Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@types/react (source)	19.2.17 → 19.2.18
@types/react-dom (source)	19.2.3 → 19.2.4
js-yaml	4.3.0 → 4.3.1
lint-staged	17.2.0 → 17.3.0
npm (source)	12.0.1 → 12.0.2
wrangler (source)	4.115.0 → 4.118.0

---

Release Notes

nodeca/js-yaml (js-yaml)

v4.3.1

Compare Source

lint-staged/lint-staged (lint-staged)

v17.3.0

Compare Source

Minor Changes

• #​1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @​type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #​1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

npm/cli (npm)

v12.0.2

Compare Source

Bug Fixes

• 834408e #​9760 pack: honor min-release-age-exclude (#​9760) (@​martinrrm, @​Copilot)
• ef6cfea #​9786 owner: use scoped registry for user lookup (#​9786) (@​martinrrm, @​Copilot)

Documentation

• 9e17dc0 #​9805 clarify npm 12 unknown-config breaking change in changelogs (#​9805) (@​Hashim1999164)

Chores

• 7b1f6c1 #​9747 parse pack --json object output in node integration (#​9747) (@​reggi, @​Copilot)

Dependencies

• workspace: @npmcli/arborist@10.0.2
• workspace: @npmcli/config@11.0.1
• workspace: libnpmdiff@9.0.2
• workspace: libnpmexec@11.0.2
• workspace: libnpmfund@8.0.2
• workspace: libnpmpack@10.0.2

cloudflare/workers-sdk (wrangler)

v4.118.0

Compare Source

Minor Changes

• #​14057 cc63aae Thanks @​matingathani! - Add --json flag to wrangler containers info for consistent JSON output with sibling commands list and instances

• #​14944 a249591 Thanks @​nickpatt! - Enable local observability capture by default in dev

  wrangler dev and the Vite plugin now capture request traces and console logs into the Local Explorer's Observability tab out of the box — previously this was opt-in behind X_LOCAL_OBSERVABILITY=true. Set X_LOCAL_OBSERVABILITY=false to opt out (for example if the extra per-worker collector/streaming-tail services cause trouble in a multi-process dev-registry setup).

• #​14919 e0bbf55 Thanks @​avenceslau! - Add additional triggers to Workflows

  Workers can now declaratively start a locally defined Workflow. Configure event subscriptions under triggers.events; Wrangler validates each target and updates the script's event triggers during deployment.

  {
    "triggers": {
      "events": [
        {
          "type": "cf.artifacts.repo.pushed",
          "filter": {
            "namespace": "my-namespace",
            "repo_name": "my-repo"
          },
          "targets": [
            {
              "type": "workflow",
              "workflow_name": "my-workflow"
            }
          ]
        }
      ]
    }
  }

Patch Changes

• #​14936 f92d1fc Thanks @​petebacondarwin! - Fix jsx_fragment being ignored when wrangler dev runs a custom build

  If your project uses a custom build and sets both jsx_factory and jsx_fragment, wrangler dev used your jsx_factory value for JSX fragments as well, so fragments compiled incorrectly. Your jsx_fragment value is now used.

• #​14936 f92d1fc Thanks @​petebacondarwin! - Stop wrangler dev starting new work after you stop it or it reloads

  Stopping wrangler dev, or having it reload after a configuration change, could still leave it starting work for the state it had just left behind: your custom build command could run once more after dev had stopped, a change to a file in your assets directory could be reported against configuration that had already been replaced, and in some cases the process could stay alive instead of exiting.

  That work is now discarded, so stopping or reloading wrangler dev leaves nothing running behind it.

• #​14936 f92d1fc Thanks @​petebacondarwin! - Stop wrangler dev from running custom builds concurrently

  When several watched files changed at once — for example during a git pull or a "save all" — wrangler dev started a custom build for every file that changed, so multiple copies of your build command ran at the same time and fought over the same output files.

  A burst of file changes now results in a single build, and a build only starts once the previous one has finished.

• #​13746 cec9d88 Thanks @​edmundhung! - Report a clear error for account IDs that can't be used in a Cloudflare API request

  Account IDs are substituted straight into Cloudflare API URL paths, so a value containing non-ASCII characters previously failed deep inside the request layer with an opaque Cannot convert argument to a ByteString error that gave no hint about which setting was at fault. Account IDs read from CLOUDFLARE_ACCOUNT_ID and from the account_id configuration field are now validated up front, and an invalid value fails with a message naming both the offending value and where it came from.

v4.117.0

Compare Source

Minor Changes

• #​14586 5a56dda Thanks @​emily-shen! - Remove containerEngine from the worker options returned by unstable_getMiniflareWorkerOptions

  unstable_getMiniflareWorkerOptions no longer includes containerEngine in the returned workerOptions, since the container engine is a Miniflare instance-wide setting rather than a per-worker one. Callers that build a Miniflare instance from these options should set containerEngine at the top level instead.

Patch Changes

• #​14586 5a56dda Thanks @​emily-shen! - Rewrite local testing paths (/cdn-cgi/*)

  Miniflare v5 moved its internal local testing endpoints to /cdn-cgi/local/* (and /__cf_local/* for endpoints that must remain reachable over tunnels) to prevent any potential collision with production routes. wrangler dev and the Vite plugin now transparently rewrite the old paths to the new ones, meaning you can continue to use the old paths without issue.

  These are the new paths:

  • /cdn-cgi/handler/scheduled → /cdn-cgi/local/scheduled
  • /cdn-cgi/handler/email → /cdn-cgi/local/email
  • /cdn-cgi/explorer/* → /cdn-cgi/local/explorer/*
  • /cdn-cgi/mf/scheduled → /cdn-cgi/local/scheduled (Note /cdn-cgi/mf/scheduled is already deprecated)
  • /cdn-cgi/mf/stream/* → /__cf_local/stream/*
  • /cdn-cgi/mf/imagedelivery/* → /__cf_local/imagedelivery/*

• Updated dependencies [5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda, 5a56dda]:

  • miniflare@5.20260730.0-alpha

v4.116.0

Compare Source

Minor Changes

• #​14907 beec0fb Thanks @​NuroDev! - Avoid Worker and workers.dev naming prompts in agent-driven deploys

  Wrangler now derives the Worker name from the project and automatically registers the same project-derived workers.dev account subdomain on a first deploy when running in a detected agent environment. The deploy output explains how to change both names.

• #​14905 b21eac2 Thanks @​jamesopstad! - The experimental build output directory now includes the Worker's configuration at .cloudflare/output/v0/workers/default/config.json instead of .cloudflare/output/v0/workers/<worker-name>/worker.config.json

• #​14893 bb09f1b Thanks @​apeacock1991! - Graduate wrangler check startup from alpha and show bundle size and a local timing summary

  The command no longer prints an alpha warning. It now reports its local profile window, sampled active, garbage collection, and idle time alongside the raw and compressed bundle sizes. The existing measurement warning continues to distinguish these local measurements from startup time measured on Cloudflare.

• #​14685 01d7020 Thanks @​edmundhung! - Add support for dispatching email handlers with createTestHarness

  You can now call server.getWorker().email({ from, to, raw }) to dispatch directly to a Worker's email() handler and inspect its outcome, rejection reason, forwarded messages, and replies.

  const result = await server.getWorker().email({
    from: "sender@example.com",
    to: "inbox@example.com",
    raw: [
      "From: Sender <sender@example.com>",
      "To: Inbox <inbox@example.com>",
      "Message-ID: <test@example.com>",
      "Subject: Test email",
      "",
      "Hello from the test harness",
    ].join("\r\n"),
  });
  
  expect(result).toMatchObject({
    outcome: "ok",
    forwards: [{ recipient: "archive@example.com" }],
    replies: [
      {
        sender: "inbox@example.com",
        raw: expect.stringContaining("Thanks for your email"),
      },
    ],
  });

Patch Changes

• #​14929 48f0c6c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260722.1	^5.20260730.1
  workerd	1.20260722.1	1.20260730.1

• #​14838 8049ca4 Thanks @​TheSaiEaranti! - Fix ctrl+c not being able to interrupt wrangler while waiting for Cloudflare Access authorization

  When a domain is behind Cloudflare Access (for example during remote bindings startup), wrangler runs cloudflared access login, which only returns once the user completes the authorization flow in the browser. This was invoked synchronously, blocking Node's event loop, so wrangler could not react to ctrl+c (or anything else) until the authorization completed — abandoning the browser flow left a hung wrangler process that had to be killed externally. cloudflared is now spawned asynchronously, keeping wrangler responsive while it waits. The remote runtime passes its abort signal through to the spawn, so tearing down the session kills a still-pending cloudflared immediately, with process exit as a last-resort cleanup.

• #​14871 1394867 Thanks @​nickpatt! - Include the local observability query endpoint in the agent-facing Local Explorer hint

  The hint wrangler dev prints for AI-agent sessions now lists POST /cdn-cgi/explorer/api/local/observability/query, so agents can discover the read-only SQL endpoint for captured request traces and console logs (the spans and logs tables) alongside the existing binding and storage routes.

• #​14918 cc54478 Thanks @​nickpatt! - Improve the agent-facing Local Explorer hint for the observability query endpoint

  When a wrangler dev session is detected as running inside an AI agent, the hint for POST /local/observability/query now explains that the endpoint takes a read-only SQL query (SELECT/WITH only) over the captured spans and logs tables, notes that attributes is JSON (read via json(attributes)), and includes a copy-pasteable curl example. The full OpenAPI schema is demoted to a last-resort footer so agents reach for the small, actionable example first instead of fetching the large schema.

• #​14897 e31ab0f Thanks @​ericclemmons! - Fix wrangler triggers deploy to use Vite-generated redirected configuration

  The command now reads .wrangler/deploy/config.json, matching wrangler deploy and wrangler versions upload, so generated Worker names and trigger settings are applied.

• Updated dependencies [01d7020, 48f0c6c, d7f38c3, 5c25cfe, 1f61001]:

  • miniflare@​4.20260730.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package	Version	Info
fets	0.8.8-alpha-20260731193303-a34f8784b021aec299765e40956224bd0ecabcb0	npm ↗︎ unpkg ↗︎

[github-actions]

💻 Website Preview

The latest changes are available as preview in: https://pr-4053.fets-3ku.pages.dev

[github-actions]

✅ Benchmark Results

     ✓ no_errors{server:node-http,mode:no-schema}
     ✓ expected_result{server:node-http,mode:no-schema}
     ✓ no_errors{server:node-http,mode:json-schema}
     ✓ expected_result{server:node-http,mode:json-schema}
     ✓ no_errors{server:uWebSockets,mode:no-schema}
     ✓ expected_result{server:uWebSockets,mode:no-schema}
     ✓ no_errors{server:uWebSockets,mode:json-schema}
     ✓ expected_result{server:uWebSockets,mode:json-schema}

     checks......................................: 100.00% ✓ 864586      ✗ 0     
     data_received...............................: 79 MB   655 kB/s
     data_sent...................................: 55 MB   458 kB/s
     http_req_blocked............................: avg=1.36µs   min=941ns    med=1.2µs    max=651.27µs p(90)=1.56µs   p(95)=1.98µs  
     http_req_connecting.........................: avg=1ns      min=0s       med=0s       max=408µs    p(90)=0s       p(95)=0s      
     http_req_duration...........................: avg=197.06µs min=137.81µs med=183.59µs max=11.46ms  p(90)=215.99µs p(95)=229.87µs
       { expected_response:true }................: avg=197.06µs min=137.81µs med=183.59µs max=11.46ms  p(90)=215.99µs p(95)=229.87µs
     ✓ { server:node-http,mode:json-schema }.....: avg=206.04µs min=151.18µs med=190.76µs max=8.89ms   p(90)=223.87µs p(95)=237.49µs
     ✓ { server:node-http,mode:no-schema }.......: avg=196.64µs min=143.19µs med=183.76µs max=11.46ms  p(90)=214.41µs p(95)=227.8µs 
     ✓ { server:uWebSockets,mode:json-schema }...: avg=194.58µs min=143.04µs med=181.64µs max=10.24ms  p(90)=213.24µs p(95)=227.62µs
     ✓ { server:uWebSockets,mode:no-schema }.....: avg=191.39µs min=137.81µs med=178.88µs max=9.07ms   p(90)=208.2µs  p(95)=222.63µs
     http_req_failed.............................: 0.00%   ✓ 0           ✗ 432293
     http_req_receiving..........................: avg=25.49µs  min=13.32µs  med=25.73µs  max=6.32ms   p(90)=29.4µs   p(95)=31.61µs 
     http_req_sending............................: avg=7.53µs   min=5.35µs   med=6.66µs   max=5.93ms   p(90)=8.73µs   p(95)=11.87µs 
     http_req_tls_handshaking....................: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting............................: avg=164.03µs min=112.78µs med=150.99µs max=11.41ms  p(90)=180.51µs p(95)=192.98µs
     http_reqs...................................: 432293  3602.401915/s
     iteration_duration..........................: avg=272.92µs min=193.37µs med=256.91µs max=11.56ms  p(90)=298.11µs p(95)=317.74µs
     iterations..................................: 432293  3602.401915/s
     vus.........................................: 1       min=1         max=1   
     vus_max.....................................: 2       min=2         max=2