Skip to content

build(deps-dev): bump the cloudflare-toolchain group across 1 directory with 3 updates - #40

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/cloudflare-toolchain-b2bd5315f9
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/cloudflare-toolchain-b2bd5315f9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown

Bumps the cloudflare-toolchain group with 3 updates in the / directory: vinext, vite and wrangler.

Updates vinext from 1.0.0-beta.6 to 1.2.1

Release notes

Sourced from vinext's releases.

vinext@1.2.1

Bug Fixes

App Router

  • match prefetch and visited cache entries for // pathnames on the app origin (#3999)
  • keep router.prefetch destinations for // pathnames on the app origin (#3987)
  • keep RSC request URLs for // pathnames on the app origin (#3981)
  • don't report a platform-cancelled render as a server error (#3994)

Misc

  • Dev: stop Pages Worker deps re-optimizing during Cloudflare startup (#4019)
  • Build: resolve output-root externals from nested chunks (#4021)
  • Init: set up Tailwind PostCSS when Next uses the Turbopack loader (#4016)
  • Dev: stop defaulting the vite dev port to 3000 (#4009)
  • Cloudflare: serve Vite module URLs before runWorkerFirst in dev (#4010)
  • Deps: require React 19.3.1 (#3995)
  • Headers: share RequestCookies method symbols across shim module instances (#4001)
  • Nitro: stop generating Nitro SWR route rules from revalidate exports (#3979)
  • Head: drop on* attributes in any case from next/head tags (#3984)
  • Middleware: match matcher paths case-sensitively like Next.js (#3978)
  • Build: compile "use cache" imports in browser Web Workers as references (#3980)
  • Server: 404 absolute-form request targets on Node entries (#3986)
  • Navigation: never treat a same-origin // pathname as a protocol-relative local path (#3992)
  • Image: keep encoded dot segments in _next/static sources literal on Workers (#3982)
  • Image: reject image sources whose dot segments resolve to a protocol-relative path (#3983)
  • Server: only trust NextRequest.ip/geo from Cloudflare metadata or a trusted proxy (#3989)
  • i18n: keep relative hrefs on the configured locale domain (#3990)

Performance

  • replace deprecated parseAst and read imports from oxc's module record (#3997)

Contributors

vinext@1.2.0

Read the Vinext 1.2 release post for the highlights.

Features

  • Init: add --name to set the Cloudflare Worker name (#3863)

Bug Fixes

Actions

  • answer a plain 500 when a form action without JavaScript throws (#3903)

... (truncated)

Commits
  • 6554076 chore: version packages (#3996)
  • 0064141 fix(dev): stop Pages Worker deps re-optimizing during Cloudflare startup (#4019)
  • 865faa4 test(e2e): destroy open connections when closing the init CSS Modules prod se...
  • 564ddc9 fix(build): resolve output-root externals from nested chunks (#4021)
  • 71c3641 test: run more Vite edge-case suites in Vite ecosystem CI (#4018)
  • a23673e fix(init): set up Tailwind PostCSS when Next uses the Turbopack loader (#4016)
  • 620992e test(response-store): retry live E2E requests the edge fails before the Worke...
  • 7f79ed1 fix(dev): stop defaulting the vite dev port to 3000 (#4009)
  • 49794ab test(e2e): run Pages Fast Refresh specs after the rest of pages-router (#4014)
  • 009c7ee fix(cloudflare): serve Vite module URLs before runWorkerFirst in dev (#4010)
  • Additional commits viewable in compare view

Updates vite from 8.1.5 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

  • deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
  • html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
  • server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
  • server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

  • build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
  • bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
  • bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
  • deps: update all non-major dependencies (#23601) (9944fa6)
  • deps: update rolldown-related dependencies (#23602) (88c1741)
  • html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
  • limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

  • avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
  • build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
  • build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
  • bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
  • client: skip rewriting unchanged adopted styles (#23697) (fa71469)
  • css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
  • deps: update all non-major dependencies (#23648) (8a4c19c)
  • deps: update rolldown-related dependencies (#23649) (794516d)
  • dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
  • don't treat modules ending with js-like query as js (#23687) (fcb6f12)
  • html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
  • html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
  • optimizer: scan deep imports with custom extensions (#23678) (8579189)
  • remove input option unescaping for now (#23694) (facc2fb)
  • server: match static aliases on path boundaries (#23643) (b28db28)
  • watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

  • module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

  • bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

  • deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
  • html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
  • server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
  • server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

  • build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
  • bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
  • bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
  • deps: update all non-major dependencies (#23601) (9944fa6)
  • deps: update rolldown-related dependencies (#23602) (88c1741)
  • html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
  • limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Commits
  • b6c20f6 release: v8.3.4 (#23702)
  • b28db28 fix(server): match static aliases on path boundaries (#23643)
  • bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
  • fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
  • 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
  • 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
  • facc2fb fix: remove input option unescaping for now (#23694)
  • 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
  • cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
  • fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
  • Additional commits viewable in compare view

Updates wrangler from 4.151.0 to 4.151.1

Release notes

Sourced from wrangler's releases.

wrangler@4.151.1

Patch Changes

  • #15541 e13d5cc Thanks @​mack-erel! - Keep remote dev sessions alive through transient network failures

    wrangler dev --remote and getPlatformProxy() refresh their preview token before it expires, but a single failed refresh — for example while the network was briefly down — stopped refreshing for good, leaving the session broken until restart. A failed refresh now retries every minute until it succeeds. Rebuilds also no longer push the refresh past the session's expiry.

  • #16284 42c6912 Thanks @​karloper! - Fix wrangler rollback reporting success after the changed secrets confirmation is declined

    Previously, declining the "The following secrets have changed…" confirmation printed "Aborting rollback..." and then also printed a success message and the target version as the "Current Version ID", even though no deployment was made and the original version was still live. Wrangler now stops after aborting, so the output matches what is actually deployed.

  • #13742 4a5377f Thanks @​edmundhung! - Hide the wrangler dev hotkey bar when Turborepo does not forward input

  • Updated dependencies [e1d1b77]:

Commits
  • e7f9e4e Version Packages (#16287)
  • 4a5377f [wrangler] Hide unusable dev hotkeys under Turborepo (#13742)
  • 42c6912 [wrangler] Don't report rollback success after declining changed secrets conf...
  • e13d5cc [remote-bindings] Retry proactive preview token refresh after a transient fai...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ry with 3 updates

Bumps the cloudflare-toolchain group with 3 updates in the / directory: [vinext](https://github.com/cloudflare/vinext), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler).


Updates `vinext` from 1.0.0-beta.6 to 1.2.1
- [Release notes](https://github.com/cloudflare/vinext/releases)
- [Commits](https://github.com/cloudflare/vinext/compare/vinext@1.0.0-beta.6...vinext@1.2.1)

Updates `vite` from 8.1.5 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

Updates `wrangler` from 4.151.0 to 4.151.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.151.1/packages/wrangler)

---
updated-dependencies:
- dependency-name: vinext
  dependency-version: 1.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: cloudflare-toolchain
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: cloudflare-toolchain
- dependency-name: wrangler
  dependency-version: 4.151.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: cloudflare-toolchain
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants