chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #4521 · nitrojs/nitro

renovate · 2026-08-09T01:10:47Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@azure/static-web-apps-cli	`^2.0.9` → `^2.0.10`
@cloudflare/workers-types	`^5.20260716.1` → `^5.20260811.1`
@cloudflare/workers-utils (source)	`^0.27.0` → `^0.31.2`
@scalar/api-reference (source)	`^1.62.7` → `^1.64.1`
@scalar/openapi-types (source)	`^0.9.2` → `^0.9.4`
@types/node (source)	`^26.1.1` → `^26.2.0`
@types/semver (source)	`^7.7.1` → `^7.8.0`
dot-prop	`^10.1.0` → `^10.2.0`
exsolve	`^1.1.0` → `^1.1.1`
get-tsconfig	`^4.14.0` → `^4.14.1`
giget	`^3.3.0` → `^3.3.1`
h3 (source)	`^2.0.1-rc.25` → `^2.0.1-rc.26`
miniflare (source)	`^4.20260710.0` → `^4.20260730.0`
nf3	`^0.3.22` → `^0.3.23`
nypm	`^0.6.8` → `^0.6.9`
oxfmt (source)	`^0.59.0` → `^0.63.0`
oxlint (source)	`^1.74.0` → `^1.78.0`
pnpm (source)	`11.13.1` → `11.21.0`
rolldown (source)	`^1.2.0` → `^1.2.3`
rollup (source)	`^4.62.2` → `^4.62.4`
rou3	`^0.9.1` → `^0.9.2`
shaders	`^3.0.448` → `^3.0.451`
source-map	`^0.7.6` → `^0.8.0`
srvx (source)	`^0.11.22` → `^0.12.5`
unimport	`^6.3.0` → `^6.4.0`
unwasm	`^0.5.3` → `^0.6.0`
vite (source)	`^8.1.4` → `^8.2.1`
wrangler (source)	`^4.111.0` → `^4.120.1`
zephyr-agent (source)	`^1.1.2` → `^1.2.1`

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

azure/static-web-apps-cli (@azure/static-web-apps-cli)

`v2.0.10`

Compare Source

What's Changed

Bug Fixes

fix: validate --env is not passed with an empty string (#999) by @monteiro-renato
fix: update stale Node 16 references in docs, samples, and tests (#1004) by @cjk7989
fix: correct the default node version (16 to 22) (#996) by @cjk7989

Full Changelog: Azure/static-web-apps-cli@v2.0.9...v2.0.10

cloudflare/workerd (@cloudflare/workers-types)

cloudflare/workers-sdk (@cloudflare/workers-utils)

`v0.31.2`

Compare Source

Patch Changes

#15013 8cf78c8 Thanks @dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0
#15011 6946da1 Thanks @LeSingh1! - Validate observability.logs.head_sampling_rate and observability.traces.head_sampling_rate are between 0 and 1

The 0–1 range check was only applied to the top level observability.head_sampling_rate. The two nested fields were type-checked as numbers but never bounds-checked, so a value such as 10 (a common mix-up with a percentage) was accepted locally and sent to the API.
```
{
  "observability": {
    "logs": { "enabled": true, "head_sampling_rate": 10 }
  }
}
```
All three fields now report must be a value between 0 and 1. consistently.

`v0.31.1`

Compare Source

Patch Changes

#15009 b5c083b Thanks @LeSingh1! - Use the inherited Worker name when generating container names in named environments

When containers is declared inside a named environment and the container has no explicit name, the default container name was built from the environment's own name field. name is inheritable, so an environment that doesn't redeclare it left that value undefined, producing the error Must have either a top level "name" and "containers.class_name" field defined, or have field "containers.name" defined. even though a top level name was set — and, if the error was ignored, a container named undefined-<class_name>-<env>.
```
{
  "name": "my-worker",
  "env": {
    "staging": {
      "containers": [{ "class_name": "MyContainer", "image": "./Dockerfile" }]
    }
  }
}
```
wrangler deploy --env staging on the configuration above now generates my-worker-mycontainer-staging, matching the documented worker_name-class_name[-env_name] default. A name declared on the environment still takes precedence over the top level one.

`v0.31.0`

Compare Source

Minor Changes

#14586 5a56dda Thanks @emily-shen! - Move formatZodError from miniflare to @cloudflare/workers-utils

The formatZodError and _forceColour helpers are no longer exported from miniflare; they are now exported from @cloudflare/workers-utils.

`v0.30.0`

Compare Source

Minor Changes

#14785 5e6556a Thanks @dario-piotrowicz! - Add toUrlPath and UrlPath exports

toUrlPath(filePath) converts a file-system path into a URL-safe path by replacing backslashes with forward slashes and rejecting Windows drive-letter prefixes (e.g. C:). UrlPath is the branded string type it returns, letting callers prove at the type level that a string has been normalized for use in URLs.

`v0.29.0`

Compare Source

Minor Changes

#14877 552bcfc Thanks @jasoncabot! - Respect and surface the Retry-After header on Cloudflare API responses

Previously, if a Wrangler command (e.g. wrangler versions upload, wrangler deploy) hit the Cloudflare API's rate limit, the resulting error gave no indication of how long to wait before trying again, and 429 responses weren't retried at all (only 5xx errors were, with a fixed linear backoff).

Now:
- 429 Too Many Requests responses are automatically retried, alongside the existing 5xx retry behaviour.
- If a retried response includes a Retry-After header, Wrangler waits for that duration instead of the default backoff, and logs a message indicating how long it's waiting. To avoid blocking for an excessive amount of time, waits longer than 60 seconds fail fast instead — the surfaced Retry-After value lets the caller schedule its own retry.
- If a retryable error is ultimately surfaced to the user (e.g. because retries were exhausted), the error message includes a note with the Retry-After duration, and the command-failed entry written to the Wrangler output file (WRANGLER_OUTPUT_FILE_PATH/WRANGLER_OUTPUT_FILE_DIRECTORY) gains a retry_after_ms field. This lets scripts and CI/CD pipelines calling Wrangler repeatedly (for example, wrangler versions upload on every commit) read the wait duration directly instead of regex-parsing stderr.
APIError.isRetryable() is unchanged (still 5xx only); retryOnAPIFailure() separately retries 429s. retryAfterMs, when present, is honoured for any retried error, not just 429s.

retryAfterMs is also now populated on APIErrors raised from direct R2 object requests, the Browser Rendering API, and errors surfaced from commands using the official cloudflare SDK client.

`v0.28.0`

Compare Source

Minor Changes

#14595 2b390d7 Thanks @colinhacks! - Recognise nub as a package manager

wrangler now detects nub — from its npm_config_user_agent and an installed nub binary — and autoconfig detects nub projects by their nub.lock, alongside npm, pnpm, yarn, and bun.

Patch Changes

#14746 a6c214f Thanks @samarth70! - Return a clear error when observability is set to null

validateObservability guarded only against undefined, so a null value (valid in JSON/JSONC config) passed the typeof value === "object" check and then threw TypeError: Cannot read properties of null (reading 'enabled') while validating the config. It now rejects null with the same "observability" should be an object but got null. diagnostic that the sibling cache validator already produces.

scalar/scalar (@scalar/api-reference)

`v1.64.1`

Patch Changes

#9828: Bump shared build and runtime dependencies to their latest compatible versions
(fuse.js, vite, vitest, tailwindcss, @vitejs/plugin-vue, @vue/test-utils,
posthog-js, yaml, and the CSS injection plugin). The fuse.js 7.5.0 upgrade
tightened generic inference, so the empty new Fuse([]) search instances now
pass an explicit FuseData type argument.
#9837: Keep the selected server when the configuration is updated. Pushing a config update to a mounted reference (for example a refreshed auth token via updateConfiguration) rebases the document in the store, which previously reset the server selector back to the first server. The user's selected server is now preserved across configuration updates.
#9783: fix: resolve axe-core ARIA violations in the API reference sidebar and client tabs

Sidebar items used aria-selected on links/buttons (invalid for those roles) and the search trigger used role="search" on a button. Selected items now use aria-current="page", the search control is a plain named button, and the sidebar no longer sets an invalid role="navigation" on <aside> (it keeps the default complementary landmark).

Client library and SDK installation "More" comboboxes sat inside role="tablist", which fails aria-required-children. They now sit beside the tablist. MCP install controls without a target URL render as buttons instead of empty a[href=""] links.
#9791: Stop recursive schema rendering when a discriminator variant allOfs back to its base type. The selected child now inherits the parent's discriminator context so the mapping is not re-inferred on every nest.
#9830: Stop listing enum values twice for an array parameter whose items is a $ref
to an enum schema. The values are now listed only in the array items card, which
also shows the item schema's title and description.
#9839: Harden the API reference against untrusted OpenAPI documents:
- Link targets taken from the document (info.license.url, info.termsOfService,
  info.contact.url, externalDocs.url, x-scalar-links) and the direct download link are now
  checked against an allow list of protocols, so a document can no longer render a javascript:
  link that runs script when a reader clicks it. Unsafe values fall back to plain text.
- deepMerge (used by the exported createEmptySpecification) no longer writes through the
  prototype chain, so a document can no longer add properties to Object.prototype via __proto__,
  constructor, or prototype. Keys with those names are kept as plain data instead of being
  dropped, so a schema is still free to describe a property named constructor.
- customCss can no longer close the injected <style> tag, which mattered during server
  rendering where the value lands in the HTML stream verbatim.
- Added rel="noopener noreferrer" to the remaining target="_blank" links.
Adds isSafeUrl and sanitizeUrl to @scalar/helpers/url/is-safe-url.
#9829: Update Vue to 3.5.40. Vue 3.5.36 tightened defineModel default validation, so
models with array or object defaults now use the factory form
(defineModel<T[]>({ default: () => [] })) as Vue already requires for regular
props. Behaviour is unchanged.
#9790: fix: keep dots in webhook navigation deep links

Webhook event names that use dots (for example account_holder.created) had the
dot dropped when building the navigation id, joining adjacent words into
account-holdercreated. Dots are now kept, producing account-holder.created.

Old deep links using the dropped-dot slug are redirected to the new slug, so
existing bookmarks keep resolving.

`v1.64.0`

Minor Changes

#9683: Surface the required OAuth scopes for an operation as a dedicated "OAuth scopes" section below the description (above parameters), instead of only inside the "Auth Required" badge popover. Scopes are de-duplicated across security alternatives and shown in both the modern and classic layouts, as well as on AsyncAPI operations.
#9711: feat: add pluginUrls configuration option to load API Reference plugins from URLs

Each entry must point to an ESM module that exports a plugin (the same shape as the plugins entries) as its default export. The standalone build (Scalar.createApiReference) imports the modules before the API reference mounts and registers their default exports alongside the plugins passed directly. Unlike plugins, the new option is JSON-serializable, so integrations that pass their configuration as JSON (for example the Docker container or Scalar for Aspire) can load plugins without replacing the whole bundle.

Patch Changes

#9732: Render every oneOf/anyOf group of an allOf in place. Previously, when one object composed several mutually-exclusive choices as sibling oneOf/anyOf under allOf, only the first group was shown and the rest were silently dropped. Each choice group now renders its own selector in the position it was declared, and the generated request example stays in sync per group.
#9794: Keep sibling properties when flattening a single-member allOf. Previously, a schema declaring its own properties next to an allOf holding a single $ref lost those sibling properties: the referenced schema's properties overwrote them instead of being combined, and the referenced schema's title/description replaced the parent's. Sibling and inherited properties now render together, required lists are unioned, and the parent schema's own annotations win over the base it extends.
#9757: fix: read enum metadata from array items

When an enum is defined inside an array schema's items, the enum values were resolved from items but their x-enum-varnames, x-enumNames, and x-enumDescriptions were still read from the outer schema, so the metadata was dropped. Both the values and their metadata are now read from the same schema.
#9681: The "Auth Required" / "Auth Optional" badge on operations now opens on hover, not just on click
#9753: fix: badge base styles no longer rely on zero specificity

The badge base rule was written with :where(.badge), which the scoped-style compiler collapsed to zero specificity, letting any late-loading reset clobber the badge font size, padding, and colors. The base styles now carry real specificity, and consumers that intentionally override them (the download-link json/yaml badges and the webhook badge) keep winning through tailwind-merge and higher-specificity variant rules.
#9766: fix: give the collapsible section trigger an accessible name and a valid aria-controls target

The trigger button rendered by CompactSection carried aria-controls set to its own id, so it declared that it controls itself, and it exposed no accessible name of its own. Screen reader users heard an unnamed button, and axe-core reported button-name and aria-allowed-attr on every model section.

The trigger now points aria-controls at the collapsible region, which carries its own id. While the section is collapsed the attribute is dropped entirely rather than left pointing at an element that is not rendered.

The accessible name now comes from aria-labelledby pointing at the heading the trigger already renders, so the name is always the visible text. Referencing the heading rather than copying it into an aria-label means the name cannot drift out of sync with what is on screen, which is the WCAG 2.5.3 (Label in Name) failure a duplicated string would risk.
#9754: fix: adapt the info links to the rendered width of the reference instead of the viewport

The introduction's info links (contact, license, terms of service, external docs, and x-scalar-links), the section header grid, and the classic-layout selector cards switched their layout based on viewport media queries, while the rest of the reference adapts to the rendered width of the reference through the narrow-references-container container query. They now restyle based on the container as well, through a new narrow: Tailwind variant.
#9751: fix: keep even heading-to-description spacing on the operation title in narrow layouts

The narrow (single-column) operation layout bumped the operation title's bottom margin to 24px, so the gap between the heading and its description no longer matched the 12px used on wider screens. The override is removed so the title keeps the shared 12px spacing at every width.
#9676: Preload additional documents in a multi-document setup while the browser is idle, so switching between them is instant.
#9788: Add print styles so printing (or saving to PDF) no longer renders expanded content over the text that follows it. The reference lays itself out as a fixed-viewport application, and its sticky columns were pinned to a screen measurement that is meaningless on paper. Printing now flattens that shell into ordinary document flow: navigation and floating chrome are hidden, sticky positioning and viewport-derived height caps are dropped so long examples are no longer truncated, and small units such as properties and cards avoid breaking across pages.
#9691: Show the format of primitive array items (e.g. an array of uuid strings) in the schema property heading

`v1.63.0`

Minor Changes

#9728: feat: export SdkInstallationInstructions and getRenderableSdks from @scalar/api-reference/blocks, so consumers that compose their own reference layout can render x-scalar-sdk-installation again

scalar/scalar (@scalar/openapi-types)

`v0.9.4`

Patch Changes

#9733: fix: add explicit .js file extensions to relative imports in the published 2.0, 3.0, 3.1 and 3.2 type declarations, so they resolve with moduleResolution: nodenext and node16

sindresorhus/dot-prop (dot-prop)

`v10.2.0`

Compare Source

Improve performance d296823

unjs/exsolve (exsolve)

`v1.1.1`

Compare Source

compare changes

🩹 Fixes

Match wildcard imports keys with a trailer (#57)

🏡 Chore

Update deps (bf25dd4)
Update repo (a55eb05)

❤️ Contributors

Pi0x x@pi0.io
Pooya Parsa (@pi0)

privatenumber/get-tsconfig (get-tsconfig)

`v4.14.1`

Compare Source

Bug Fixes

parse-tsconfig: resolve extends dependencies of symlinked packages (#131) (1ca80dd)

unjs/giget (giget)

`v3.3.1`

Compare Source

compare changes

🏡 Chore

Update deps (2d55c7a)

❤️ Contributors

Pooya Parsa (@pi0)

h3js/h3 (h3)

`v2.0.1-rc.26`

Compare Source

compare changes

🚀 Enhancements

resolveDotSegments: Add mergeSlashes option (9581407)
session: Default session cookie to SameSite=Lax (acf8d77)
⚠️ Escape interpolated values in html tagged template (#1459)
readValidatedBody: Support readBody options (#1476)
Add onDispose hook (#1488)
defineValidatedHandler: Support async validation (#1491)
sse: Allow returning EventStream directly from handlers (#1508)

🔥 Performance

Single-scan fast-path guard for resolveDotSegments (#1458)
cookie: Avoid quadratic chunked cookie parsing and header rebuilds (#1472)
middleware: Precompose middleware chains (#1475)
body-limit: Stream enforcement instead of pre-buffering (#1500)

🩹 Fixes

resolveDotSegments: Preserve trailing slash on trailing dot segments (ca7de07)
cookie: Dedup cookies with leading-dot / mixed-case domains (#1462)
cors: Warn on credentials with null origin (#1464)
Decode Basic-auth credentials as UTF-8 (#1463)
proxy: ForwardHeaders must not override framing headers (#1467)
cookie: Cap chunk count in setChunkedCookie (#1469)
cors: Set single-valued CORS headers instead of appending (#1466)
auth: Harden basic-auth realm handling and credential timing (#1468)
validate: Convert malformed JSON to 400 in validated-handler path (#1465)
base: Collapse leading-slash run in all base-stripping sites (#1471)
html: Make raw() trust marker unforgeable and hoist escape map (#1473)
json-rpc: Use -32600 for valid-JSON non-object bodies (#1483)
Only discard prepared headers for error responses (#1486)
event-stream: Correct stream teardown on close and client disconnect (#1484)
deprecated: Correct v1 signatures in the compat shim (#1492)
response: Do not render non-Error throws as successful responses (#1485)
event: Keep event.context and req.context as one reference (#1499)
response: Absorb errors thrown in onResponse hook (4a32c1b)
response: Route synchronous prepareResponse throws through the error pipeline (#1503)
response: Keep content-length header for Uint8Array responses (#1504)
response: Strip HEAD body when merging prepared headers into a mutable Response (#1490)
response: Allow status and headers staged during the first stream chunk (#1512)

💅 Refactors

request: ⚠️ Make x-forwarded-proto trust opt-in (#1461)
event-stream: ⚠️ Drop autoclose option (#1495)
sse: Promote EventStream to public API, deprecate createEventStream (#1509)

📖 Documentation

Security caveats for cors, proxy, redirect, host and static utils (#1470)
Explain event.url.pathname decoding (3f8b5bc)

🌊 Types

Canonical RouteRules interface (#1474)
Remove unused StaticAssetMeta.path (0b34e24)

🏡 Chore

Apply automated updates (3e74620)
Fix stale comment (879c869)
Update agents.md (6444251)
Add missing H3Core types (978b17c)
Update deps (199afe6)
Use normal tsc for typecheck (7d70c6f)
Update srvx to 0.12 (5eb0a01)
Update undocs (ba42947)
Update docs (50266f3)
Apply automated updates (321b1dc)
Update deps (6e24eb3)

⚠️ Breaking Changes

⚠️ Escape interpolated values in html tagged template (#1459)
request: ⚠️ Make x-forwarded-proto trust opt-in (#1461)
event-stream: ⚠️ Drop autoclose option (#1495)

❤️ Contributors

Pooya Parsa (@pi0)
Pi0x x@pi0.io
N0liu (@n0liu)
G1mn beebird@gmail.com
Sandro Circi (@sandros94)
Max (@onmax)

cloudflare/workers-sdk (miniflare)

`v4.20260730.0`

Compare Source

Minor Changes

#14685 01d7020 Thanks @edmundhung! - Add JSON output to /cdn-cgi/handler/email

The /cdn-cgi/handler/email endpoint now accepts ?format=json to return the email handler result as JSON, including its outcome, rejection reason, forwarded messages, and replies. Requests without format=json still return the existing text outcome for backward compatibility.

Patch Changes

#14929 48f0c6c Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260722.1 ^5.20260730.1

workerd 1.20260722.1 1.20260730.1
#14810 d7f38c3 Thanks @allocsys! - Fix the local Images binding transform (env.IMAGES.input(...).transform(...)) ignoring the fit, gravity, and background options. Previously, local dev always letterboxed transformed images with black bars regardless of the options passed in. Local dev now respects fit, gravity, and background, matching production Images binding behavior.
#14850 5c25cfe Thanks @exKAZUu! - Disable the keep-alive timeout on the loopback server

The loopback server (which serves custom service bindings, @cloudflare/vite-plugin's module transport, and other workerd → Node callbacks) used Node's default server.keepAliveTimeout of 5 seconds. workerd pools and reuses connections to the loopback server, so Node closing an idle pooled socket raced with workerd sending the next request on it, making that request fail with Network connection lost. The failure is probabilistic and load-dependent; under @cloudflare/vite-plugin with a large SSR module graph and a cold optimizer cache (thousands of fetchModule calls with multi-second idle gaps between bursts), it broke most dev sessions. Disable the idle keep-alive timeout on the loopback server, mirroring the undici pools used for dispatch in the opposite direction.
#14914 1f61001 Thanks @nickpatt! - Capture Workflows invocations in local observability

When local observability is enabled, the Workflows engine service is now attached to the trace collector (like every user worker), so workflow runs show up in the Local Explorer's Observability view attributed to the workflow. Previously the engine ran outside the per-user-worker tail wiring, so workflow invocations left no traces, spans, or logs in the local store.

`v4.20260722.1`

Compare Source

Minor Changes

#14702 e426cb9 Thanks @Sipixer! - Support passing V8 flags to workerd via the MINIFLARE_WORKERD_V8_FLAGS environment variable

The generated workerd config already supports v8Flags, but Miniflare never populated it, so the runtime always ran with V8's default heap limit (~1.4 GB). Large dev applications (e.g. big SSR module graphs under @cloudflare/vite-plugin, where each server-file edit grows the runner isolate's heap) can reach that limit, at which point workerd aborts with V8 fatal error; location = Reached heap limit and every subsequent dispatchFetch() fails with fetch failed until the dev server is manually restarted.

Setting e.g. MINIFLARE_WORKERD_V8_FLAGS="--max-old-space-size=4096" raises the limit and keeps long dev sessions alive. The variable follows the same space-separated format as MINIFLARE_WORKERD_AUTOGATES.
#14280 465c0fb Thanks @tahmid-23! - Add a local S3-compatible API for R2 buckets at /cdn-cgi/local/r2/s3/<bucket-id>, where <bucket-id> is the ID the bucket is configured with in the r2Buckets option

Buckets configured with s3Credentials: { accessKeyId, secretAccessKey } in r2Buckets are served over an S3-compatible HTTP API, authenticated with AWS Signature Version 4 (both Authorization header and presigned URL query authentication). Supported operations: GetObject, HeadObject, PutObject, CopyObject, DeleteObject, DeleteObjects, ListObjects, ListObjectsV2, HeadBucket, ListBuckets, CreateMultipartUpload, UploadPart, UploadPartCopy, CompleteMultipartUpload, and AbortMultipartUpload. Status codes, error responses, and unsupported-header screening mirror R2's S3 endpoint, including its static responses for bucket-configuration reads and its named errors for unimplemented operations.
#14712 6e0bf6e Thanks @mack-erel! - Support connect() on remote VPC Network and VPC Service bindings in local development

Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported. Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development.

This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required.

Patch Changes

#14784 1035f74 Thanks @ATKasem! - Fix getWithMetadata dropping metadata for falsy KV values

KVNamespace.getWithMetadata returned null metadata whenever the stored value was falsy — an empty string or "0" — because the metadata branch was guarded by a truthiness check on the value. The guard now checks for null explicitly, so metadata is preserved for empty-string and "0" values while genuinely missing keys still return null.
#14864 3a22ae5 Thanks @Hashim1999164! - Hide the workerd console window on Windows when the parent process has no console. Spawning workerd without `windowsHide

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "after 1am and before 5am"
Automerge
- "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-08-09T01:10:53Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nitro.build	Ready	Preview	Aug 14, 2026 5:00pm

pkg-pr-new · 2026-08-09T01:12:19Z

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4521

commit: c6e47ae

socket-security · 2026-08-09T01:12:56Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@types/semver@7.8.0
	zephyr-agent@1.2.2
	shiki@4.4.3
	@cloudflare/workers-utils@0.31.2
	shaders@3.0.452
	@types/node@26.2.0
	dot-prop@10.2.0
	oxfmt@0.63.0
	rou3@0.9.2
	nypm@0.6.9
	unwasm@0.6.0
	source-map@0.8.0
	@azure/static-web-apps-cli@2.0.10
	oxlint@1.78.0
	wrangler@4.123.0
	get-tsconfig@4.14.2
	@scalar/api-reference@1.65.0
	unimport@6.4.0
	@cloudflare/workers-types@5.20260813.1
	rollup@4.62.4
	miniflare@4.20260730.0
	@scalar/openapi-types@0.9.4

View full report

renovate Bot requested a review from pi0 as a code owner August 9, 2026 01:10

vercel Bot had a problem deploying to Preview August 9, 2026 01:10 Failure

renovate Bot force-pushed the renovate/all-minor-patch branch from 0a1139a to 674b0fa Compare August 9, 2026 16:30

vercel Bot had a problem deploying to Preview August 9, 2026 16:30 Failure

renovate Bot force-pushed the renovate/all-minor-patch branch from 674b0fa to 92b16aa Compare August 10, 2026 10:04

vercel Bot deployed to Preview August 10, 2026 10:05 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 92b16aa to 299184c Compare August 10, 2026 15:47

vercel Bot deployed to Preview August 10, 2026 15:47 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 299184c to 7928ad3 Compare August 10, 2026 19:44

vercel Bot deployed to Preview August 10, 2026 19:45 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 7928ad3 to 0927625 Compare August 10, 2026 22:55

vercel Bot deployed to Preview August 10, 2026 22:55 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 0927625 to 26862f4 Compare August 11, 2026 01:11

vercel Bot deployed to Preview August 11, 2026 01:12 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 26862f4 to 4e546df Compare August 11, 2026 22:17

vercel Bot deployed to Preview August 11, 2026 22:17 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 4e546df to f89e066 Compare August 12, 2026 08:50

vercel Bot deployed to Preview August 12, 2026 08:50 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from f89e066 to 86edf1d Compare August 12, 2026 17:49

vercel Bot deployed to Preview August 12, 2026 17:49 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 86edf1d to 5c873c6 Compare August 13, 2026 04:17

vercel Bot deployed to Preview August 13, 2026 04:18 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 5c873c6 to 310035c Compare August 13, 2026 10:50

vercel Bot deployed to Preview August 13, 2026 10:51 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 310035c to c3c42dd Compare August 13, 2026 17:01

vercel Bot deployed to Preview August 13, 2026 17:01 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from c3c42dd to 1fb077d Compare August 13, 2026 23:05

vercel Bot deployed to Preview August 13, 2026 23:06 View deployment

renovate Bot force-pushed the renovate/all-minor-patch branch from 1fb077d to cc4d984 Compare August 14, 2026 03:17

vercel Bot deployed to Preview August 14, 2026 03:18 View deployment

chore(deps): update all non-major dependencies

c6e47ae

renovate Bot force-pushed the renovate/all-minor-patch branch from cc4d984 to c6e47ae Compare August 14, 2026 16:59

vercel Bot deployed to Preview August 14, 2026 17:00 View deployment

Navigation Menu

Uh oh!

Uh oh!

chore(deps): update all non-major dependencies - #4521

chore(deps): update all non-major dependencies#4521
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
@cloudflare/workers-types	^5.20260722.1	^5.20260730.1
workerd	1.20260722.1	1.20260730.1

Uh oh!

Uh oh!

Conversation

renovate Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Bug Fixes

Patch Changes

Patch Changes

Minor Changes

Minor Changes

Minor Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

🩹 Fixes

🏡 Chore

❤️ Contributors

Bug Fixes

🏡 Chore

❤️ Contributors

🚀 Enhancements

🔥 Performance

🩹 Fixes

💅 Refactors

📖 Documentation

🌊 Types

🏡 Chore

⚠️ Breaking Changes

❤️ Contributors

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Configuration

Uh oh!

vercel Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 9, 2026 •

edited

Loading

vercel Bot commented Aug 9, 2026 •

edited

Loading

pkg-pr-new Bot commented Aug 9, 2026 •

edited

Loading

socket-security Bot commented Aug 9, 2026 •

edited

Loading