Skip to content

fix(deps): update all non-major dependencies#573

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

fix(deps): update all non-major dependencies#573
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 9, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@astrojs/cloudflare (source) 13.3.013.5.0 age confidence
@tailwindcss/vite (source) 4.2.44.3.0 age confidence
astro (source) ^6.2.1^6.3.1 age confidence
react (source) ^19.2.5^19.2.6 age confidence
react-dom (source) ^19.2.5^19.2.6 age confidence
tailwindcss (source) 4.2.44.3.0 age confidence
undici (source) 8.1.08.2.0 age confidence
wrangler (source) 4.87.04.90.0 age confidence

Release Notes

withastro/astro (@​astrojs/cloudflare)

v13.5.0

Compare Source

Minor Changes

v13.4.0

Compare Source

Minor Changes
  • #​16519 1b1c218 Thanks @​louisescher! - Adds support for redirecting URLs in remote image optimization.

    Previously, when a remote image URL meant to be optimized by Astro led to a redirect, Astro would fail silently and ignore the redirect. Now, Astro tracks up to 10 redirects for these images. If any of the redirects are not covered by a pattern in image.remotePatterns or a domain in image.domains, Astro will fail with a helpful error message.

    In the following example, the first image would be loaded successfully, while the second would lead to Astro throwing an error:

    export default defineConfig({
      image: {
        domains: ['example.com', 'cdn.example.com'],
      },
    });
    {
      /* Redirects to https://cdn.example.com/assets/image.png: */
    }
    <Image
      src="https://example.com/assets/image.png"
      width="1920"
      height="1080"
      alt="An example image."
    />;
    
    {
      /* Redirects to https://malicious.com/image.png: */
    }
    <Image
      src="https://example.com/bad-image.png"
      width="1920"
      height="1080"
      alt="An example image."
    />;

    In cases where all redirects to HTTPS hosts should be trusted, the following configuration for image.remotePatterns can be used:

    export default defineConfig({
      image: {
        remotePatterns: [
          {
            protocol: 'https',
          },
        ],
      },
    });
Patch Changes

v13.3.1

Compare Source

Patch Changes
tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.0

Compare Source

Added
  • Add @container-size utility (#​18901)
  • Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#​19981, #​20019)
  • Add scrollbar-gutter-* utilities (#​20018)
  • Add zoom-* utilities (#​20020)
  • Add tab-* utilities (#​20022)
  • Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#​19996)
  • Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#​19996)
  • Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#​19989)
Fixed
  • Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#​19949)
  • Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#​19965)
  • Ensure CSS files containing @variant are processed by @tailwindcss/vite (#​19966)
  • Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#​19980)
  • Canonicalization: preserve significant _ whitespace in arbitrary values (#​19986)
  • Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))]w-[calc(100%-(--spacing(60)))]) (#​19986)
  • Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in]mt-[-20in], not mt-[-1920px]) (#​19988)
  • Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#​19991)
  • Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1"style="flex-grow: 1", not style="grow: 1") (#​19918)
  • Allow multiple @utility definitions with the same name but different value types (#​19777)
  • Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#​19707)
  • Ensure start and end legacy utilities without values do not generate CSS (#​20003)
  • Ensure --value(…) is required in functional @utility definitions (#​20005)
  • Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#​20011)
withastro/astro (astro)

v6.3.1

Compare Source

Patch Changes

v6.3.0

Compare Source

Minor Changes
  • #​16366 d69f858 Thanks @​matthewp! - Adds a new experimental.advancedRouting option that lets you take full control of Astro's request handling pipeline by creating a src/app.ts file in your project.

    Today, Astro handles every incoming request through a fixed internal pipeline: trailing slash normalization, redirects, actions, middleware, page rendering, i18n, and so on. That pipeline works great for most sites, but as projects grow you often want to run your own logic between those steps — an auth check before rendering, a rate limiter before actions, custom logging around the whole stack. Advanced routing gives you that control.

    When enabled, Astro looks for a src/app.ts file in your project. If it finds one, that file becomes the entrypoint for all server-rendered requests. You compose the pipeline yourself using the handlers Astro provides, and you can slot your own logic anywhere in the chain.

Enabling advanced routing
// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  experimental: {
    advancedRouting: true,
  },
});
Two ways to build your pipeline

Astro ships two entrypoints for advanced routing: astro/fetch and astro/hono.

astro/fetch is a low-level, framework-free API built on the Web Fetch standard. You create a FetchState from the incoming request, then call handler functions in sequence. Each handler takes the state, does its work, and returns a Response (or undefined to pass through). This is the core primitive that everything else is built on:

// src/app.ts
import {
  FetchState,
  trailingSlash,
  redirects,
  actions,
  middleware,
  pages,
  i18n,
} from 'astro/fetch';

export default {
  async fetch(request: Request) {
    const state = new FetchState(request);

    // Early exits — these return a Response only when they apply.
    const slash = trailingSlash(state);
    if (slash) return slash;

    const redirect = redirects(state);
    if (redirect) return redirect;

    const action = await actions(state);
    if (action) return action;

    // Middleware wraps page rendering; i18n post-processes the response.
    const response = await middleware(state, () => pages(state));
    return i18n(state, response);
  },
};

astro/hono wraps the same handlers as Hono middleware, so you can mix Astro's pipeline with Hono's ecosystem of middleware (logger, CORS, JWT, rate limiting, etc.) using the app.use() pattern you already know:

// src/app.ts
import { Hono } from 'hono';
import { getCookie } from 'hono/cookie';
import { logger } from 'hono/logger';
import { actions, middleware, pages, i18n } from 'astro/hono';

const app = new Hono();

app.use(logger());

// Auth gate — only runs for /dashboard routes.
app.use('/dashboard/*', async (c, next) => {
  const session = getCookie(c, 'session');
  if (!session) return c.redirect('/login');
  return next();
});

app.use(actions());
app.use(middleware());
app.use(pages());
app.use(i18n());

export default app;

Both approaches give you the same power — pick whichever fits your project. If you don't need a framework, astro/fetch keeps things minimal. If you want a rich middleware ecosystem, astro/hono gets you there with one import.

For more information on enabling and using this feature in your project, see the experimental advanced routing docs. To give feedback, or to keep up with its development, see the advanced routing RFC for more information and discussion.

  • #​16366 d69f858 Thanks @​matthewp! - Adds a consume() instance method to AstroCookies. This method marks the cookies as consumed and returns the Set-Cookie header values. After consumption, any subsequent set() calls will log a warning, since the headers have already been sent.

    Previously this was only available as a static method AstroCookies.consume(cookies). The static method is now deprecated but kept for backward compatibility with existing adapters.

  • #​16412 ba2d2e3 Thanks @​0xbejaxer! - Add retry and error event handling for astro-island hydration import failures to reduce unrecoverable hydration errors on transient network failures.

  • #​16582 885cd31 Thanks @​Princesseuh! - Adds a new image.dangerouslyProcessSVG flag to optionally enable processing SVG inputs. For security reasons, Astro will no longer rasterizes SVG image sources by default in its default image service and endpoint.

    Set image.dangerouslyProcessSVG: true to opt back into processing SVG inputs.

    // astro.config.mjs
    import { defineConfig } from 'astro/config';
    
    export default defineConfig({
      // ...
      image: {
        dangerouslyProcessSVG: true,
      },
    });

    Note that this is a breaking change for users who were previously relying on Astro's default image service to rasterize SVG inputs, but it is a necessary change to improve security and prevent potential vulnerabilities.

  • #​16519 1b1c218 Thanks @​louisescher! - Adds support for redirecting URLs in remote image optimization.

    Previously, when a remote image URL meant to be optimized by Astro led to a redirect, Astro would fail silently and ignore the redirect. Now, Astro tracks up to 10 redirects for these images. If any of the redirects are not covered by a pattern in image.remotePatterns or a domain in image.domains, Astro will fail with a helpful error message.

    In the following example, the first image would be loaded successfully, while the second would lead to Astro throwing an error:

    export default defineConfig({
      image: {
        domains: ['example.com', 'cdn.example.com'],
      },
    });
    {
      /* Redirects to https://cdn.example.com/assets/image.png: */
    }
    <Image
      src="https://example.com/assets/image.png"
      width="1920"
      height="1080"
      alt="An example image."
    />;
    
    {
      /* Redirects to https://malicious.com/image.png: */
    }
    <Image
      src="https://example.com/bad-image.png"
      width="1920"
      height="1080"
      alt="An example image."
    />;

    In cases where all redirects to HTTPS hosts should be trusted, the following configuration for image.remotePatterns can be used:

    export default defineConfig({
      image: {
        remotePatterns: [
          {
            protocol: 'https',
          },
        ],
      },
    });
Patch Changes
  • #​16592 9c6efc5 Thanks @​matthewp! - Escapes interpolated values in the dev server redirect HTML template, consistent with how the 404 template already handles them

  • #​16585 78f305e Thanks @​web-dev0521! - Fixes z.array(z.boolean()) in form actions incorrectly coercing the string "false" to true. Boolean array elements now use the same 'true'/'false' string comparison as single z.boolean() fields, so submitting ["false", "true", "false"] correctly parses as [false, true, false].

  • #​16567 12a03f2 Thanks @​matthewp! - Fixes deleted content collection entries persisting in getCollection() results during dev

  • #​16595 ce9b25c Thanks @​web-dev0521! - Fixes pushDirective in the CSP runtime duplicating the new directive once per existing non-matching directive. Calling insertDirective() (or otherwise pushing a directive whose name is not yet in the list) now appends it exactly once, and a directive that merges with a later existing entry no longer leaves an unmerged copy behind.

  • #​16600 94e4b7c Thanks @​web-dev0521! - Fixes Astro.preferredLocale returning the wrong value when i18n.locales mixes object-form entries ({ path, codes }) with string entries that normalize to the same locale. The first matching code in the configured locales order is now selected, matching the documented behavior.

  • #​16591 cce20f7 Thanks @​matthewp! - Uses a consistent generic error message in the image endpoint across all adapters

  • #​16629 f54be80 Thanks @​g-taki! - Fixes a bug where SSR responses in astro dev could crash with TypeError: this.logger.flush is not a function.

  • #​16589 3740b24 Thanks @​ArmandPhilippot! - Fixes an outdated code snippet in the documentation for session storage configuration.

  • Updated dependencies [354e231]:

v6.2.2

Compare Source

Patch Changes
  • #​16292 00f48ee Thanks @​p-linnane! - Fixes head metadata propagation in dev for adapters that load modules in the prerender Vite environment, such as @astrojs/cloudflare. The astro:head-metadata plugin previously only tracked the ssr environment, so maybeRenderHead() could fire inside an unrelated component's <template> element, trapping subsequent hoisted <style> blocks.

  • #​16451 778865f Thanks @​maximslo! - Fixes build crash when processing animated AVIF images. Sharp now gracefully passes through unsupported image formats instead of crashing during the build.

  • #​16548 7214d3e Thanks @​senutpal! - Fixes scoped styles applying to the wrong element when vite.css.transformer is set to 'lightningcss' and a selector uses a nested & inside :where(...), such as Tailwind v4's space-x-*, space-y-*, and divide-* utilities.

  • #​16566 9ac96b4 Thanks @​web-dev0521! - Fixes data-astro-prefetch="tap" not triggering when clicking nested elements (e.g. <span>, <img>, <svg>) inside an anchor tag.

  • #​15994 1e70d18 Thanks @​ossaidqadri! - Fix <style> compilation failure when importing Astro components via tsconfig path aliases

  • #​16144 1cd6650 Thanks @​fkatsuhiro! - Fixed a regression where .html was unexpectedly stripped from dynamic route parameters on non-page routes (.ts endpoints and redirects). This caused endpoints like /some/[...id].ts returning id: 'file.html' on getStaticPaths to not serve that file because the generated route (/some/file.html) would get matched as id: file that is not part of the list returned by getStaticPaths.

  • #​16415 559c0fd Thanks @​0xbejaxer! - Fix CSS traversal boundaries so pages with export const partial = true still contribute styles when imported as components by other pages.

  • #​16516 17f1867 Thanks @​fkatsuhiro! - Fixes an issue where the index route would return a 404 error when using a custom base path combined with trailingSlash: 'never'. This ensures that the home page and internal rewrites are correctly matched under these configurations.

  • #​16515 280ec88 Thanks @​jp-knj! - Fixes an issue where i18n.fallback pages with fallbackType: 'rewrite' were emitted with empty bodies during astro build.

  • #​16565 7959798 Thanks @​enjoyandlove! - Fixes session persistence when session.delete() is the first mutation in a request (no prior get, set, has, or keys). The session was marked dirty in memory, but persistence skipped the save because #data stayed undefined, so the backing store could still return the deleted key on the next request.

  • #​16527 86fd80d Thanks @​enjoyandlove! - Prevents script deduplication state from being consumed while rendering inert <template> contexts.

  • #​16540 e59c637 Thanks @​ascorbic! - Skips session storage reads when no session cookie is present. Previously, calling session.get() on a request without a session cookie would initialize the storage driver and make a read that was guaranteed to miss. On network-backed drivers this added latency and resource usage to every anonymous request.

  • #​16517 6ab0b3c Thanks @​adamchal! - Removes inline CSS for prerendered routes from the SSR manifest. The static HTML on disk already inlines those styles, and the SSR worker never renders prerendered routes, so the data was dead weight. Builds with many prerendered routes and build.inlineStylesheets: "always" (or "auto" with small stylesheets) will see a smaller SSR entry chunk, which reduces cold-start parse time on platforms like Cloudflare Workers.

  • #​16509 d3d3557 Thanks @​cyphercodes! - Fix conditional named slot callbacks receiving arguments from Astro.slots.render().

  • #​16236 c6b068e Thanks @​fkatsuhiro! - Fixes the position prop on <Image /> and <Picture /> components to correctly apply object-position styles

  • #​16018 d14f47c Thanks @​felmonon! - Fix defineLiveCollection() so LiveLoader data types declared as interfaces are accepted.

facebook/react (react)

v19.2.6: 19.2.6 (May 6th, 2026)

Compare Source

React Server Components

nodejs/undici (undici)

v8.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.1.0...v8.2.0

cloudflare/workers-sdk (wrangler)

v4.90.0

Compare Source

Minor Changes
  • #​12279 248bc08 Thanks @​penalosa! - Add deprecation warning for delivery_delay in queue producer bindings

    The delivery_delay setting in [[queues.producers]] was silently having no effect since 2024. This change adds a deprecation warning when the setting is used, informing users that queue-level settings should be configured using wrangler queues update instead. The setting will be removed in a future version.

Patch Changes
  • #​13853 8852b0c Thanks @​gpanders! - Fix Containers SSH config

  • #​13858 e414e56 Thanks @​penalosa! - Fix wrangler whoami and account selection failing for Account API Tokens

    The /memberships fallback for Account API Tokens was checking for code 9109, but /memberships actually returns 9106 for that case. Correct the code so the fallback to /accounts triggers as intended.

  • Updated dependencies []:

    • miniflare@​4.20260507.1

v4.89.1

Compare Source

Patch Changes
  • #​13824 dd3baf3 Thanks @​emily-shen! - Fix container deployment being skipped for Workers for Platforms user workers

    Previously, deploying a worker with --dispatch-namespace would early-exit before calling deployContainers(), meaning container-app registration that links the image to the Durable Object namespace was never executed for WfP user workers. Container deployment now runs before the WfP early exit.

  • Updated dependencies [5cf6f81]:

    • miniflare@​4.20260507.1

v4.89.0

Compare Source

Minor Changes
  • #​13055 f3fed88 Thanks @​GregBrimble! - Introducing the cache configuration option for Workers.

    You can now set { cache: { enabled: true } } in your Wrangler configuration file to enable a HTTP cache in front of your Worker's fetch handler. This is also supported in [previews] configuration — previews.cache overrides the top-level cache setting for preview deployments, and falls back to the top-level value when absent. More information can be found in our documentation.

  • #​13776 1a54ac5 Thanks @​petebacondarwin! - wrangler dev and other Miniflare-backed commands now run the local workerd runtime with TZ=UTC to match production

    Previously, wrangler dev (and other commands that spin up Miniflare, such as wrangler kv, wrangler d1, wrangler r2, wrangler check) inherited the host machine's timezone, so Date and Intl APIs inside a Worker observed the developer's local timezone during local development but UTC in production. This caused subtle, hard-to-debug differences between local and deployed behaviour.

    Local development now matches production. Code that previously relied on the host timezone during wrangler dev will need to either accept UTC (the production behaviour) or explicitly construct dates/formatters with the desired timezone.

Patch Changes
  • #​13829 2284f20 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260504.1 1.20260506.1
  • #​13841 332f527 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260506.1 1.20260507.1
  • #​13777 18e833d Thanks @​matingathani! - fix: throw a clear error when _routes.json contains invalid JSON instead of silently skipping it

  • #​13751 b6cea17 Thanks @​matingathani! - fix: ensure wrangler types --check --env-file does not falsely report stale types when .dev.vars exists

  • #​13775 53e846a Thanks @​maxwellpeterson! - Fix wrangler preview not propagating the assets binding to preview deployments

    Previously, wrangler preview would upload the asset manifest correctly but the resulting preview deployment had no ASSETS binding (or whatever name was configured under assets.binding). Workers reading from the binding would see undefined and fail at runtime.

    The fix emits the assets binding into the deployment's env map alongside other bindings, mirroring wrangler deploy.

  • #​13770 beff19c Thanks @​petebacondarwin! - Only show accounts available for the current login auth in wrangler whoami and the interactive account picker

    Wrangler now lists the intersection of /accounts and /memberships instead of either endpoint alone, dropping accounts the active OAuth token or API token has no membership in. The accounts field of wrangler whoami --json is filtered the same way. When /memberships is inaccessible to the current auth (e.g. Account API Tokens) Wrangler falls back to /accounts so those tokens continue to work as before.

  • #​13832 af42fed Thanks @​gpanders! - Show containers ssh in wrangler containers --help and in wrangler containers ssh --help

    The containers ssh command was previously hidden, so it did not appear in the list of subcommands shown by wrangler containers --help, and its description was omitted from wrangler containers ssh --help. The command is now listed with its description in both places.

  • Updated dependencies [2284f20, 332f527, 039bada, 1a54ac5]:

    • miniflare@​4.20260507.0

v4.88.0

Compare Source

Minor Changes
  • #​13760 e07825a Thanks @​danielgek! - Add builtin storage option to wrangler ai-search create.

    wrangler ai-search create now supports a third storage type, builtin, in addition to r2 and web-crawler. When --type builtin is selected (or chosen interactively), Wrangler creates the instance using Cloudflare-managed storage by omitting type and source from the API request — the API treats an absent type as builtin storage. Builtin instances do not accept --source, --prefix, --include-items, or --exclude-items.

  • #​13721 58899d8 Thanks @​danielgek! - Add optional custom_metadata step to wrangler ai-search create

    The wrangler ai-search create interactive wizard now lets you declare custom metadata fields that the new AI Search instance should index. Each field is a field_name paired with a data_type (text, number, boolean, or datetime).

    You can provide fields up-front via the new repeatable --custom-metadata flag using field_name:data_type syntax:

    wrangler ai-search create my-instance \
      --type r2 --source my-bucket \
      --custom-metadata title:text \
      --custom-metadata views:number

    For larger schemas, use --custom-metadata-schema to point at a JSON file containing an array of { field_name, data_type } objects:

    wrangler ai-search create my-instance \
      --type r2 --source my-bucket \
      --custom-metadata-schema schema.json
    [
      { "field_name": "title", "data_type": "text" },
      { "field_name": "views", "data_type": "number" }
    ]
  • #​13701 18b9d5b Thanks @​dario-piotrowicz! - Prompt for missing name and compatibility date interactively during wrangler deploy

    When deploying without a project name or compatibility_date in your configuration or CLI arguments, wrangler deploy now interactively prompts for the missing values instead of immediately failing with an error. For compatibility date, the prompt offers to use today's date; if you decline, the existing error is shown. The compatibility date prompt is skipped when --latest is passed. In non-interactive or CI environments, behavior is unchanged.

    Additionally, when no config file exists, wrangler deploy now offers to save the prompted name and compatibility date to a wrangler.jsonc file for future use. This interactive flow is available for all wrangler deploy invocations — not just asset-only deployments.

  • [#​13810](https://redirect.github.com/cloudflare/workers-sdk/p

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label May 9, 2026
@renovate renovate Bot enabled auto-merge (squash) May 9, 2026 01:00
@renovate renovate Bot added the dependencies label May 9, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented May 9, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs
seren-dev 4b582cc May 11 2026, 09:10 PM

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 71e2b4a to 073b90e Compare May 9, 2026 01:43
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 44ac806 to dc8b74a Compare May 10, 2026 21:26
@SerenModz21
Copy link
Copy Markdown
Owner

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from dc8b74a to 4b582cc Compare May 11, 2026 21:08
@sonarqubecloud
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant