Skip to content

fix(deps): update npm non-major dependencies - #46

Open
renovate[bot] wants to merge 1 commit into
stagingfrom
renovate/npm-non-major-dependencies
Open

fix(deps): update npm non-major dependencies#46
renovate[bot] wants to merge 1 commit into
stagingfrom
renovate/npm-non-major-dependencies

Conversation

@renovate

@renovate renovate Bot commented Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@cloudflare/workers-types 5.20261103.1 → 5.20261106.1 age confidence
@tailwindcss/postcss (source) 4.3.3 → 4.3.4 age confidence
@tanstack/react-query (source) 5.105.2 → 5.106.1 age confidence
eslint-config-next (source) 16.4.4 → 16.4.5 age confidence
lucide-react (source) 1.66.0 → 1.69.0 age confidence
next (source) 16.4.4 → 16.4.5 age confidence
tailwindcss (source) 4.3.3 → 4.3.4 age confidence
wrangler (source) 4.157.0 → 4.158.0 age confidence

Release Notes

cloudflare/workerd (@​cloudflare/workers-types)

v5.20261106.1

Compare Source

v5.20261104.1

Compare Source

tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.4

Compare Source

Added
  • Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#​20367)
Fixed
  • Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#​20356)
  • Ensure variants using @scope wrap generated utilities instead of nesting inside them (#​20369)
  • Ensure nested @scope rules preserve their scoping semantics when flattened (#​20369)
  • Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#​20369)
  • Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#​20373)
  • Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#​20380)
  • Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#​20379)
  • Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#​20383)
  • Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#​20387)
  • Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#​20392)
  • Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#​20397)
  • Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#​20399)
  • Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#​20408)
  • Drop invalid UTF-8 candidates during class detection (#​20389)
  • Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#​20414)
  • Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#​20417)
  • Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#​20419)
  • Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#​20420)
  • Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#​20434)
  • Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#​20466)
  • Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#​20512)
  • Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#​20508)
  • Improve style invalidation performance of group-* and peer-* variants (#​20513)
  • Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#​20531)
  • Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#​20550)
  • Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#​20562)
  • Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#​20563)
  • Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#​20563)
  • Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#​20569)
  • Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#​20516)
  • Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#​20561)
  • Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#​20547, #​20572)
  • Underline the correct occurrence of an unsupported data type in --value(…) warnings (#​20554)
  • Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#​20540)
  • Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#​20574)
  • Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#​20576)
  • Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#​20575)
  • Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#​20577)
  • Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#​20558)
  • Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#​20486)
  • Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#​20578)
  • Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#​20582)
  • Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#​20593)
  • Decode single-digit hexadecimal escapes in theme variable and @utility names as the CSS spec does (e.g. @theme { --color-\0: red; } no longer registers --color-0) (#​20591)
  • Don't treat !important inside strings, comments or url() in declaration values as the important flag (e.g. content: "a !important b") (#​20627)
  • Parse a custom property at the end of the input when it has no trailing ; (e.g. --foo: bar as the last declaration) (#​20653)
  • Keep a declaration without a ; at the end of the CSS input (e.g. color: red) (#​20655)
TanStack/query (@​tanstack/react-query)

v5.106.1

Compare Source

Patch Changes

v5.106.0

Compare Source

Patch Changes

v5.105.3

Compare Source

Patch Changes
vercel/next.js (eslint-config-next)

v16.4.5

Compare Source

This release contains security fixes for the following advisories:

Moderate

lucide-icons/lucide (lucide-react)

v1.69.0: Version 1.69.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

v1.68.0: Version 1.68.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

v1.67.0: Version 1.67.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.66.0...1.67.0

cloudflare/workers-sdk (wrangler)

v4.158.0

Compare Source

Minor Changes

  • #​16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

    Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

    In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

  • #​16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

    These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

  • #​16700 dc35efb Thanks @​cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

    Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.

  • #​16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

    These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

  • #​16700 dc35efb Thanks @​cjol! - Bump bundled shell-quote from 1.10.0 to 1.11.0 to pick up a security fix

    shell-quote is bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.

  • #​16700 dc35efb Thanks @​cjol! - Bump bundled yaml from 2.8.1 to 2.9.0 to pick up a security fix

    yaml is bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.

  • #​16688 fa3edb3 Thanks @​FlorentCollin! - Use the account_id from the configuration file in wrangler d1 migrations list --remote

    Before this change, the command ignored the account_id in the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configured account_id, as wrangler d1 migrations apply does.

  • #​16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #​16695 b2061f4 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261103.1 ^5.20261104.1
    workerd 1.20261103.1 1.20261104.1

  • #​16306 36e64f2 Thanks @​efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

    When a remote bindings request reached a workers.dev host protected by Access without valid Access credentials (for example, Access was added after the dev server started, the CF_Authorization cookie expired, or Access was not detected at startup), the edge redirected it to the Access login page. The binding followed that redirect back through the remote proxy, looping until it failed with TypeError: Too many redirects and an error message containing the Access login URL. Miniflare now detects the redirect, returns a readable 401 explaining how to re-authenticate, and logs the existing one-time "Cloudflare Access blocked a remote bindings request" warning.

    The remote proxy server now marks the responses it forwards from a binding, so only Access responses generated in front of it are replaced. An Access login redirect or block page returned by a remote binding itself (for example, a Worker proxying an Access-protected origin) now reaches the caller unchanged.

  • Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • Between 08:00 AM and 11:59 AM (* 8-11 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Nov 7, 2026
@renovate

renovate Bot commented Nov 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.4.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-11-09T02_47_43_957Z-debug-0.log

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 7, 2026

Copy link
Copy Markdown

Deploying ops-staging with  Cloudflare Pages  Cloudflare Pages

Latest commit: 0e9c3d7
Status:🚫  Build failed.

View logs

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants