Skip to content

build(deps): Bump the minor-and-patch group across 1 directory with 9 updates - #95

Open
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/npm_and_yarn/minor-and-patch-12caefbc36
Open

build(deps): Bump the minor-and-patch group across 1 directory with 9 updates#95
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/npm_and_yarn/minor-and-patch-12caefbc36

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 9 updates in the / directory:

Package From To
@modelcontextprotocol/sdk 1.29.0 1.32.1
hono 4.13.12 4.13.13
jose 6.2.3 6.2.12
zod 4.4.3 4.6.7
@cloudflare/workers-types 5.20261003.1 5.20261014.1
@google/clasp 3.3.0 3.4.1
@types/google-apps-script 2.0.11 2.0.13
vite-plus 1.0.0 1.1.0
wrangler 4.147.0 4.151.0

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

  • Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
  • New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

1.31.0

Upgrade notes

  • Stored OAuth tokens and client information now include an issuer field. Storage that rejects unknown fields needs to allow it.
  • Pass expectedIssuer when constructing ClientCredentialsProvider, PrivateKeyJwtProvider or StaticPrivateKeyJwtProvider. Constructing them without it is deprecated.

What's Changed

Full Changelog: modelcontextprotocol/typescript-sdk@1.30.1...1.31.0

1.30.1

What's Changed

New Contributors

... (truncated)

Commits
  • ff07b00 chore: bump version to 1.32.1 (#2954)
  • 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
  • a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
  • 32549b0 chore: bump version to 1.32.0 (#2935)
  • 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
  • 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
  • 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
  • fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
  • 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
  • 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates hono from 4.13.12 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

Commits
  • 08a023c 4.13.13
  • ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
  • f23b146 fix(jsx): allow JSXNode function component results (#5476)
  • 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
  • deff529 test(client): simulate network error for undefined route in parseResponse tes...
  • See full diff in compare view

Updates jose from 6.2.3 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits
  • 505a55b chore(release): 6.2.12
  • 7bc9a33 perf: encode single-signature JWS input once
  • 78637bd perf: normalize General JWE shared headers once
  • bf5138b perf: deduplicate pending jwks key imports
  • b23a6f3 perf: use native encoding for larger ASCII strings
  • fd3ae3f perf: normalize jwks selection metadata once
  • 6925d43 perf: avoid copying AES-GCM output
  • be62530 docs: clarify and shorten public API guidance
  • 1b41312 build: preserve README when generation fails
  • 0b51829 build: check tree-shaking for every public binding
  • Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.7

Release notes

Sourced from zod's releases.

v4.6.7

Commits:

  • b500a2ee95134f81d74da7911d7378dd2853d042 4.6.7

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

  • 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
  • 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
  • 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
  • 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
  • b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
  • 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
  • bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
  • c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
  • a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
  • a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
  • 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

  • d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
  • f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
  • de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
  • 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
  • ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
  • cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
  • 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
  • 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

... (truncated)

Commits
  • b500a2e 4.6.7
  • 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
  • 529f78d 4.6.6
  • a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
  • a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
  • c42596b release: hold the run on the release-approval environment until the staged ve...
  • bacad51 docs: square the Code for Japan logo to match the other bronze tiles
  • 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
  • b2ef983 docs: add Code for Japan to bronze sponsors
  • 74304ce release: stage npm versions instead of publishing them (#6622)
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20261003.1 to 5.20261014.1

Commits

Updates @google/clasp from 3.3.0 to 3.4.1

Release notes

Sourced from @​google/clasp's releases.

v3.4.1

3.4.1 (2026-08-28)

Bug Fixes

  • files: prevent rootDir double application during pull, clone, and create (13d3322)

v3.4.0

3.4.0 (2026-08-20)

Features

  • cli: add global --allow-symlinks option for shared symlinked folders/files (78d7104)
  • commands: surface security warnings for skipped files and enforce strict deletion boundaries (f2d835d)
  • implement PKCE support in OAuth flows (#1142) (1a1665e)

Bug Fixes

  • auth: remove hardcoded OAuth client secret from published npm package (CWE-798) (#1139) (a678e92)
  • auth: restore OAuth client secret for desktop public client compatibility (be27aaf)
  • auth: secure credential file writing with symlink protection and permissions (378c1a6)
  • core: secure file system crawling, atomic writes, and structured security reporting (aa4cfeb)
  • create-script: accept --type webapp and --type api as standalone aliases (#1155) (34a468e), refs #1154
  • deps: update google-auth-library and googleapis to resolve Node 22+/25+ compatibility issues (87a3759)
  • mcp: validate projectDir against permitted base paths (CWE-22 path traversal) (#1141) (1e8132c)
  • prevent OAuth CSRF via missing state parameter in authorization flow (#1135) (8dac6c2)
  • Print help instead of throwing error on unknown commands (#1157) (39a9c12)
  • security: clean up CSRF demo script and harden path boundary & test mocks (0a28a48)
  • security: prevent path traversal via srcDir in .clasp.json (#1140) (408448e)
  • security: validate sourceDir MCP parameter and use realpath in WriteFiles (#1144) (4eb9dca)
Changelog

Sourced from @​google/clasp's changelog.

3.4.1 (2026-08-28)

Bug Fixes

  • files: prevent rootDir double application during pull, clone, and create (13d3322)

3.4.0 (2026-08-20)

Features

  • cli: add global --allow-symlinks option for shared symlinked folders/files (78d7104)
  • commands: surface security warnings for skipped files and enforce strict deletion boundaries (f2d835d)
  • implement PKCE support in OAuth flows (#1142) (1a1665e)

Bug Fixes

  • auth: secure credential file writing with symlink protection and permissions (378c1a6)
  • core: secure file system crawling, atomic writes, and structured security reporting (aa4cfeb)
  • create-script: accept --type webapp and --type api as standalone aliases (#1155) (34a468e), refs #1154
  • deps: update google-auth-library and googleapis to resolve Node 22+/25+ compatibility issues (87a3759)
  • mcp: validate projectDir against permitted base paths (CWE-22 path traversal) (#1141) (1e8132c)
  • prevent OAuth CSRF via missing state parameter in authorization flow (#1135) (8dac6c2)
  • Print help instead of throwing error on unknown commands (#1157) (39a9c12)
  • security: clean up CSRF demo script and harden path boundary & test mocks (0a28a48)
  • security: prevent path traversal via srcDir in .clasp.json (#1140) (408448e)
  • security: validate sourceDir MCP parameter and use realpath in WriteFiles (#1144) (4eb9dca)
Commits
  • e9441e5 chore(master): release 3.4.1 (#1167)
  • b907723 test(commands): normalize stubbed localPath in unsafe deletion test
  • af0332f test(commands): normalize path separators in pull tests for Windows compatibi...
  • 13d3322 fix(files): prevent rootDir double application during pull, clone, and create
  • efd0524 chore(master): release 3.4.0 (#1138)
  • ec5608c test(core): normalize localPath in files_security tests for Windows compatibi...
  • 6b6c742 Regenerate package-lock.json
  • be55a0d chore(deps): update minor/patch dependencies and fix transitive audit vulnera...
  • 87a3759 fix(deps): update google-auth-library and googleapis to resolve Node 22+/25+ ...
  • 378c1a6 fix(auth): secure credential file writing with symlink protection and permiss...
  • Additional commits viewable in compare view

Updates @types/google-apps-script from 2.0.11 to 2.0.13

Commits

Updates vite-plus from 1.0.0 to 1.1.0

Release notes

Sourced from vite-plus's releases.

vite-plus v1.1.0: faster vp dev startup and clearer interactive prompts

Vite+ 1.1 starts vp dev faster and makes the interactive prompts clearer, alongside fixes for vp migrate, package-manager commands, and Windows terminals.

Highlights

  • vp dev reaches its local URL about 24% sooner and uses about 30% less memory in the parent process, because Vite+ no longer loads Vite and Vitest there before starting the dev server (#2851), by @​camc314.
  • Interactive prompts render boxes, logs, and wrapped text consistently, with clearer hints, validation, and navigation instructions (#2870), by @​cpojer.

Features

  • vp run sets npm_execpath and npm_config_user_agent for npm, pnpm, and Yarn, so tools such as npm-run-all2 use the project's package manager instead of falling back to npm (#2895), by @​naokihaba and @​tarikermis.
  • Upgrade vite@8.3.1 to vite@8.3.3, rolldown@1.2.11 to rolldown@1.2.12, vitest@5.0.1 to vitest@5.0.3, oxlint@1.85.0 to oxlint@1.87.0, and oxfmt@0.70.0 to oxfmt@0.72.0. The new lint and format versions can flag code that passed before, so run vp fmt after upgrading if CI runs vp check. vp migrate now keeps the React Refresh allowCompoundComponents option because the bundled Oxlint supports it (#2871, #2896, #2904), by @​voidzero-guard[bot].

Fixes & Enhancements

  • vp migrate keeps Oxlint rules written with plugin aliases (such as @typescript-eslint/*, react-hooks/*, and import-x/*) and removes rules the bundled Oxlint does not support, listing them in a warning (#2820, #2906), by @​TheAlexLichter and @​yusuke99.
  • vp migrate leaves projects without a declared package manager unpinned, keeps existing declarations, and points to vp env pin when it infers one (#2817), by @​TheAlexLichter.
  • vp migrate reports a short error for a directory without package.json instead of an ENOENT stack trace (#2821), by @​TheAlexLichter.
  • vp create in an existing pnpm workspace adds the catalog entries the new application needs, so installation no longer fails with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC (#2808), by @​SaKaNa-Y.
  • On Windows, one Ctrl+C stops vpr scripts and managed Bun, pnpm, npm, and Yarn commands without leaving cmd.exe stuck at Terminate batch job (Y/N)? (#2890), by @​fengmk2.
  • vp pack --watch on Windows rebuilds with the new options after the config file changes (#2826), by @​liangmiQwQ.
  • vp test doctor and vp test complete run the Vitest subcommands instead of being treated as test file filters (#2879), by @​liangmiQwQ.
  • With isolated dependency layouts such as pnpm's global virtual store, vp pack finds installed Vue language tools and TypeScript Go for declaration generation, and Playwright browser provider options keep their types (#2868, #2865), by @​liangmiQwQ.
  • Package-manager commands fail when the project's package manager does not support a named option, instead of silently dropping it and continuing. Bun 1.4.1+ receives --offline and --prefer-offline, and Yarn Classic accepts a single --filter for vp remove (#2775), by @​jong-kyung.
  • vp pm config in Bun projects falls back to npm, as its warning says (#2899), by @​jong-kyung.
  • vp pm approve-builds states that Yarn Berry disables third-party build scripts by default from 4.14.0, not in every version (#2902), by @​jong-kyung.
  • vp implode asks you to type boom instead of uninstall to confirm (#2901), by @​fengmk2.
  • Global package installs and updates print a green +, and removals a red -, with bold package names in both (#2828), by @​liangmiQwQ.
  • Setup headings and command hints keep their colors when the installer captures stdout (#2829), by @​liangmiQwQ.

Refactor

  • Replace semver with verkit in the CLI, reducing the bundled CLI JavaScript by about 26 KB (#2837), by @​liangmiQwQ.
  • Share the shim filename logic between setup and vp env doctor, and remove unused config migration metadata (#2876, #2894), by @​jong-kyung.

Docs

  • Announce Vite+ 1.0 on the website and update the homepage vp pack demo (#2843, #2844), by @​TheAlexLichter and @​naokihaba.
  • Document vp install -g --node and explain when vp env default re-resolves versions (#2885, #2884), by @​hyunbinseo.
  • Use runnable package examples in the vpx guide and vpx --help (#2864), by @​SaKaNa-Y.
  • Remove the redundant vp install step from setup-vp CI examples (#2888), by @​yusuke99.
  • Explain how to return from a preview build, align manual installation examples with the installed toolchain, and update the JetBrains Node.js path and vp env current --json example for the split directory layout (#2886, #2887, #2889, #2891), by @​jong-kyung.

Chore

... (truncated)

Commits
  • 3aa366e release: v1.1.0: faster vp dev startup and clearer interactive prompts (#2907)
  • b639509 fix(shim): preserve Windows terminal after Ctrl+C (#2890)
  • 390f215 perf(cli): defer Vite config resolver until needed (#2851)
  • 27b4ffd fix(migrate): strip unsupported Oxlint rules with report (#2906)
  • 7944376 fix(create): complete catalogs in existing pnpm workspaces (#2808)
  • 6961386 fix(migrate): preserve unpinned package manager policy (#2817)
  • d0490f6 fix(migrate): preserve Oxlint rule aliases (#2820)
  • 1ebe40a fix(migrate): report missing package.json (#2821)
  • 64cc3aa fix(cli): reload pack config on Windows in watch mode (#2826)
  • c03dd22 fix(cli): set package-manager lifecycle env for vp run (#2895)
  • Additional commits viewable in compare view

Updates wrangler from 4.147.0 to 4.151.0

Release notes

Sourced from wrangler's releases.

wrangler@4.151.0

Minor Changes

  • #16245 d6b1c82 Thanks @​WalshyDev! - Include source maps by default in wrangler build --experimental-cf-build-output

    Build Output now matches wrangler deploy and wrangler versions upload, which upload source maps by default, so Workers built for tools like cf get stack traces that point at the original source. Source maps that can't be resolved are skipped rather than failing the build. Set upload_source_maps = false to opt out.

Patch Changes

  • #16220 97b2fb1 Thanks @​FlorentCollin! - Support local D1 queries through the experimental d1_binding_jsrpc compatibility flag

    Local D1 bindings now implement the RPC query backend used by D1Database.query() and prepared-statement methods when the flag is enabled. Queries reuse local SQLite execution, including transactional batches, execution metadata, and session bookmarks, while bindings without the flag continue to use HTTP. Update the bundled workerd runtime to 1.20261012.1 and align the default compatibility date with that release.

  • Updated dependencies [f360829, 97b2fb1, 97b2fb1, acd2822]:

wrangler@4.150.0

Minor Changes

  • #16231 091e5ec Thanks @​WalshyDev! - Upload source maps by default for wrangler deploy, wrangler versions upload and wrangler preview

    When upload_source_maps isn't set in config or via --upload-source-maps, Wrangler now generates and uploads source maps so stack traces in logs and wrangler tail point at your original source without extra setup. In this default mode, source maps that can't be resolved (for example inline data: maps or missing .map files from a custom build) are skipped rather than failing the upload. Setting upload_source_maps = true keeps the existing strict behaviour, and upload_source_maps = false (or --no-upload-source-maps for deploy and versions upload) opts out.

    wrangler build --experimental-cf-build-output is unchanged and still only includes source maps when upload_source_maps = true.

  • #16128 daae435 Thanks @​redsteadz! - Stop wrangl...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
❌ Deployment failed
View logs		 nyuchi-tools 4737979 Oct 21 2026, 08:52 AM

@bryanfawcett
Bryan Fawcett (bryanfawcett) changed the base branch from main to staging October 21, 2026 08:13
@dependabot
build(deps): Bump the minor-and-patch group across 1 directory with 9…
4737979 
… updates

Bumps the minor-and-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.32.1` |
| [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.13` |
| [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.12` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.7` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261003.1` | `5.20261014.1` |
| [@google/clasp](https://github.com/google/clasp) | `3.3.0` | `3.4.1` |
| [@types/google-apps-script](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/google-apps-script) | `2.0.11` | `2.0.13` |
| [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) | `1.0.0` | `1.1.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.147.0` | `4.151.0` |



Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.32.1
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.32.1)

Updates `hono` from 4.13.12 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.12...v4.13.13)

Updates `jose` from 6.2.3 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.3...v6.2.12)

Updates `zod` from 4.4.3 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.7)

Updates `@cloudflare/workers-types` from 5.20261003.1 to 5.20261014.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@google/clasp` from 3.3.0 to 3.4.1
- [Release notes](https://github.com/google/clasp/releases)
- [Changelog](https://github.com/google/clasp/blob/master/CHANGELOG.md)
- [Commits](google/clasp@v3.3.0...v3.4.1)

Updates `@types/google-apps-script` from 2.0.11 to 2.0.13
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/google-apps-script)

Updates `vite-plus` from 1.0.0 to 1.1.0
- [Release notes](https://github.com/voidzero-dev/vite-plus/releases)
- [Commits](https://github.com/voidzero-dev/vite-plus/commits/v1.1.0/packages/cli)

Updates `wrangler` from 4.147.0 to 4.151.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.151.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261011.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@google/clasp"
  dependency-version: 3.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.32.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/google-apps-script"
  dependency-version: 2.0.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vite-plus
  dependency-version: 1.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.149.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-12caefbc36 branch from 70073b5 to 4737979 Compare October 21, 2026 08:52

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bryanfawcett Bryan Fawcett (bryanfawcett) Awaiting requested review from bryanfawcett bryanfawcett is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants