Skip to content

build(deps): bump the npm-dependencies group with 8 updates - #107

Merged
ibrunotome merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-0adee4a675
Aug 29, 2026
Merged

build(deps): bump the npm-dependencies group with 8 updates#107
ibrunotome merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-0adee4a675

Conversation

@dependabot

@dependabotdependabotBot commented on behalf of githubAug 28, 2026•
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies group with 8 updates:

PackageFromTo
lucide-react1.31.01.33.0
viem2.55.162.55.19
@cloudflare/vite-plugin1.52.11.53.1
@cloudflare/workers-types5.20260814.15.20260821.1
@vitejs/plugin-react6.0.56.1.0
eslint-plugin-react-you-might-not-need-an-effect1.0.11.0.2
wrangler4.123.04.125.0
vite-plus0.2.90.3.0

Updates lucide-react from 1.31.0 to 1.33.0

Release notes

Sourced from lucide-react's releases.

Version 1.33.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.32.0...1.33.0

Version 1.32.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.31.0...1.32.0

Commits

Updates viem from 2.55.16 to 2.55.19

Release notes

Sourced from viem's releases.

viem@2.55.19

Patch Changes

viem@2.55.18

Patch Changes

viem@2.55.17

Patch Changes

Commits

Updates @cloudflare/vite-plugin from 1.52.1 to 1.53.1

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.53.1

Patch Changes

@​cloudflare/vite-plugin@​1.53.0

Minor Changes

  • #150266529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

    A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

    {
"name": "my-worker",
"main": "worker.js",
"compatibility_date": "2026-07-01",
"containers": [
{ "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
],
"exports": {
"MyContainerDO": {
"type": "durable-object",
"storage": "sqlite",
"container": "my-container"
}
}
}

    The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

    container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

    • a container reference names a container that does not exist
    • two Durable Object exports claim the same container
    • a container and a Durable Object export disagree about which one they are linked to
    • a container ends up linked to no Durable Object at all
    • two containers share a name
    • a container's class_name names a Durable Object whose storage is legacy-kv
    • two containers are attached to the same Durable Object

    That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

  • #152383a4fc6b Thanks @​jamesopstad! - Honor access.dev when running Workers with @cloudflare/vite-plugin, so ctx.access.getIdentity() returns the configured identity.

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.53.1

Patch Changes

1.53.0

Minor Changes

  • #150266529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

    A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

    {
"name": "my-worker",
"main": "worker.js",
"compatibility_date": "2026-07-01",
"containers": [
{ "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
],
"exports": {
"MyContainerDO": {
"type": "durable-object",
"storage": "sqlite",
"container": "my-container"
}
}
}

    The existing containers[].class_name direction keeps working and either direction may be used, but the two must agree: a container that names its Durable Object cannot also be claimed by a different one.

    container is only valid on live durable-object exports (created and expecting-transfer) and requires storage: "sqlite". Wrangler now also reports an error when:

    • a container reference names a container that does not exist
    • two Durable Object exports claim the same container
    • a container and a Durable Object export disagree about which one they are linked to
    • a container ends up linked to no Durable Object at all
    • two containers share a name
    • a container's class_name names a Durable Object whose storage is legacy-kv
    • two containers are attached to the same Durable Object

    That last case was previously accepted but could never work: workerd attaches a single container per Durable Object namespace, and in local development every container for a class builds into the same image tag, so one silently overwrote the other. If you have two containers on one class_name, give each its own Durable Object class.

Patch Changes

... (truncated)

Commits

Updates @cloudflare/workers-types from 5.20260814.1 to 5.20260821.1

Commits

Updates @vitejs/plugin-react from 6.0.5 to 6.1.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import{defineConfig}from'vite'importreactfrom'@vitejs/plugin-react'exportdefaultdefineConfig({plugins: [react({compiler: true})]})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import{defineConfig}from'vite'importreactfrom'@vitejs/plugin-react'exportdefaultdefineConfig({plugins: [react({compiler: true})]})

Commits

Updates eslint-plugin-react-you-might-not-need-an-effect from 1.0.1 to 1.0.2

Release notes

Sourced from eslint-plugin-react-you-might-not-need-an-effect's releases.

v1.0.2

1.0.2 (2026-08-20)

Miscellaneous Chores

Changelog

Sourced from eslint-plugin-react-you-might-not-need-an-effect's changelog.

1.0.2 (2026-08-20)

Miscellaneous Chores

Commits

Updates wrangler from 4.123.0 to 4.125.0

Release notes

Sourced from wrangler's releases.

wrangler@4.125.0

Minor Changes

  • #1499559872c4 Thanks @​ThomasRubini! - Add connect trigger for raw sockets

    You can now configure a Worker to receive raw socket connections during wrangler dev, delivered directly to the Worker's connect(socket, env, ctx) handler:

    {
"connect": [{ "protocol": "tcp", "port": 5432 }]
}

    Each entry opens a listening socket on 127.0.0.1 (or the given address) that forwards incoming connections straight to the Worker, bypassing the local dev HTTP entry point. This requires the experimental compatibility flag. Only "tcp" is supported at the moment.

    @cloudflare/config also supports declaring this trigger via triggers.connect(...), which lowers to the connect field above:

    import{defineWorker,triggers}from"@cloudflare/config";exportdefaultdefineWorker({triggers: [triggers.connect({protocol: "tcp",port: 5432,address: "127.0.0.1"}),],});

  • #15172c68f9cb Thanks @​WillTaylorDev! - Add container support to worker previews

    Worker previews now support containers through a new previews.containers configuration block. Container configuration doesn't inherit, so declare containers explicitly in the previews block to enable them for previews. This mirrors how previews.durable_objects works today. Wrangler names each preview container application {worker_name}_{preview_slug}_{class_name}, normalising and shortening the result to what the API accepts. Either change appends a short digest of the composed name, so two names that would otherwise land on one stay distinct. An entry cannot set its own name, because application names are unique to an account and a fixed name would collide between two previews of the same Worker. A Durable Object class is backed by at most one container application, so the validator rejects two entries that share a class_name. Wrangler skips container applications bound to Durable Object classes that another Worker implements through script_name, because the implementing Worker owns its own container application. A binding is not required: a Durable Object declared through migrations or exports and reached only over ctx.exports can still back a container. Every entry must set class_name. A previews.containers entry whose class_name matches no Durable Object class at all is rejected before the preview deployment is created, so a typo fails loudly instead of producing a preview with no container.

    Wrangler creates the container applications on wrangler preview. Deleting a preview tears them down server side, so wrangler preview delete doesn't remove them.

    Container build and deploy progress prints to stdout. wrangler preview --json suppresses wrangler's own output so it doesn't interleave with the payload, and warnings and errors still go to stderr. Docker's build output and the progress spinner write to stdout directly and bypass that suppression, so parse --json from a non interactive shell, where the spinner is skipped, and prefer a prebuilt image over a Dockerfile.

  • #15174649f667 Thanks @​WillTaylorDev! - [private beta]: Create the parent Worker automatically when wrangler preview targets one that doesn't exist yet

    Previews hang off a parent Worker, so running wrangler preview before the Worker had ever been deployed failed with a raw API error naming the Preview endpoint. Wrangler now offers to create an empty parent Worker and then carries on creating the Preview. The parent uses the same workers.dev and Preview URL settings that wrangler deploy would resolve, without applying routes or cron triggers. In non-interactive environments, Wrangler creates the Worker without asking.

  • #1473530c2d47 Thanks @​vaishnav-mk! - Add individual and batch Workflow instance deletion to the runtime and SDK.

    • WorkflowInstance.delete() deletes one instance. Self-deletion stops the current execution.
    • env.MY_WORKFLOW.deleteBatch(instanceIds) deletes up to 100 instances and returns { deleted, errors } per input position.
    • wrangler workflows instances delete <name> [id..] deletes instances remotely or with --local; IDs can also come from a JSON array passed with --filename, with a combined limit of 100.

Patch Changes

  • #152605ae9d5b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

... (truncated)

Commits

Updates vite-plus from 0.2.9 to 0.3.0

Release notes

Sourced from vite-plus's releases.

vite-plus v0.3.0: XDG install layout, tsup project migration, and Bun 1.4 support

Fresh installs now use a split directory layout instead of a single ~/.vite-plus root. Unix follows the XDG base directory specification, and Windows uses the standard %LOCALAPPDATA% and %APPDATA% folders. Existing ~/.vite-plus installs keep their current directory layout. vp migrate also converts tsup projects, and vp now sends Bun 1.4 package-manager commands to bun directly. The published npm package shrank by about half, and the upgrade check no longer delays each command.

Breaking Changes

  • Fresh installs now use a split directory layout instead of a single root: XDG base directories on Unix, and the standard known folders on Windows. Existing ~/.vite-plus installs keep their current layout, and the installer does not move their files. VP_HOME still selects the single-root layout (#2346), by @​forehalo

    CategoryUnix defaultWindows defaultSingle-root (VP_HOME)
    bin~/.local/share/vite-plus/bin%LOCALAPPDATA%\vite-plus\bin<root>/bin
    data~/.local/share/vite-plus%LOCALAPPDATA%\vite-plus\data<root>
    cache~/.cache/vite-plus%LOCALAPPDATA%\vite-plus\cache<root>/cache
    config~/.config/vite-plus%APPDATA%\vite-plus<root>
    state~/.local/state/vite-plus%LOCALAPPDATA%\vite-plus\state<root>

    The installer configures your shell for the new location, and CI that installs through setup-vp keeps the single-root layout automatically. Update each hard-coded ~/.vite-plus/bin path, such as a path in a Dockerfile.

    vp upgrade leaves an existing install where it is. To move one to the split layout, remove it and install again:

    vp implode
unset VP_HOME VP_DATA_DIR VP_BIN_DIR VP_CACHE_DIR
curl -fsSL https://vite.plus | bash

    On Windows, run vp implode, then Remove-Item Env:\VP_HOME, Env:\VP_DATA_DIR, Env:\VP_BIN_DIR, Env:\VP_CACHE_DIR -ErrorAction SilentlyContinue, then irm https://vite.plus/ps1 | iex. Also delete any persistent VP_HOME or VP_*_DIR definition from your shell profile or system environment, because a fresh install still honors them and VP_HOME selects the single-root layout.

    vp implode removes every Vite+ managed Node.js runtime, global package, configuration file, and cache. Stay on your current layout if you would rather not rebuild that state. See Move an existing install to the split directory layout.

Highlights

  • vp migrate now converts tsup projects. It replaces the tsup dependency and script with vp pack. It also changes tsup.config.ts to a tsdown.config.ts that imports from vite-plus/pack (#2434), by @​KTrain5169
  • Shell integrations now accept the global -C flag. vp -C <dir> env use changes the environment of your current shell. The -C<dir> and -C=<dir> forms also work. In zsh, Fish, Nushell, and PowerShell, vpr completion keeps the working directory when it changes the command to vp run (#2508), by @​simulacre7
  • The published vite-plus npm package shrank from 1.05 MB to 516 kB, a 51% reduction. It now includes only Markdown files from the documentation workspace. It no longer includes VitePress tooling, images, or deployment files (#2480), by @​liangmiQwQ

Features

  • With Bun 1.4 or later, Vite+ forwards these commands and flags to bun. Earlier Bun versions keep their fallback or unsupported behavior and report the required Bun version (#2513), by @​jong-kyung
    • vp dedupe runs bun dedupe, including --check
    • vp pm prune runs bun prune
    • vp pm audit --fix runs bun audit fix
    • vp add, vp remove, and vp update send --filter to bun
    • vp add --save-catalog sends --catalog to bun
  • The upgrade check no longer delays fast commands. It runs in a separate process. It reports an available update during a later command, and commands no longer wait for the registry (#2380), by @​liangmiQwQ
  • Upgrade the bundled toolchain (#2443, #2500, #2504, #2519, #2532), by @​voidzero-guard[bot]:
    • vite: 8.2.1 to 8.2.2
    • rolldown: 1.2.3 to 1.2.5
    • vitest: 4.1.10 to 4.1.11
    • oxlint: 1.77.0 to 1.79.0
    • oxfmt: 0.62.0 to 0.64.0

... (truncated)

Commits
  • b2d15e3 release: v0.3.0: XDG install layout, tsup project migration, and Bun 1.4 supp...
  • ce131be fix(cli): run root-only workspaces in place (#2533)
  • 634bd07 fix(cli): improve workspace app target classification (#2530)
  • 501cc3a feat(cli): tsup -> tsdown -> Vite+ migration (#2434)
  • 916fae1 fix(cli): guide local users to global-only commands (#2522)
  • 45acff9 fix(trampoline): reject unversioned shim pointers (#2526)
  • f0bebb0 fix(installer): hide shell config warnings in CI (#2511)
  • c25b6b2 fix(installer): enforce Windows setup requirements (#2505)
  • 349a72b fix(cli): support GitLab setup-vp legacy layout (#2520)
  • 2b16995 fix(cli): normalize staged concurrency options (#2501)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by cubic

Bumps the npm-dependencies group to keep runtime libraries and dev tooling current. No app behavior changes; all updates are upstream patches, minor features, and dependency refreshes.

  • viem renames the Tempo Earn entry recovery parameter from recoveryRecipient to tempoRefundRecipient, a breaking change for any viem/tempo usage.
  • vite-plus 0.3.0 halves its published package size, drops the upgrade-check delay from fast commands, and moves fresh installs to a split XDG layout.
  • @cloudflare/vite-plugin and wrangler add local-dev features including raw socket connect triggers, workflow instance deletion, and container-backed previews.

Written for commit 7b80c7f. Summary will update on new commits.

@dependabot
build(deps): bump the npm-dependencies group with 8 updates
7b80c7f
Bumps the npm-dependencies group with 8 updates:
| Package | From | To |
| --- | --- | --- |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.33.0` |
| [viem](https://github.com/wevm/viem) | `2.55.16` | `2.55.19` |
| [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.52.1` | `1.53.1` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260814.1` | `5.20260821.1` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` |
| [eslint-plugin-react-you-might-not-need-an-effect](https://github.com/nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect) | `1.0.1` | `1.0.2` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.123.0` | `4.125.0` |
| [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) | `0.2.9` | `0.3.0` |
Updates `lucide-react` from 1.31.0 to 1.33.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.33.0/packages/lucide-react)
Updates `viem` from 2.55.16 to 2.55.19
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@2.55.16...viem@2.55.19)
Updates `@cloudflare/vite-plugin` from 1.52.1 to 1.53.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.53.1/packages/vite-plugin-cloudflare)
Updates `@cloudflare/workers-types` from 5.20260814.1 to 5.20260821.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)
Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)
Updates `eslint-plugin-react-you-might-not-need-an-effect` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect/releases)
- [Changelog](https://github.com/nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect/blob/main/CHANGELOG.md)
- [Commits](nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect@v1.0.1...v1.0.2)
Updates `wrangler` from 4.123.0 to 4.125.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.125.0/packages/wrangler)
Updates `vite-plus` from 0.2.9 to 0.3.0
- [Release notes](https://github.com/voidzero-dev/vite-plus/releases)
- [Commits](https://github.com/voidzero-dev/vite-plus/commits/v0.3.0/packages/cli)
---
updated-dependencies:
- dependency-name: lucide-react
dependency-version: 1.33.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-dependencies
- dependency-name: viem
dependency-version: 2.55.19
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: npm-dependencies
- dependency-name: "@cloudflare/vite-plugin"
dependency-version: 1.53.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-dependencies
- dependency-name: "@cloudflare/workers-types"
dependency-version: 5.20260821.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-dependencies
- dependency-name: "@vitejs/plugin-react"
dependency-version: 6.1.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-dependencies
- dependency-name: eslint-plugin-react-you-might-not-need-an-effect
dependency-version: 1.0.2
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: npm-dependencies
- dependency-name: wrangler
dependency-version: 4.125.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: npm-dependencies
- dependency-name: vite-plus
dependency-version: 0.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: npm-dependencies
...
Signed-off-by: dependabot[bot] <support@github.com>
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 28, 2026
@dependabot
dependabotBot requested a review from a teamAugust 28, 2026 12:10
@dependabotdependabotBot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 28, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pagesBot commented Aug 28, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Deploying with Cloudflare Workers Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

StatusNameLatest CommitPreview URLUpdated (UTC)
✅ Deployment successful!
View logs		auth7b80c7fCommit Preview URL

Branch Preview URL		Aug 28 2026, 12:11 PM

@socket-security

socket-securityBot commented Aug 28, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security		VulnerabilityQualityMaintenanceLicense
Added@​voidzero-dev/​vite-plus-core@​0.3.0971007799100
Addedlucide-react@​1.33.0100100989680
Added@​cloudflare/​vite-plugin@​1.53.1971008596100
Addedwrangler@​4.125.0981009296100
Addedeslint-plugin-react-you-might-not-need-an-effect@​1.0.210010010093100
Added@​vitejs/​plugin-react@​6.1.010010010095100
Added@​cloudflare/​workers-types@​5.20260821.11001009699100
Addedvite-plus@​0.3.097100100100100

View full report

@ibrunotome
ibrunotome merged commit 3da085a into mainAug 29, 2026
5 checks passed
@ibrunotome
ibrunotome deleted the dependabot/npm_and_yarn/npm-dependencies-0adee4a675 branch August 29, 2026 13:39
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ibrunotome