build(deps): bump the compatible-updates group across 1 directory with 5 updates by dependabot[bot] · Pull Request #56 · constillo/constillo-site

dependabot · 2026-11-08T20:08:18Z

Bumps the compatible-updates group with 5 updates in the / directory:

Package	From	To
@nuxtjp/localized-site	`0.5.1`	`0.5.2`
vue	`3.5.44`	`3.5.45`
@nuxtjp/dependency-security	`0.2.0`	`0.2.2`
vue-tsc	`3.3.13`	`3.3.14`
wrangler	`4.151.2`	`4.158.0`

Updates @nuxtjp/localized-site from 0.5.1 to 0.5.2

Commits

ea8ed7f Update dependency security and Dependabot action (#64)
See full diff in compare view

Updates vue from 3.5.44 to 3.5.45

Release notes

Sourced from vue's releases.

v3.5.45

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.45 (2026-11-05)

Bug Fixes

compiler-core: copy loc in cloneLoc instead of recomputing it (#16092) (3cee79a), closes #16091

compiler-dom: preserve static boolean binding semantics (#16055) (05db7e8), closes #16051

compiler-sfc: respect catch and switch lexical scopes (fix #16098) (#16101) (0f20152)

hmr: retry reloads after pending async roots resolve (#16060) (fbaa794)

hydration: only update component el when replacing its host node (#16001) (51fd0cb)

KeepAlive: cache a resolved Suspense child right away (#16119) (716a29e)

KeepAlive: unmount a child deactivated before it was cached (#15981) (02d2c2b)

reactivity: run onScopeDispose in a stopped scope (#16108) (21dd33c)

runtime-core: anchor on the async placeholder when a component root has no el (#16122) (b5abf8c)

runtime-core: call directive mounted hooks with the latest binding (#16120) (6416207), closes #12460 #12482

runtime-core: remove the placeholder of an unmounted pending async component (#15982) (2b9a0bb)

runtime-core: render nothing for a component whose async setup rejects (#16111) (f64bfa5)

runtime-core: skip stopped error boundaries for async failures (#16061) (0326ed8)

runtime-dom: treat disablepictureinpicture and disableremoteplayback as boolean attributes (#15952) (ef81ddc)

suspense: do not mount the fallback after the boundary is unmounted (#15939) (4fd6a6b)

suspense: drop the unmount hooks of a pending branch when the boundary is unmounted (d04b662)

suspense: enter transitions nested in the pending branch on reveal (#16121) (b8074de), closes #12435 #15294

suspense: keep a discarded component marked unmounted (1dc8cdf)

suspense: keep the async root update retry across a discarded pending branch (#16107) (06bea73)

suspense: keep the internal cleanup of a discarded component (79b80b7)

suspense: keep the timeout counting when the root is switched again while pending (#16143) (a045acd)

suspense: patch same-root updates of nested boundaries in retained content (#16109) (2dbcea8), closes #15878

suspense: release parent dep on suspensible unmount (#15870) (46e5dbf)

suspense: resolve async deps whose pending cycle was discarded (#15980) (f7d0811)

suspense: resolve the boundary when an async setup rejects without an error handler in dev (#16110) (a14aa0b)

suspense: skip a root replacement in a retained nested boundary showing its fallback (#16125) (a47af77)

suspense: skip the out-in afterLeave of an unmounted boundary (#16115) (85e71c0), closes #11037 #11059

transition: handle leave immediately done in out-in mode (#11824) (70599b5), closes #15727

transition: switch modes around a keyed suspense boundary (#16124) (ff0b341)

types: add dialog closedby attribute (#16064) (24c9d0b)

v-model: respect number modifier for Set select values (0ff253b)

Performance Improvements

compiler-sfc: skip unused tsconfig include enumeration (#15899) (1612403), closes #15898

compiler-ssr: render static style attributes at compile time (#16010) (2629c89)

mark internal initializers as pure (#16012) (34fbeb1)

runtime-core: copy raw attrs when setup context attrs are passed as vnode props (#16129) (823c744)

Commits

8b479a8 release: v3.5.45
9f9b71c chore(deps): bump source-map-js from 1.2.1 to 1.2.2 (#16150)
1d718d2 chore(deps): update dependency @types/node to v26 (#16087)
68583ce chore(deps): bump undici from 8.9.0 to 8.12.3 (#16149)
91f2625 chore(deps): bump fast-uri from 3.1.0 to 3.1.9 (#16148)
a8ab1f8 chore(deps): update build (#15918)
a0d1388 chore(deps): update dependency minimatch to v11 [security] (#16145)
923f70d fix(deps): update compiler (#15920)
3cb1161 chore(deps): update lint (#15921)
0ce9e16 chore(deps): update dawidd6/action-download-artifact action to v28 (#16086)
Additional commits viewable in compare view

Updates @nuxtjp/dependency-security from 0.2.0 to 0.2.2

Commits

See full diff in compare view

Updates vue-tsc from 3.3.13 to 3.3.14

Release notes

Sourced from vue-tsc's releases.

v3.3.14

language-core

fix: isolate template virtual code from setup control flow (d31557b)

fix: re-assert dot-value bindings in template closures (4524874) (f9c908f) (b65e458)

fix: avoid TS2454 from the withDotValue assertion (c774144)

fix: use a const type parameter in __VLS_unwrap to keep literal bindings on TS 7.1 (ce6c1de)

fix: avoid never slot props for dynamic slot names in generic components (7957e7f)

fix: omit emitted events from inherited attrs of generic components (2d94d89)

fix: check bindings of generic directive hooks (0cb7d92)

fix: wrap the v-model assignment target in parentheses (9bb1dc9)

fix: type the $event parameter of inline handlers explicitly (d3b42a1)

fix: type unknown components without diagnostic filters (b3909a3)

fix: keep leading @ts-nocheck and /// <reference> effective in script setup (c2e2e6f)

fix: declare component context vars before slot code (b7c773d)

fix: avoid non-null assertion in JS slot codegen (5633525)

fix: restore tag navigation for barrel imports (6358d15)

fix: map the whole hyphenated directive name in the auto-import access (beb0151)

language-service

fix: prevent crash on malformed html.customData configuration (3961653)

typescript-plugin

fix: show unwrapped type when hovering setup refs in template (c742c14)

Contributors: @johnsoncodehk, @lazerg, @ValentinYoushkevich, @so1ve, @WangKepeople

Changelog

Sourced from vue-tsc's changelog.

3.3.14 (2026-10-30)

language-core

fix: isolate template virtual code from setup control flow (d31557b)

fix: re-assert dot-value bindings in template closures (4524874) (f9c908f) (b65e458)

fix: avoid TS2454 from the withDotValue assertion (c774144)

fix: use a const type parameter in __VLS_unwrap to keep literal bindings on TS 7.1 (ce6c1de)

fix: avoid never slot props for dynamic slot names in generic components (7957e7f)

fix: omit emitted events from inherited attrs of generic components (2d94d89)

fix: check bindings of generic directive hooks (0cb7d92)

fix: wrap the v-model assignment target in parentheses (9bb1dc9)

fix: type the $event parameter of inline handlers explicitly (d3b42a1)

fix: type unknown components without diagnostic filters (b3909a3)

fix: keep leading @ts-nocheck and /// <reference> effective in script setup (c2e2e6f)

fix: declare component context vars before slot code (b7c773d)

fix: avoid non-null assertion in JS slot codegen (5633525)

fix: restore tag navigation for barrel imports (6358d15)

fix: map the whole hyphenated directive name in the auto-import access (beb0151)

language-service

fix: prevent crash on malformed html.customData configuration (3961653)

typescript-plugin

fix: show unwrapped type when hovering setup refs in template (c742c14)

Contributors: @johnsoncodehk, @lazerg, @ValentinYoushkevich, @so1ve, @WangKepeople

Commits

df80037 v3.3.14
d31557b fix(language-core): isolate template virtual code from setup control flow (#6...
b3909a3 fix(language-core): type unknown components without diagnostic filters (fix #...
845975c chore: bump @volar/* to 2.4.30
0cb7d92 fix(language-core): check bindings of generic directive hooks (#6291)
See full diff in compare view

Updates wrangler from 4.151.2 to 4.158.0

Release notes

Sourced from wrangler's releases.

wrangler@4.158.0

Minor Changes

#16186 f1d81a2 Thanks @leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

#16700 dc35efb Thanks @cjol! - Bump bundled brace-expansion to pick up security fixes

These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

#16700 dc35efb Thanks @cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.

#16700 dc35efb Thanks @cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

#16700 dc35efb Thanks @cjol! - Bump bundled shell-quote from 1.10.0 to 1.11.0 to pick up a security fix

shell-quote is bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.

#16700 dc35efb Thanks @cjol! - Bump bundled yaml from 2.8.1 to 2.9.0 to pick up a security fix

yaml is bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.

#16688 fa3edb3 Thanks @FlorentCollin! - Use the account_id from the configuration file in wrangler d1 migrations list --remote

Before this change, the command ignored the account_id in the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configured account_id, as wrangler d1 migrations apply does.

#16695 b2061f4 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

#16695 b2061f4 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261103.1 ^5.20261104.1

workerd 1.20261103.1 1.20261104.1

#16306 36e64f2 Thanks @efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

... (truncated)

Commits

c579d50 Version Packages (#16681)
f1d81a2 [miniflare] Enable local Artifacts in development tools [3/3] (#16186)
dc35efb Bump dependencies to clear 101 Dependabot alerts (#16700)
4d88a45 [miniflare] Stabilize Artifacts integration tests on Windows (#16693)
0083f80 [wrangler] Harden the local KV pagination regression test (#16697)
fa3edb3 [wrangler] Use config account_id in d1 migrations list --remote (#16688)
9a0732c Version Packages (#16654)
44d1ee4 fix(wrangler): stop wrangler delete orphaning Container applications (#16011)
8ac43df Require explicit route metadata flags when downloading Worker configuration (...
680666e Version Packages (#16646)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…h 5 updates Bumps the compatible-updates group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@nuxtjp/localized-site](https://github.com/nuxtjp/site-builder) | `0.5.1` | `0.5.2` | | [vue](https://github.com/vuejs/core) | `3.5.44` | `3.5.45` | | [@nuxtjp/dependency-security](https://github.com/nuxtjp/nuxtjp-ui/tree/HEAD/packages/nuxt-dependency-security) | `0.2.0` | `0.2.2` | | [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.13` | `3.3.14` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.151.2` | `4.158.0` | Updates `@nuxtjp/localized-site` from 0.5.1 to 0.5.2 - [Release notes](https://github.com/nuxtjp/site-builder/releases) - [Commits](nuxtjp/site-builder@v0.5.1...npm/nuxtjp--localized-site/v0.5.2) Updates `vue` from 3.5.44 to 3.5.45 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.44...v3.5.45) Updates `@nuxtjp/dependency-security` from 0.2.0 to 0.2.2 - [Commits](https://github.com/nuxtjp/nuxtjp-ui/commits/npm/nuxtjp--operations-console/v0.2.2/packages/nuxt-dependency-security) Updates `vue-tsc` from 3.3.13 to 3.3.14 - [Release notes](https://github.com/vuejs/language-tools/releases) - [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md) - [Commits](https://github.com/vuejs/language-tools/commits/v3.3.14/packages/tsc) Updates `wrangler` from 4.151.2 to 4.158.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.158.0/packages/wrangler) --- updated-dependencies: - dependency-name: "@nuxtjp/localized-site" dependency-version: 0.5.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: compatible-updates - dependency-name: vue dependency-version: 3.5.45 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: compatible-updates - dependency-name: "@nuxtjp/dependency-security" dependency-version: 0.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: compatible-updates - dependency-name: vue-tsc dependency-version: 3.3.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: compatible-updates - dependency-name: wrangler dependency-version: 4.158.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: compatible-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 8, 2026

Navigation Menu

Repository navigation

build(deps): bump the compatible-updates group across 1 directory with 5 updates - #56

build(deps): bump the compatible-updates group across 1 directory with 5 updates#56
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/compatible-updates-e931d98c18

dependabot Bot commented on behalf of github Nov 8, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Dependency	From	To
`@cloudflare/workers-types`	^5.20261103.1	^5.20261104.1
workerd	1.20261103.1	1.20261104.1

Conversation

dependabot Bot commented on behalf of github Nov 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.5.45

3.5.45 (2026-11-05)

Bug Fixes

Performance Improvements

v3.3.14

language-core

language-service

typescript-plugin

3.3.14 (2026-10-30)

language-core

language-service

typescript-plugin

wrangler@4.158.0

Minor Changes

Patch Changes

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Nov 8, 2026 •

edited

Loading