, service-binding miss, or the `notFound` path hit during the `web`→`web-og` deploy window — is deliberately `max-age=60` so the unfurl refreshes once the real answer exists. Instead it went out `immutable` for a year, so one transient failure froze a wrong social card in every downstream cache that honors it. This is a concrete mechanism for the "sustained placeholder on a stably-released MR" behaviour previously observed on the federated PR OG route: once a placeholder was cached, nothing could dislodge it. Front door stayed green throughout — status 200, valid PNG, correct content-type. Only the header was wrong. ## Fix Set `cache-control` on the Response after construction. `Headers.set` is case-insensitive, so it replaces the library default whatever casing the library uses (rather than relying on matching its casing in the spread, which would re-break on a library change). ## Why the tests didn't catch it `test/routing.test.ts` mocked `ImageResponse` with a stub that passed the caller's headers straight through, so it never reproduced the library default. All 11 `cache-control` assertions were **unfalsifiable** — they read back exactly what the caller passed. They were also substring matches (`toMatch(/max-age=60/)`), which pass on the merged value even with a faithful mock. Both were fixed: - the mock now mirrors `workers-og`'s real header construction (capitalized default + case-sensitive spread of the caller's headers); - the 11 assertions are exact-match (`toBe`); - `test/cards.render.test.ts` gets two assertions against the **real** library under workerd — no mock fidelity required. ## Mutation proof Reverting the one-line fix (passing `'cache-control'` back through `ImageResponse`'s `headers` option) while keeping the tests: ``` Failed Tests 10 FAIL test/routing.test.ts > returns a placeholder PNG with SHORT cache when the service binding misses Expected: "public, max-age=60" Received: "public, immutable, no-transform, max-age=31536000, public, max-age=60" FAIL test/cards.render.test.ts > placeholder card: cache-control is EXACTLY the short cache Expected: "public, max-age=60" Received: "public, immutable, no-transform, max-age=31536000, public, max-age=60" …8 more ``` The `Received:` values are byte-identical to what production serves today. Restored → 35/35 pass (27 routing + 8 render). ## Second commit: `fix(deps)` — clearing the red `osv dependency scan` This branch was based on `main`, which carries 3 High CVEs, so the osv gate was red for a reason unrelated to the OG fix. Rather than leave the PR unmergeable, the floors are raised here (root `pnpm.overrides`, lockfile-only resolution changes): | package | main | this PR | advisory | |---|---|---|---| | `undici` | 7.28.0 | 7.29.0 | GHSA-4cwx-7wf7-3272 (High 7.4) + 4 more | | `js-yaml` | 4.3.0 | 4.3.1 | GHSA-5p4m-2wfm-xmqj (High 7.5) | | `nanoid` | 3.3.16 | 3.3.18 | GHSA-2v37-7h3g-55p8 (High 8.2) | The `undici` and `js-yaml` floors are byte-identical to the ones #137/#138/#139 already carry. **`nanoid` is a newer advisory that none of those three cover** — their osv checks last ran 2026-08-07 and passed, which is now stale. So merging #137, #138 or #139 alone leaves main at 1 High; **this is currently the only open PR that takes main to zero High.** Verified locally on this exact tree — the gate goes red → green: ``` before: Total 4 packages affected by 11 known vulnerabilities (0 Critical, 3 High, …) ✗ osv: 0 Critical + 3 High vulnerability(ies) — must be resolved before merge. after: Total 1 package affected by 4 known vulnerabilities (0 Critical, 0 High, 3 Medium, 1 Low) ✓ osv: no High/Critical vulnerabilities. ``` `pnpm lint`, `pnpm -r typecheck`, `pnpm -r test` (357 tests) all green on the merged branch. **Deliberately not fixed here:** the 4 remaining `hono` mediums (4.12.32 → 4.12.34, GHSA-54fx / -79qm / -8j4g / -f23p). `hono` is the production runtime framework and a direct dependency; the osv gate does not block on Medium, and Dependabot's weekly `npm-minor-patch` group already has it in range (`^4.12.32`). Left to that PR so this one stays reviewable. --------- Co-authored-by: liveapp-bot <liveapp-bot@liveapp.local> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 7, 2026

This was referenced Aug 7, 2026

chore(deps-dev): Bump @cloudflare/workers-types from 4.20260702.1 to 5.20260708.1 #138

Merged

chore(deps-dev): Bump typescript from 6.0.3 to 7.0.2 #139

Merged

lukaso-bot mentioned this pull request Aug 11, 2026

fix(web-og): stop workers-og's 1-year immutable default overriding OG cache-control #141

Merged

lukaso force-pushed the dependabot/npm_and_yarn/npm-minor-patch-4da0cf4e50 branch from 0fe8db0 to 83a65a5 Compare August 12, 2026 23:22

dependabot Bot closed this Aug 14, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-minor-patch-4da0cf4e50 branch August 14, 2026 21:58

Navigation Menu

chore(deps): Bump the npm-minor-patch group with 7 updates - #137

chore(deps): Bump the npm-minor-patch group with 7 updates#137
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-4da0cf4e50

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

lukaso-bot commented Aug 7, 2026

Uh oh!

lukaso-bot commented Aug 7, 2026

Uh oh!

lukaso-bot commented Aug 12, 2026

Uh oh!

lukaso-bot commented Aug 12, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.5.7

2.5.7

Patch Changes

2.5.7

Patch Changes

0.3.23

Patch Changes

v4.23.5

4.23.5 (2026-08-02)

Bug Fixes

v4.23.4

4.23.4 (2026-08-02)

Bug Fixes

v4.23.3

4.23.3 (2026-08-02)

Bug Fixes

v4.23.2

4.23.2 (2026-08-02)

Bug Fixes

v4.12.34

Security fixes

memo() retains SSR output across requests, leading to cross-user data disclosure

ReDoS in CORS middleware via Access-Control-Request-Headers

Algorithmic complexity DoS in Language Middleware

Proxy Helper does not remove response headers listed in the Connection header

v4.12.33

What's Changed

v1.62.1

Bug Fixes

v1.62.0

🧱 New component testing model

🛑 Cancel operations with AbortSignal

🖼️ WebP screenshots

wrangler@4.118.0

Minor Changes

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.1

Patch Changes

@​cloudflare/vitest-pool-workers@​0.20.0

Minor Changes

Patch Changes

@​cloudflare/vitest-pool-workers@​0.19.1

Patch Changes

@​cloudflare/vitest-pool-workers@​0.19.0

Minor Changes

Patch Changes

0.20.1

Patch Changes

0.20.0

Minor Changes

Patch Changes

0.19.1

Patch Changes

0.19.0

Minor Changes

Uh oh!

cloudflare-workers-and-pages Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

github-actions Bot commented Aug 7, 2026

Preview deployed

Uh oh!

lukaso-bot commented Aug 7, 2026

Uh oh!

lukaso-bot commented Aug 7, 2026

Uh oh!

lukaso-bot commented Aug 12, 2026

Uh oh!

lukaso-bot commented Aug 12, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

dependabot Bot commented on behalf of github Aug 7, 2026 •

edited

Loading

`memo()` retains SSR output across requests, leading to cross-user data disclosure

ReDoS in CORS middleware via `Access-Control-Request-Headers`

Proxy Helper does not remove response headers listed in the `Connection` header

`@cloudflare/vitest-pool-workers@0`.20.1

`@cloudflare/vitest-pool-workers@0`.20.0

`@cloudflare/vitest-pool-workers@0`.19.1

`@cloudflare/vitest-pool-workers@0`.19.0

cloudflare-workers-and-pages Bot commented Aug 7, 2026 •

edited

Loading