Skip to content

build(deps): bump the web-deps group in /apps/web with 5 updates - #33

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/web-deps-3ab7040a12
Open

build(deps): bump the web-deps group in /apps/web with 5 updates#33
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/web-deps-3ab7040a12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor

Bumps the web-deps group in /apps/web with 5 updates:

Package From To
next 16.2.11 16.2.12
@cloudflare/vite-plugin 1.46.0 1.48.0
@vitejs/plugin-rsc 0.5.29 0.5.32
eslint-config-next 16.2.11 16.2.12
wrangler 4.113.0 4.115.0

Updates next from 16.2.11 to 16.2.12

Release notes

Sourced from next's releases.

v16.2.12

What's Changed

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

Commits

Updates @cloudflare/vite-plugin from 1.46.0 to 1.48.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.48.0

Minor Changes

  • #14883 76e6014 Thanks @​jamesopstad! - Serve the bundled client HTML in dev when Vite's experimental.bundledDev is enabled

    Note that this feature is experimental and subject to change.

Patch Changes

  • #14862 c232d05 Thanks @​petebacondarwin! - Destroy the client socket instead of crashing when a WebSocket upgrade fails

    If dispatchFetch rejected while a WebSocket upgrade was still in flight (for example when Miniflare is disposed during a dev server shutdown or restart), the error escaped the async upgrade handler as an unhandled rejection. This could terminate the dev server process and leaked the client socket. The upgrade handler now catches such failures and tears the socket down cleanly.

  • #14837 de6a951 Thanks @​1rgs! - Fix compatibility with Vite's experimental.bundledDev option. Keep Miniflare, containers, and tunnels alive when a build runs in dev.

    The plugin used the buildEnd hook as its signal that the dev server was closing, and tore down its dev resources there. Vite's experimental.bundledDev runs a build pass during serve, which fires buildEnd while the dev server is still live — so Miniflare was disposed (the next request failed with Expected \miniflare` to be defined`), locally-built container images were removed, and any active tunnel was closed, all mid-serve.

    During serve, these resources are now torn down from a patched server.close. We will replace server patching with first-class APIs when they are added to Vite.

  • #14851 fb89b72 Thanks @​exKAZUu! - Retry transient module-transport failures in the runner worker

    Each fetchModule invoke was a single fetch to the dev server with no retry. If that one fetch failed transiently (e.g. Network connection lost when workerd reuses a loopback connection that Node just closed), Vite's module runner cached the rejection and every request importing the affected module failed for the rest of the dev session. The invoke is an idempotent request for module code, so retry it up to three times before giving up.

  • Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

    • wrangler@4.115.0
    • miniflare@4.20260722.1

@​cloudflare/vite-plugin@​1.47.0

Minor Changes

  • #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

    wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

    You can explore this data two ways:

    • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
    • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

    While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

  • #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

    Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

    The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

  • Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.48.0

Minor Changes

  • #14883 76e6014 Thanks @​jamesopstad! - Serve the bundled client HTML in dev when Vite's experimental.bundledDev is enabled

    Note that this feature is experimental and subject to change.

Patch Changes

  • #14862 c232d05 Thanks @​petebacondarwin! - Destroy the client socket instead of crashing when a WebSocket upgrade fails

    If dispatchFetch rejected while a WebSocket upgrade was still in flight (for example when Miniflare is disposed during a dev server shutdown or restart), the error escaped the async upgrade handler as an unhandled rejection. This could terminate the dev server process and leaked the client socket. The upgrade handler now catches such failures and tears the socket down cleanly.

  • #14837 de6a951 Thanks @​1rgs! - Fix compatibility with Vite's experimental.bundledDev option. Keep Miniflare, containers, and tunnels alive when a build runs in dev.

    The plugin used the buildEnd hook as its signal that the dev server was closing, and tore down its dev resources there. Vite's experimental.bundledDev runs a build pass during serve, which fires buildEnd while the dev server is still live — so Miniflare was disposed (the next request failed with Expected \miniflare` to be defined`), locally-built container images were removed, and any active tunnel was closed, all mid-serve.

    During serve, these resources are now torn down from a patched server.close. We will replace server patching with first-class APIs when they are added to Vite.

  • #14851 fb89b72 Thanks @​exKAZUu! - Retry transient module-transport failures in the runner worker

    Each fetchModule invoke was a single fetch to the dev server with no retry. If that one fetch failed transiently (e.g. Network connection lost when workerd reuses a loopback connection that Node just closed), Vite's module runner cached the rejection and every request importing the affected module failed for the rest of the dev session. The invoke is an idempotent request for module code, so retry it up to three times before giving up.

  • Updated dependencies [773ead4, 773ead4, 09b8a44, 4dfb96e, 1035f74, e426cb9, 3a22ae5, 465c0fb, 465c0fb, e8b3a9d, 552bcfc, b737676, 6e0bf6e]:

    • wrangler@4.115.0
    • miniflare@4.20260722.1

1.47.0

Minor Changes

  • #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

    wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

    You can explore this data two ways:

    • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
    • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

    While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

  • #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

    Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

    The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

... (truncated)

Commits
  • 760a85b Version Packages (#14824)
  • fb89b72 fix(vite-plugin): retry transient module-transport failures in the runner wor...
  • 77c1ed3 fix(vite-plugin-cloudflare): pin npm wasm runtime override (#14895)
  • 76e6014 Support serving HTML in experimental.bundledDev (#14883)
  • 465c0fb [miniflare] Expose R2 via an S3-compatible API locally (#14280)
  • de6a951 fix(vite-plugin): keep Miniflare alive when a build runs during serve (#14837)
  • c232d05 [vite-plugin] Fix flaky WebSocket upgrade test and harden upgrade handler (#1...
  • 16b3d5a Version Packages (#14799)
  • 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
  • c4bacec Recover from workerd crashes in Miniflare (#14792)
  • See full diff in compare view

Updates @vitejs/plugin-rsc from 0.5.29 to 0.5.32

Release notes

Sourced from @​vitejs/plugin-rsc's releases.

plugin-rsc@0.5.32

Bug Fixes

  • rsc: preserve server reference metadata compatibility (#1340) (54f38e0)

plugin-rsc@0.5.31

Features

  • rsc: ability to register server function via plugins (#1310) (31cdbb8)

Bug Fixes

  • deps: update all non-major dependencies (#1327) (a00a9f8)
  • deps: update dependency react-router to v8 [security] (#1328) (4560c61)
  • rsc: correct keepUseClientProxy option typo (#1325) (6225dc9)
  • rsc: ignore root resolution errors in rsc:virtual-client-package (#1309) (d432264)

Documentation

  • replace tsc-dev with tsc in agents instruction so they won't get stuck (#1324) (036ae00)
  • rsc: document /react/* entries and update examples list (#1311) (bd417ef)

Miscellaneous Chores

  • rsc: align performance track payload with starter (#1321) (dfc36c4)
  • rsc: explain inline hoist transform with comments (#1331) (7a16ffe)
  • rsc: fix internal and example typos (#1318) (b14ed96)
  • rsc: split use cache into dedicated example (#1312) (713fed1)
  • rsc: update Tailwind and remove HMR workaround (#1329) (28f6637)

Code Refactoring

  • rsc: normalize return value of transformServerActionServer (#1313) (bc5ca14)

Tests

  • rsc: unskip performance track test in canary CI (#1308) (cd6c50f)

Continuous Integration

plugin-rsc@0.5.30

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-rsc's changelog.

0.5.32 (2026-07-28)

Bug Fixes

  • rsc: preserve server reference metadata compatibility (#1340) (54f38e0)

0.5.31 (2026-07-28)

Features

  • rsc: ability to register server function via plugins (#1310) (31cdbb8)

Bug Fixes

  • deps: update all non-major dependencies (#1327) (a00a9f8)
  • deps: update dependency react-router to v8 [security] (#1328) (4560c61)
  • rsc: correct keepUseClientProxy option typo (#1325) (6225dc9)
  • rsc: ignore root resolution errors in rsc:virtual-client-package (#1309) (d432264)

Documentation

  • replace tsc-dev with tsc in agents instruction so they won't get stuck (#1324) (036ae00)
  • rsc: document /react/* entries and update examples list (#1311) (bd417ef)

Miscellaneous Chores

  • rsc: align performance track payload with starter (#1321) (dfc36c4)
  • rsc: explain inline hoist transform with comments (#1331) (7a16ffe)
  • rsc: fix internal and example typos (#1318) (b14ed96)
  • rsc: split use cache into dedicated example (#1312) (713fed1)
  • rsc: update Tailwind and remove HMR workaround (#1329) (28f6637)

Code Refactoring

  • rsc: normalize return value of transformServerActionServer (#1313) (bc5ca14)

Tests

  • rsc: unskip performance track test in canary CI (#1308) (cd6c50f)

Continuous Integration

0.5.30 (2026-07-23)

Bug Fixes

  • rsc: keep client HMR for client modules co-located with rsc-graph code (#1248) (f0e27eb)
  • rsc: pass root importer explicitly instead of undefined for this.resolve in rsc:virtual-client-package (#1295) (372a0e7)

Documentation

... (truncated)

Commits

Updates eslint-config-next from 16.2.11 to 16.2.12

Release notes

Sourced from eslint-config-next's releases.

v16.2.12

What's Changed

Full Changelog: vercel/next.js@v16.2.11...v16.2.12

Commits

Updates wrangler from 4.113.0 to 4.115.0

Release notes

Sourced from wrangler's releases.

wrangler@4.115.0

Minor Changes

  • #14807 4dfb96e Thanks @​oOPa! - Add hidden --jurisdiction option to wrangler kv namespace create for internal testing

    This option creates a KV namespace within a specific jurisdiction (for example us, eu, or fedramp), backing it with jurisdiction-scoped storage. It is experimental and currently gated to allow-listed accounts, so it is hidden from --help until the feature is generally available.

  • #14280 465c0fb Thanks @​tahmid-23! - Add experimental local_dev.experimental_s3_credentials to r2_buckets config

    When set, the R2 bucket is served over a local S3-compatible API at /cdn-cgi/local/r2/s3/<bucket-id> during local development, authenticated with the configured AWS SigV4 credentials. <bucket-id> is the bucket's bucket_name, or the binding name if bucket_name is not set:

    {
  "r2_buckets": [
    {
      "binding": "BUCKET",
      "bucket_name": "my-bucket",
      "local_dev": {
        "experimental_s3_credentials": {
          "accessKeyId": "local-access-key-id",
          "secretAccessKey": "local-secret-access-key"
        }
      }
    }
  ]
}

  • #14877 552bcfc Thanks @​jasoncabot! - Respect and surface the Retry-After header on Cloudflare API responses

    Previously, if a Wrangler command (e.g. wrangler versions upload, wrangler deploy) hit the Cloudflare API's rate limit, the resulting error gave no indication of how long to wait before trying again, and 429 responses weren't retried at all (only 5xx errors were, with a fixed linear backoff).

    Now:

    • 429 Too Many Requests responses are automatically retried, alongside the existing 5xx retry behaviour.
    • If a retried response includes a Retry-After header, Wrangler waits for that duration instead of the default backoff, and logs a message indicating how long it's waiting. To avoid blocking for an excessive amount of time, waits longer than 60 seconds fail fast instead — the surfaced Retry-After value lets the caller schedule its own retry.
    • If a retryable error is ultimately surfaced to the user (e.g. because retries were exhausted), the error message includes a note with the Retry-After duration, and the command-failed entry written to the Wrangler output file (WRANGLER_OUTPUT_FILE_PATH/WRANGLER_OUTPUT_FILE_DIRECTORY) gains a retry_after_ms field. This lets scripts and CI/CD pipelines calling Wrangler repeatedly (for example, wrangler versions upload on every commit) read the wait duration directly instead of regex-parsing stderr.

    APIError.isRetryable() is unchanged (still 5xx only); retryOnAPIFailure() separately retries 429s. retryAfterMs, when present, is honoured for any retried error, not just 429s.

    retryAfterMs is also now populated on APIErrors raised from direct R2 object requests, the Browser Rendering API, and errors surfaced from commands using the official cloudflare SDK client.

  • #14712 6e0bf6e Thanks @​mack-erel! - Support connect() on remote VPC Network and VPC Service bindings in local development

    Remote VPC Network and VPC Service bindings previously only supported HTTP and JSRPC, so calling binding.connect(address) against a private TCP service (for example a database) failed in local dev with Incoming CONNECT on a worker not supported. Raw TCP connections through remote VPC Network and VPC Service bindings now work in local development.

    This feature is experimental. Existing HTTP and JSRPC usage of remote VPC Network and VPC Service bindings is unaffected, and no new configuration is required.

Patch Changes

... (truncated)

Commits
  • 760a85b Version Packages (#14824)
  • ee4472a [wrangler] Remove jurisdiction field from kv_namespaces in wrangler config (#...
  • 552bcfc [wrangler] Respect and surface 429 errors from HTTP requests (#14877)
  • e353367 fix output comparisons for e2e tests (#14884)
  • 4dfb96e [wrangler] Support jurisdictions for KV namespaces (#14807)
  • 09b8a44 [wrangler] Split cloudchamber curl headers on the first colon only (#14815)
  • 465c0fb [miniflare] Expose R2 via an S3-compatible API locally (#14280)
  • b737676 [wrangler] Derive old log file age from filename timestamp (#14801)
  • 16b3d5a Version Packages (#14799)
  • 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the web-deps group in /apps/web with 5 updates
55132fc 
Bumps the web-deps group in /apps/web with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `16.2.11` | `16.2.12` |
| [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.46.0` | `1.48.0` |
| [@vitejs/plugin-rsc](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-rsc) | `0.5.29` | `0.5.32` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.2.11` | `16.2.12` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.113.0` | `4.115.0` |


Updates `next` from 16.2.11 to 16.2.12
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.2.11...v16.2.12)

Updates `@cloudflare/vite-plugin` from 1.46.0 to 1.48.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.48.0/packages/vite-plugin-cloudflare)

Updates `@vitejs/plugin-rsc` from 0.5.29 to 0.5.32
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-rsc/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-rsc@0.5.32/packages/plugin-rsc)

Updates `eslint-config-next` from 16.2.11 to 16.2.12
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.2.12/packages/eslint-config-next)

Updates `wrangler` from 4.113.0 to 4.115.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.115.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-deps
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.48.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-deps
- dependency-name: "@vitejs/plugin-rsc"
  dependency-version: 0.5.32
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-deps
- dependency-name: eslint-config-next
  dependency-version: 16.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-deps
- dependency-name: wrangler
  dependency-version: 4.115.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants