Skip to content

build(deps): bump the web-deps group across 1 directory with 7 updates - #108

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/web-deps-f39a6700e3
Open

build(deps): bump the web-deps group across 1 directory with 7 updates#108
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/web/web-deps-f39a6700e3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the web-deps group with 7 updates in the /apps/web directory:

Package From To
next 16.3.5 16.3.8
@cloudflare/vite-plugin 1.57.2 1.62.5
@vitejs/plugin-rsc 0.5.34 0.5.35
eslint-config-next 16.3.5 16.3.8
vinext 1.0.0-beta.9 1.0.1
vite 8.3.0 8.3.2
wrangler 4.136.2 4.147.0

Updates next from 16.3.5 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Medium:

Low:

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

Commits
  • b0fad0d v16.3.8
  • 719e4c6 [lts-active] Scope response cache keys to their source route (#218)
  • e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
  • 40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
  • 2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
  • bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
  • 8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
  • e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
  • 4c20699 v16.3.7
  • 2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
  • Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.57.2 to 1.62.5

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.62.5

Patch Changes

@​cloudflare/vite-plugin@​1.62.4

Patch Changes

@​cloudflare/vite-plugin@​1.62.3

Patch Changes

@​cloudflare/vite-plugin@​1.62.2

Patch Changes

@​cloudflare/vite-plugin@​1.62.1

Patch Changes

@​cloudflare/vite-plugin@​1.62.0

Minor Changes

  • #15914 7f0734c Thanks @​jamesopstad! - Use cf/config for cloudflare.config.ts authoring

    Experimental cloudflare.config.ts projects must now import defineConfig, bindings, triggers, and related helpers from cf/config. Generated declarations from Wrangler and the Vite plugin also reference this package, so projects using the experimental configuration flow must add cf as a dependency.

    The Vite plugin no longer exports @cloudflare/vite-plugin/experimental-config. wrangler/experimental-config remains available for defineWranglerConfig, but no longer re-exports Cloudflare configuration helpers.

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.62.5

Patch Changes

1.62.4

Patch Changes

1.62.3

Patch Changes

1.62.2

Patch Changes

1.62.1

Patch Changes

1.62.0

Minor Changes

... (truncated)

Commits

Updates @vitejs/plugin-rsc from 0.5.34 to 0.5.35

Release notes

Sourced from @​vitejs/plugin-rsc's releases.

[email protected]

Features

Bug Fixes

Miscellaneous Chores

  • deps: update dependency @​types/react-dom to ^19.2.5 (#1432) (e7c2b6d)
  • deps: update dependency @​types/react-dom to ^19.2.7 (#1444) (f135533)
  • deps: update tsdown to v0.23 (#1451) (736efe2)

Code Refactoring

Tests

  • rsc: copy use cache/server mixed directive handling to examples/use-cache-persistent (#1417) (523e45b)
Changelog

Sourced from @​vitejs/plugin-rsc's changelog.

0.5.35 (2026-09-16)

Features

Bug Fixes

Miscellaneous Chores

  • deps: update dependency @​types/react-dom to ^19.2.5 (#1432) (e7c2b6d)
  • deps: update dependency @​types/react-dom to ^19.2.7 (#1444) (f135533)
  • deps: update tsdown to v0.23 (#1451) (736efe2)

Code Refactoring

Tests

  • rsc: copy use cache/server mixed directive handling to examples/use-cache-persistent (#1417) (523e45b)
Commits

Updates eslint-config-next from 16.3.5 to 16.3.8

Release notes

Sourced from eslint-config-next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Medium:

Low:

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @​lukesandberg for helping!

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

Commits

Updates vinext from 1.0.0-beta.9 to 1.0.1

Release notes

Sourced from vinext's releases.

[email protected]

Bug Fixes

Dev

  • keep vite-plugin-commonjs out of vinext's inlined deps during the dep scan (#3620)
  • ignore client-supplied forwarded middleware context (#3617)
  • pre-bundle use-sync-external-store in the App Router client (#3542)
  • ignore generated .vinext files in the watcher (#3556)

Shims

  • null a framed GET/HEAD body on a NextRequest's Request input (#3649)
  • drop a framed GET/HEAD body from a Request init in NextRequest (#3621)
  • keep a Request init's method, headers and body in NextRequest (#3612)
  • support stable catchError and retry APIs (#3566)

Misc

  • Cache: separate browser headers from framework storage policy (#3540)
  • Cloudflare: serve prerendered Pages Router from Static Assets (#3603)
  • Nitro: serve App Router apps in Nitro dev and preview (#3608)
  • Pages: include locale in domain ISR cache identity (#3598)
  • App Router: release the refresh abort handle once supplemental requests settle (#3572)
  • Build: prerender before emitting standalone output (#3579)
  • CLI: recognize symlinked vite entrypoints (#3571) (#3573)
  • Config: preserve quoted JSON in dotenv files (#3568)
  • Router: preserve middleware and rewrites for missing static assets (#3541)
  • Cloudflare: support colon cache tags in KV (#3569)
  • Plugins: accept HTML comment end variants in request prescan (#3574)
  • Tracing: forward native Workers span metadata (#3564)
  • Init: list Response Store deployment in next steps (#3536)

Performance

Build

  • skip vite-plugin-commonjs for modules it never rewrites (#3594)
  • skip the scan-time typeof window fold when it cannot change imports (#3596)
  • reuse OG HarfBuzz patch and jsx-in-js transforms across passes (#3590)
  • skip stylesheet processing in RSC scan builds (#3589)
  • prefilter optimize-imports matcher on quoted package source (#3550)
  • skip unused sourcemaps in vinext source transforms (#3552)
  • avoid repeated realpath calls in middleware export validation (#3553)

SSR

  • track dynamic usage without loading the next/headers implementation (#3558)
  • stop loading browser runtime modules for shared helpers (#3559)
  • import the render abort check without server-only modules (#3549)

... (truncated)

Commits
  • e5ada16 chore: version packages (#3554)
  • 46cc0b2 fix(cache): separate browser headers from framework storage policy (#3540)
  • 07a1c83 fix(cloudflare): serve prerendered Pages Router from Static Assets (#3603)
  • 8a3155d fix(shims): null a framed GET/HEAD body on a NextRequest's Request input (#3649)
  • 6bc3074 fix(shims): drop a framed GET/HEAD body from a Request init in NextRequest (#...
  • 175b92f test(nitro): cover middleware, navigation, server actions and route handlers ...
  • 4faf3ce fix(dev): keep vite-plugin-commonjs out of vinext's inlined deps during the d...
  • 531696c fix(nitro): serve App Router apps in Nitro dev and preview (#3608)
  • 0589467 chore: update lockfile (#3618)
  • 93f092d fix(dev): ignore client-supplied forwarded middleware context (#3617)
  • Additional commits viewable in compare view

Updates vite from 8.3.0 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

  • build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
  • bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
  • bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
  • deps: update all non-major dependencies (#23601) (9944fa6)
  • deps: update rolldown-related dependencies (#23602) (88c1741)
  • html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
  • limit size of object and array printing via forwardConsole (#23565) (e64a587)
  • merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
  • optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
  • optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
  • pass queries to renderBuiltUrl (#23586) (744269e)
  • server: handle file watcher errors without crashing (#23503) (6894f5c)
  • server: release previous environments after initialization (#23499) (5a3a010)
  • ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
  • worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

  • avoid encoding intermediate source maps (#23461) (89574f6)
  • build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
  • only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

  • fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

Code Refactoring

Tests

  • bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

v8.3.1

Bug Fixes

  • deps: update all non-major dependencies (#23482) (3c752c8)
  • deps: update all non-major dependencies (#23537) (e8990c4)
  • deps: update rolldown-related dependencies (#23483) (9aecbbf)
  • handle server.ws: false in mergeConfig (#23511) (f68c0d5)
  • merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
  • optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.2 (2026-10-01)

Bug Fixes

  • build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
  • bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
  • bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
  • deps: update all non-major dependencies (#23601) (9944fa6)
  • deps: update rolldown-related dependencies (#23602) (88c1741)
  • html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
  • limit size of object and array printing via forwardConsole (#23565) (e64a587)
  • merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
  • optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
  • optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
  • pass queries to renderBuiltUrl (#23586) (744269e)
  • server: handle file watcher errors without crashing (#23503) (6894f5c)
  • server: release previous environments after initialization (#23499) (5a3a010)
  • ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
  • worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

  • avoid encoding intermediate source maps (#23461) (89574f6)
  • build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
  • only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

  • fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

Code Refactoring

Tests

  • bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

8.3.1 (2026-09-24)

Bug Fixes

  • deps: update all non-major dependencies (#23482) (3c752c8)
  • deps: update all non-major dependencies (#23537) (e8990c4)
  • deps: update rolldown-related dependencies (#23483) (9aecbbf)
  • handle server.ws: false in mergeConfig (#23511) (f68c0d5)
  • merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
  • optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)

... (truncated)

Commits
  • 1003321 release: v8.3.2 (#23623)
  • 24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
  • 94d0080 perf: only register time middleware when debug logging is enabled (#23621)
  • 89574f6 perf: avoid encoding intermediate source maps (#23461)
  • 5a3a010 fix(server): release previous environments after initialization (#23499)
  • 1929b4c docs: fix dead og-image PNG links in vite6/vite7 changelog entries (#23594)
  • 6894f5c fix(server): handle file watcher errors without crashing (#23503)
  • cf5c028 perf(build): avoid quadratic link scan in the preload helper (#23510)
  • bba3bb8 fix: merge build.rolldownOptions.output.minify correctly (#23536)
  • 5e4b9ca fix(optimize-deps): avoid "unsupported" warnings for browser:false mappings (...
  • Additional commits viewable in compare view

Updates wrangler from 4.136.2 to 4.147.0

Release notes

Sourced from wrangler's releases.

[email protected]

Minor Changes

  • #15928 7f57b1c Thanks @​ichernetsky-cf! - Allow "us" as a jurisdiction for Container applications

    Container placement constraints now accept constraints.jurisdiction: "us" in Wrangler and typed Cloudflare configuration. This makes the US jurisdiction available alongside "eu" and "fedramp".

Patch Changes

  • #15974 7f700ef Thanks @​martinezjandrew! - Fix wrangler containers list to report live instances

    The LIVE INSTANCES column now reports each application's active runtime instances instead of its configured instance count, matching the Cloudflare dashboard. JSON output continues to expose the configured count through the existing instances field.

  • #15980 90e6a1b Thanks @​martinezjandrew! - Accept Durable Object application IDs in Containers commands

    wrangler containers instances and wrangler containers delete now accept the 32-character hexadecimal application IDs returned for Durable Object-backed applications, in addition to legacy dashed UUIDs.

  • #15871 6a4b0fe Thanks @​tw4! - Retry transient API failures in wrangler workflows instances list and wrangler workflows instances describe

    Previously, a single temporary 5xx response or dropped connection made these read-only commands exit with an error, even though the next request would have succeeded. They now use Wrangler's existing bounded API retry handling. The read that resolves --id latest is retried too, which also benefits the other wrangler workflows instances commands that accept latest; the mutating requests they make afterwards are not retried. Persistent failures are still reported after the retries are exhausted, and under --json any retry notices are written to stderr so stdout stays valid JSON.

  • Updated dependencies []:

[email protected]

M...

Description has been truncated

@dependabot
build(deps): bump the web-deps group across 1 directory with 7 updates
a656ba3 
Bumps the web-deps group with 7 updates in the /apps/web directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `16.3.5` | `16.3.8` |
| [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.57.2` | `1.62.5` |
| [@vitejs/plugin-rsc](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-rsc) | `0.5.34` | `0.5.35` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.3.5` | `16.3.8` |
| [vinext](https://github.com/cloudflare/vinext) | `1.0.0-beta.9` | `1.0.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.2` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.136.2` | `4.147.0` |



Updates `next` from 16.3.5 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.3.5...v16.3.8)

Updates `@cloudflare/vite-plugin` from 1.57.2 to 1.62.5
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vite-plugin-cloudflare/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/[email protected]/packages/vite-plugin-cloudflare)

Updates `@vitejs/plugin-rsc` from 0.5.34 to 0.5.35
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-rsc/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/[email protected]/packages/plugin-rsc)

Updates `eslint-config-next` from 16.3.5 to 16.3.8
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.8/packages/eslint-config-next)

Updates `vinext` from 1.0.0-beta.9 to 1.0.1
- [Release notes](https://github.com/cloudflare/vinext/releases)
- [Commits](https://github.com/cloudflare/vinext/compare/[email protected]@1.0.1)

Updates `vite` from 8.3.0 to 8.3.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.2/packages/vite)

Updates `wrangler` from 4.136.2 to 4.147.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/[email protected]/packages/wrangler)

---
updated-dependencies:
- dependency-name: next
  dependency-version: 16.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: web-deps
- dependency-name: "@cloudflare/vite-plugin"
  dependency-version: 1.62.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-deps
- dependency-name: "@vitejs/plugin-rsc"
  dependency-version: 0.5.35
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-deps
- dependency-name: eslint-config-next
  dependency-version: 16.3.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-deps
- dependency-name: vinext
  dependency-version: 1.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-deps
- dependency-name: vite
  dependency-version: 8.3.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: web-deps
- dependency-name: wrangler
  dependency-version: 4.147.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: web-deps
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 7, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 7, 2026
@dependabot dependabot Bot mentioned this pull request Oct 7, 2026
Closed

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AetherAI3 AetherAI3 Awaiting requested review from AetherAI3 AetherAI3 is a code owner
@dbarrante dbarrante Awaiting requested review from dbarrante dbarrante is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants