Repository navigation
fix(deps): update workers-sdk derived dependencies - #517
Conversation
ant-release-bot
added
the
dependencies
ant-release-bot
added
the
dependencies
commit: |
|
LGTM |
![clanky-the-clanker[bot]](https://avatars.githubusercontent.com/in/5306670?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Approved — A routine dependency bump whose versions match across both manifests, with a changeset included. No issues found.
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
✅ All checks passed
🚀 Release: ✅ LGTM
Risk: Low. A changeset is included for the dependency update.
🔒 Security: ✅ LGTM
The updates bring in upstream fixes for bundled dependencies that had security advisories. No new risk found.
📖 AGENTS.md: ✅ LGTM
No issues in the changed files.
📋 Code Quality: ✅ LGTM
The version bumps match across both package manifests.
⚡ Performance: ✅ LGTM
No performance concerns.
📝 Documentation: ✅ LGTM
No documentation issues.
Reviewed commit: 746e89c9
|
| mean | stddev | min | max | |
|---|---|---|---|---|
| PR | 193.8 ms | 13.6 ms | 182.7 ms | 232.3 ms |
| base | 187.7 ms | 6.1 ms | 177.4 ms | 200.6 ms |
Δ (PR vs base): ↑ +6.1 ms (+3.2%)
Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.
This PR contains the following updates:
0.9.2→0.9.30.9.9→0.9.100.3.3→0.3.40.7.3→0.7.40.30.1→0.30.20.23.8→0.23.90.25.0→0.26.00.1.22→0.1.230.15.6→0.16.00.51.1→0.52.05.20261103.0-beta→5.20261104.0-betaWarning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
cloudflare/workers-sdk (@cloudflare/autoconfig)
v0.9.3Compare Source
Patch Changes
#16700
dc35efbThanks @cjol! - Bump bundledbrace-expansionto pick up security fixesThese packages bundle
brace-expansion(a dependency ofminimatch), and the bundled versions were affected by published advisories. The bundles now includebrace-expansion2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
Updated dependencies [
dc35efb,dc35efb,b2061f4,f1d81a2]:cloudflare/workers-sdk (@cloudflare/build-output-utils)
v0.9.10Compare Source
Patch Changes
#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
Updated dependencies [
b2061f4]:cloudflare/workers-sdk (@cloudflare/cli-shared-helpers)
v0.3.4Compare Source
Patch Changes
#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
Updated dependencies [
dc35efb,dc35efb,b2061f4,f1d81a2]:cloudflare/workers-sdk (@cloudflare/codemods)
v0.7.4Compare Source
Patch Changes
#16700
dc35efbThanks @cjol! - Bump bundledbrace-expansionto pick up security fixesThese packages bundle
brace-expansion(a dependency ofminimatch), and the bundled versions were affected by published advisories. The bundles now includebrace-expansion2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.#16700
dc35efbThanks @cjol! - Bump bundledminimatchfrom 5.1.6 to 5.1.9 to pick up security fixesThese packages bundle
minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive**matching, which D1'smigrations_patternrelies on.#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
cloudflare/workers-sdk (@cloudflare/config)
v0.30.2Compare Source
Patch Changes
#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
cloudflare/workers-sdk (@cloudflare/containers-shared)
v0.23.9Compare Source
Patch Changes
#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
Updated dependencies [
dc35efb,dc35efb,b2061f4,f1d81a2]:cloudflare/workers-sdk (@cloudflare/deploy-helpers)
v0.26.0Compare Source
Minor Changes
#16020
37c3c48Thanks @penalosa! - Allow custom strict-mode conflict abort messagesAdd an optional
strictModeAbortMessageto deploy-helpers' pre-1.0 deploy and versions-upload APIs so callers can describe their own override flags when strict mode aborts a conflicting upload in a non-interactive session. Wrangler keeps its existing--strictguidance when the message is omitted.Patch Changes
#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
Updated dependencies [
dc35efb,dc35efb,dc35efb,dc35efb,dc35efb,b8387a5,4cde694,b2061f4,b2061f4,f1d81a2,4bb491b,36e64f2,92c4b97]:cloudflare/workers-sdk (@cloudflare/runtime-types)
v0.1.23Compare Source
Patch Changes
#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
Updated dependencies [
dc35efb,dc35efb,dc35efb,dc35efb,dc35efb,b8387a5,4cde694,b2061f4,b2061f4,f1d81a2,4bb491b,36e64f2,92c4b97]:cloudflare/workers-sdk (@cloudflare/workers-auth)
v0.16.0Compare Source
Minor Changes
#16528
cff43aaThanks @mtlemilio! - Correct and request the PlanetScale setup scope in new cf OAuth loginsUse the policy-compliant
hyperdrive-planetscale.setupidentifier for the PlanetScale setup scope and request it in new cf OAuth logins by default. OAuth grants remain constrained by the user's permissions, so only users with the corresponding Bach membership permission can exercise it. Existing sessions must authenticate again to receive the scope.Patch Changes
#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
Updated dependencies [
dc35efb,dc35efb,b2061f4,f1d81a2]:cloudflare/workers-sdk (@cloudflare/workers-utils)
v0.52.0Compare Source
Minor Changes
#16186
f1d81a2Thanks @leostera! - Support local Artifacts across Wrangler, Vite, and Workers VitestSet
remote: falseon an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omittedremotecontinues to use the deployed resource, with a warning that changes affect real repositories;remote: trueexplicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite'sremoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator whenremoteis omitted, so tests do not change real repositories by accident; setremote: trueto test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.In Miniflare's own options, Artifacts bindings route like every other binding: only
dev.remote: truewith a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.Patch Changes
#16700
dc35efbThanks @cjol! - Bump bundledbrace-expansionto pick up security fixesThese packages bundle
brace-expansion(a dependency ofminimatch), and the bundled versions were affected by published advisories. The bundles now includebrace-expansion2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.#16700
dc35efbThanks @cjol! - Bump bundledminimatchfrom 5.1.6 to 5.1.9 to pick up security fixesThese packages bundle
minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive**matching, which D1'smigrations_patternrelies on.#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
cloudflare/workers-sdk (miniflare)
v5.20261104.0-betaCompare Source
Minor Changes
#16186
f1d81a2Thanks @leostera! - Support local Artifacts across Wrangler, Vite, and Workers VitestSet
remote: falseon an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omittedremotecontinues to use the deployed resource, with a warning that changes affect real repositories;remote: trueexplicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite'sremoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator whenremoteis omitted, so tests do not change real repositories by accident; setremote: trueto test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.In Miniflare's own options, Artifacts bindings route like every other binding: only
dev.remote: truewith a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.Patch Changes
#16700
dc35efbThanks @cjol! - Bump bundledbrace-expansionto pick up security fixesThese packages bundle
brace-expansion(a dependency ofminimatch), and the bundled versions were affected by published advisories. The bundles now includebrace-expansion2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.#16700
dc35efbThanks @cjol! - Bump bundleddevaluefrom 5.6.3 to 5.9.3 to pick up security fixesdevalueis bundled into these packages, which use it to serialise values between Node.js and workerd. Version 5.6.3 is affected by several published advisories, and 5.9.3 includes their fixes. Serialisation behaviour does not change.#16700
dc35efbThanks @cjol! - Bump bundledfast-xml-parserfrom 4.4.1 to 4.5.5 to pick up security fixesMiniflare bundles
fast-xml-parserinto its local R2 S3 API, and Wrangler bundles it through the AWS SDK used bywrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.#16700
dc35efbThanks @cjol! - Bump bundledhonofrom 4.12.5 to 4.13.11 to pick up security fixeshonois bundled into Miniflare, and 4.12.5 is affected by several published advisories. Version 4.13.11 includes their fixes. Miniflare's own behaviour does not change.#16700
dc35efbThanks @cjol! - Bump bundledminimatchfrom 5.1.6 to 5.1.9 to pick up security fixesThese packages bundle
minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive**matching, which D1'smigrations_patternrelies on.#16686
b8387a5Thanks @FlorentCollin! - Skip D1 comment-only statements that start at offset 0Local D1 skipped a comment-only statement only when whitespace came before the
--. A statement such as-- commentat offset 0 failed with "SQL code did not contain a statement." Local D1 now skips these statements, as remote D1 does.#16687
4cde694Thanks @FlorentCollin! - Stop local D1 reads outside sessions from writing to the database fileBefore, local D1 stored a new session bookmark for each query. Thus, each
SELECTcommitted a write transaction with a WAL append and an fsync. Now, local D1 gets a bookmark only when the request has a session bookmark or constraint. Requests from awithSession()session andquery()calls with abookmarkhave one. Other queries do not get a bookmark. Production D1 operates in the same way.#16695
b2061f4Thanks @dependabot! - UpdateDEFAULT_COMPAT_DATEto 2026-11-04Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.
#16695
b2061f4Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"The following dependency versions have been updated:
#16611
4bb491bThanks @petebacondarwin! - Restrict access to local Secrets Store persistence directoriesOn POSIX systems, new and existing local Secrets Store directories are restricted to their owner before storage is opened. Startup fails if the directory cannot be secured, belongs to another user, or is a symbolic link. Windows continues to use inherited filesystem access controls.
#16306
36e64f2Thanks @efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"When a remote bindings request reached a
workers.devhost protected by Access without valid Access credentials (for example, Access was added after the dev server started, theCF_Authorizationcookie expired, or Access was not detected at startup), the edge redirected it to the Access login page. The binding followed that redirect back through the remote proxy, looping until it failed withTypeError: Too many redirectsand an error message containing the Access login URL. Miniflare now detects the redirect, returns a readable 401 explaining how to re-authenticate, and logs the existing one-time "Cloudflare Access blocked a remote bindings request" warning.The remote proxy server now marks the responses it forwards from a binding, so only Access responses generated in front of it are replaced. An Access login redirect or block page returned by a remote binding itself (for example, a Worker proxying an Access-protected origin) now reaches the caller unchanged.
#16607
92c4b97Thanks @petebacondarwin! - Prevent Workers from changing local static assets and Workers Sites files during developmentAsset files remain available to serve and can still be updated by editing them on disk.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.