Skip to content

Bump the npm_and_yarn group across 1 directory with 6 updates#83

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-0ce170234a
Open

Bump the npm_and_yarn group across 1 directory with 6 updates#83
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-0ce170234a

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 13, 2026

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package From To
wrangler 4.54.0 4.73.0
diff 8.0.2 8.0.3
lodash 4.17.21 4.17.23
rollup 4.54.0 4.59.0
seroval 1.3.2 1.5.1

Updates wrangler from 4.54.0 to 4.73.0

Release notes

Sourced from wrangler's releases.

wrangler@4.73.0

Minor Changes

  • #12853 ff543e3 Thanks @​gpanders! - Deprecate SSH passthrough flags in wrangler containers ssh

    The --cipher, --log-file, --escape-char, --config-file, --pkcs11, --identity-file, --mac-spec, --option, and --tag flags are now deprecated. These flags expose OpenSSH-specific options that are tied to the current implementation. A future release will replace the underlying SSH transport, at which point these flags will be removed. They still function for now.

  • #12815 e63539d Thanks @​NuroDev! - Support disabling persistence in unstable_startWorker() and unstable_dev()

    You can now disable persistence entirely by setting persist: false in the dev options:

    const worker = await unstable_dev("./src/worker.ts", {
	persist: false,
});

    Or when using unstable_startWorker():

    const worker = await unstable_startWorker({
	entrypoint: "./src/worker.ts",
	dev: {
		persist: false,
	},
});

    This is useful for testing scenarios where you want to ensure a clean state on each run without any persisted data from previous runs.

Patch Changes

  • #12861 f7de0fd Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260310.1 1.20260312.1

  • #12734 8e89e85 Thanks @​flostellbrink! - Add back support for wrangler d1 exports with multiple tables.

    Example:

    # All tables (default)
wrangler d1 export db --output all-tables.sql
Single table (unchanged)
wrangler d1 export db --output single-table.sql --table foo

... (truncated)

Commits
  • 25b090a Version Packages (#12840)
  • 6ee18e1 Fix autoconfig for Astro 6+ projects to skip wrangler config generation (#12856)
  • f7de0fd Bump the workerd-and-workers-types group with 2 updates (#12861)
  • ff543e3 CC-7209: Deprecate and hide OpenSSH options from ssh command (#12853)
  • a31ee0b [workers-playground] Migrate from Cloudflare Pages to Cloudflare Workers (#12...
  • 4bb61b9 [wrangler] Add hostname and IP validation for VPC services (#12700)
  • 8e89e85 fix(wrangler): handle d1 export with multiple tables (#12734)
  • 8d1e130 fix(wrangler): vectorize list and list-metadata-index should output valid jso...
  • e63539d feat(wrangler): Support disabling state persistence in `unstable_startWorker(...
  • a6ddbdb Support Vitest 4 in @cloudflare/vitest-pool-workers (#11632)
  • Additional commits viewable in compare view

Updates diff from 8.0.2 to 8.0.3

Changelog

Sourced from diff's changelog.

8.0.3

  • #631 - fix support for using an Intl.Segmenter with diffWords. This has been almost completely broken since the feature was added in v6.0.0, since it would outright crash on any text that featured two consecutive newlines between a pair of words (a very common case).
  • #635 - small tweaks to tokenization behaviour of diffWords when used without an Intl.Segmenter. Specifically, the soft hyphen (U+00AD) is no longer considered to be a word break, and the multiplication and division signs (× and ÷) are now treated as punctuation instead of as letters / word characters.
  • #641 - the format of file headers in createPatch etc. patches can now be customised somewhat. It now takes a headerOptions option that can be used to disable the file headers entirely, or omit the Index: line and/or the underline. In particular, this was motivated by a request to make jsdiff patches compatible with react-diff-view, which they now are if produced with headerOptions: FILE_HEADERS_ONLY.
  • #647 and #649 - fix denial-of-service vulnerabilities in parsePatch whereby adversarial input could cause a memory-leaking infinite loop, typically crashing the calling process. Also fixed ReDOS vulnerabilities whereby adversarially-crafted patch headers could take cubic time to parse. Now, parsePatch should reliably take linear time. (Handling of headers that include the line break characters \r, \u2028, or \u2029 in non-trailing positions is also now more reasonable as side effect of the fix.)
Commits
  • 13576bf 8.0.3 release (#652)
  • 1179ccb Ignore .zed (#651)
  • 949d6e2 Add test for the vuln I just fixed (#650)
  • 15a1585 Fix the second denial-of-service vulnerability in parsePatch (#649)
  • de95cca Fix potentially cubic-time regex in parsePatch (#647)
  • b9aeede Allow more customisation of file headers in patches (#641)
  • 43c716c Merge pull request #636 from kpdecker/dependabot/npm_and_yarn/node-forge-1.3.2
  • b8162c7 Bump node-forge from 1.3.1 to 1.3.2
  • ad6dc17 Fix some bugs in the diffWords regex (and errors & ambiguities in the comment...
  • 3e1774a Fix a comment typo (#633)
  • Additional commits viewable in compare view

Updates lodash from 4.17.21 to 4.17.23

Commits

Updates undici from 7.14.0 to 7.18.2

Release notes

Sourced from undici's releases.

v7.18.2

⚠️ Security Release

This fixes GHSA-g9mf-h72j-4rw9 and CVE-2026-22036.

What's Changed

Full Changelog: nodejs/undici@v7.18.1...v7.18.2

v7.18.1

What's Changed

Full Changelog: nodejs/undici@v7.18.0...v7.18.1

v7.18.0

What's Changed

Full Changelog: nodejs/undici@v7.17.0...v7.18.0

v7.17.0

What's Changed

... (truncated)

Commits
  • 7e5cb2d Bumped v7.18.2 (#4730)
  • b04e3cb fix(decompress): limit Content-Encoding chain to 5 to prevent resource exhaus...
  • 2bcb77b Bumped v7.18.1 (#4728)
  • 58a12b7 build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4719)
  • 5fa2930 build(deps): bump step-security/harden-runner from 2.13.1 to 2.14.0 (#4718)
  • fbbe283 docs: add security warning for strictContentLength option (#4726)
  • ce12d9e fix: do not crash if Node.js is compiled without SSL (#4727)
  • ebe3e33 Bumped v7.18.0 (#4725)
  • 4e9b88b fix: limit Content-Encoding chain to 5 to prevent resource exhaustion
  • d560767 Bumped v7.17.0 (#4724)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.


Updates rollup from 4.54.0 to 4.59.0

Release notes

Sourced from rollup's releases.

v4.59.0

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

v4.58.0

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

v4.57.1

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Changelog

Sourced from rollup's changelog.

4.59.0

2026-02-22

Features

  • Throw when the generated bundle contains paths that would leave the output directory (#6276)

Pull Requests

4.58.0

2026-02-20

Features

  • Also support __NO_SIDE_EFFECTS__ annotation before variable declarations declaring function expressions (#6272)

Pull Requests

4.57.1

2026-01-30

Bug Fixes

  • Fix heap corruption issue in Windows (#6251)
  • Ensure exports of a dynamic import are fully included when called from a try...catch (#6254)

Pull Requests

... (truncated)

Commits

Updates seroval from 1.3.2 to 1.5.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 1 directory with 6 updates
5700bbf 
Bumps the npm_and_yarn group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.54.0` | `4.73.0` |
| [diff](https://github.com/kpdecker/jsdiff) | `8.0.2` | `8.0.3` |
| [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` |
| [rollup](https://github.com/rollup/rollup) | `4.54.0` | `4.59.0` |
| [seroval](https://github.com/lxsmnsyc/seroval) | `1.3.2` | `1.5.1` |



Updates `wrangler` from 4.54.0 to 4.73.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.73.0/packages/wrangler)

Updates `diff` from 8.0.2 to 8.0.3
- [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md)
- [Commits](kpdecker/jsdiff@v8.0.2...v8.0.3)

Updates `lodash` from 4.17.21 to 4.17.23
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.21...4.17.23)

Updates `undici` from 7.14.0 to 7.18.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.14.0...v7.18.2)

Updates `rollup` from 4.54.0 to 4.59.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.54.0...v4.59.0)

Updates `seroval` from 1.3.2 to 1.5.1
- [Release notes](https://github.com/lxsmnsyc/seroval/releases)
- [Commits](https://github.com/lxsmnsyc/seroval/commits)

---
updated-dependencies:
- dependency-name: wrangler
  dependency-version: 4.73.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-version: 8.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.18.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-version: 4.59.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: seroval
  dependency-version: 1.5.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 13, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented Mar 13, 2026 •
edited
Loading

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 port-tides 5700bbf Commit Preview URL

Branch Preview URL		 Mar 13 2026, 10:34 PM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants