Skip to content

Update all non-major dependencies#583

Merged
renovate[bot] merged 1 commit intomainfrom
renovate/all-minor-patch
Feb 23, 2026
Merged

Update all non-major dependencies#583
renovate[bot] merged 1 commit intomainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Feb 23, 2026

This PR contains the following updates:

Package Change Age Confidence
@biomejs/biome (source) 2.4.02.4.4 age confidence
hono (source) 4.11.94.12.1 age confidence
wrangler (source) 4.65.04.67.0 age confidence

Release Notes

biomejs/biome (@​biomejs/biome)

v2.4.4

Compare Source

Patch Changes
  • #​9150 6946835 Thanks @​dyc3! - Fixed #​9138: Astro files containing --- in HTML content (e.g., <h1>---Hi</h1>) are now parsed correctly, both when a frontmatter block is present and when there is no frontmatter at all.

  • #​9150 aa6f837 Thanks @​dyc3! - Fixed #​9138: The HTML parser incorrectly failing to parse bracket characters ([ and ]) in text content (e.g. <div>[Foo]</div>).

  • #​9151 c0d4b0c Thanks @​dyc3! - Fixed parsing of Svelte directive keywords (use, style) when used as plain text content in HTML/Svelte files. Previously, <p>use JavaScript</p> or <p>style it</p> would incorrectly produce a bogus element instead of proper text content.

  • #​9162 7f1e060 Thanks @​dyc3! - Fixed #​9161: The Vue parser now correctly handles colon attributes like xlink:href and xmlns:xlink by parsing them as single attributes instead of splitting them into separate tokens.

  • #​9164 458211b Thanks @​dyc3! - Fixed #​9161: The noAssignInExpressions rule no longer flags assignments in Vue v-on directives (e.g., @click="counter += 1"). Assignments in event handlers are idiomatic Vue patterns and are now skipped by the rule.

v2.4.3

Compare Source

Patch Changes
  • #​9120 aa40fc2 Thanks @​ematipico! - Fixed #​9109, where the GitHub reporter wasn't correctly enabled when biome ci runs on GitHub Actions.

  • #​9128 8ca3f7f Thanks @​dyc3! - Fixed #​9107: The HTML parser can now correctly parse Astro directives (client/set/class/is/server), which fixes the formatting for Astro directives.

  • #​9124 f5b0e8d Thanks @​ematipico! - Fixed #​8882 and #​9108: The Astro frontmatter lexer now correctly identifies the closing --- fence when the frontmatter contains multi-line block comments with quote characters, strings that mix quote types (e.g. "it's"), or escaped quote characters (e.g. "\").

  • #​9142 3ca066b Thanks @​THernandez03! - Fixed #​9141: The noUnknownAttribute rule no longer reports closedby as an unknown attribute on <dialog> elements.

  • #​9126 792013e Thanks @​ematipico! - Added missing Mocha globals to the Test domain: context, run, setup, specify, suite, suiteSetup, suiteTeardown, teardown, xcontext, xdescribe, xit, and xspecify. These are injected by Mocha's BDD and TDD interfaces and were previously flagged as undeclared variables in projects using Mocha.

  • #​8855 6918c9e Thanks @​ruidosujeira! - Fixed #​8840. Now the Biome CSS parser correctly parses not + scroll-state inside @container queries.

  • #​9111 4fb55cf Thanks @​Jayllyz! - Slightly improved performance of noIrregularWhitespace by adding early return optimization and simplifying character detection logic.

  • #​8975 086a0c5 Thanks @​FrankFMY! - Fixed #​8478: useDestructuring no longer suggests destructuring when the variable has a type annotation, like const foo: string = object.foo.

v2.4.2

Compare Source

Patch Changes

v2.4.1

Compare Source

Patch Changes
honojs/hono (hono)

v4.12.1

Compare Source

What's Changed

Full Changelog: honojs/hono@v4.12.0...v4.12.1

v4.12.0

Compare Source

Release Notes

Hono v4.12.0 is now available!

This release includes new features for the Hono client, middleware improvements, adapter enhancements, and significant performance improvements to the router and context.

$path for Hono Client

The Hono client now has a $path() method that returns the path string instead of a full URL. This is useful when you need just the path portion for routing or key-based operations:

const client = hc<typeof app>('http://localhost:8787')

// Get the path string
const path = client.api.posts.$path()
// => '/api/posts'

// With path parameters
const postPath = client.api.posts[':id'].$path({
  param: { id: '123' },
})
// => '/api/posts/123'

// With query parameters
const searchPath = client.api.posts.$path({
  query: { filter: 'test' },
})
// => '/api/posts?filter=test'

Unlike $url() which returns a URL object, $path() returns a plain path string, making it convenient for use with routers or as cache keys.

Thanks @​ShaMan123!

ApplyGlobalResponse Type Helper for RPC Client

The new ApplyGlobalResponse type helper allows you to add global error response types to all routes in the RPC client. This is useful for typing common error responses from app.onError() or global middlewares:

const app = new Hono()
  .get('/api/users', (c) => c.json({ users: ['alice', 'bob'] }, 200))
  .onError((err, c) => c.json({ error: err.message }, 500))

type AppWithErrors = ApplyGlobalResponse<
  typeof app,
  {
    401: { json: { error: string; message: string } }
    500: { json: { error: string; message: string } }
  }
>

const client = hc<AppWithErrors>('http://api.example.com')
// Now client knows about both success and error responses
const res = await client.api.users.$get()
// InferResponseType includes { users: string[] } | { error: string; message: string }

Thanks @​mohankumarelec!

SSG Redirect Plugin

A new redirectPlugin for SSG generates static HTML redirect pages for HTTP redirect responses (301, 302, 303, 307, 308):

import { toSSG } from 'hono/ssg'
import { defaultPlugin, redirectPlugin } from 'hono/ssg'

const app = new Hono()
app.get('/old', (c) => c.redirect('/new'))
app.get('/new', (c) => c.html('New Page'))

// redirectPlugin must be placed before defaultPlugin
await toSSG(app, fs, {
  plugins: [redirectPlugin(), defaultPlugin()],
})

The generated redirect pages include a <meta http-equiv="refresh"> tag, a canonical link, and a robots noindex meta tag.

Thanks @​3w36zj6!

onAuthSuccess Callback for Basic Auth

The Basic Auth middleware now supports an onAuthSuccess callback that is invoked after successful authentication. This allows you to set context variables or perform logging without re-parsing the Authorization header:

app.use(
  '/auth/*',
  basicAuth({
    username: 'hono',
    password: 'ahotproject',
    onAuthSuccess: (c, username) => {
      c.set('user', { name: username, role: 'admin' })
      console.log(`User ${username} authenticated`)
    },
  })
)

The callback also works with async functions and the verifyUser mode.

Thanks @​AprilNEA!

getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify

getConnInfo() is now available for three additional adapters:

// AWS Lambda (supports API Gateway v1, v2, and ALB)
import { handle, getConnInfo } from 'hono/aws-lambda'

// Cloudflare Pages
import { handle, getConnInfo } from 'hono/cloudflare-pages'

// Netlify
import { handle, getConnInfo } from 'hono/netlify'

app.get('/', (c) => {
  const info = getConnInfo(c)
  return c.text(`Your IP: ${info.remote.address}`)
})

Thanks @​rokasta12!

alwaysRedirect Option for Trailing Slash Middleware

The trailing slash middleware now supports an alwaysRedirect option. When enabled, the middleware redirects before executing handlers, which fixes the issue where trailing slash handling doesn't work with wildcard routes:

app.use(trimTrailingSlash({ alwaysRedirect: true }))

app.get('/my-path/*', async (c) => {
  return c.text('wildcard')
})

// /my-path/something/ will be redirected to /my-path/something
// before the wildcard handler is executed

Progressive Locale Code Truncation

The normalizeLanguage function in the language middleware now supports RFC 4647 Lookup-based progressive truncation. Locale codes like ja-JP will match ja when only the base language is in supportedLanguages:

app.use(
  '/*',
  languageDetector({
    supportedLanguages: ['en', 'ja'],
    fallbackLanguage: 'en',
    order: ['cookie', 'header'],
  })
)

// Accept-Language: ja-JP → matches 'ja'
// Accept-Language: ko-KR → falls back to 'en'

Thanks @​sorafujitani!

exports Field for ExecutionContext

The ExecutionContext type now includes an exports property for Cloudflare Workers. You can use module augmentation to type it with Wrangler's generated types:

import 'hono'

declare module 'hono' {
  interface ExecutionContext {
    readonly exports: Cloudflare.Exports
  }
}

Thanks @​toreis-up!

Performance Improvements

TrieRouter 1.5x ~ 2.0x Faster

The TrieRouter has been significantly optimized with reduced spread syntax usage, O(1) hasChildren checks, lazy regular expression generation, and removal of redundant processes:

Route Node.js Deno Bun
short static GET /user 1.70x 1.40x 1.34x
dynamic GET /user/lookup/username/hey 1.38x 1.69x 1.51x
wildcard GET /static/index.html 1.51x 1.72x 1.43x
all together 1.58x 1.60x 1.82x

Thanks @​EdamAme-x!

Fast Path for c.json()

c.json() now has the same fast path optimization as c.text(). When no custom status, headers, or finalized state exists, the Response is created directly without allocating a Headers object:

// This common pattern is now faster
return c.json({ message: 'Hello' })

Benchmark results:

Metric Before After Change
Reqs/sec 92,268 95,244 +3.2%
Latency 5.42ms 5.25ms -3.1%
Throughput 17.24MB/s 19.07MB/s +10.6%

Thanks @​mgcrea!

New features

  • feat(client): Add ApplyGlobalResponse type helper for RPC Client #​4556
  • feat(ssg): add redirect plugin #​4599
  • feat(client): $path #​4636
  • feat(basic-auth): add context key and callback options #​4645
  • feat(adapter): add getConnInfo for AWS Lambda, Cloudflare Pages, and Netlify #​4649
  • feat(trailing-slash): add alwaysRedirect option to support wildcard routes #​4658
  • feat(language): add progressive locale code truncation to normalizeLanguage #​4717
  • feat(types): Add exports field to ExecutionContext #​4719

Performance

  • perf(context): add fast path to c.json() matching c.text() optimization #​4707
  • perf(trie-router): improve performance (1.5x ~ 2.0x) #​4724
  • perf(context): use createResponseInstance for new Response #​4733

All changes

New Contributors

Full Changelog: honojs/hono@v4.11.10...v4.12.0

v4.11.10

Compare Source

What's Changed

  • fix: fixed to be more properly timing safe (Merge commit from fork 91def7c)

Full Changelog: honojs/hono@v4.11.9...v4.11.10

cloudflare/workers-sdk (wrangler)

v4.67.0

Compare Source

Minor Changes
  • #​12401 8723684 Thanks @​jonesphillip! - Add validation retry loops to pipelines setup command

    The wrangler pipelines setup command now prompts users to retry when validation errors occur, instead of failing the entire setup process. This includes:

    • Validation retry prompts for pipeline names, bucket names, and field names
    • A "simple" mode for sink configuration that uses sensible defaults
    • Automatic bucket creation when buckets don't exist
    • Automatic Data Catalog enablement when not already active

    This improves the setup experience by allowing users to correct mistakes without restarting the entire configuration flow.

  • #​12395 aa82c2b Thanks @​cmackenzie1! - Generate typed pipeline bindings from stream schemas

    When running wrangler types, pipeline bindings now generate TypeScript types based on the stream's schema definition. This gives you full autocomplete and type checking when sending data to your pipelines.

    // wrangler.json
    {
    	"pipelines": [
    		{ "binding": "ANALYTICS", "pipeline": "analytics-stream-id" },
    	],
    }

    If your stream has a schema with fields like user_id (string) and event_count (int32), the generated types will be:

    declare namespace Cloudflare {
    	type AnalyticsStreamRecord = { user_id: string; event_count: number };
    	interface Env {
    		ANALYTICS: Pipeline<Cloudflare.AnalyticsStreamRecord>;
    	}
    }

    For unstructured streams or when not authenticated, bindings fall back to the generic Pipeline<PipelineRecord> type.

Patch Changes
  • #​12592 aaa7200 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260217.0 1.20260218.0
  • #​12606 2f19a40 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260218.0 1.20260219.0
  • #​12604 e2a6600 Thanks @​petebacondarwin! - fix: pass --env flag to auxiliary workers in multi-worker mode

    When running wrangler dev with multiple config files (e.g. -c ./apps/api/wrangler.jsonc -c ./apps/queues/wrangler.jsonc -e=dev), the --env flag was not being passed to auxiliary (non-primary) workers. This meant that environment-specific configuration (such as queue bindings) was not applied to auxiliary workers, causing features like queue consumers to not be triggered in local development.

  • #​12597 0b17117 Thanks @​sdnts! - The maximum allowed delivery and retry delays for Queues is now 24 hours

  • #​12598 ca58062 Thanks @​mattzcarey! - Stop redacting wrangler whoami output in non-interactive mode

    wrangler whoami is explicitly invoked to retrieve account info, so email and account names should always be visible. Redacting them in non-interactive/CI environments makes it difficult for coding agents and automated tools to identify which account to use. Other error messages that may appear unexpectedly in CI logs (e.g. multi-account selection errors) remain redacted.

  • Updated dependencies [f239077, aaa7200, 2f19a40, 5f9f0b4, 452cdc8, 527e4f5, 0b17117]:

v4.66.0

Compare Source

Minor Changes
  • #​12466 caf9b11 Thanks @​petebacondarwin! - Add WRANGLER_CACHE_DIR environment variable and smart cache directory detection

    Wrangler now intelligently detects where to store cache files:

    1. Use WRANGLER_CACHE_DIR env var if set
    2. Use existing cache directory if found (node_modules/.cache/wrangler or .wrangler/cache)
    3. Create cache in node_modules/.cache/wrangler if node_modules exists
    4. Otherwise use .wrangler/cache

    This improves compatibility with Yarn PnP, pnpm, and other package managers that don't use traditional node_modules directories, without requiring any configuration.

  • #​12572 936187d Thanks @​dario-piotrowicz! - Ensure the nodejs_compat flag is always applied in autoconfig

    Previously, the autoconfig feature relied on individual framework configurations to specify Node.js compatibility flags, some could set nodejs_compat while others nodejs_als.

    Now instead nodejs_compat is always included as a compatibility flag, this is generally beneficial and the user can always remove the flag afterwards if they want to.

  • #​12560 c4c86f8 Thanks @​taylorlee! - Support --tag and --message flags on wrangler deploy

    They have the same behavior that they do as during wrangler versions upload, as both
    are set on the version.

    The message is also reused for the deployment as well, with the same behavior as used
    during wrangler versions deploy.

Patch Changes
  • #​12543 5a868a0 Thanks @​G4brym! - Fix AI Search binding failing in local dev

    Using AI Search bindings with wrangler dev would fail with "RPC stub points at a non-serializable type". AI Search bindings now work correctly in local development.

  • #​12552 c58e81b Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260212.0 1.20260213.0
  • #​12568 33a9a8f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260213.0 1.20260214.0
  • #​12576 8077c14 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260214.0 1.20260217.0
  • #​12466 caf9b11 Thanks @​petebacondarwin! - fix: exclude .wrangler directory from Pages uploads

    The .wrangler directory contains local cache and state files that should never be deployed. This aligns Pages upload behavior with Workers Assets, which already excludes .wrangler via .assetsignore.

  • #​12556 7d2355e Thanks @​ascorbic! - Fix port availability check probing the wrong host when host changes

    memoizeGetPort correctly invalidated its cached port when called with a different host, but then still probed the original host for port availability. This could return a port that was free on the original host but already in use on the requested one, leading to bind failures at startup.

  • #​12562 7ea69af Thanks @​MattieTK! - Support function-based Vite configs in autoconfig setup

    wrangler setup and wrangler deploy --x-autoconfig can now automatically add the Cloudflare Vite plugin to projects that use function-based defineConfig() patterns. Previously, autoconfig would fail with "Cannot modify Vite config: expected an object literal but found ArrowFunctionExpression" for configs like:

    export default defineConfig(({ isSsrBuild }) => ({
    	plugins: [reactRouter(), tsconfigPaths()],
    }));

    This pattern is used by several official framework templates, including React Router's node-postgres and node-custom-server templates. The following defineConfig() patterns are now supported:

    • defineConfig({ ... }) (object literal, already worked)
    • defineConfig(() => ({ ... })) (arrow function with expression body)
    • defineConfig(({ isSsrBuild }) => ({ ... })) (arrow function with destructured params)
    • defineConfig(() => { return { ... }; }) (arrow function with block body)
    • defineConfig(function() { return { ... }; }) (function expression)
  • #​12548 5cc7158 Thanks @​dario-piotrowicz! - Fix .assetsignore formatting when autoconfig creates a new file

    Previously, when wrangler setup or wrangler deploy --x-autoconfig created a new .assetsignore file via autoconfig, it would add unnecessary leading empty lines before the wrangler-specific entries. Empty separator lines should only be added when appending to an existing .assetsignore file. This fix ensures newly created .assetsignore files start cleanly without leading blank lines.

  • #​12556 7d2355e Thanks @​ascorbic! - Improve error message when port binding is blocked by a sandbox or security policy

    When running wrangler dev inside a restricted environment (such as an AI coding agent sandbox or locked-down container), the port availability check would fail with a raw EPERM error. This now provides a clear message explaining that a sandbox or security policy is blocking network access, rather than the generic permission error that previously pointed at the file system.

  • #​12545 c9d0f9d Thanks @​dario-piotrowicz! - Improve framework detection when multiple frameworks are found

    When autoconfig detects multiple frameworks in a project, Wrangler now applies smarter logic to select the most appropriate one. Selecting the wrong one is acceptable locally where the user can change the detected framework, in CI an error is instead thrown.

  • #​12548 5cc7158 Thanks @​dario-piotrowicz! - Add trailing newline to generated package.json and wrangler.jsonc files

  • #​12548 5cc7158 Thanks @​dario-piotrowicz! - Fix .gitignore formatting when autoconfig creates a new file

    Previously, when wrangler setup or wrangler deploy created a new .gitignore file via autoconfig, it would add unnecessary leading empty lines before the wrangler-specific entries. Empty separator lines should only be added when appending to an existing .gitignore file. This fix ensures newly created .gitignore files start cleanly without leading blank lines.

  • #​12545 c9d0f9d Thanks @​dario-piotrowicz! - Throw actionable error when autoconfig is run in the root of a workspace

    When running Wrangler commands that trigger auto-configuration (like wrangler dev or wrangler deploy) in the root directory of a monorepo workspace, a helpful error is now shown directing users to run the command in a specific project's directory instead.

  • Updated dependencies [5a868a0, c58e81b, 33a9a8f, 8077c14, caf9b11, 9a565d5, 7f18183, 39491f9, 43c462a]:


Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot merged commit 3a86a83 into main Feb 23, 2026
2 checks passed
@renovate renovate bot deleted the renovate/all-minor-patch branch February 23, 2026 05:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants