Skip to content

build(deps): bump the minor-and-patch group with 14 updates#403

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-b4738a1341
Open

build(deps): bump the minor-and-patch group with 14 updates#403
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/minor-and-patch-b4738a1341

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 14 updates:

Package From To
@j178/prek 0.4.10 0.4.11
knip 6.27.0 6.29.0
react-doctor 0.8.1 0.9.1
@cloudflare/sandbox 0.12.3 0.12.4
better-auth 1.6.23 1.6.25
hono 4.12.30 4.12.32
wrangler 4.112.0 4.114.0
@hugeicons/core-free-icons 4.2.2 4.2.3
@tanstack/react-query 5.101.2 5.101.4
lucide-react 1.25.0 1.26.0
react 19.2.7 19.2.8
react-dom 19.2.7 19.2.8
@vitejs/plugin-react 6.0.3 6.0.4
@playwright/test 1.61.1 1.62.0

Updates @j178/prek from 0.4.10 to 0.4.11

Release notes

Sourced from @​j178/prek's releases.

0.4.11

Release Notes

Released on 2026-07-25.

Highlights

  • This release adds two new builtin hooks, deny-pattern and require-pattern, as native alternatives for pygrep use cases. deny-pattern fails when a configured pattern is found, while require-pattern ensures every selected file contains a match. By matching natively without spawning a Python subprocess, they run over 4x faster than pygrep in benchmarks. Note that they use Rust regex syntax, which does not support look-around features such as negative lookbehind.

  • prek run now supports --glob <PATTERN> to run hooks on tracked files matching a glob. It can be repeated or combined with --files and --directory.

  • Hook priorities now support reusable aliases:

    [priorities]
checks = 10
[[repos]]
repo = "builtin"
hooks = [
{ id = "check-json", priority = "checks" },
{ id = "check-yaml", priority = "checks" },
]

    This makes parallel scheduling easier to read and maintain.

Enhancements

  • Add deny-pattern and require-pattern builtin hooks (#2359)
  • Support --glob patterns in prek run (#2381)
  • Support reusable aliases for hook priorities (#2331)
  • Implement requirements-txt-fixer as a builtin hook (#2390)
  • Improve user-facing warnings and errors (#2380)
  • Install Node hooks through git url (#2394)

Performance

  • Reduce blocking-pool overhead in file hooks (#2384)
  • Speed up mixed-line-ending scans with memchr2 (#2391)

Bug fixes

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.4.11

Released on 2026-07-25.

Highlights

  • This release adds two new builtin hooks, deny-pattern and require-pattern, as native alternatives for pygrep use cases. deny-pattern fails when a configured pattern is found, while require-pattern ensures every selected file contains a match. By matching natively without spawning a Python subprocess, they run over 4x faster than pygrep in benchmarks. Note that they use Rust regex syntax, which does not support look-around features such as negative lookbehind.

  • prek run now supports --glob <PATTERN> to run hooks on tracked files matching a glob. It can be repeated or combined with --files and --directory.

  • Hook priorities now support reusable aliases:

    [priorities]
checks = 10
[[repos]]
repo = "builtin"
hooks = [
{ id = "check-json", priority = "checks" },
{ id = "check-yaml", priority = "checks" },
]

    This makes parallel scheduling easier to read and maintain.

Enhancements

  • Add deny-pattern and require-pattern builtin hooks (#2359)
  • Support --glob patterns in prek run (#2381)
  • Support reusable aliases for hook priorities (#2331)
  • Implement requirements-txt-fixer as a builtin hook (#2390)
  • Improve user-facing warnings and errors (#2380)
  • Install Node hooks through git url (#2394)

Performance

  • Reduce blocking-pool overhead in file hooks (#2384)
  • Speed up mixed-line-ending scans with memchr2 (#2391)

Bug fixes

... (truncated)

Commits

Updates knip from 6.27.0 to 6.29.0

Release notes

Sourced from knip's releases.

Release 6.29.0

  • fix(glob): do not follow symbolic links in async glob (#1900) (b7d5ce2f545d91953a97733aa1567e8728b20644) - thanks @​mogelbrod!
  • Add built-in compiler for tsrx (db05e0142a41fad2ad45d62ba5106e0d97c92b45)
  • Fix -u shortcut for --duration (932b9262af275d209923a5efab1b6f23067bb006)

Release 6.28.0

  • Update oxc-resolver (resolve #1889) (1444f6aaf04d42ad07ee0b88da4dfae0e116043a)
  • Keep entry-exported members public (resolve #1890) (94967c13a589a7e83408b1495c31323ac126fcab)
  • Don't un-ignore sibling paths on unrelated gitignore negations (resolve #1891) (5c026ba50c1e89804fc5094a52dc4c4c37d92bc2)
  • Memoize the gitignore shadowed-pattern check (a5fa3b0ebb7f84c107dba1c1ca9a9b73995f668f)
  • Ignore nested files under a gitignore dir/* pattern (404a53e3e49fa7c1f51b60bcb30ea50450f75aab)
  • Track types referenced by JSDoc imports (resolve #1888) (6ae48aadbe03952690c8608e6df42bd039cf6624)
  • Update oxc-parser (02ca17a72c3f0afa7df32297d2dd2f5463ac6e00)
  • feat: markdownlint-cli2 (#1887) (323b96f55b38b53f5e4648d72fecd968fae35147) - thanks @​Zamiell!
  • Update rolldown snapshot (009e509dee6a5013fd3937abb4ec81684601b023)
  • Resolve $GITHUB_ACTION_PATH in GHA composite actions (ead489f066733f701acfe5b81eac0a6c813fb5c5)
  • Don't report node: specifiers as unlisted dependencies (1a7114f0a159fe82328041e11fc61c5c1730cc01)
  • Discover tsdown CLI entries (0d47a45bfc518a7bf73a4b4878aeab236d6f9791)
  • Discover Convex function modules (e01f21c44773186e7ad74e7badf9fc81b82edfb5)
  • Ignore common system binaries (cd003065fda5422550a412bba07ebbb1f9bae126)
  • Add OpenClaw plugin (73a2d7dd45f65ea312fde38cb4fa4f5a4fc34bf2)
  • Discover Tailwind CLI input stylesheet (resolve #1551) (9ae5feed922ecb7e8c436545e9b45125bd73b457)
  • Discover Angular global stylesheets from angular.json (fb9e0488f6f21284714d0651fcf1dd2de02d425a)
  • Hint when project patterns exclude a compiled extension (74de516d3d73839536fc2a43c2c0ec38a6299631)
  • Ignore common global binaries (a99a206015fe414a4de12016cc62499910afaf6f)
  • Run multiple preprocessors in sequence (844358367e9d1939bbf47f8dcb97d810741f56c1)
  • fix(nuxt): resolve nuxt module paths (#1896) (3c8594f5ffc641b00575b6d7455990db1277ac75) - thanks @​danielroe!
  • Report unused re-exports when ignoreExportsUsedInFile is set (#1895) (a113a5f4eedc81ef56b00a3e488cc94febefede5) - thanks @​mlm20!
  • Pass -w to pnpm add in sentry ecosystem test (ea8c8ac6fe9519f00ca6a61131b345f5de521704)
  • Update sentry snapshot (b75768d544d9f869ebce8f8c6dd8490f3db87023)
  • Record all traversed dirs in glob cache (resolve #1897) (81be1d436eae15518df764cbcb443899e11a9569)
  • Invalidate glob cache when .gitignore changes (baff301f2dceda97bf8bf73809d811cc44c72c8c)
  • Improve Nuxt and Nitro plugin resolution (86ffab7bcdd095631d6b0b17254e8acd6b5022bc)
  • fix: don't treat [-]-c[heck] as config flag for prettier (#1902) (b7266ee8240a9b8686e91a44a4706d3605d094c4) - thanks @​davidkna-sap!
  • Use Entra ID to publish VS Code extension (4236253482f884d92cfde2ccf85c7fb9aca17f7e)
  • Remove obsolete trust policy exclusions (630d5f9835f4303ec9aa7d090ad40a177808c4fb)
  • Update dependencies (810147b5aa21bb57ad103fd19ba92844e42cd84c)
  • Migrate from typescript/native-preview to typescript (140a25a577a64273a7a77f2ff2c8f224118ac298)
Commits

Updates react-doctor from 0.8.1 to 0.9.1

Release notes

Sourced from react-doctor's releases.

[email protected]

Patch Changes

  • #1428 1e67af0 Thanks @​aidenybai! - Add seven conservative diagnostics for responsive accessible names, reduced-motion content, animation ownership and focus timing, loading-control identity, request error states, and composite-widget feedback. Keep project-wide reduced-motion policy on the existing require-reduced-motion diagnostic instead of introducing a duplicate rule.

  • #1437 30369b6 Thanks @​skoshx! - Detect React Compiler from its compatibility runtime so compiler-gated diagnostics stay disabled when configuration lives outside the scanned package.

  • #1434 db9d300 Thanks @​aidenybai! - Make every design-tagged rule opt-in during general scans while keeping the focused design command and explicit rule configuration able to enable them.

  • Updated dependencies [1e67af0, 707378a, 8765ca3, db9d300]:

[email protected]

Minor Changes

  • #979 9155bc0 Thanks @​aidenybai! - Add an experimental Ink TUI at react-doctor experimental-tui. It streams diagnostics during the scan, then renders the complete score-sorted report with keyboard navigation, inline code frames, focused fix prompts, and optional agent handoff. Monorepos get interactive project selection and one combined report with project-qualified paths. Ink and React load lazily, so the default static, JSON, and score-only paths are unaffected.

Patch Changes

  • #1423 3d7ea66 Thanks @​aidenybai! - Speed up custom Hook and wildcard re-export analysis, and upgrade the Oxc toolchain.

  • #1424 76263ec Thanks @​aidenybai! - Add direct Three.js and WebGL diagnostics derived from the React Three Fiber suite, covering hot animation and pointer paths, render-time construction, resource cleanup, device pixel ratio, shadowed point lights, frame delta, instance-buffer and projection updates, WebGPU legacy APIs, TSL uniform branches, and synchronous GPU readbacks. Prevent cyclic config bindings from crashing project discovery.

  • Updated dependencies [3d7ea66, 599e30d, 76263ec]:

[email protected]

Patch Changes

[email protected]

Patch Changes

  • #1419 8c4959b Thanks @​aidenybai! - Correct false positives and false negatives found by an all-rules 2,000-project parity audit. Tighten project capability detection, browser-target compatibility, React Compiler configuration reachability, Tailwind conflict handling, JSX attribute ordering, accessible-name evidence, server-action provenance, state/effect execution analysis, image and motion evidence, and framework export handling.

  • #1337 0b0b5ac Thanks @​aidenybai! - Add deterministic design-quality lint rules spanning motion performance, accessibility, and Tailwind/JSX hygiene.

    Add react-doctor design [directory] for a focused UI audit. The command runs the complete design-rule bucket plus other explicitly design-tagged rules, deliberately activates that family's focused opt-in diagnostics, respects explicit per-rule disablements, and skips unrelated analyzers, external lint configuration, custom plugins, and health scoring.

    Motion

    • motion-create-in-render — Motion component factories executed during a component or custom-hook render, including synchronous iteration callbacks. Module scope, event/effect callbacks, and stable React initializers remain valid.
    • motion-value-constructor-in-render — manual motionValue() objects recreated during React render. Recommends useMotionValue() while preserving module-scope and explicitly stabilized values.

... (truncated)

Changelog

Sourced from react-doctor's changelog.

0.9.1

Patch Changes

  • #1428 1e67af0 Thanks @​aidenybai! - Add seven conservative diagnostics for responsive accessible names, reduced-motion content, animation ownership and focus timing, loading-control identity, request error states, and composite-widget feedback. Keep project-wide reduced-motion policy on the existing require-reduced-motion diagnostic instead of introducing a duplicate rule.

  • #1437 30369b6 Thanks @​skoshx! - Detect React Compiler from its compatibility runtime so compiler-gated diagnostics stay disabled when configuration lives outside the scanned package.

  • #1434 db9d300 Thanks @​aidenybai! - Make every design-tagged rule opt-in during general scans while keeping the focused design command and explicit rule configuration able to enable them.

  • Updated dependencies [1e67af0, 707378a, 8765ca3, db9d300]:

0.9.0

Minor Changes

  • #979 9155bc0 Thanks @​aidenybai! - Add an experimental Ink TUI at react-doctor experimental-tui. It streams diagnostics during the scan, then renders the complete score-sorted report with keyboard navigation, inline code frames, focused fix prompts, and optional agent handoff. Monorepos get interactive project selection and one combined report with project-qualified paths. Ink and React load lazily, so the default static, JSON, and score-only paths are unaffected.

Patch Changes

  • #1423 3d7ea66 Thanks @​aidenybai! - Speed up custom Hook and wildcard re-export analysis, and upgrade the Oxc toolchain.

  • #1424 76263ec Thanks @​aidenybai! - Add direct Three.js and WebGL diagnostics derived from the React Three Fiber suite, covering hot animation and pointer paths, render-time construction, resource cleanup, device pixel ratio, shadowed point lights, frame delta, instance-buffer and projection updates, WebGPU legacy APIs, TSL uniform branches, and synchronous GPU readbacks. Prevent cyclic config bindings from crashing project discovery.

  • Updated dependencies [3d7ea66, 599e30d, 76263ec]:

0.8.3

Patch Changes

0.8.2

Patch Changes

  • #1419 8c4959b Thanks @​aidenybai! - Correct false positives and false negatives found by an all-rules 2,000-project parity audit. Tighten project capability detection, browser-target compatibility, React Compiler configuration reachability, Tailwind conflict handling, JSX attribute ordering, accessible-name evidence, server-action provenance, state/effect execution analysis, image and motion evidence, and framework export handling.

  • #1337 0b0b5ac Thanks @​aidenybai! - Add deterministic design-quality lint rules spanning motion performance, accessibility, and Tailwind/JSX hygiene.

    Add react-doctor design [directory] for a focused UI audit. The command runs the complete design-rule bucket plus other explicitly design-tagged rules, deliberately activates that family's focused opt-in diagnostics, respects explicit per-rule disablements, and skips unrelated analyzers, external lint configuration, custom plugins, and health scoring.

... (truncated)

Commits

Updates @cloudflare/sandbox from 0.12.3 to 0.12.4

Release notes

Sourced from @​cloudflare/sandbox's releases.

@​cloudflare/sandbox@​0.12.4

Patch Changes

  • #798 33ac27b Thanks @​aron-cf! - Add labels to SandboxOptions so getSandbox() can attach Cloudflare Container labels for analytics and observability. Labels are applied on container start; updates while running apply on the next start.
Commits

Updates better-auth from 1.6.23 to 1.6.25

Release notes

Sourced from better-auth's releases.

v1.6.25

better-auth

Bug Fixes

  • Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures (#10294)
  • Fixed Google One Tap creating new users when sign-up was disabled on the Google provider (#10479)
  • Fixed $fetch and $store not being exposed on the Solid client (#10444)
  • Fixed internal adapter queries being routed to the wrong table when a built-in table's modelName was set to another table's schema key (e.g. user.modelName = "account").

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​birkskyum, @​jsj, @​krish-vachhani

Full changelog: v1.6.24...v1.6.25

v1.6.24

better-auth

Features

  • Added request context (ctx) as a third argument to verifyIdToken, enabling custom ID token verifiers to read request headers (#10376)
  • Added beforeStoreCookie option to the last-login-method plugin for GDPR compliance (#5753)

Bug Fixes

  • Replaced flaky MongoDB where-coercion integration test with a direct unit test for more reliable test runs (#10369)
  • Fixed the get-session endpoint to include no-store cache control headers, preventing stale session data from being served (#10222)
  • Fixed SQLite migration diffs to recognize BIGINT as a valid number type, preventing spurious pending changes on rate limiter columns (#10316)
  • Fixed auth requests failing when request cloning throws an error inside verification callbacks (#10336)
  • Fixed useSession({ throw: true }) incorrectly excluding null from its data type (#9787)
  • Fixed auth query revalidation and signal listeners not being restored after a client component remounts (#10379)
  • Fixed the CookieAttributes index signature type to be more precise (#10442)
  • Fixed silent misrouting of adapter queries when user.modelName was set to a value that collides with another schema key (#10235)
  • Fixed Kysely migration generation producing duplicate indexes for fields marked both unique and index (#10357)
  • Fixed magic-link and email-OTP send endpoints to validate the Origin header on cookieless requests, preventing cross-origin abuse (#10368)
  • Fixed remote MCP auth 401 challenge headers being hidden from browser clients due to missing CORS exposure (#10290)
  • Fixed OpenAPI schema to include plugin user fields (such as username and displayUsername) in /sign-up/email and /update-user request bodies (#10453)
  • Fixed organization.listMembers failing with "User not found for member" for organizations with more than ~100 members (#10342)
  • Fixed organization invitations to use database-generated IDs when advanced.database.generateId is configured, matching the behavior of other models (#10040)
  • Fixed getDefaultModelName to prefer exact schema key matches over modelName aliases, preventing adapter queries from being misrouted when a built-in table's name collides with another schema key

For detailed changes, see CHANGELOG

auth

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.6.25

Patch Changes

  • #10479 5124c34 Thanks @​krish-vachhani! - Prevent Google One Tap from creating new users when sign-up is disabled for the Google provider.

  • #10444 7439359 Thanks @​birkskyum! - Expose the real $fetch instance and $store atoms from the Solid client instead of resolving them as dynamic API routes.

  • Updated dependencies [0ffd1fb]:

    • @​better-auth/core@​1.6.25
    • @​better-auth/drizzle-adapter@​1.6.25
    • @​better-auth/kysely-adapter@​1.6.25
    • @​better-auth/memory-adapter@​1.6.25
    • @​better-auth/mongo-adapter@​1.6.25
    • @​better-auth/prisma-adapter@​1.6.25
    • @​better-auth/telemetry@​1.6.25

1.6.24

Patch Changes

  • #10235 03dc5a0 Thanks @​ping-maxwell! - Fixes silent foreign-key and adapter-join misrouting when a user remaps a built-in model name to a string that collides with another schema key

  • #10357 7508940 Thanks @​c-nicol! - Fixes Kysely migration generation for new-table fields that are both unique: true and index: true.

  • #10342 bae7198 Thanks @​ping-maxwell! - Fix organization.listMembers failing with "User not found for member" for orgs with more than ~100 members by applying the same membership limit to the users query.

  • #10336 ef4d273 Thanks @​Tushar-Khandelwal-2004! - Prevent verification callbacks from failing auth requests when cloning the request throws.

  • #10333 99dbdd7 Thanks @​c-nicol! - Fixes Drizzle schema generation for fields that are both unique: true and index: true.

  • #10368 086ca91 Thanks @​gaurav0107! - Force-validate the request Origin on the magic-link (/sign-in/magic-link) and email-otp (/email-otp/send-verification-otp) send endpoints, including cookieless requests, to match the built-in /sign-in/email and /sign-up/email routes. A cookieless cross-origin POST can no longer trigger a magic-link or verification-OTP email to an arbitrary address. Cookieless requests that carry no Origin (server-to-server) are unaffected.

  • #10290 8f2dedd Thanks @​GautamBytes! - Expose the remote MCP auth client's 401 challenge headers to browser clients using CORS.

  • #10453 4e685ee Thanks @​ping-maxwell! - OpenAPI now includes user.additionalFields and plugin user schema fields (e.g. username plugin username / displayUsername) on /sign-up/email and /update-user request bodies.

  • #10190 3bf0e49 Thanks @​gaurav-init! - Pass the endpoint context as the second argument to beforeDeleteOrganization and afterDeleteOrganization hooks in the organization plugin, matching the signature shown in the docs and the existing databaseHooks pattern. The Stripe plugin's beforeDeleteOrganization wrapper now forwards the context to user-supplied hooks instead of dropping it.

  • #10040 f59a0ee Thanks @​shiminshen! - Organization invitations now let the database generate their id when ID generation is delegated to the database (e.g. advanced.database.generateId: "uuid" with a UUID-capable adapter such as Postgres), matching every other model. Previously createInvitation always generated the invitation id in application code, so invitation rows received an app-generated value instead of a database-generated one while organizations, members and teams correctly deferred to the database (better-auth/better-auth#10024). A caller-provided id (e.g. via beforeCreateInvitation) is still honored.

  • #10302 0f2cc1b Thanks @​momomuchu! - Prefer exact schema-key matches over modelName aliases in getDefaultModelName, so remapping a built-in table onto another table's schema key (e.g. user.modelName = "account") does not reroute internal adapter queries to the wrong table.

  • #9787 ae78109 Thanks @​ping-maxwell! - Fixes an issue where useSession({ throw: true }) incorrectly excluded null from its data type.

  • #10222 46d2bf0 Thanks @​ping-maxwell! - fix: add no-store cache-control headers to get-session route

  • #10316 29a373e Thanks @​vinay-oppuri! - Recognize SQLite BIGINT as a valid number type in migration diffs so database-backed rate limiter columns like lastRequest no longer report spurious pending changes on every run.

  • #10379 f6d18fa Thanks @​ping-maxwell! - fix(client): restore auth query revalidation and signal listeners after remount

... (truncated)

Commits
  • 07a646e chore: release v1.6.25 (#10491)
  • 7439359 fix(solid): expose $fetch and $store on the solid client (#10444)
  • dac701c chore(deps): bump next from 16.2.6 to 16.2.11 (#10493)
  • 5124c34 fix(one-tap): enforce google provider signup restrictions (#10479)
  • 9a661c7 chore: release v1.6.24 (#10323)
  • 4e685ee fix(open-api): include plugin user fields on sign-up/update bodies (#10453)
  • d3ce782 fix(cookies): tighten CookieAttributes index signature type (#10441) (#10442)
  • ae78109 fix(client): preserve null in useSession().data type with throw:true (#9787)
  • f6d18fa fix(client): restore auth query lifecycle after remount (#10379)
  • 086ca91 fix(magic-link, email-otp): force-validate Origin on cookieless send endpoint...
  • Additional commits viewable in compare view

Updates hono from 4.12.30 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

  • ci: enable reports for type & bundle size check in honojs/hono#5148
  • fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
  • fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
  • test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
  • fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
  • fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

v4.12.31

What's Changed

Full Changelog: honojs/hono@v4.12.30...v4.12.31

Commits
  • 26d8e42 4.12.32
  • 402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
  • c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
  • a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
  • 44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
  • e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
  • bf8608c ci: enable reports for type & bundle size check (#5148)
  • cadff88 4.12.31
  • 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
  • aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
  • Additional commits viewable in compare view

Updates wrangler from 4.112.0 to 4.114.0

Release notes

Sourced from wrangler's releases.

[email protected]

Minor Changes

  • #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

    wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

    You can explore this data two ways:

    • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
    • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

    While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

  • #14373 246ce92 Thanks @​Jacroney! - Improve the D1 database-limit error message

    When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

  • #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260721.1 ^5.20260722.1
    workerd 1.20260721.1 1.20260722.1

  • #14788 8416b33 Thanks @​chinesepowered! - Fix grammar in the container image-too-large error

    The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."

  • #14809 4683ff8 Thanks @​jamesopstad! - Ignore the removed legacy_env field when reading a redirected configuration

    Older versions of tools such as the Vite plugin can generate a redirected configuration (.wrangler/deploy/config.json) that still includes the removed legacy_env field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips legacy_env from redirected configurations. User-authored configurations still report an error so that the field can be removed.

  • #14593

@dependabot
build(deps): bump the minor-and-patch group with 14 updates
e0feaf4 
Bumps the minor-and-patch group with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [@j178/prek](https://github.com/j178/prek) | `0.4.10` | `0.4.11` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.27.0` | `6.29.0` |
| [react-doctor](https://github.com/millionco/react-doctor/tree/HEAD/packages/react-doctor) | `0.8.1` | `0.9.1` |
| [@cloudflare/sandbox](https://github.com/cloudflare/sandbox-sdk) | `0.12.3` | `0.12.4` |
| [better-auth](https://github.com/better-auth/better-auth/tree/HEAD/packages/better-auth) | `1.6.23` | `1.6.25` |
| [hono](https://github.com/honojs/hono) | `4.12.30` | `4.12.32` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.112.0` | `4.114.0` |
| @hugeicons/core-free-icons | `4.2.2` | `4.2.3` |
| [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.101.2` | `5.101.4` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.26.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.3` | `6.0.4` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.61.1` | `1.62.0` |


Updates `@j178/prek` from 0.4.10 to 0.4.11
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.10...v0.4.11)

Updates `knip` from 6.27.0 to 6.29.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/[email protected]/packages/knip)

Updates `react-doctor` from 0.8.1 to 0.9.1
- [Release notes](https://github.com/millionco/react-doctor/releases)
- [Changelog](https://github.com/millionco/react-doctor/blob/main/packages/react-doctor/CHANGELOG.md)
- [Commits](https://github.com/millionco/react-doctor/commits/[email protected]/packages/react-doctor)

Updates `@cloudflare/sandbox` from 0.12.3 to 0.12.4
- [Release notes](https://github.com/cloudflare/sandbox-sdk/releases)
- [Commits](https://github.com/cloudflare/sandbox-sdk/compare/@cloudflare/[email protected]...@cloudflare/[email protected])

Updates `better-auth` from 1.6.23 to 1.6.25
- [Release notes](https://github.com/better-auth/better-auth/releases)
- [Changelog](https://github.com/better-auth/better-auth/blob/main/packages/better-auth/CHANGELOG.md)
- [Commits](https://github.com/better-auth/better-auth/commits/v1.6.25/packages/better-auth)

Updates `hono` from 4.12.30 to 4.12.32
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.30...v4.12.32)

Updates `wrangler` from 4.112.0 to 4.114.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/[email protected]/packages/wrangler)

Updates `@hugeicons/core-free-icons` from 4.2.2 to 4.2.3

Updates `@tanstack/react-query` from 5.101.2 to 5.101.4
- [Release notes](https://github.com/TanStack/query/releases)
- [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md)
- [Commits](https://github.com/TanStack/query/commits/@tanstack/[email protected]/packages/react-query)

Updates `lucide-react` from 1.25.0 to 1.26.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.26.0/packages/lucide-react)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@vitejs/plugin-react` from 6.0.3 to 6.0.4
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/[email protected]/packages/plugin-react)

Updates `@playwright/test` from 1.61.1 to 1.62.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.61.1...v1.62.0)

---
updated-dependencies:
- dependency-name: "@j178/prek"
  dependency-version: 0.4.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: knip
  dependency-version: 6.29.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-doctor
  dependency-version: 0.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@cloudflare/sandbox"
  dependency-version: 0.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: better-auth
  dependency-version: 1.6.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.12.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.114.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@hugeicons/core-free-icons"
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.62.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 25, 2026
@dependabot
dependabot Bot requested a review from Yevanchen as a code owner July 25, 2026 06:45
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 25, 2026
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Jul 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Yevanchen Yevanchen Awaiting requested review from Yevanchen Yevanchen is a code owner
@KurosawaGeeker KurosawaGeeker Awaiting requested review from KurosawaGeeker KurosawaGeeker is a code owner
@samzong samzong Awaiting requested review from samzong samzong is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants