fix(deps): update all non-major dependencies

[khepri-bot]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@cloudflare/vite-plugin (source)	1.52.1 → 1.54.4			devDependencies	minor	1.56.0 (+8)
@cloudflare/vitest-pool-workers (source)	0.21.3 → 0.22.0			devDependencies	minor
@octokit/core	7.0.7 → 7.0.8			dependencies	patch
@octokit/core	7.0.7 → 7.0.8			devDependencies	patch
@playwright/test (source)	1.62.1 → 1.63.0			devDependencies	minor
@sentry/cloudflare (source)	10.70.0 → 10.73.0			dependencies	minor	10.75.0 (+1)
@sentry/solid (source)	10.70.0 → 10.73.0			dependencies	minor	10.75.0 (+1)
@testing-library/user-event	14.6.4 → 14.6.7			devDependencies	patch
@types/node (source)	26.2.0 → 26.4.1			devDependencies	minor	26.6.2 (+4)
daisyui (source)	5.7.17 → 5.7.28			devDependencies	patch	5.7.42 (+10)
happy-dom	20.11.2 → 20.14.0			devDependencies	minor	20.14.5 (+4)
node	24.19.0 → 24.20.0			uses-with	minor	24.21.0
pnpm/action-setup	v6.0.10 → v6.1.0			action	minor
solid-js (source)	1.9.14 → 1.9.15			dependencies	patch
tsx (source)	4.23.12 → 4.23.13			devDependencies	patch	4.23.15 (+1)
vite (source)	8.2.1 → 8.2.2			devDependencies	patch	8.3.0
wrangler (source)	4.123.0 → 4.129.0			devDependencies	minor	4.135.0 (+8)
zod (source)	4.4.3 → 4.5.4			dependencies	minor	4.6.5 (+5)

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vite-plugin)

v1.54.4

Compare Source

Patch Changes

• #​15407 7662118 Thanks @​xgame92! - Surface Worker export type fetch errors during development

  The Vite plugin now reports the Worker name, HTTP status, and response body when fetching export types fails. This preserves the underlying error instead of replacing it with a JSON parsing error.

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6, 93d72a5, f6fb347, f6fb347, dc24057, d2d8eea]:

  • miniflare@5.20260903.0-alpha
  • wrangler@​4.129.0

v1.54.3

Compare Source

Patch Changes

• Updated dependencies [dbbb795, 200780f, b3f2628, 87a7acf, 1809c5e, ea28cc3, b3fb2bf, 707cb6f]:
  • wrangler@​4.128.0
  • miniflare@5.20260831.0-alpha

v1.54.2

Compare Source

Patch Changes

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:
  • miniflare@5.20260828.0-alpha
  • wrangler@​4.127.1

v1.54.1

Compare Source

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@​4.127.0

v1.54.0

Compare Source

Minor Changes

• #​15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

  Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

• #​15326 9fcb1c9 Thanks @​jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

  The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.

Patch Changes

• Updated dependencies [aa54b49, 4a67a28, 2d78137, 04e8564, d1cc3af, 693ca29, 693ca29, 693ca29, daefb3c, 37ed753, f76b68e, ad89456, c809851, c66d2d5, 693ca29, 74de3ab, 0cb8690, 9fcb1c9, 22182da, a4c3458, 433fa98, d589d30, dd5148d, 82d11fc]:
  • miniflare@5.20260825.0-alpha
  • wrangler@​4.126.0

v1.53.1

Compare Source

Patch Changes

• Updated dependencies [59872c4, c68f9cb, 99a1f49, 5ae9d5b, 4b52975, ce9b151, ef73a28, 649f667, 39dcea6, 99a1f49, 99a1f49, 99a1f49, f2437e6, 30c2d47]:
  • wrangler@​4.125.0
  • miniflare@5.20260820.0-alpha

v1.53.0

Compare Source

Minor Changes

• #​15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

  A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

  {
    "name": "my-worker",
    "main": "worker.js",
    "compatibility_date": "2026-07-01",
    "containers": [
      { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
    ],
    "exports": {
      "MyContainerDO": {
        "type": "durable-object",
        "storage": "sqlite",
        "container": "my-container"
      }
    }
  }

  The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

  container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

  • a container reference names a container that does not exist
  • two Durable Object exports claim the same container
  • a container and a Durable Object export disagree about which one they are linked to
  • a container ends up linked to no Durable Object at all
  • two containers share a name
  • a container's class_name names a Durable Object whose storage is legacy-kv
  • two containers are attached to the same Durable Object

  That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

• #​15238 3a4fc6b Thanks @​jamesopstad! - Honor access.dev when running Workers with @cloudflare/vite-plugin, so ctx.access.getIdentity() returns the configured identity.

• #​15028 d4f441f Thanks @​harshmathurx! - Handle Worker-side request body cancellation without surfacing stream controller errors in local dev.

• #​15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

  When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

  The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

• #​15239 f431166 Thanks @​jamesopstad! - Prevent date-enabled Node.js compatibility from adding conflicting globals to generated runtime types

  Runtime type generation now treats Node.js compatibility enabled by a compatibility date the same way as an explicit nodejs_compat flag. Node.js globals continue to come from @types/node instead of being generated as any declarations that override those types.

• #​15196 8fb2b87 Thanks @​skepticfx! - Use the FedRAMP High managed container registry when Wrangler targets the FedRAMP High compliance region

  Container builds, pushes, deployments, image commands, and local development now select the corresponding production or staging FedRAMP registry and API from either compliance_region or CLOUDFLARE_COMPLIANCE_REGION.

• Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

  • wrangler@​4.124.0
  • miniflare@5.20260815.0-alpha

cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.22.0

Compare Source

Minor Changes

• #​13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

  @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

  If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

• #​15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

• #​15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

  When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

• #​15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

  inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

• #​15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

• #​15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

  When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

  The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

• Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

  • wrangler@​4.124.0
  • miniflare@5.20260815.0-alpha

octokit/core.js (@​octokit/core)

v7.0.8

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v18 (#​800) (9729779)

microsoft/playwright (@​playwright/test)

v1.63.0

Compare Source

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock.
Tests that share a lock name never run concurrently, across files, workers and projects, while
everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group.
Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended
replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments,
and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API
steps, the subtitle is the locator or the navigation url — for example, Click with subtitle getByRole('button').
Both are rendered next to the step title in the trace viewer and the HTML report.

🖼️ Aria and screen snapshots in traces

The snapshots option of tracing.start() and the testOptions.trace fixture option now accept an
object selecting what to capture on every action:

// playwright.config.ts
export default defineConfig({
  use: {
    trace: {
      mode: 'on',
      snapshots: { dom: true, aria: true, screen: true }
    },
  },
});

With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot
side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.

New APIs

Browser and Context

• httpCredentials now also accepts an array of credentials. The first entry matching the request origin is used, and entries without an origin match any request.
• New option opfs includes the origin private file system in the storage state, so it can be persisted and restored into later contexts.
• New events page.on('dialogclosed') and browserContext.on('dialogclosed') are emitted when a JavaScript dialog is accepted, dismissed or closed by the user.

Locators

• New locator.ariaSnapshotJSON() and page.ariaSnapshotJSON() return the aria snapshot as a JSON value instead of YAML markup, with mode, depth and boxes options.
• apiRequestContext.get() and other request methods accept a type argument that types the response json():

const response = await request.get<User>('/api/users/42');
const user = await response.json(); // typed as User

Test runner

• New standalone testOptions.reducedMotion, testOptions.forcedColors and testOptions.contrast options.
• New --add-reporter command line option appends a reporter on top of the ones configured in playwright.config, instead of replacing them like --reporter does.
• New omitTags option for the list, line, dot, github and junit reporters suppresses the tags that are automatically appended to test titles.

Command line

• npx playwright install --no-remove keeps the browsers of other Playwright installations instead of removing them.
• npx playwright codegen --http-credentials records against pages behind HTTP authentication.

Miscellaneous

• New built-in perfetto reporter writes a Trace Event Format file for the Perfetto UI or chrome://tracing, rendering the test run as a timeline with a lane per worker.
• The HTML report renders a duration waterfall next to test steps.

Announcements

• ⚠️ The experimental @playwright/experimental-ct-react, @playwright/experimental-ct-react17 and @playwright/experimental-ct-vue packages will no longer be updated. Follow the migration guide to move to the stories model introduced in 1.62. Story ids passed to fixtures.mount() can now be typed through the generated Stories registry.
• ⚠️ Ubuntu 20.04 is not supported anymore.
• 🐧 On Linux arm64, Playwright now downloads the Chrome for Testing build of Chromium, the same build used on all other platforms.

Browser Versions

• Chromium 153.0.8010.12
• Mozilla Firefox 155.0
• WebKit 26.6

This version was also tested against the following stable channels:

• Google Chrome 153
• Microsoft Edge 153

getsentry/sentry-javascript (@​sentry/cloudflare)

v10.73.0

Compare Source

Important Changes

• feat(v10/nextjs): Add @sentry/nextjs/config entry point (#​23766)

  withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

  // next.config.mjs
  - import { withSentryConfig } from '@sentry/nextjs';
  + import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

• feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#​23734)
• fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#​23769)

Internal Changes

• test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#​23775)

Bundle size 📦

Path	Size
@​sentry/browser	27.1 KB
@​sentry/browser - with treeshaking flags	25.58 KB
@​sentry/browser (incl. Tracing)	45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.28 KB
@​sentry/browser (incl. Tracing, Profiling)	50.17 KB
@​sentry/browser (incl. Tracing, Replay)	83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.83 KB
@​sentry/browser (incl. Feedback)	43.87 KB
@​sentry/browser (incl. sendFeedback)	31.78 KB
@​sentry/browser (incl. FeedbackAsync)	36.79 KB
@​sentry/browser (incl. Metrics)	28.16 KB
@​sentry/browser (incl. Logs)	28.38 KB
@​sentry/browser (incl. Metrics & Logs)	29.06 KB
@​sentry/react	28.86 KB
@​sentry/react (incl. Tracing)	47.74 KB
@​sentry/vue	32.4 KB
@​sentry/vue (incl. Tracing)	47.46 KB
@​sentry/svelte	27.12 KB
CDN Bundle	29.43 KB
CDN Bundle (incl. Tracing)	47.45 KB
CDN Bundle (incl. Logs, Metrics)	30.98 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	48.72 KB
CDN Bundle (incl. Replay, Logs, Metrics)	69.34 KB
CDN Bundle (incl. Tracing, Replay)	84.09 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	85.37 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	89.76 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91 KB
CDN Bundle - uncompressed	87.76 KB
CDN Bundle (incl. Tracing) - uncompressed	143.4 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	92.36 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	147.29 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	214.26 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	259.91 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	263.78 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	273.29 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	277.15 KB
@​sentry/nextjs (client)	50.22 KB
@​sentry/sveltekit (client)	45.94 KB
@​sentry/core/server	78.67 KB
@​sentry/core/browser	65.18 KB
@​sentry/node-core	61.78 KB
@​sentry/node	122.81 KB
@​sentry/node (incl. diagnostics channel injection)	165.86 KB
@​sentry/node/import (ESM hook with diagnostics-channel injection)	166 B
@​sentry/node/light	50.21 KB
@​sentry/node - without tracing	73.19 KB
@​sentry/aws-serverless	82.24 KB
@​sentry/cloudflare (withSentry) - minified	197.84 KB
@​sentry/cloudflare (withSentry)	486.96 KB

v10.72.0

Compare Source

Important Changes

• AI integrations no longer report errors that propagate to the caller (#​23638, #​23639, #​23640)

  Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

• feat(v10/cloudflare): Add rpcTracePropagationBindings (#​23737, #​23738)

  The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

• fix(v10/astro): support astro v7 route patterns properly (#​23657)
• fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#​23595)
• fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#​23673)
• fix(v10/node): Only end the process session when it is still ok (#​23731)
• fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#​23589)
• fix(v10/replay): Suppress Worker destroyed error on session expiry (#​23654)
• fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#​23591)
• fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#​23667)
• fix(v10/server-utils): Support openai v7 in auto-instrumentation (#​23713)
• fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#​23656)

Internal Changes

• chore(v10): Add external contributor to CHANGELOG.md (#​23626)
• docs(v10): Changelog + contributor credit for AI caller-handled error fixes (#​23641)
• test(v10/e2e): Fix scripts for nuxt dev server (#​23658)
• test(v10/e2e): Look up events via the organization trace endpoint (#​23680)
• test(v10/e2e): Look up the symbolicated event via the eventids endpoint (#​23681)

Work in this release was contributed by @​ryanrho-mercor, @​lux-in-tenebris-lucet, and @​suhailopensource. Thank you for your contributions!

Bundle size 📦

Path	Size
@​sentry/browser	27.1 KB
@​sentry/browser - with treeshaking flags	25.58 KB
@​sentry/browser (incl. Tracing)	45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.28 KB
@​sentry/browser (incl. Tracing, Profiling)	50.17 KB
@​sentry/browser (incl. Tracing, Replay)	83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.83 KB
@​sentry/browser (incl. Feedback)	43.87 KB
@​sentry/browser (incl. sendFeedback)	31.78

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 08:59 AM, only on Monday (* 0-8 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.