Update all non-major dependencies by renovate[bot] · Pull Request #588 · iAverages/avrg.dev

renovate · 2026-03-30T00:49:57Z

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	`2.4.8` → `2.4.9`
hono (source)	`4.12.8` → `4.12.9`
wrangler (source)	`4.76.0` → `4.78.0`

Release Notes

biomejs/biome (@biomejs/biome)

`v2.4.9`

Compare Source

Patch Changes

#9315 085d324 Thanks @ematipico! - Added a new nursery CSS rule noDuplicateSelectors, that disallows duplicate selector lists within the same at-rule context.

For example, the following snippet triggers the rule because the second selector and the first selector are the same:
```
/* First selector */
.x .y .z {
}

/* Second selector */
.x {
  .y {
    .z {
    }
  }
}
```
#9567 b7ab931 Thanks @ematipico! - Fixed #7211: useOptionalChain now detects negated logical OR chains. The following code is now considered invalid:
```
!foo || !foo.bar;
```
#8670 607ebf9 Thanks @tt-a1i! - Fixed #8345: useAdjacentOverloadSignatures no longer reports false positives for static and instance methods with the same name. Static methods and instance methods are now treated as separate overload groups.
```
class Kek {
  static kek(): number {
    return 0;
  }
  another(): string {
    return "";
  }
  kek(): number {
    return 1;
  } // no longer reported as non-adjacent
}
```
#9476 97b80a8 Thanks @masterkain! - Fixed #9475: Fixed a panic when Biome analyzed ambient TypeScript modules containing class constructor, getter, or setter signatures that reference local type aliases. Biome now handles these declarations without crashing during semantic analysis.
#9553 0cd5298 Thanks @dyc3! - Fixed a bug where enabling the rules of a whole group, would enable rules that belonged to a domain under the same group.

For example, linter.rules.correctness = "error" no longer enables React- or Qwik-specific correctness rules unless linter.domains.react, linter.domains.qwik, or an explicit rule config also enables them, or their relative dependencies are installed.
#9586 4cafb71 Thanks @dyc3! - Fixed #8828: Grit patterns using export { $foo } from $source now match named re-exports in JavaScript and TypeScript files.
#9550 d4e3d6e Thanks @dyc3! - Fixed #9548: Biome now parses conditional expressions whose consequent is an arrow function returning a parenthesized object expression.
#8696 a7c19cc Thanks @Faizanq! - Fixed #8685 where noUselessLoneBlockStatements would remove empty blocks containing comments. The rule now preserves these blocks since comments may contain important information like TODOs or commented-out code.
#9557 6671ac5 Thanks @datalek! - Fixed #9557: Biome's LSP server no longer crashes on startup when used with editors that don't send workspaceFolders during initialization. This affected any LSP client that only sends rootUri, which is valid per the LSP specification.
#9455 1710cf1 Thanks @omar-y-abdi! - Fixed #9174: useExpect now correctly rejects asymmetric matchers in Vitest or Jest like expect.stringContaining(), expect.objectContaining(), and utilities like expect.extend() that are not valid assertions. Previously these constructs caused false negatives, allowing tests without real assertions to pass the lint rule.
#9584 956e367 Thanks @ematipico! - Fixed a bug where Vue directive attribute values like v-bind:class="{'dynamic': true}" were incorrectly parsed as JavaScript statements instead of expressions. Object literals inside directive values like :class, v-if, and v-html are now correctly parsed as expressions, preventing spurious parse errors.
#9474 e168494 Thanks @ematipico! - Added the new nursery rule noUntrustedLicenses. This rule disallows dependencies that ship with invalid licenses or licenses that don't meet the criteria of your project/organisation.

The rule has the following options:
- allow: a list of licenses that can be allowed. Useful to bypass possible invalid licenses from downstream dependencies.
- deny: a list of licenses that should trigger the rule. Useful to deny licenses that don't fit your project/organisation.
  When both deny and allow are provided, deny takes precedence.
- requireOsiApproved: whether the licenses need to be approved by the Open Source Initiative.
- requireFsfLibre: whether the licenses need to be approved by the Free Software Foundation.
#9544 723798b Thanks @ViniciusDev26! - Added an unsafe fix to useConsistentMethodSignatures that automatically converts between method-style and property-style signatures.
#9555 8a3647b Thanks @ematipico! - Fixed #188: the Biome Language Server no longer panics when open files change abruptly, such as during git branch checkouts.
#9605 f65c637 Thanks @ematipico! - Fixed #9589. Now Biome correctly parses object expressions inside props and directives. The following code doesn't emit errors anymore:
```
<style is:global define:vars={{ bgLight: light }}>
<Component name={{ first, name }} />
```
#9565 ccb249e Thanks @eyupcanakman! - Fixed #9505: noUselessStringConcat no longer reports tagged template literals as useless string concatenations. Tagged templates invoke a function and can return non-string values, so combining them with + is not equivalent to a single template literal.
#9534 4d050df Thanks @Netail! - Added the nursery rule noInlineStyles. The rule disallows the use of inline style attributes in HTML and the style prop in JSX, including React.createElement calls. Inline styles make code harder to maintain and can interfere with Content Security Policy.
#9611 cddaa44 Thanks @gaauwe! - Fixed a regression where Biome LSP could misread editor settings sent through workspace/didChangeConfiguration when the payload was wrapped in a top-level biome key. This caused requireConfiguration and related settings to be ignored in some editors.

honojs/hono (hono)

`v4.12.9`

Compare Source

What's Changed

fix(request): remove parseBody from bodyCache to prevent TypeError by @yusukebe in #4807
feat(client): add PickResponseByStatusCode type by @yusukebe in #4791
fix(ssg): pass SSG_CONTEXT to forGetInfoURLRequest by @yuintei in #4810
fix(service-worker): make fire() fallback behavior consistent with handle() by @yusukebe in #4821
fix(cors): reflect request origin when credentials is true with wildcard by @ctonneslan in #4813

New Contributors

@yuintei made their first contribution in #4810
@ctonneslan made their first contribution in #4813

Full Changelog: honojs/hono@v4.12.8...v4.12.9

cloudflare/workers-sdk (wrangler)

`v4.78.0`

Compare Source

Minor Changes

#13031 eeaa473 Thanks @WalshyDev! - Add support for Cloudflare Access Service Token authentication via environment variables

When running wrangler dev with remote bindings behind a Cloudflare Access-protected domain, Wrangler previously required cloudflared access login which opens a browser for interactive authentication. This does not work in CI/CD environments.

You can now set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate using an Access Service Token instead:
```
export CLOUDFLARE_ACCESS_CLIENT_ID="<your-client-id>.access"
export CLOUDFLARE_ACCESS_CLIENT_SECRET="<your-client-secret>"
wrangler dev
```
Additionally, when running in a non-interactive environment (CI) without these credentials, Wrangler now throws a clear, actionable error instead of hanging on cloudflared access login.
#13027 9fcdfca Thanks @G4brym! - feat: Add ai_search_namespaces and ai_search binding types

Two new binding types for AI Search:
- ai_search_namespaces: Namespace binding — namespace is required and auto-provisioned at deploy time if it doesn't exist (like R2 buckets)
- ai_search: Single instance binding bound directly to a pre-existing instance in the default namespace
Both are remote-only in local dev.
#12874 53ed15a Thanks @xortive! - Add Workers VPC service support for Hyperdrive origins

Hyperdrive configs can now connect to databases through Workers VPC services using the --service-id option:
```
wrangler hyperdrive create my-config --service-id <vpc-service-uuid> --database mydb --user myuser --password mypassword
```
This enables Hyperdrive to connect to databases hosted in private networks that are accessible through Workers VPC TCP services.
#12852 6b50bfa Thanks @Carolx715! - Add interactive data catalog validation to R2 object and lifecycle commands.

When performing R2 operations that could affect data catalog state (object put, object delete, lifecycle add, lifecycle set), Wrangler now validates with the API and prompts users for confirmation if a conflict is detected. For bulk put operations, Wrangler prompts upfront before starting the batch. Users can bypass prompts with --force (-y). In non-interactive/CI environments, the operation proceeds automatically.
#13030 0386553 Thanks @natewong1313! - Add local mode support for Stream bindings

Miniflare and wrangler dev now support using Cloudflare Stream bindings locally.

Supported operations:
- upload() — upload video via URL
- video(id).details(), .update(), .delete(), .generateToken()
- videos.list()
- captions.generate(), .list(), .delete()
- downloads.generate(), .get(), .delete()
- watermarks.generate(), .list(), .get(), .delete()
The following are not yet supported in local mode and will throw:
- createDirectUpload()
- Caption upload via File
- Watermark generation via File
Data is persisted across restarts by default. You must set streamPersist: false in Miniflare options to disable persistence.
#12874 53ed15a Thanks @xortive! - Add --cert-verification-mode option to wrangler vpc service create and wrangler vpc service update

You can now configure the TLS certificate verification mode when creating or updating a VPC connectivity service. This controls how the connection to the origin server verifies TLS certificates.

Available modes:
- verify_full (default) -- verify certificate chain and hostname
- verify_ca -- verify certificate chain only, skip hostname check
- disabled -- do not verify the server certificate at all
```
wrangler vpc service create my-service --type tcp --tcp-port 5432 --ipv4 10.0.0.1 --tunnel-id <tunnel-uuid> --cert-verification-mode verify_ca
```
This applies to both TCP and HTTP VPC service types. When omitted, the default verify_full behavior is used.
#12874 53ed15a Thanks @xortive! - Add TCP service type support for Workers VPC

You can now create TCP services in Workers VPC using the --type tcp option:
```
wrangler vpc service create my-db --type tcp --tcp-port 5432 --ipv4 10.0.0.1 --tunnel-id <tunnel-uuid>
```
This enables exposing TCP-based services like PostgreSQL, MySQL, and other database servers through Workers VPC.

Patch Changes

#13039 bc24ec8 Thanks @petebacondarwin! - fix: Angular auto-config now correctly handles projects without SSR configured

Previously, running wrangler deploy (or wrangler setup) on a plain Angular SPA (created with ng new without --ssr) would crash with Cannot set properties of undefined (setting 'experimentalPlatform'), because the auto-config code unconditionally assumed SSR was configured.

Angular projects without SSR are now treated as assets-only deployments: no wrangler.jsonc main entry is generated, angular.json is not modified, no src/server.ts is created, and no extra dependencies are installed.
#13036 0b4c21a Thanks @pbrowne011! - Fix wrangler deploy --dry-run skipping asset build-artifact validation checks

Previously, --dry-run skipped the entire asset sync step, which meant it also skipped validation that runs during asset manifest building. This included the check that errors when a _worker.js file or directory would be uploaded as a public static asset (which can expose private server-side code), as well as the per-file size limit check.

With this fix, --dry-run now runs buildAssetManifest against the asset directory when assets are configured, performing the same file-system validation as a real deploy without uploading anything or making any API calls.
#13061 535582d Thanks @petebacondarwin! - fix: resolve secondary worker types when environment overrides the worker name in multi-worker type generation

When running wrangler types with multiple -c config flags and the secondary worker has named environments that override the worker name (e.g. a worker named do-worker with env staging whose effective name becomes do-worker-staging), service bindings and Durable Object bindings in the primary worker that reference do-worker-staging now correctly resolve to the typed entry point instead of falling back to an unresolved comment type such as DurableObjectNamespace /* MyClass from do-worker-staging */.

The fix extends the secondary entries map to also register environment-specific worker names, so that lookups by the env-qualified name (e.g. do-worker-staging) resolve to the same source file as the base worker name.
#13058 992f9a3 Thanks @petebacondarwin! - fix: patch undici to prevent fetch() throwing on 401 responses with a request body

Fetching with a request body (string, JSON, FormData, etc.) to an endpoint that returns a 401 would throw TypeError: fetch failed with cause expected non-null body source. This affected Unstable_DevWorker.fetch() and any other use of undici's fetch in wrangler.

The root cause is isTraversableNavigable() in undici returning true unconditionally, causing the 401 credential-retry logic to run in Node.js where it should never apply (there is no browser UI to prompt for credentials). This is tracked upstream in nodejs/undici#4910. Until an upstream fix is released, we apply a patch to undici that returns false from isTraversableNavigable().
#13017 91b7f73 Thanks @petebacondarwin! - fix: prevent Docker container builds from spawning console windows on Windows

On Windows, detached: true in child_process.spawn() gives each child process its own visible console window, causing many windows to flash open during wrangler deploy with [[containers]]. The detached option is now only set on non-Windows platforms (where it is needed for process group cleanup), and windowsHide: true is added to further suppress console windows on Windows.
#12996 f6cdab2 Thanks @guybedford! - Fix source phase imports in bundled and non-bundled Workers

Wrangler now preserves import source syntax when it runs esbuild, including module format detection and bundled deploy output. This fixes both --no-bundle and bundled deployments for Workers that import WebAssembly using source phase imports.
#12931 ce65246 Thanks @dario-piotrowicz! - Improve error message when modules cannot be resolved during bundling

When a module cannot be resolved during bundling, Wrangler now suggests using the alias configuration option to substitute it with an alternative implementation. This replaces esbuild's default suggestion to "mark the path as external", which is not a supported option in Wrangler.

For example, if you try to import a module that doesn't exist:
```
import foo from "some-missing-module";
```
Wrangler will now suggest:
```
To fix this, you can add an entry to "alias" in your Wrangler configuration
to substitute "some-missing-module" with an alternative implementation.
See https://developers.cloudflare.com/workers/wrangler/configuration/#bundling-issues
```
This provides actionable guidance for resolving import errors.
#13049 7a5be20 Thanks @nikitassharma! - add library-push flag to containers registries credentials

This flag is not available for public use.
#13018 9c5ebf5 Thanks @tgarg-cf! - Validate that queue consumers in wrangler config only use the "worker" type

Previously, non-worker consumer types (e.g. http_pull) could be specified in the queues.consumers config. Now, wrangler will error if a consumer type other than "worker" is specified in the config file.

To configure non-worker consumer types, use the wrangler queues consumer CLI commands instead (e.g. wrangler queues consumer http-pull add).
Updated dependencies [9fcdfca, 1faff35, f4ea4ac, 0386553]:
- miniflare@4.20260317.3

`v4.77.0`

Compare Source

Minor Changes

#13023 593c4db Thanks @jamesopstad! - Add wrangler versions upload support for the experimental secrets configuration property

When the new secrets property is defined, wrangler versions upload now validates that all secrets declared in secrets.required are configured on the Worker before the upload succeeds. If any required secrets are missing, the upload fails with a clear error listing which secrets need to be set.

When secrets is not defined, the existing behavior is unchanged.
```
// wrangler.jsonc
{
  "secrets": {
    "required": ["API_KEY", "DB_PASSWORD"]
  }
}
```
#12732 c2e9163 Thanks @jamesopstad! - Add deploy support for the experimental secrets configuration property

When the new secrets property is defined, wrangler deploy now validates that all secrets declared in secrets.required are configured on the Worker before the deploy succeeds. If any required secrets are missing, the deploy fails with a clear error listing which secrets need to be set.

When secrets is not defined, the existing behavior is unchanged.
```
// wrangler.jsonc
{
  "secrets": {
    "required": ["API_KEY", "DB_PASSWORD"]
  }
}
```

Patch Changes

#12896 451dae3 Thanks @petebacondarwin! - fix: Add retry and timeout protection to remote preview API calls

Remote preview sessions (wrangler dev --remote) now automatically retry transient 5xx API errors (up to 3 attempts with linear backoff) and enforce a 30-second per-request timeout. Previously, a single hung or failed API response during session creation or worker upload could block the dev session reload indefinitely.
#12569 379f2a2 Thanks @MattieTK! - Use qwik add cloudflare-workers instead of qwik add cloudflare-pages for Workers targets

Both the wrangler autoconfig and C3 Workers template for Qwik were running qwik add cloudflare-pages even when targeting Cloudflare Workers. This caused the wrong adapter directory structure to be scaffolded (adapters/cloudflare-pages/ instead of adapters/cloudflare-workers/), and required post-hoc cleanup of Pages-specific files like _routes.json.

Qwik now provides a dedicated cloudflare-workers adapter that generates the correct Workers configuration, including wrangler.jsonc with main and assets fields, a public/.assetsignore file, and the correct adapters/cloudflare-workers/vite.config.ts.

Also adds --skipConfirmation=true to all qwik add invocations so the interactive prompt is skipped in automated contexts.
#11899 9a1cf29 Thanks @hoodmane! - Remove cf-requirements support for Python workers. It hasn't worked with the runtime for a while now.
#11800 875da60 Thanks @southpolesteve! - Add upgrade hint to unexpected configuration field warnings when an update is available

When Wrangler encounters unexpected fields in the configuration file and a newer version of Wrangler is available, it now displays a message suggesting to update. This helps users who may be using configuration options that were added in a newer version of Wrangler.
Updated dependencies [b8f3309, 5aaaab2, 5aaaab2, f8516dd, 9c9fe30, 6a6449e]:
- miniflare@4.20260317.2

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update all non-major dependencies

f7e5d56

renovate bot added the dependencies label Mar 30, 2026

renovate bot merged commit c730d10 into main Mar 30, 2026
2 checks passed

renovate bot deleted the renovate/all-minor-patch branch March 30, 2026 04:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update all non-major dependencies#588

Update all non-major dependencies#588
renovate[bot] merged 1 commit intomainfrom
renovate/all-minor-patch

renovate bot commented Mar 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Mar 30, 2026

Release Notes

v2.4.9

Patch Changes

v4.12.9

What's Changed

New Contributors

v4.78.0

Minor Changes

Patch Changes

v4.77.0

Minor Changes

Patch Changes

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v2.4.9`

`v4.12.9`

`v4.78.0`

`v4.77.0`