Skip to content

chore(deps): update npm packages - #585

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages
Open

chore(deps): update npm packages#585
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages

Conversation

@renovate

@renovate renovate Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@analogjs/content (source) 2.9.0 → 2.9.2 age adoption passing confidence
@analogjs/platform (source) 2.9.0 → 2.9.2 age adoption passing confidence
@analogjs/router (source) 2.9.0 → 2.9.2 age adoption passing confidence
@analogjs/vite-plugin-angular 2.9.0 → 2.9.2 age adoption passing confidence
@angular/build 22.2.3 → 22.2.4 age adoption passing confidence
@astrojs/cloudflare (source) 14.4.0 → 14.4.2 age adoption passing confidence
@cloudflare/build-output-utils (source) 0.9.3 → 0.9.4 age adoption passing confidence
@cloudflare/codemods (source) ^0.5.1 → ^0.6.0 age adoption passing confidence
@cloudflare/config (source) ^0.27.0 → ^0.28.0 age adoption passing confidence
@cloudflare/sandbox 1.0.2 → 1.0.3 age adoption passing confidence
@cloudflare/workers-auth (source) ^0.14.1 → ^0.15.0 age adoption passing confidence
@cloudflare/workers-types 5.20261019.1 → 5.20261022.1 age adoption passing confidence
@react-router/dev (source) 8.4.0 → 8.5.0 age adoption passing confidence
@tanstack/react-router (source) 1.170.45 → 1.170.46 age adoption passing confidence
@tanstack/react-start (source) 1.169.3 → 1.169.4 age adoption passing confidence
arktype (source) 2.2.8 → 2.2.9 age adoption passing confidence
astro (source) 7.4.0 → 7.4.2 age adoption passing confidence
better-auth (source) 1.7.11 → 1.7.12 age adoption passing confidence
cf (source) >=1.0.0-beta.18 <1.0.0-beta.19 → >=1.0.0-beta.18 <1.0.0 age adoption passing confidence
ignore 7.0.12 → 7.0.13 age adoption passing confidence
postal-mime (source) 4.0.11 → 4.1.4 age adoption passing confidence
react-router (source) 8.4.0 → 8.5.0 age adoption passing confidence
wrangler (source) 4.151.3 → 4.152.0 age adoption passing confidence

Release Notes

analogjs/analog (@​analogjs/content)

v2.9.2

Compare Source

Bug Fixes

v2.9.1

Compare Source

Bug Fixes
  • vite-plugin-angular: emit ctorParameters and propDecorators in fastCompile class metadata (#​2668) (33a4275)
angular/angular-cli (@​angular/build)

v22.2.4

Compare Source

@​angular/cli
Commit Type Description
63e45bcfe fix keep schematic positional arguments in index order
6053771cb fix only load autocompletion in interactive shells
@​schematics/angular
Commit Type Description
eec8dc049 fix apply viewEncapsulation to generated application components
3a549925e fix correct error and warning messages in environments schematic
fe119a7c7 fix show routing module suffixes in findModule error
36d988001 fix skip webWorkerTsConfig for unit-test builder test targets
460167cd3 fix use the generated class name when declaring in an NgModule
@​angular/build
Commit Type Description
c235a9554 fix add integrity metadata for all initial chunks beyond the module preload limit
80c7480b4 fix align lazy route entry names with workspace root for SSR modulepreload
b94627706 fix attach location to Sass errors and guard stack parsing
0dc103735 fix correct typos and spacing in error and warning messages
3e464c3f5 fix invalidate Vite module cache for removed dev server output files
7d9ba6280 fix match proxy glob patterns against URL pathname only
3aa7e93cc fix name the provider packages in the unit-test browsers error
e78cf0ae9 fix preserve diagnostic locations at offset 0 and guard empty files
b3baa20c6 fix support quotes in styles and polyfills paths
648aff9eb fix use component file path in inline stylesheet diagnostic locations
a9bec13b5 fix use distinct chunk naming for web worker bundles
a05723948 fix watch only explicitly added paths in chokidar watcher
35702a598 perf avoid reading external component stylesheets twice
@​angular/ssr
Commit Type Description
3beb2551c fix resolve query parameter placeholders in redirect targets (#​34321)
ff3f3727a fix resolve route parameters in redirect targets (#​34321)
d365b0008 fix use only the first value of the X-Forwarded-Prefix header
withastro/astro (@​astrojs/cloudflare)

v14.4.2

Compare Source

Patch Changes

  • #​18422 07700d4 Thanks @​cyface! - Fixes the /_image endpoint returning a 500 error when href points to a missing file or a file that isn't an image. It now responds with a 404 or 400 instead.

