chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #4449 · nitrojs/nitro

renovate · 2026-07-19T01:33:12Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@azure/functions	`^3.5.2` → `^3.6.0`
@cloudflare/workers-types	`^5` → `^5.20260716.1`
@cloudflare/workers-utils (source)	`^0.26` → `^0.27.0`
@scalar/api-reference (source)	`^1` → `^1.62.7`
@scalar/openapi-types (source)	`^0.9.1` → `^0.9.2`
@types/node (source)	`^26.1.0` → `^26.1.1`
@vitest/coverage-v8 (source)	`^4.1.9` → `^4.1.10`
crossws (source)	`^0.4.9` → `^0.4.10`
miniflare (source)	`^4` → `^4.20260710.0`
oxfmt (source)	`^0.58.0` → `^0.59.0`
oxlint (source)	`^1.73.0` → `^1.74.0`
pnpm (source)	`11.9.0` → `11.13.1`
pretty-bytes	`^7.1.0` → `^7.1.1`
rolldown (source)	`^1.1.5` → `^1.2.0`
rollup (source)	`^4.62.0` → `^4.62.2`
shaders	`^2.5.130` → `^2.5.135`
undocs	`0.4.17-20260413-104322-a4a49c4` → `0.4.17-20260708-180838-02fc272`
vite7 (source)	`^7.3.5` → `^7.3.6`
vitest (source)	`^4.1.9` → `^4.1.10`
wrangler (source)	`^4` → `^4.111.0`

Release Notes

cloudflare/workerd (@cloudflare/workers-types)

cloudflare/workers-sdk (@cloudflare/workers-utils)

`v0.27.0`

Compare Source

Minor Changes

#14630 42df9bb Thanks @penalosa! - Extract the Cloudflare CLI auth layer into a product-agnostic @cloudflare/workers-auth core

The OAuth login/logout/refresh, credential storage, config cache, and account-selection machinery is now shared behind an AuthProduct descriptor, with a thin per-CLI entrypoint on top. @cloudflare/workers-auth/wrangler (createWranglerAuth) preserves wrangler's existing behaviour, and a new @cloudflare/workers-auth/cf (createCfAuth) adds the cf CLI: its own OAuth app registration (client id, callback port, branded consent pages, scoped-token-only auth), a dedicated scope catalog, JSON config files under ~/.config/cloudflare, and an isolated config-cache namespace so cf login/logout never purges wrangler's cache.

As part of the extraction, @cloudflare/workers-utils now exports the shared createConfigCache (with a namespace option), openInBrowser, and the isInteractive / isNonInteractiveOrCI / isCI TTY-and-CI detection helpers (each taking the caller's logger as a parameter rather than relying on a singleton). These read a bundled ci-info, so consumers that need to fake CI in their tests should mock this package's helpers rather than ci-info directly.

scalar/scalar (@scalar/api-reference)

`v1.62.7`

`v1.62.6`

Patch Changes

#9618: Render document-wide authentication for AsyncAPI documents. The introduction now shows the same Authentication selector used for OpenAPI, populated from components.securitySchemes, with requirements derived from the union of every server's security (AsyncAPI has no root-level security). When some servers require auth and others accept unauthenticated connections, a no-auth option is offered too. Schemes shared with OpenAPI (http, oauth2, openIdConnect, apiKey) get full input UI, and AsyncAPI OAuth2 availableScopes are mapped onto OpenAPI scopes so the scope list renders. Broker-specific types still appear in the selector but have no dedicated input yet. The selector is now fully interactive for AsyncAPI (selecting schemes, entering credentials, editing scopes) because the auth mutators accept AsyncAPI documents. Operation/channel-level auth is intentionally left for a follow-up.
#9618: Name the actual document type in the "security scheme is missing a type" warning. When a scheme has no recognizable type, the auth selector previously always told users to check their "OpenAPI document", even for AsyncAPI documents. The warning now reflects the document it belongs to (e.g. "AsyncAPI") via a new optional documentType prop on the auth selector block, defaulting to openapi. Schemes that carry a valid but unsupported type (such as AsyncAPI broker types like userPassword or scramSha256) now show a dedicated "not supported yet" message naming the type, instead of the misleading "missing a type" warning.
#9679: Fix the plugin auth accessor reading from the wrong store. It now reads from the client store — the same store the reference-side Authentication panel writes credentials into — so plugins see the secrets and selected security schemes the user actually entered instead of an empty state.

`v1.62.5`

Patch Changes

#9671: Add a canDeleteSchemes prop to the auth selector so the delete (trash) affordance can be hidden. It defaults to true (unchanged for the API client, where schemes are editable) and the API reference now passes false, since its schemes come from the rendered document and cannot be removed there.
#9646: Fix deep links to response properties. Response property anchors now carry a responses marker so the target operation is found and scrolled to on a fresh load, and response properties are linkable even when expandAllResponses is off (a deep link expands the collapsed response and scrolls the property into view).
#9631: Hide the protocol and server filters in the classic layout for AsyncAPI documents
#9639: Add a read-only accessor for the global authentication state to the plugin API. Plugin lifecycle hooks (onInit, onConfigChange) now receive an auth accessor alongside config, and the plugin manager exposes getAuthState() for view components. Plugins can read stored secrets and the selected security schemes via auth.export(), auth.getAuthSecrets(documentName, schemeName), and auth.getAuthSelectedSchemas(payload) without being able to mutate auth.
#9664: fix: keep base allOf properties when merging oneOf/anyOf branches

When a schema used allOf to factor out shared object properties next to a oneOf/anyOf, each branch's own properties/required overwrote the shared base fields instead of being combined with them. The base fields now stay visible alongside each branch's own fields.

scalar/scalar (@scalar/openapi-types)

`v0.9.2`

Patch Changes

#9710: Republish so the updated README (with the Scalar platform overview) reaches npm. Also renames the README generator metadata in package.json from readme to scalarReadme: npm treats a readme field as the readme text itself, so affected packages were published with a literal [object Object] readme on the registry instead of README.md.

h3js/crossws (crossws)

`v0.4.10`

Compare Source

compare changes

🚀 Enhancements

proxy: Add clientIdleTimeout to reclaim silent clients (#204)

🏡 Chore

Update deps (1d461de)

❤️ Contributors

Pooya Parsa (@pi0)
Pi0x x@pi0.io

cloudflare/workers-sdk (miniflare)

`v4.20260710.0`

Compare Source

Minor Changes

#14602 7692a61 Thanks @edmundhung! - Add unsafeEvictDurableObject() for targeted Durable Object eviction

This lets users verify how a Durable Object recovers after its instance is torn down.
#14602 7692a61 Thanks @edmundhung! - Allow listDurableObjectIds() to accept Durable Object class names as well as binding names.

Patch Changes

#14627 ed33326 Thanks @tpmmorris! - Add convenient logging for worker emails in the project directory. In addition to the system's temp directory, logs for emails sent by workers are also written to a local temp directory defined by the calling process, e.g for an simple text email sent via Wrangler this is .wrangler/tmp/email/<session>/email-text/<message-uuid>.txt (and related files) in the project root. Callers of Miniflare can control this location via the new defaultProjectTmpPath option, which Wrangler and Vite plugin now set automatically.
#14642 018574b Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20260708.1 ^5.20260710.1

workerd 1.20260708.1 1.20260710.1

`v4.20260708.1`

Compare Source

Minor Changes

#14535 1b965c5 Thanks @Naapperas! - Support dynamic retry delays for Workflow steps in local dev

A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.
```
await step.do(
  "call flaky API",
  {
    retries: {
      limit: 5,
      backoff: "constant",
      delay: ({ ctx }) => ctx.attempt * 1000,
    },
  },
  async () => {
    /* ... */
  }
);
```
The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

`v4.20260708.0`

Compare Source

Minor Changes

#14489 e3f0cd6 Thanks @edmundhung! - Add listDurableObjectIds() to Miniflare

Miniflare now exposes listDurableObjectIds() for listing persisted Durable Object instance IDs by binding name. The Vitest pool now uses this shared Miniflare API internally instead of duplicating Miniflare's storage listing logic.
#14465 2fedb1f Thanks @vaishnav-mk! - Add rollback support when terminating Workflow instances

WorkflowInstance.terminate({ rollback: true }) now runs registered rollback handlers before marking a local Workflow instance as terminated. Wrangler also supports this via wrangler workflows instances terminate --rollback, including local mode.

The rollback option is only sent for terminate operations and is rejected by the Local Explorer API for pause, resume, and restart actions.

Patch Changes

#14596 8511ddf Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

workerd 1.20260706.1 1.20260708.1

@cloudflare/workers-types ^5.20260706.1 ^5.20260708.1

oxc-project/oxc (oxfmt)

`v0.59.0`

Compare Source

🐛 Bug Fixes

415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

oxc-project/oxc (oxlint)

`v1.74.0`

Compare Source

🚀 Features

0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#24044) (Boshen)

🐛 Bug Fixes

8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#24341) (leaysgur)
2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#24339) (leaysgur)

⚡ Performance

7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#24413) (connorshea)
6272051 linter/typescript/no-require-imports: Compile allow patterns once (#24417) (connorshea)
33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#24420) (connorshea)

pnpm/pnpm (pnpm)

`v11.13.1`: pnpm 11.13.1

Compare Source

Patch Changes

Fixed pnpm pack applying workspace-root ignore rules when a workspace package has its own .npmignore file.
Keep the interactive minimumReleaseAge approval prompt visible during pnpm install. The progress reporter now pauses its redraws while a prompt is waiting for input instead of overwriting it, so the install no longer hangs on a question the user cannot see #13019.
Fixed pnpm self-update failing to link native platform binaries stored in sibling global virtual store slots.

`v11.13.0`: pnpm 11.13

Compare Source

Minor Changes

Added versioning.epics to pnpm-workspace.yaml. An epic ties a group of member packages to a lead package, constraining every member's major version to a band derived from the lead's major: while the lead is on major M, members live in M*100 … M*100+99. Members move independently inside the band (patch, minor, and a major intent that stays in-band); a bump that would carry a member past the band ceiling is rejected until the lead advances its own major. When a release plan takes the lead to a new stable major, every member re-bases to the band floor in the same plan. Membership is matched with pnpm's package selectors — name globs, ./-prefixed directory globs, and !-prefixed negations.
Added the team command for managing organization teams and team memberships on the registry, with create, destroy, add, rm, and ls subcommands and support for --otp, --parseable, and --json flags.
Added native workspace release management #12952: the new pnpm change command records change intents as changesets-compatible .changeset/*.md files (pnpm change status shows the pending release plan), and the bare pnpm version -r consumes them — bumping versions across the workspace with dependent propagation through workspace: ranges, fixed groups, a maxBump cap, --filter narrowing, and --dry-run — writing changelogs, and recording consumed intents in a committed ledger that keeps cherry-picks and merge-backs between release branches safe. Packages can be moved onto per-package release lanes with the new pnpm lane <name> --filter <pkg> command and back with pnpm lane main --filter <pkg> (pnpm lane shows the membership), releasing X.Y.Z-lane.N prereleases from the same runs that release stable versions of the packages on the main lane. Configuration lives under the new versioning key of pnpm-workspace.yaml (fixed, ignore, maxBump, lanes, changelog). When two workspace projects publish the same name, intent files, versioning.lanes, and versioning.fixed/ignore may reference a project by its workspace-relative directory path (e.g. "./pnpm/npm/pnpm") — the one additive extension to the changesets format, applied automatically by pnpm change.

Release changelogs default to registry storage (versioning.changelog.storage): no CHANGELOG.md is committed. Each release's section is composed at publish time and packed into the published tarball on top of the previously published version's changelog, and the consumed change intents are garbage-collected by a later pnpm version -r only once the registry confirms the version is published with its section. Set versioning.changelog.storage: repository to keep committed CHANGELOG.md files instead.
Added a new override selector form with an empty range — "pkg@": "<version>" — called a convergence override. It rewrites a dependency edge only when its exact version satisfies the edge's declared range, so compatible consumers converge on one version while incompatible consumers keep their own resolution — now and for any dependent added in the future #12794.
```
overrides:
  "form-data@": 4.0.6
```
The value must be an exact version. When a full resolution detects that every declared range also admits a newer version, pnpm warns that the override is stale and names the version to converge on. Previously an empty range in an override selector was undocumented and behaved like a bare (unscoped) override.

Patch Changes

A tokenHelper set in the global pnpm auth.ini is no longer rejected as project-level configuration. The guard that blocks tokenHelper from a project .npmrc only treated ~/.npmrc as a trusted source, so a helper written to auth.ini (for example by pnpm config set) failed on every command and could not even be removed with pnpm config delete. A tokenHelper in a workspace or project .npmrc is still rejected.
pnpm cache delete now removes a package's metadata from every metadata cache directory (metadata, metadata-full, and metadata-full-filtered), instead of only the one the current resolution mode reads. Previously a package cached under a different mode (e.g. metadata-full-filtered) was left behind. Closes #12753.
Fixed an injected workspace dependency (injectWorkspacePackages: true) incorrectly staying as file: instead of deduping back to link: when an unrelated, ordinary shared dependency resolved to a peer-suffixed variant for the target project's own copy but not for the injected occurrence. See #10433.
pnpm deploy now supports workspaces that use catalogs.
Fixed pnpm deploy with a shared lockfile so local file: tarball dependencies keep their package name in the generated deploy lockfile. This prevents warm-store deploys from failing with ERR_PNPM_UNEXPECTED_PKG_CONTENT_IN_STORE when the tarball filename includes the version.
Options that follow create, exec, or test appearing as a subcommand of another command are now parsed instead of being silently treated as positional parameters. For example, pnpm team create @org:team --registry <url> previously ignored the --registry option and sent the request to the default registry.
pnpm add -g, pnpm update -g, pnpm setup, and the self-updater no longer fail with ERR_PNPM_MISSING_TIME when trustPolicy: no-downgrade or resolutionMode: time-based is set in the global config #12883. The decision to fetch full registry metadata now lives in one place, and the no-downgrade trust policy always requests full metadata (matching the self-updater), since the trust evidence it checks is missing from abbreviated metadata even on registries that include the time field.
pnpm list and pnpm why no longer crash with EMFILE: too many open files when a project has a large number of unsaved dependencies (packages present in node_modules but not in the lockfile). The reads of those packages are now concurrency-limited.
The published pnpm package no longer declares dependencies or devDependencies. Because the CLI bundles its runtime dependencies into dist/node_modules, those fields are dropped when packing, so npm install of the tarball no longer tries to resolve internal-only packages such as @pnpm/test-ipc-server. Closes #12955.
Fixed pnpm publish --otp and pnpm publish --batch --otp to send the configured OTP to the registry.
pnpm publish again sends the package's README to the registry as metadata, so registries can render it on the package page. The readme is always included in the published metadata (matching the npm CLI), while the embed-readme setting continues to control only whether the readme is written into the package.json inside the tarball. This restores the behavior that was lost when publishing became fully native. Closes #12966.
Fixed the dependency status check wrongly reporting "up to date" when a package.json, .pnpmfile.cjs, or patch file was edited in the same second as the previous install, on filesystems that record mtimes at whole-second resolution (for example ext4 with 128-byte inodes). The optimistic repeat-install fast path and verify-deps-before-run compared mtimes strictly, so a same-second edit whose mtime rounded down looked unchanged and re-resolution was skipped. Such a file's whole second is now treated as possibly-modified, falling through to the content check; behavior on sub-second filesystems is unchanged.
Retry package metadata requests when a registry or proxy returns 304 Not Modified to an unconditional request, preventing false ERR_PNPM_CACHE_MISSING_AFTER_304 failures pnpm/pnpm#12882.

If the retry also returns 304, report ERR_PNPM_META_NOT_MODIFIED_WITHOUT_CACHE instead.
Fixed pnpm update removing transitive lockfile entries when dedupePeerDependents is disabled and the selected package is absent pnpm/pnpm#12456.
Limit modern deploy lockfiles and localized virtual stores to dependencies reachable from the selected dependency groups.
A tokenHelper command is now given a 60-second time limit. A helper that hangs (deadlock, stuck I/O) is killed and reported as an error instead of leaving the command waiting forever.
Fixed orphaned child processes on Windows when pnpm exits on an error while commands spawned by pnpm exec or pnpm dlx are still running (for example, when one project's command fails during pnpm --recursive exec). The PIDs of these commands are now recorded when they are spawned and their whole process trees are terminated with taskkill on an error exit. Previously the cleanup relied on enumerating the system process list, which is so slow on Windows that the enumeration hit its timeout and the cleanup was silently skipped #12406.
pnpm pack now respects workspace-root .npmignore and .gitignore files when packing workspace packages.

Platinum Sponsors

Gold Sponsors

`v11.12.0`: pnpm 11.12

Compare Source

Minor Changes

a897ef7: Custom fetchers exported from a pnpmfile can now delegate by returning a { delegate: <resolution> } envelope: pnpm rewrites the package's resolution to the delegated shape and runs the built-in fetcher on it. This is the portable delegation form that also works in pacquet, where cafs and fetchers cannot be passed to the hook. Related to pnpm/pnpm#11685.

Patch Changes

2b02764: The changed-packages filter (--filter "...[<since>]") no longer allows an option-like <since> value (such as --output=<path>) to be interpreted as a git option — git now rejects it as a bad revision. The repository root is also resolved to the nearest .git entry, so the filter works in a git worktree checked out inside another repository's tree.
43711ce: pnpm outdated no longer checks the registry for dependencies that are resolved from local link:, file:, or workspace: references in the lockfile #12827.
3c6718b: Fixed a deadlock in peer dependency resolution: pnpm install hung forever when a peer dependency cycle spanned a project's own dependencies and auto-installed peer providers, for example when installing electron-builder@26.15.3 #12921.
252f15e: Fixed peer dependency auto-install picking a version the peer range rejects. In a workspace with several projects, a package declaring a peer dependency with a semver range (for example ^1.0.0) could get the highest version found anywhere in the workspace (for example a 2.0.0 resolved for another project) instead of a version that satisfies the range. Peers are now deduplicated onto the highest preferred version that satisfies the declared range, and when none does, the range is resolved from the registry.

Also fixed re-resolving with an existing lockfile hoisting a different peer version than a fresh install of the same manifest: root dependencies reused from the lockfile were invisible to peer hoisting, so a peer that a root dependency provides could be bound to another version.
a38adda: pnpm self-update <version> now installs the requested pnpm version when it matches the currently running version but is missing from the global self-update directory.
6a85968: pnpm stage list now stops paginating after a fail-safe cap of 1000 pages, so a misbehaving registry cannot keep the command looping forever.
eee7c9a: verify-deps-before-run no longer spawns a pnpm install when pnpm is executed in a directory that has no package.json. A mistyped command run outside a project (for example pnpm witch 10 login) used to crash with a confusing error from the spawned install; now it fails with the regular "no package.json found" error.

Platinum Sponsors

Gold Sponsors

`v11.11.0`

Compare Source

Minor Changes

508b8c2: Added the pnpm access command for managing package access and visibility on the registry, supporting listing packages and collaborators, getting and setting package status and MFA requirements, and granting or revoking team access.

Patch Changes

c70e33e: Allow allowBuilds entries for git-hosted packages to match by repository URL without pinning the resolved commit hash. This lets trusted git repositories keep running their build scripts after branch updates without approving each new commit, while package-name-only rules still do not approve git-hosted artifacts.
3067e4f: Reduced peak memory usage during cold-cache dependency resolution. The metadata fetch is memoized for the whole resolution phase, and it was retaining each package's raw registry response body (used only to mirror the response to disk) for that entire time. The memoized cache now holds a body-less copy, so the raw body only lives as long as the call that writes the disk mirror. On large graphs that fetch full metadata (e.g. with minimumReleaseAge or trustPolicy enabled) this cuts peak RSS by roughly 30%, back in line with pnpm 10. The resolved lockfile is unchanged.
51300fd: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at formatGlobalVirtualStorePath, the single point every global-virtual-store slot path funnels through — closing the same escape in the isolated linker, the resolver's dependency-graph builder, and the config-dependency installer.
f8058eb: Reject symlinked pnpm-lock.yaml files when reading or writing the env lockfile document.
9318a11: Allow registries and namedRegistries to be configured in the global config.yaml file.
51300fd: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
14332f0: Fail instead of silently removing an optional dependency's locked entries from pnpm-lock.yaml when the registry cannot resolve it. Previously, when registry metadata lacked a version that the lockfile already pinned (for example, a mirror that had not synced a recent release yet), pnpm install and pnpm dedupe silently dropped the optional dependency's entries — emptying maps such as the platform binaries of @napi-rs/canvas — so the lockfile differed between machines and frozen installs on other hosts had nothing to link #12853.
fecfe83: Fixed peer dependency resolution with autoInstallPeers when a workspace package depends on a version of a package that a transitive dependency's self-contained closure also provides for itself. The peer providers that are attached to the root project for reuse are no longer peer-resolved a second time in the root context, so packages inside such a closure no longer get their peers bound to the root project's incompatible version #4993.
5a4daec: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry, namedRegistries, and pnprServer.
d1da02e: pnpm publish no longer prints credentials when the target registry is configured with inline user:pass@ credentials (e.g. registry=https://user:pass@example.com/). They are now redacted both from the "publishing to registry" line and from the OIDC (trusted publishing) failure messages.
dcfc611: pnpm self-update now honors `trustPolicy=no-downgrad

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- "after 1am and before 5am"
Automerge
- "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-07-19T01:33:18Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nitro.build	Ready	Preview, Comment	Jul 19, 2026 1:35am

socket-security · 2026-07-19T01:34:04Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
undocs-nightly@0.4.17-20260708-180838-02fc272
@cloudflare/workers-utils@0.27.0
rolldown@1.2.0
shaders@2.5.135
crossws@0.4.10
vite@8.1.5
oxfmt@0.58.0 ⏵ 0.59.0		⁺¹	⁺¹
pretty-bytes@7.1.1
wrangler@4.112.0
oxlint@1.73.0 ⏵ 1.74.0	⁺¹	⁺¹
@scalar/api-reference@1.62.9
@cloudflare/workers-types@5.20260718.1
miniflare@4.20260714.0
@scalar/openapi-types@0.9.3

View full report

socket-security · 2026-07-19T01:34:06Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `powershell-utils` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → `npm/undocs-nightly@0.4.17-20260708-180838-02fc272` → `npm/powershell-utils@0.1.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/powershell-utils@0.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `seroval` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: docs/pnpm-lock.yaml → `npm/undocs-nightly@0.4.17-20260708-180838-02fc272` → `npm/seroval@1.5.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/seroval@1.5.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

pkg-pr-new · 2026-07-19T01:35:23Z

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4449

commit: 93b5dfd

renovate · 2026-07-19T05:03:36Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

chore(deps): update all non-major dependencies

475bf97

renovate Bot requested a review from pi0 as a code owner July 19, 2026 01:33

chore: apply automated updates

93b5dfd

vercel Bot deployed to Preview July 19, 2026 01:35 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore(deps): update all non-major dependencies#4449

chore(deps): update all non-major dependencies#4449
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jul 19, 2026

Uh oh!

vercel Bot commented Jul 19, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 19, 2026

Uh oh!

socket-security Bot commented Jul 19, 2026

Uh oh!

pkg-pr-new Bot commented Jul 19, 2026

Uh oh!

renovate Bot commented Jul 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
@cloudflare/workers-types	^5.20260708.1	^5.20260710.1
workerd	1.20260708.1	1.20260710.1

Dependency	From	To
workerd	1.20260706.1	1.20260708.1
@cloudflare/workers-types	^5.20260706.1	^5.20260708.1

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jul 19, 2026

Release Notes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

🚀 Enhancements

🏡 Chore

❤️ Contributors

Minor Changes

Patch Changes

Minor Changes

Minor Changes

Patch Changes

🐛 Bug Fixes

🚀 Features

🐛 Bug Fixes

⚡ Performance

v11.13.1: pnpm 11.13.1

Patch Changes

v11.13.0: pnpm 11.13

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

v11.12.0: pnpm 11.12

Minor Changes

Patch Changes

Platinum Sponsors

Gold Sponsors

Minor Changes

Patch Changes

Configuration

Uh oh!

vercel Bot commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 19, 2026

Uh oh!

socket-security Bot commented Jul 19, 2026

Uh oh!

pkg-pr-new Bot commented Jul 19, 2026

Uh oh!

renovate Bot commented Jul 19, 2026

Edited/Blocked Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v11.13.1`: pnpm 11.13.1

`v11.13.0`: pnpm 11.13

`v11.12.0`: pnpm 11.12

vercel Bot commented Jul 19, 2026 •

edited

Loading