fix(deps): update all non-major dependencies by khepri-bot[bot] · Pull Request #124 · gordon-code/github-tracker

khepri-bot · 2026-08-10T05:01:50Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vite-plugin (source)	`1.45.1` → `1.47.0`
@cloudflare/vitest-pool-workers (source)	`0.18.6` → `0.18.8`
@playwright/test (source)	`1.61.1` → `1.62.0`
@sentry/cloudflare (source)	`10.67.0` → `10.68.0`
@sentry/solid (source)	`10.67.0` → `10.68.0`
daisyui (source)	`5.6.18` → `5.7.4`
happy-dom	`20.11.0` → `20.11.1`
pnpm (source)	`11.15.1` → `11.17.0`
wrangler (source)	`4.112.0` → `4.114.0`

Release Notes

cloudflare/workers-sdk (@cloudflare/vite-plugin)

`v1.47.0`

Compare Source

Minor Changes

#14633 3203b5d Thanks @nickpatt! - Add local-dev observability

wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

You can explore this data two ways:
- A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
- A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.
While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

#14792 c4bacec Thanks @matthewp! - Recover local development after the Workers runtime crashes

Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.
Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:
- wrangler@4.114.0
- miniflare@4.20260722.0

`v1.46.0`

Compare Source

Minor Changes

#14724 a50f73a Thanks @jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.
```
// cloudflare.config.ts
import { defineSettings, defineWorker } from "wrangler/experimental-config";
import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };

export const settings = defineSettings({
	accountId: "<your-account-id>",
});

export default defineWorker({
	name: "my-worker",
	entrypoint,
	compatibilityDate: "2026-05-18",
});
```
This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

Patch Changes

Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:
- miniflare@4.20260721.0
- wrangler@4.113.0

cloudflare/workers-sdk (@cloudflare/vitest-pool-workers)

`v0.18.8`

Compare Source

Patch Changes

#14793 7b3fea6 Thanks @trafgals! - Prevent worker disposal errors from failing otherwise successful test runs

Errors raised while disposing test Workers are now logged for diagnostics rather than overriding the test result. Set NODE_DEBUG=vitest-pool-workers to view these errors.
Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:
- wrangler@4.114.0
- miniflare@4.20260722.0

`v0.18.7`

Compare Source

Patch Changes

#14713 de34449 Thanks @allocsys! - Fix a non-ASCII path failure during the Miniflare WebSocket handshake: the MF-Vitest-Worker-Data header embedded the raw process.cwd() value, which threw a Latin-1/ASCII header encoding error when the workspace path contained non-ASCII characters (e.g. CJK characters) on Windows. The value is now percent-encoded on write and decoded on read, matching the fix applied to the module fallback redirect response.
#14713 de34449 Thanks @allocsys! - Fix a runtime start-up failure ("No such module "cloudflare:test-internal"") when the project workspace path contains non-ASCII characters (e.g. CJK characters) on Windows. The module fallback service's redirect response set the target file path directly as an HTTP Location header value, but headers are restricted to the Latin-1/ASCII byte range, so any non-ASCII byte in the path caused header construction to throw. Such paths are now percent-encoded (and tagged with a sentinel prefix) before being used as a header value, and decoded again only for the values we encoded, so the round-trip is unambiguous and a workspace path containing a literal % is left untouched instead of being mis-decoded.
#14739 5eac99e Thanks @Ankcorn! - Support testing Streaming Tail Workers in Vitest Pool Workers.
#14763 538e867 Thanks @gianghungtien! - Treat webSocketMessage(), webSocketClose() and webSocketError() as optional Durable Object handlers

The pool wraps each Durable Object class and installs a prototype method for every default handler before user code is loaded, so workerd always sees a handler and always dispatches. When the wrapped class didn't actually define one, the wrapper threw <ClassName> exported by <path> does not define a `webSocketClose()` method, even though deployed Workers silently ignore these events for classes that omit them. A hibernatable Durable Object defining only webSocketMessage() would log an uncaught TypeError on every close.

These three handlers now no-op when absent, matching deployed behaviour. alarm() is unchanged and still reports a missing handler, since workerd rejects setAlarm() up front on a class without one.
Updated dependencies [42af66d, a0a091b, f03b108, deae171, 0df3d43, d83a476, 4e92e32, d1d6945, 4815711, a0c8bb1, a50f73a, 2b390d7, c82d96b, 34430b3, f75ae5d]:
- miniflare@4.20260721.0
- wrangler@4.113.0

microsoft/playwright (@playwright/test)

`v1.62.0`

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried.
The default 'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

New apiResponse.timing() returns resource timing information for an API response.

Evaluation

New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
page.evaluate() and related methods now accept functions as evaluate arguments.
page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

⚠️ Debian 11 is not supported anymore.

Browser Versions

Chromium 151.0.7922.34
Mozilla Firefox 153.0
WebKit 26.5

This version was also tested against the following stable channels:

Google Chrome 151
Microsoft Edge 151

getsentry/sentry-javascript (@sentry/cloudflare)

`v10.68.0`

Compare Source

feat(cloudflare): Add @sentry/cloudflare/vite orchestrion plugin (#21967)
feat(nestjs): Support WebSocket errors in SentryGlobalFilter (#22224)
feat(node,server-utils): Set cache.key on dataloader spans and capture redis delete operations as cache.remove (#22389)
feat(server-utils): Allow integrations to be part of marker (#22094)
feat(server-utils): Migrate FirebaseInstrumentation to orchestrion (#22141)
feat(server-utils): Warn when bundler config has instrumented module in external (#22379)
feat(v10): Add http.route attribute to http.server spans with parameterized routes (#22564)
feat(v10): Add url.full and url.path to http.server spans (#22533)
feat(v10/cloudflare): Auto-instrument Durable Object classes (#22541)
feat(v10/cloudflare): Auto-instrument the worker entry with withSentry (#22540)
feat(v10/cloudflare): Auto-instrument WorkerEntrypoint classes (#22543)
feat(v10/cloudflare): Auto-instrument Workflow classes (#22542)
feat(v10/cloudflare): Read wrangler config and resolve the Sentry options module (#22538)
feat(v10/core): Add instrumentStateGraph API (#22491)
feat(v10/core): Add url.full attribute to core fetch instrumentation (#22436)
feat(v10/core): Support filtering stackFrameVariables by variable name (#22526)
feat(v10/react-router): Make instrumentation API the default (#22525)
fix(cloudflare,deno,node): Align types of vercelai (#22343)
fix(core): Instrument Anthropic client in place instead of via a deep proxy (#22305)
fix(replay): Set text/javascript MIME type on compression worker Blob (#22377)
fix(sveltekit): Adapt frame rewriting for kit 3 (#22407)
fix(v10): Pin @apm-js-collab/code-transformer-bundler-plugins to 0.7.1 (#22497)
fix(v10/cloudflare): Import prismaIntegration from server-utils (#22535)
fix(v10/core): Avoid functionToStringIntegration causing infinite recursions (#22527)
fix(v10/core): Avoid propagating baggage: "undefined" when DSC is missing (#22440)

Internal Changes

chore: Add external contributor to CHANGELOG.md (#22342)
chore: Add external contributor to CHANGELOG.md (#22405)
chore(deps): Bump axios from 1.16.0 to 1.18.0 in /dev-packages/e2e-tests/test-applications/nestjs-basic (#22395)
chore(deps): Bump morgan from 1.10.0 to 1.11.0 (#22187)
chore(size-limit): weekly auto-bump (#22182)
ci(v10): Add v10 to build and license-compliance branch filters (#22499)
feat(deps): Bump axios from 1.16.0 to 1.18.0 (#22396)
ref(server-utils): Remove unneeded orchestrion config (#22384)
ref(server-utils): Small fastify cleanup (#22385)
test: Remove unnecessary test waits (#22383)
test(sveltekit-3): Fix import defineEnvVars from @sveltejs/kit/env (#22390)
test(v10/cloudflare): Add Vite-build support to the integration-test runner (#22539)

Work in this release was contributed by @psh4607 and @trinitiwowka. Thank you for your contributions!

Bundle size 📦

Path	Size
@sentry/browser	27.11 KB
@sentry/browser - with treeshaking flags	25.59 KB
@sentry/browser (incl. Tracing)	45.51 KB
@sentry/browser (incl. Tracing + Span Streaming)	47.25 KB
@sentry/browser (incl. Tracing, Profiling)	50.15 KB
@sentry/browser (incl. Tracing, Replay)	83.84 KB
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.71 KB
@sentry/browser (incl. Tracing, Replay with Canvas)	88.44 KB
@sentry/browser (incl. Tracing, Replay, Feedback)	100.79 KB
@sentry/browser (incl. Feedback)	43.88 KB
@sentry/browser (incl. sendFeedback)	31.79 KB
@sentry/browser (incl. FeedbackAsync)	36.8 KB
@sentry/browser (incl. Metrics)	28.17 KB
@sentry/browser (incl. Logs)	28.39 KB
@sentry/browser (incl. Metrics & Logs)	29.07 KB
@sentry/react	28.87 KB
@sentry/react (incl. Tracing)	47.72 KB
@sentry/vue	32.41 KB
@sentry/vue (incl. Tracing)	47.43 KB
@sentry/svelte	27.13 KB
CDN Bundle	29.45 KB
CDN Bundle (incl. Tracing)	47.42 KB
CDN Bundle (incl. Logs, Metrics)	30.99 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	48.69 KB
CDN Bundle (incl. Replay, Logs, Metrics)	69.34 KB
CDN Bundle (incl. Tracing, Replay)	84.04 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	85.32 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	89.71 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	90.94 KB
CDN Bundle - uncompressed	87.8 KB
CDN Bundle (incl. Tracing) - uncompressed	143.35 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	92.4 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	147.23 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	214.24 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	259.79 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	263.66 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	273.17 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	277.03 KB
@sentry/nextjs (client)	50.2 KB
@sentry/sveltekit (client)	45.92 KB
@sentry/core/server	78.45 KB
@sentry/core/browser	65.16 KB
@sentry/node-core	61.77 KB
@sentry/node	122.9 KB
@sentry/node (incl. diagnostics channel injection)	147.76 KB
@sentry/node/import (ESM hook with diagnostics-channel injection)	68.39 KB
@sentry/node/light	50.21 KB
@sentry/node - without tracing	73.19 KB
@sentry/aws-serverless	82.24 KB
@sentry/cloudflare (withSentry) - minified	193.11 KB
@sentry/cloudflare (withSentry)	475.28 KB

Force OTP to LTR. closes: #4609 (822ed4c)

capricorn86/happy-dom (happy-dom)

`v20.11.1`

Compare Source

👷‍♂️ Patch fixes

Improve performance of query selectors by avoiding construction of DOMException when not needed - By @@cyfung1031 in task #2228

pnpm/pnpm (pnpm)

`v11.17.0`: pnpm 11.17

Compare Source

Minor Changes

Added a new setting, update.githubActionsServer, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the GITHUB_SERVER_URL environment variable, falling back to https://github.com. The URL must use the https:// or http:// protocol #13220.

pnpm outdated and pnpm update no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.

Setting update.githubActions to false now makes pnpm outdated and the interactive pnpm update skip GitHub Actions dependencies.

Patch Changes

The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll pnpm/pnpm#12721.
Fixed catalog: references in dependencies and overrides failing to resolve when installing through a pnpr server, which errored with "No catalog entry '' was found for catalog 'default'." even though the catalog entry existed. Also fixed a crash on Windows when installing a nested workspace member (e.g. packages/foo) through a pnpr server #13232.
Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug #13164.
Revert script ordering change for pnpm run --sequential /regex/
Support the from-git argument in the pnpm version command.
When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication pnpm/pnpm#12721.

Platinum Sponsors

Gold Sponsors

`v11.16.0`: pnpm 11.16

Compare Source

Minor Changes

The first release of a package now publishes the version written in its manifest verbatim, instead of bumping off it. pnpm version -r and pnpm change status check the registry for each release's current version; when that version is not yet published, the package debuts at it and its pending changesets apply only from the next release. A newly added package seeded at 1100.0.0 with a minor changeset is therefore published as 1100.0.0 rather than skipping straight to 1100.1.0.
Added a --changeset flag to pnpm update. Set update.changeset to true in pnpm-workspace.yaml to enable this behavior by default, and use --no-changeset to override the setting for one update. After the update completes, pnpm writes a .changeset/pnpm-update-<suffix>.md file declaring a patch bump for every workspace package whose dependencies or optionalDependencies were changed by the update and a major bump when peerDependencies changed, including packages that consume an updated catalog entry via the catalog: protocol. Private packages, packages without a name, and packages listed in the ignore array of .changeset/config.json are skipped. If .changeset/config.json does not exist, a warning is printed and no changeset is generated.
Added GitHub Actions dependencies to pnpm outdated and interactive pnpm update. Non-interactive updates can include them with --include-github-actions or by setting update.githubActions to true in pnpm-workspace.yaml. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.
Added update and audit settings sections to pnpm-workspace.yaml, superseding the awkwardly named updateConfig, auditConfig, and top-level auditLevel settings:
```
update:
  ignoreDeps: # was updateConfig.ignoreDependencies
    - webpack
    - "@&#8203;babel/*"

audit:
  level: high # was auditLevel
  ignore: # was auditConfig.ignoreGhsas
    - GHSA-xxxx-yyyy-zzzz
```
update.ignoreDeps lists dependency name patterns that pnpm update and pnpm outdated should skip. audit.level and audit.ignore tune pnpm audit.

The deprecated updateConfig, auditConfig, and auditLevel settings keep working until the next major version. When both a new section value and its deprecated counterpart are set, the new section takes precedence and a warning is printed. Both the TypeScript CLI and the Rust config surface (pacquet) recognize the new sections.

Patch Changes

Fixed pnpm add --save-exact/--save-prefix and pnpm update writing a package's version with the peerDependencies range's prefix (e.g. ^19.2.7 instead of the requested 19.2.7) whenever the same package also appeared in peerDependencies. A real dependencies/devDependencies/optionalDependencies entry now takes precedence over a same-named peerDependencies entry when computing the current specifiers #13108.

Platinum Sponsors

Gold Sponsors



config help if that's undesired. If you want to rebase/retry this PR, check this box This PR has been generated by Mend Renovate.

fix(deps): update all non-major dependencies

3ee135d

khepri-bot Bot added the renovate label Aug 10, 2026

khepri-bot Bot requested a review from a team August 10, 2026 05:01

Navigation Menu

Uh oh!

fix(deps): update all non-major dependencies - #124

fix(deps): update all non-major dependencies#124
khepri-bot[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major-dependencies

khepri-bot Bot commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

khepri-bot Bot commented Aug 10, 2026

Release Notes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

🧱 New component testing model

🛑 Cancel operations with AbortSignal

🖼️ WebP screenshots

🧩 Custom test filtering with Reporter.preprocess()

🔁 Isolated retries

New APIs

Browser and Context

Actions

Network

Evaluation

Command line & MCP

Reporters

Announcements

Browser Versions

Bundle size 📦

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

👷‍♂️ Patch fixes

v11.17.0: pnpm 11.17

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v11.16.0: pnpm 11.16

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v11.17.0`: pnpm 11.17

`v11.16.0`: pnpm 11.16