  • #​18465 f31f143 Thanks @​astro-factory! - Fixes a custom src/fetch.ts rendering truncated pages without islands or hoisted scripts in astro dev when prerenderEnvironment: 'node' is set

  • #​18461 8b77891 Thanks @​astro-factory! - Fixes options passed to sharpImageService() being ignored when generating images at build time with imageService: 'compile'

  • #​18468 119263a Thanks @​astro-factory! - Fixes astro sync, astro check, and astro build overwriting the dependency cache of a running astro dev server, which caused it to fail with "The file does not exist ... in the optimize deps directory" errors

  • Updated dependencies []:

v14.4.1

Compare Source

Patch Changes
cloudflare/workers-sdk (@​cloudflare/build-output-utils)

v0.9.4

Patch Changes
cloudflare/workers-sdk (@​cloudflare/codemods)

v0.6.0

Minor Changes

  • #​16357 182d6de Thanks @​Naapperas! - Add a jurisdiction setting to Workflows

    A Workflow defined by the Worker can now set the jurisdiction that its instances run and store their data in, on either a workflows binding or a workflow export:

    {
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "jurisdiction": "eu"
    }
  ]
}

    The accepted values are eu, fedramp, and us. wrangler deploy and wrangler triggers deploy send the jurisdiction when they create or update the Workflow. A Workflow's jurisdiction is set when it is created and cannot be changed afterwards, so wrangler deploy and wrangler versions upload stop before uploading when an existing Workflow has a different jurisdiction from the configured one. Leaving jurisdiction out keeps the Workflow's existing jurisdiction. @cloudflare/config adds the setting to exports.workflow(), cf migrate carries it over, and wrangler workflows describe prints it. Local development ignores it.

cloudflare/workers-sdk (@​cloudflare/config)

v0.28.0

Minor Changes

  • #​14900 08f22d3 Thanks @​mack-erel! - Support remote Hyperdrive bindings in local development

    {
  "hyperdrive": [
    {
      "binding": "HYPERDRIVE",
      "id": "<your-hyperdrive-id>",
      "remote": true
    }
  ]
}

  • #​16357 182d6de Thanks @​Naapperas! - Add a jurisdiction setting to Workflows

    A Workflow defined by the Worker can now set the jurisdiction that its instances run and store their data in, on either a workflows binding or a workflow export:

    {
  "workflows": [
    {
      "binding": "MY_WORKFLOW",
      "name": "my-workflow",
      "class_name": "MyWorkflow",
      "jurisdiction": "eu"
    }
  ]
}

    The accepted values are eu, fedramp, and us. wrangler deploy and wrangler triggers deploy send the jurisdiction when they create or update the Workflow. A Workflow's jurisdiction is set when it is created and cannot be changed afterwards, so wrangler deploy and wrangler versions upload stop before uploading when an existing Workflow has a different jurisdiction from the configured one. Leaving jurisdiction out keeps the Workflow's existing jurisdiction. @cloudflare/config adds the setting to exports.workflow(), cf migrate carries it over, and wrangler workflows describe prints it. Local development ignores it.

cloudflare/sandbox-sdk (@​cloudflare/sandbox)

v1.0.3

Compare Source

Patch Changes
  • #​1030 2d5a2a8 Thanks @​ghostwriternr! - Fix Files.readDirectory() dropping a leading U+FEFF from entry names. Names that start with U+FEFF now come back unchanged, so passing them to stat() or other file operations finds the entry.
cloudflare/workers-sdk (@​cloudflare/workers-auth)

v0.15.0

Minor Changes

  • #​16375 f43e2e6 Thanks @​penalosa! - Use each CLI's temporary-account flag in authentication errors

    Default to --temporary-account while keeping Wrangler's --temporary spelling. Expose account-lookup authentication failure reasons so consumers can distinguish missing credentials from expired tokens without matching error messages.

Patch Changes
cloudflare/workerd (@​cloudflare/workers-types)

v5.20261022.1

Compare Source

v5.20261021.1

Compare Source

remix-run/react-router (@​react-router/dev)

v8.5.0

Compare Source

Patch Changes
  • Fix critical CSS collection in dev registering server-only route imports as client dependencies, which triggered dependency re-optimization and full page reloads (#​15595)
  • Fix intermittent Prerender: Request failed for ... connect ECONNREFUSED errors during prerendering (#​15325)
    • Send requests to the address the Vite preview server bound to
    • Avoid re-resolving localhost for each request, which could select a different address family (127.0.0.1 vs ::1)
Unstable Changes

⚠️ Unstable features are not recommended for production use

  • Add ssr: "unstable_api-only" to retain a runtime server for loaders, actions, and route discovery while disabling production document rendering (#​15601)
    • Generate a root-only SPA shell when prerendering is disabled
    • Support prerendered pages and data files alongside runtime loaders and actions, with a SPA fallback for non-prerendered paths
    • Default API-only builds to lazy route discovery
    • Reject API-only configuration in RSC Framework Mode
    • Preserve server-only route exports in additional Vite server environments in both API-only and SSR modes
    • Serve prerendered pages and the SPA fallback in Vite preview while retaining live data requests and route discovery
  • Add the future.unstable_customRouteDiscovery flag to opt into application-controlled route discovery in conventional Framework Mode (#​15602)
  • Fix source maps for route modules in unstable RSC Framework Mode (#​15479)
  • Add unstable_apiServerOrigin to configure the origin for API-only loader, action, and route discovery requests (#​15601)
  • Updated dependencies:
TanStack/router (@​tanstack/react-router)

v1.170.46

Compare Source

Patch Changes

  • #​8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

  • #​8671 689a7c5 - Publish the @tanstack/react-router agent skills (react-router, compositions/router-query, lifecycle/migrate-from-react-router), which were missing from the package's files list.

  • Updated dependencies [32a3360]:

TanStack/router (@​tanstack/react-start)

v1.169.4

Compare Source

Patch Changes
arktypeio/arktype (arktype)

v2.2.9

Compare Source

Keep tuple elements around defaults in .in and .out

Combining a tuple's defaultable elements with its other elements dropped some of them, depending on key order:

const T = type(["string", "number = 5", "boolean?"])

// was: [string, boolean?]
// now: [string, number?, boolean?]
T.in.expression

// was: number[]
// now: [number, string, ...number[]]
type(["number", "string = 'foo'", "...", "number[]"]).out.expression

A bound that narrows two existing length constraints at once also no longer throws "multiple distinct intersection results":

// was: throws
// now: string == 2
type("1 <= string <= 2").and("string >= 2")

Thanks to @​ybai08 (#​1696).

Reject NaN in unions discriminated by typeof

number rejects NaN, but compiled unions like number | null dropped that check when they discriminated by typeof, so NaN was only rejected with jitless (#​1702).

const T = type("number | null")

// was: NaN
// now: ArkErrors: must be a number (was NaN)
T(NaN)

Thanks to @​thecotne.

Don't treat Object.prototype keys as declared

Inherited names like toString or constructor, and an own __proto__ key like the one JSON.parse creates, were treated as declared keys, so "+": "delete" kept them and "+": "reject" accepted them (#​1701).

const T = type({ a: "string", "+": "reject" })

// was: { a: "x", constructor: 1 }
// now: ArkErrors: constructor must be removed
T({ a: "x", constructor: 1 })

Thanks to @​thecotne.

Only emit referenced $defs in toJsonSchema

With useRefs, or for a cyclic type, every node a type referenced was written to $defs, including discriminated union cases that never appear in the output. Some of those couldn't be converted, so toJsonSchema() threw Unexpected JSON Schema input for structure: {} (#​1689, fixes #​1612, #​1511 and #​1546).

const T = type.or(
	{ a: type.enumerated("a", "b", "c"), b: "1" },
	{ a: type.enumerated("a", "e", "f"), b: "2" }
)

// was: throws
// now: only the $defs that a $ref points to
T.toJsonSchema({ useRefs: true })

Thanks to @​giaBaoJS.

Convert unrepresentable types in ~standard.jsonSchema instead of throwing

~standard.jsonSchema.input and .output now throw only for an unsupported target, i.e. one other than draft-2020-12 or draft-07. Parts of a type that JSON Schema can't represent are converted instead (#​1694):

  • a predicate, a second pattern, a Date bound or an array's non-index props is dropped from the schema it constrains
  • bigint, symbol, a non-JSON unit like undefined and any prototype other than Array become {}
  • a variadic tuple with postfix elements keeps its prefix and minItems, but not its items
  • a default that isn't JSON is omitted
const T = type({
	big: "bigint",
	even: type("number").narrow(n => n % 2 === 0)
})

// was: throws
// now: { type: "object", properties: { big: {}, even: { type: "number" } }, ... }
T["~standard"].jsonSchema.input({ target: "draft-2020-12" })

Fallbacks from a scope's toJsonSchema config or from libraryOptions still take precedence, and toJsonSchema() itself still throws by default.

A defaultValue fallback can now return undefined to omit the default rather than writing default: undefined.

withastro/astro (astro)

v7.4.2

Compare Source

Patch Changes

  • #​18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

  • #​18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

  • #​18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

  • #​18467 d1fb7d3 Thanks @​astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

  • #​18475 cf27e70 Thanks @​ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

    This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

  • #​18451 7a0ba6f Thanks @​DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

  • #​18336 e943003 Thanks @​astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

  • #​18399 829fc00 Thanks @​astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

  • #​18330 4db9e0d Thanks @​Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

  • Updated dependencies [cf27e70]:

v7.4.1

Compare Source

Patch Changes

  • #​18425 6fdc36e Thanks @​astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

  • #​18419 395d195 Thanks @​astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

  • #​18401 484822f Thanks @​danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

  • #​18407 a6e00be Thanks @​astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

  • #​18427 908f167 Thanks @​astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

  • #​18428 40e7d54 Thanks @​astro-factory! - Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

  • #​18424 617ff59 Thanks @​astro-factory! - Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

  • #​18274 70834bb Thanks @​Princesseuh! - Fixes increasing memory usage when editing the Astro configuration while the dev server is running

better-auth/better-auth (better-auth)

v1.7.12

Compare Source

Patch Changes
cloudflare/cf (cf)

v1.0.0-beta.20

Compare Source

Minor Changes

  • 0050a39: Write hand-written command messages to stderr

    Breaking change during the beta: cf auth login, cf auth logout, the auth
    profile commands, cf cli telemetry enable / disable and cf migrate now
    print their notices, warnings and success messages on stderr, so redirected or
    piped stdout holds only command output, as with generated commands. The auth
    and telemetry commands use clack's log lines and the ✓ success line, which,
    as with generated commands, appears only when stderr is a terminal. A command
    to run next is printed on its own line so it copies cleanly. cf auth login
    with CLOUDFLARE_API_TOKEN set now warns once that the token takes
    precedence, and cf auth logout no longer reports removing OAuth tokens that
    it keeps while CLOUDFLARE_API_TOKEN is set.

  • 1dc3664: Require the latest minor releases of supported Node.js majors

    Require Node.js 22.23.0, 24.22.0, or 26.12.0 and allow later releases within
    each m

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

  • Branch creation
    • "before 10am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner October 25, 2026 16:48
@renovate
renovate Bot enabled auto-merge (squash) October 25, 2026 16:48
@socket-security

socket-security Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​cloudflare/​build-output-utils@​0.9.41001007098100
Updated@​analogjs/​content@​2.9.0 ⏵ 2.9.288 +21007396100
Added@​cloudflare/​config@​0.28.01001007398100
Updated@​analogjs/​router@​2.9.0 ⏵ 2.9.2921007596100
Updated@​analogjs/​platform@​2.9.0 ⏵ 2.9.2951007596100
Updated@​react-router/​dev@​8.4.0 ⏵ 8.5.098 +110075 +196100
Updated@​angular/​build@​22.2.3 ⏵ 22.2.48410078 +198100
Updatedreact-router@​8.4.0 ⏵ 8.5.010010079 +197 +1100
Updated@​cloudflare/​workers-auth@​0.14.1 ⏵ 0.15.09510082 +198 +1100
Updated@​astrojs/​cloudflare@​14.4.0 ⏵ 14.4.210010084 +198 +1100
Updatedbetter-auth@​1.7.11 ⏵ 1.7.1298 +110085 +196 +1100
Updated@​tanstack/​react-router@​1.170.45 ⏵ 1.170.46931008798100
Updated@​tanstack/​react-start@​1.169.3 ⏵ 1.169.4991008898100
Updatedastro@​7.4.0 ⏵ 7.4.298 +110088 +198100
Updatedwrangler@​4.151.3 ⏵ 4.152.09810092 +196100
Updated@​cloudflare/​codemods@​0.5.1 ⏵ 0.6.0100 +110092 +196 +1100
Updatedarktype@​2.2.8 ⏵ 2.2.910010010093100
Updatedignore@​7.0.12 ⏵ 7.0.13100 +1100100 +193100
Updated@​cloudflare/​workers-types@​5.20261019.1 ⏵ 5.20261022.1100 +11009699100
Updatedpostal-mime@​4.0.11 ⏵ 4.1.4100 +110010096 +1100
Updated@​analogjs/​vite-plugin-angular@​2.9.0 ⏵ 2.9.299100100 +196100
Updated@​cloudflare/​sandbox@​1.0.2 ⏵ 1.0.3100 +1100100 +199 +1100

View full report

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://renovate-npm-packages-void-cloud.voidzero-docs.workers.dev (commit 4d3e3b9)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status Deployment URL Commit Updated (UTC) See this deployment's details
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗		 https://f20ee8b4-void-cloud.voidzero-docs.workers.dev 4d3e3b9 2026-10-25T21:17:53.287Z Visit the dashboard ↗
  • Build: Success ✅
  • Deployment: Success ✅

View logs ↗		 https://2d579e6e-void-cloud.voidzero-docs.workers.dev abb74aa 2026-10-25T16:49:37.273Z Visit the dashboard ↗

@renovate
renovate Bot force-pushed the renovate/npm-packages branch from abb74aa to 4d3e3b9 Compare October 25, 2026 21:16

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants