[dependabot]

Bumps the development group with 8 updates in the / directory:

Package	From	To
@cloudflare/vite-plugin	1.65.0	1.66.0
@types/node	26.6.5	26.6.6
@vinext/cloudflare	1.2.0	1.3.0
eslint	10.13.0	10.14.0
eslint-config-next	16.4.2	16.4.3
fake-indexeddb	6.2.6	6.2.7
vinext	1.3.0	1.4.0
wrangler	4.152.0	4.154.0

Updates @cloudflare/vite-plugin from 1.65.0 to 1.66.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.66.0

Minor Changes

• #16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

• #16444 79678c4 Thanks @​petebacondarwin! - Update Vite plugin v1 to the October 23 Workers runtime

  Use Miniflare 5.20261023.0-beta and the matching Wrangler release for local development and preview. Align bundled helpers and Workers types with this runtime, and use 2026-10-23 as the fallback compatibility date when none is configured. The runtime and helper updates also prevent malformed HTTP responses with excessive content encodings from causing unhandled stream errors. The published helpers also update their bundled Zod validator and fix Windows keyring setup for remote-binding credentials when the configuration path contains spaces.

• #16479 1d5354b Thanks @​petebacondarwin! - Treat cloudflare:durable-objects as a built-in runtime module

  Workers can import retryable() from cloudflare:durable-objects to mark Durable Object methods as safe to retry. The plugin now leaves that import for the runtime to resolve, as it does for cloudflare:workers, instead of trying to resolve it as a package.

• #16493 4ce6176 Thanks @​petebacondarwin! - Preserve a Worker response's statusText in Vite dev and preview

  Responses such as new Response(body, { status: 231, statusText: "Custom" }) now reach the browser as 231 Custom instead of 231 unknown. Empty status text is also preserved over HTTP/1.x.

• #16501 109844e Thanks @​petebacondarwin! - Preserve separate Set-Cookie request headers in Vite dev and preview

  Workers now receive each incoming Set-Cookie value separately for HTTP requests and WebSocket upgrades, including values with commas in an Expires date. Previously, multiple values could be combined into one header.

• #16503 ca116f9 Thanks @​petebacondarwin! - Fix a dev server failing to start when an earlier dev server in the same process had different Worker exports

  The Vite plugin now clears the Worker export types it detected when a dev server closes. A dev server created afterwards in the same process derives them from its own config again, so it no longer fails with Class extends value undefined for a Durable Object the earlier server's Worker did not export.

• #16504 436fa9a Thanks @​petebacondarwin! - Fix Vite DevTools WebSocket connections closing unexpectedly

  Leave upgrades at /__devtools/__ws to Vite DevTools instead of forwarding them to the Worker. Sandbox preview requests continue to reach the Worker.

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.66.0

Minor Changes

• #16539 046db08 Thanks @​petebacondarwin! - Update the development registry to use the canonical Cloudflare path

  Upgrade Miniflare to 5.20261023.1-beta and Wrangler to 4.154.0. Vite plugin v1 now uses CLOUDFLARE_DEV_REGISTRY_PATH or <Cloudflare config directory>/dev-registry/v5 for Worker discovery. MINIFLARE_REGISTRY_PATH is no longer read. When mixing Vite and Wrangler development sessions, set the same CLOUDFLARE_DEV_REGISTRY_PATH for both because Wrangler retains its legacy default.

• #16407 9ec1101 Thanks @​petebacondarwin! - Support remote Hyperdrive bindings in Vite plugin v1 development and preview

  Set remote: true on a Hyperdrive binding in wrangler.jsonc to connect to its deployed configuration without a local database connection string. The retained remote proxy exposes the binding's connection string and socket streams, and remote session cleanup preserves startup errors and shares one disposal attempt.

Patch Changes

• #16542 ef573d4 Thanks @​petebacondarwin! - Preserve machine-readable error properties from remote bindings

  Enable enhanced error serialization on the remote proxy Worker used by Vite plugin v1. Combined with Miniflare 5.20261023.1-beta, remote binding errors retain properties such as code and numericCode so Worker code can handle them without parsing error messages.

• #16480 ccaa34a Thanks @​petebacondarwin! - Prevent malformed token-exchange responses from crashing remote binding startup

  Update the Undici dependency bundled from the retained remote-bindings package to 7.30.1. Responses with excessive content encodings now reject without a later unhandled stream error when the server closes the connection early.

• #16502 6f2eda1 Thanks @​petebacondarwin! - Update the retained asset configuration validator to Zod 4.6.6

  The Vite plugin validates _headers and _redirects through its private workers-shared package. Update that bundled copy to address excessive memory consumption when validating oversized collections.

• #16444 79678c4 Thanks @​petebacondarwin! - Update Vite plugin v1 to the October 23 Workers runtime

  Use Miniflare 5.20261023.0-beta and the matching Wrangler release for local development and preview. Align bundled helpers and Workers types with this runtime, and use 2026-10-23 as the fallback compatibility date when none is configured. The runtime and helper updates also prevent malformed HTTP responses with excessive content encodings from causing unhandled stream errors. The published helpers also update their bundled Zod validator and fix Windows keyring setup for remote-binding credentials when the configuration path contains spaces.

• #16479 1d5354b Thanks @​petebacondarwin! - Treat cloudflare:durable-objects as a built-in runtime module

  Workers can import retryable() from cloudflare:durable-objects to mark Durable Object methods as safe to retry. The plugin now leaves that import for the runtime to resolve, as it does for cloudflare:workers, instead of trying to resolve it as a package.

• #16493 4ce6176 Thanks @​petebacondarwin! - Preserve a Worker response's statusText in Vite dev and preview

  Responses such as new Response(body, { status: 231, statusText: "Custom" }) now reach the browser as 231 Custom instead of 231 unknown. Empty status text is also preserved over HTTP/1.x.

• #16501 109844e Thanks @​petebacondarwin! - Preserve separate Set-Cookie request headers in Vite dev and preview

  Workers now receive each incoming Set-Cookie value separately for HTTP requests and WebSocket upgrades, including values with commas in an Expires date. Previously, multiple values could be combined into one header.

• #16503 ca116f9 Thanks @​petebacondarwin! - Fix a dev server failing to start when an earlier dev server in the same process had different Worker exports

  The Vite plugin now clears the Worker export types it detected when a dev server closes. A dev server created afterwards in the same process derives them from its own config again, so it no longer fails with Class extends value undefined for a Durable Object the earlier server's Worker did not export.

• #16504 436fa9a Thanks @​petebacondarwin! - Fix Vite DevTools WebSocket connections closing unexpectedly

  Leave upgrades at /__devtools/__ws to Vite DevTools instead of forwarding them to the Worker. Sandbox preview requests continue to reach the Worker.

Commits

• ae80956 [vite-plugin] Version v1 maintenance release (#16544)
• 046db08 [vite-plugin] Update v1 development registry and runtime (#16539)
• 79678c4 [vite-plugin] Update v1 to the October 23 runtime (#16444)
• d3b872f [vite-plugin] Route v1 DevTools WebSocket upgrades explicitly (#16540)
• 436fa9a [vite-plugin] Preserve WebSockets owned by other v1 listeners (#16504)
• ca116f9 [vite-plugin] Clear v1 Worker exports between dev servers (#16503)
• 109844e [vite-plugin] Preserve repeated request cookies in v1 (#16501)
• 4ce6176 [vite-plugin] Preserve Worker response status text in v1 (#16493)
• 1d5354b [vite-plugin] Resolve Durable Object runtime imports in v1 (#16479)
• See full diff in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates @vinext/cloudflare from 1.2.0 to 1.3.0

Release notes

Sourced from @​vinext/cloudflare's releases.

@​vinext/cloudflare@​1.3.0

Read the Vinext 1.4 release post for the highlights.

Features

Cloudflare

• share one Response Store App Router entry across hosts (#3897)
• store both parts of a page whenever Workers Cache renders one (#4333)
• store both parts of a page whenever Response Store stores or regenerates one (#4332)
• store the page's document when an RSC request misses its Response Store entry (#4331)
• add --vite-config to deploy (#4215)

Bug Fixes

Cloudflare

• share one Workers Cache entry across hosts (#3924)
• share one Response Store static Pages entry across hosts (#3898)
• don't purge the edge copy of a page's other part on Response Store (#4342)

Misc

• Cache: date "use cache" entries from when their generation started, like Next.js (#4348)
• Response Store: refreshes overtaken by invalidate(), purge() or revalidatePath() land like Next.js, without the R2 head (#4323)
• Response Store: drop concurrent refreshes of a revision another write already replaced (#4307)

Contributors

• @​Gourav224
• @​james-elicx

@​vinext/cloudflare@​1.2.1

Bug Fixes

• Cloudflare: stop non-replayable Response Store data refreshes from spending edge purges (#4259)
• default NODE_ENV to production for vinext-cloudflare deploy and vinext typegen (#4267)
• Cloudflare: serve KV entries of a tag revalidated with a cacheLife profile stale until it expires (#4258)

Contributors

• @​james-elicx

Changelog

Sourced from @​vinext/cloudflare's changelog.

1.3.0

Read the Vinext 1.4 release post for the highlights.

Features

Cloudflare

• share one Response Store App Router entry across hosts (#3897)
• store both parts of a page whenever Workers Cache renders one (#4333)
• store both parts of a page whenever Response Store stores or regenerates one (#4332)
• store the page's document when an RSC request misses its Response Store entry (#4331)
• add --vite-config to deploy (#4215)

Bug Fixes

Cloudflare

• share one Workers Cache entry across hosts (#3924)
• share one Response Store static Pages entry across hosts (#3898)
• don't purge the edge copy of a page's other part on Response Store (#4342)

Misc

• Cache: date "use cache" entries from when their generation started, like Next.js (#4348)
• Response Store: refreshes overtaken by invalidate(), purge() or revalidatePath() land like Next.js, without the R2 head (#4323)
• Response Store: drop concurrent refreshes of a revision another write already replaced (#4307)

Contributors

• @​Gourav224
• @​james-elicx

1.2.1

Bug Fixes

• Cloudflare: stop non-replayable Response Store data refreshes from spending edge purges (#4259)
• default NODE_ENV to production for vinext-cloudflare deploy and vinext typegen (#4267)
• Cloudflare: serve KV entries of a tag revalidated with a cacheLife profile stale until it expires (#4258)

Contributors

• @​james-elicx

Commits

• db25840 chore: version packages (#4312)
• f7ebc33 fix(cache): date "use cache" entries from when their generation started, like...
• f450a83 fix(cloudflare): share one Workers Cache entry across hosts (#3924)
• 12658ff fix(cloudflare): share one Response Store static Pages entry across hosts (#3...
• 3100f38 feat(cloudflare): share one Response Store App Router entry across hosts (#3897)
• ba1e052 fix(app-router): store a page's resolved client stale time, not the pending m...
• 62a069c fix(response-store): refreshes overtaken by invalidate(), purge() or revalida...
• 4c6a47b fix(response-store): drop concurrent refreshes of a revision another write al...
• 479512a fix(cloudflare): don't purge the edge copy of a page's other part on Response...
• 522c356 fix(cloudflare): store both parts of a page whenever Workers Cache renders on...
• Additional commits viewable in compare view

Updates eslint from 10.13.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

Commits

• 12cbff4 10.14.0
• 6b696e7 Build: changelog update for 10.14.0
• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
• 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
• dab466e docs: Update README
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419)
• Additional commits viewable in compare view

Updates eslint-config-next from 16.4.2 to 16.4.3

Release notes

Sourced from eslint-config-next's releases.

v16.4.3

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [lts-active] Fix extensionless Google font URLs in both bundlers (#100277)
• [lts-active] Don't load the app-page runtime in proxy.ts (#100423)
• [lts-active] Revert "Turbopack: loader change invalidation (#95732)" (#100438)
• [lts-active][cd] Gate release bot credentials behind GitHub environments (#100123)
• [lts-active] test: Pin react-virtualized (#100545)
• [lts-active][cd] Move release un-draft to a follow-up job in bot-autonomous (#100572)
• [lts-active] Keep OpenTelemetry request traces together (#100349, #100294, #100324, #100350, #100552, #100583) (#100542)
• [lts-active] Avoid loading standalone React in server bootstrap (#100610)

Credits

Huge thanks to @​mischnic, @​lukesandberg, @​acdlite, @​eps1lon, and @​sokra for helping!

Commits

• 29bbeab v16.4.3
• See full diff in compare view

Updates fake-indexeddb from 6.2.6 to 6.2.7

Release notes

Sourced from fake-indexeddb's releases.

v6.2.7

• Improve performance of put and delete for object stores with indexes (#172 by @​jameskfry)

Changelog

Sourced from fake-indexeddb's changelog.

6.2.7 (2026-10-29)

• Improve performance of put and delete for object stores with indexes (#172 by @​jameskfry)

Commits

• 09e7f76 6.2.7
• e1b6b48 Changelog
• f7cf6d8 Merge pull request #172 from jameskfry/perf/delete-index-records
• 0f4e496 Keep the single-key index path allocation-free
• f0f8bc0 Delete index records by index key instead of scanning the whole index
• 8881007 Update for 6.2.6 because the version script didn't automatically run for me s...
• See full diff in compare view

Updates vinext from 1.3.0 to 1.4.0

Release notes

Sourced from vinext's releases.

vinext@1.4.0

Read the Vinext 1.4 release post for the highlights.

Features

Cloudflare

• share one Response Store App Router entry across hosts (#3897)
• store the page's document when an RSC request misses its Response Store entry (#4331)
• add --vite-config to deploy (#4215)

Misc

• Init: add --ignore-wrangler-config for Cloudflare init (#4216)
• App Router: store the page's document when an RSC request misses its entry (#4321)
• App Router: regenerate the document when a stale RSC request regenerates its page (#4319)

Bug Fixes

App Router

• assign a router history write's traversal index as it lands (#4376)
• write router history through the live History API methods (#4354)
• match Next.js's openGraph and twitter title templates (#4349)
• keep static prefetches when a Server Action calls refresh() (#4281)
• prefetch visible links again only after router.refresh() finishes (#4280)
• keep a refreshed parallel slot's identity, so a refresh doesn't remount it (#4279)
• fulfill a full prefetch from a recent navigation's visited response (#4298)
• advertise staleTimes.static on unclaimed cache hits under cached navigations (#4300)
• retain a layout's children above their own BFCache boundaries (#4326)
• run Server Actions with their page's implicit tags (#4290)
• match Next.js's title template rule (#4346)
• scope copied history tree ids to their document (#4347)
• keep another root layout's not-found out of matched routes (#4324)
• store a page's resolved client stale time, not the pending marker (#4343)
• log server render errors in production (#4320)

Cache

• skip data cache reads during on-demand revalidation (#4292)
• date "use cache" entries from when their generation started, like Next.js (#4348)
• make unstable_noStore() a no-op under Cache Components (#4293)
• run a "use cache" function inside the render that serializes its result (#4297)

Dev

• measure App Router compile time on the wall clock under workerd (#4383)
• pre-bundle next/image shim deps for the Pages Cloudflare Worker (#4380)
• resolve vinext's shim paths through Vite so dev loads one instance (#4310)

... (truncated)

Commits

• db25840 chore: version packages (#4312)
• 3654b4a docs(blog): add the Vinext 1.4 release post (#4384)
• f938be8 fix(dev): measure App Router compile time on the wall clock under workerd (#4...
• fd0b866 fix(config): match exact tsconfig paths keys only against the exact specifier...
• 2c1c4f0 fix(pages): apply next.config headers to res before Node API handlers run (#4...
• fb9bf31 fix(app-router): assign a router history write's traversal index as it lands ...
• 8992097 fix(app-router): write router history through the live History API methods (#...
• af33d13 fix(dev): pre-bundle next/image shim deps for the Pages Cloudflare Worker (#4...
• a3b6b4d fix(pages-router): decode API request bodies with Next's bundled iconv-lite (...
• a7d1c1e chore(deps): bump wrangler to 4.153.0 (#4374)
• Additional commits viewable in compare view

Updates wrangler from 4.152.0 to 4.154.0

Release notes

Sourced from wrangler's releases.

wrangler@4.154.0

Minor Changes

• #16494 0968b08 Thanks @​petebacondarwin! - Enable Miniflare's development registry by default and centralize path resolution

  In Miniflare v5 beta, resolve the registry from CLOUDFLARE_DEV_REGISTRY_PATH, then the unsafeDevRegistryPath constructor option, then <Cloudflare config directory>/dev-registry/v5. The default is independent of legacy Wrangler directories and is scoped to the Miniflare major version. The Vite v2 beta plugin follows this new default, while current Wrangler and getPlatformProxy() retain Wrangler's legacy default for compatibility with existing Wrangler sessions. Vite v2 and Wrangler therefore require the same CLOUDFLARE_DEV_REGISTRY_PATH to discover each other; set it for both processes when mixing these tools.

  Add enableDevRegistry: false to disable registration and discovery explicitly. Shared storage now uses the resolved default without requiring an explicit path. As before, shared storage requires an enabled registry to elect a storage owner, so combining unsafeEnableSharedStorage: true with enableDevRegistry: false is rejected. Miniflare no longer reads MINIFLARE_REGISTRY_PATH; use CLOUDFLARE_DEV_REGISTRY_PATH instead. Expose resolveDevRegistryPath() for integrations that also read registry files. Wrangler uses the effective path for its runtime configuration, initial bindings display, and Flagship active-session check, so the canonical override cannot bypass that check. An explicitly disabled Wrangler registry remains disabled.

Patch Changes

• #16499 f3c13b3 Thanks @​dinasaur404! - Preserve binding error codes and names in local development

  Errors from remote bindings and from Node.js binding proxies (getPlatformProxy() and Miniflare#getBindings()) now keep their machine-readable properties, such as Artifacts' code and numericCode. Previously these properties were dropped and the error name was folded into the message (for example "ArtifactsError: Repository not found"), so code could only branch on error text during local development.

  Node.js callers also keep custom error names such as ArtifactsError. Errors from remote bindings received inside a Worker keep their properties but are still named Error.

• Updated dependencies [0968b08, f3c13b3]:

  • miniflare@5.20261023.1-beta

wrangler@4.153.0

Minor Changes

• #14865 c0e915f Thanks @​TheSaiEaranti! - Add an --infer-origin-from-routes flag to wrangler dev

  When a config has routes, local dev infers the origin from the first route, so the Worker sees request.url, the Host header, and any Origin header rewritten to the route's host even though the client connected to localhost. That silently breaks Host/Origin-sensitive logic — for example a CORS check allowlisting http://localhost:* receives http://<route-host> instead and rejects the request only in local dev.

  The inference is intentional and remains the default. Passing --infer-origin-from-routes=false now opts out, preserving the real local origin without removing routes from the config. An explicitly configured --host, --local-upstream, or dev.host continues to take precedence either way. The flag only affects local development: in remote mode the route host still determines the preview session as before.

• #15955 23ef63a Thanks @​ericclemmons! - Expand dotenv variable references in --secrets-file input

  Dotenv files supplied through --secrets-file to deploy, versions upload, and preview now expand $VAR and ${VAR} references using process values and earlier file values. Process environment values override matching file keys, including explicitly empty values. Treat dotenv secrets files as trusted input: they can read and upload any process environment value, such as a CI credential referenced by X=${GITHUB_TOKEN}. In CI, use secrets files whose contents untrusted contributors cannot modify.

  This changes how existing dotenv secrets files are interpreted: an unset reference becomes an empty string, so PASSWORD=pa$word becomes pa when word is unset. Escape literal dollar signs with a backslash (PASSWORD=pa\$word), or use a JSON secrets file to preserve values exactly. JSON input and bulk-secret commands, including piped stdin, retain their existing literal parsing.

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16403 5f82a56 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From | To |

... (truncated)

Commits

• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T16:18:48.824823Z	a8ca596	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sykosyber]

No findings. I read AGENTS.md and CLAUDE.md (CONTRIBUTING.md is absent), the full diff of package.json and package-lock.json against origin/main at df2163b, and the files that consume those packages (vite.config.ts, wrangler.jsonc, scripts/patch-eslint-react-filename.mjs, .nvmrc, ci.yml, deploy-preview.yml, githits-policy.yml). I compared the published manifests for the bumped packages and their direct dependency changes with the lockfile, including workerd's install.js. npm ci succeeded and npm test passed (92 files, 840 tests). The moves to undici 7.30.1 and @humanfs/node 0.16.8 land on the patched releases for the advisories that covered the previous pins. I did not run typecheck, lint, the vinext build, scan:bundle, build:next, or Playwright locally. GitHub CI on this SHA passed those jobs. The GitHits policy job skipped because its credentials were unset, and that private runtime was not available here. I did not read the unchanged parts of package-lock.json or the rest of the vinext 1.4 distribution beyond project detection and the deploy gate.