Skip to content

Bump the minor-npm-dependencies group across 1 directory with 6 updates - #17

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-npm-dependencies-37dcd50f5c
Closed

Bump the minor-npm-dependencies group across 1 directory with 6 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-npm-dependencies-37dcd50f5c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-npm-dependencies group with 4 updates in the / directory: jose, @cloudflare/vitest-pool-workers, @typescript-eslint/eslint-plugin and vitest.

Updates jose from 6.2.1 to 6.2.2

Release notes

Sourced from jose's releases.

v6.2.2

Fixes

  • reject failed decompression with JWEInvalid error (043b181)
Changelog

Sourced from jose's changelog.

6.2.2 (2026-03-18)

Fixes

  • reject failed decompression with JWEInvalid error (043b181)
Commits
  • 9c86586 chore(release): 6.2.2
  • 4984b5c chore(deps): bump the actions group with 4 updates
  • 043b181 fix: reject failed decompression with JWEInvalid error
  • 867cc2c chore(deps-dev): bump undici
  • f4e20e7 chore(deps-dev): bump tar in the npm_and_yarn group across 1 directory
  • d0505bf chore: cleanup after release
  • See full diff in compare view

Updates @cloudflare/vitest-pool-workers from 0.13.2 to 0.13.5

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.13.5

Patch Changes

  • #13077 11c77b7 Thanks @​penalosa! - fix: runInDurableObject now correctly returns redirect responses (3xx) from Durable Object callbacks instead of throwing "Expected callback for X" errors

  • #13056 8384743 Thanks @​penalosa! - fix: Support dynamic import() inside entrypoint and Durable Object handlers

    Previously, calling exports.default.fetch() or SELF.fetch() on a worker whose handler used a dynamic import() would hang and fail with "Cannot perform I/O on behalf of a different Durable Object". This happened because the module runner's transport — which communicates over a WebSocket owned by the runner Durable Object — was invoked from a different DO context.

    The fix patches the module runner's transport via the onModuleRunner hook so that all invoke() calls are routed through the runner DO's I/O context, regardless of where the import() originates.

  • #13074 4618c05 Thanks @​penalosa! - fix: only apply module fallback extension probing for require(), not import

    The module fallback service previously tried adding .js, .mjs, .cjs, and .json suffixes to extensionless specifiers unconditionally. Per the Node.js spec, this extension-probing behaviour is specific to CommonJS require(). ESM import statements must include explicit file extensions.

    Extension-less TypeScript import specifiers continue to work correctly — they are resolved by Vite's resolver rather than the fallback's extension loop.

  • #13073 baec845 Thanks @​penalosa! - Add adminSecretsStore() to cloudflare:test for seeding secrets in tests

    Secrets store bindings only expose a read-only .get() method, so there was previously no way to seed secret values from within a test. The new adminSecretsStore() helper returns Miniflare's admin API for a secrets store binding, giving tests full control over create, update, and delete operations.

    import { adminSecretsStore } from "cloudflare:test";
    import { env } from "cloudflare:workers";
    const admin = adminSecretsStore(env.MY_SECRET);
    await admin.create("test-value");
    const value = await env.MY_SECRET.get(); // "test-value"

  • #13083 cfd513f Thanks @​penalosa! - Add a 30-second timeout to waitUntil promise draining to prevent hanging tests

    Previously, if a ctx.waitUntil() promise never resolved, the test suite would hang indefinitely after the test file finished. Now, any waitUntil promises that haven't settled within 30 seconds are abandoned with a warning, allowing the test suite to continue. This aligns with the production waitUntil limit.

  • Updated dependencies [eeaa473, 9fcdfca, bc24ec8, 1faff35, 0b4c21a, 535582d, 992f9a3, f4ea4ac, 91b7f73, f6cdab2, 53ed15a, ce65246, 7a5be20, 6b50bfa, 0386553, 9c5ebf5, 53ed15a, 53ed15a]:

    • wrangler@4.78.0
    • miniflare@4.20260317.3

@​cloudflare/vitest-pool-workers@​0.13.4

Patch Changes

@​cloudflare/vitest-pool-workers@​0.13.3

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.13.5

Patch Changes

  • #13077 11c77b7 Thanks @​penalosa! - fix: runInDurableObject now correctly returns redirect responses (3xx) from Durable Object callbacks instead of throwing "Expected callback for X" errors

  • #13056 8384743 Thanks @​penalosa! - fix: Support dynamic import() inside entrypoint and Durable Object handlers

    Previously, calling exports.default.fetch() or SELF.fetch() on a worker whose handler used a dynamic import() would hang and fail with "Cannot perform I/O on behalf of a different Durable Object". This happened because the module runner's transport — which communicates over a WebSocket owned by the runner Durable Object — was invoked from a different DO context.

    The fix patches the module runner's transport via the onModuleRunner hook so that all invoke() calls are routed through the runner DO's I/O context, regardless of where the import() originates.

  • #13074 4618c05 Thanks @​penalosa! - fix: only apply module fallback extension probing for require(), not import

    The module fallback service previously tried adding .js, .mjs, .cjs, and .json suffixes to extensionless specifiers unconditionally. Per the Node.js spec, this extension-probing behaviour is specific to CommonJS require(). ESM import statements must include explicit file extensions.

    Extension-less TypeScript import specifiers continue to work correctly — they are resolved by Vite's resolver rather than the fallback's extension loop.

  • #13073 baec845 Thanks @​penalosa! - Add adminSecretsStore() to cloudflare:test for seeding secrets in tests

    Secrets store bindings only expose a read-only .get() method, so there was previously no way to seed secret values from within a test. The new adminSecretsStore() helper returns Miniflare's admin API for a secrets store binding, giving tests full control over create, update, and delete operations.

    import { adminSecretsStore } from "cloudflare:test";
    import { env } from "cloudflare:workers";
    const admin = adminSecretsStore(env.MY_SECRET);
    await admin.create("test-value");
    const value = await env.MY_SECRET.get(); // "test-value"

  • #13083 cfd513f Thanks @​penalosa! - Add a 30-second timeout to waitUntil promise draining to prevent hanging tests

    Previously, if a ctx.waitUntil() promise never resolved, the test suite would hang indefinitely after the test file finished. Now, any waitUntil promises that haven't settled within 30 seconds are abandoned with a warning, allowing the test suite to continue. This aligns with the production waitUntil limit.

  • Updated dependencies [eeaa473, 9fcdfca, bc24ec8, 1faff35, 0b4c21a, 535582d, 992f9a3, f4ea4ac, 91b7f73, f6cdab2, 53ed15a, ce65246, 7a5be20, 6b50bfa, 0386553, 9c5ebf5, 53ed15a, 53ed15a]:

    • wrangler@4.78.0
    • miniflare@4.20260317.3

0.13.4

Patch Changes

... (truncated)

Commits
  • 81b2b9b Version Packages (#13038)
  • baec845 [vitest-pool-workers] Add adminSecretsStore() to cloudflare:test (#13073)
  • 4618c05 [vitest-pool-workers] Only probe extensions in module fallback for `require()...
  • 11c77b7 [vitest-pool-workers] fix: handle redirect responses in runInDurableObject ...
  • 7125939 [vitest-pool-workers] Add regression test for Istanbul coverage across multip...
  • cfd513f [vitest-pool-workers] Add 30s timeout to waitUntil promise draining (#13083)
  • 8384743 [vitest-pool-workers] Fix dynamic import() in entrypoint and DO handlers (#13...
  • a61451f Version Packages (#12980)
  • f9728fd Update some missing tests and fixtures with Vitest 4 (#12999)
  • 7d2661b Version Packages (#12945)
  • Additional commits viewable in compare view

Updates @typescript-eslint/eslint-plugin from 8.56.1 to 8.57.2

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

  • eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)
  • eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)
  • eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)
  • eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)
  • eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)
  • eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)
  • eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)
  • typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.1

8.57.1 (2026-03-16)

🩹 Fixes

  • eslint-plugin: [prefer-optional-chain] no report for property on intersection type (#12126)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.0

8.57.0 (2026-03-09)

🚀 Features

  • eslint-plugin: [no-unnecessary-condition] allow literal loop conditions in for/do loops (#12080)

... (truncated)

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.57.2 (2026-03-23)

🩹 Fixes

  • eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)
  • eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)
  • eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)
  • eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)
  • eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)
  • eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.57.1 (2026-03-16)

🩹 Fixes

  • eslint-plugin: [prefer-optional-chain] no report for property on intersection type (#12126)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.57.0 (2026-03-09)

🚀 Features

  • eslint-plugin: [no-unnecessary-condition] allow literal loop conditions in for/do loops (#12080)

🩹 Fixes

  • eslint-plugin: [no-base-to-string] fix false positive for toString with overloads (#12089)
  • eslint-plugin: [prefer-promise-reject-errors] add allow TypeOrValueSpecifier to prefer-promise-reject-errors (#12094)
  • typescript-estree: if the template literal is tagged and the text has an invalid escape, cooked will be null (#11355)
  • eslint-plugin: guard against negative paramIndex in no-useless-default-assignment (#12077)

... (truncated)

Commits
  • be4d54d chore(release): publish 8.57.2
  • f68c8e4 fix(eslint-plugin): [prefer-readonly-parameter-types] preserve type alias inf...
  • 73acd2e fix(eslint-plugin): [no-useless-default-assignment] skip reporting false posi...
  • 3d21482 fix(eslint-plugin): [no-unsafe-return] false positive on unwrapping generic (...
  • e128548 fix(eslint-plugin): [no-restricted-types] flag banned generics in extends or ...
  • 2b7f63f chore(eslint-plugin): correct tsutils.isTypeFlag usage post-merge
  • 65175cd fix(eslint-plugin): [array-type] ignore Array and ReadonlyArray without type ...
  • 9c9ab5e feat(eslint-plugin): [no-unnecessary-type-arguments] report inferred required...
  • 42a1c89 fix(eslint-plugin): [prefer-optional-chain] remove dangling closing parenthes...
  • 71855ff docs(eslint-plugin): [no-unnecessary-condition] add link to TS handbook (#12131)
  • Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.56.1 to 8.57.2

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.57.2

8.57.2 (2026-03-23)

🩹 Fixes

  • eslint-plugin: [prefer-optional-chain] remove dangling closing parenthesis (#11865)
  • eslint-plugin: [array-type] ignore Array and ReadonlyArray without type arguments (#11971)
  • eslint-plugin: [no-restricted-types] flag banned generics in extends or implements (#12120)
  • eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)
  • eslint-plugin: [no-unsafe-return] false positive on unwrapping generic (#12125)
  • eslint-plugin: [no-useless-default-assignment] skip reporting false positives for unresolved type parameters (#12127)
  • eslint-plugin: [prefer-readonly-parameter-types] preserve type alias infomation (#11954)
  • typescript-estree: skip createIsolatedProgram fallback for projectService (#12066, #12065)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.1

8.57.1 (2026-03-16)

🩹 Fixes

  • eslint-plugin: [prefer-optional-chain] no report for property on intersection type (#12126)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.57.0

8.57.0 (2026-03-09)

🚀 Features

  • eslint-plugin: [no-unnecessary-condition] allow literal loop conditions in for/do loops (#12080)

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.57.2 (2026-03-23)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.57.1 (2026-03-16)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.57.0 (2026-03-09)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates vitest from 4.1.0 to 4.1.2

Release notes

Sourced from vitest's releases.

v4.1.2

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (vitest-dev/vitest#9975).

   🐞 Bug Fixes

    View changes on GitHub

v4.1.1

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • fc6f482 chore: release v4.1.2
  • 6f97b55 feat: disable colors if agent is detected (#9851)
  • b3c992c fix(coverage): correct coverageConfigDefaults values and types (#9940)
  • 7c06598 fix: ensure sequential mock/unmock resolution (#9830)
  • f54abad chore: add typo-checker skill and fix typos (#9963)
  • 7aa9377 fix: don't resolve setupFiles from parent directory (#9960)
  • 1f2d318 chore: release v4.1.1
  • ebfde79 refactor: rename matchesTagsFilter to matchesTags (#9956)
  • 5611500 feat(experimental): introduce experimental.vcsProvider (#9928)
  • eec53d9 feat(experimental): expose matchesTagsFilter to test if the current filter ...
  • Additional commits viewable in compare view

Updates wrangler from 4.75.0 to 4.78.0

Release notes

Sourced from wrangler's releases.

wrangler@4.78.0

Minor Changes

  • #13031 eeaa473 Thanks @​WalshyDev! - Add support for Cloudflare Access Service Token authentication via environment variables

    When running wrangler dev with remote bindings behind a Cloudflare Access-protected domain, Wrangler previously required cloudflared access login which opens a browser for interactive authentication. This does not work in CI/CD environments.

    You can now set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate using an Access Service Token instead:

    export CLOUDFLARE_ACCESS_CLIENT_ID="<your-client-id>.access"
    export CLOUDFLARE_ACCESS_CLIENT_SECRET="<your-client-secret>"
    wrangler dev

    Additionally, when running in a non-interactive environment (CI) without these credentials, Wrangler now throws a clear, actionable error instead of hanging on cloudflared access login.

  • #13027 9fcdfca Thanks @​G4brym! - feat: Add ai_search_namespaces and ai_search binding types

    Two new binding types for AI Search:

    • ai_search_namespaces: Namespace binding — namespace is required and auto-provisioned at deploy time if it doesn't exist (like R2 buckets)
    • ai_search: Single instance binding bound directly to a pre-existing instance in the default namespace

    Both are remote-only in local dev.

  • #12874 53ed15a Thanks @​xortive! - Add Workers VPC service support for Hyperdrive origins

    Hyperdrive configs can now connect to databases through Workers VPC services using the --service-id option:

    wrangler hyperdrive create my-config --service-id <vpc-service-uuid> --database mydb --user myuser --password mypassword

    This enables Hyperdrive to connect to databases hosted in private networks that are accessible through Workers VPC TCP services.

  • #12852 6b50bfa Thanks @​Carolx715! - Add interactive data catalog validation to R2 object and lifecycle commands.

    When performing R2 operations that could affect data catalog state (object put, object delete, lifecycle add, lifecycle set), Wrangler now validates with the API and prompts users for confirmation if a conflict is detected. For bulk put operations, Wrangler prompts upfront before starting the batch. Users can bypass prompts with --force (-y). In non-interactive/CI environments, the operation proceeds automatically.

  • #13030 0386553 Thanks @​natewong1313! - Add local mode support for Stream bindings

    Miniflare and wrangler dev now support using Cloudflare Stream bindings locally.

    Supported operations:

    • upload() — upload video via URL
    • video(id).details(), .update(), .delete(), .generateToken()
    • videos.list()
    • captions.generate(), .list(), .delete()

... (truncated)

Commits
  • 81b2b9b Version Packages (#13038)
  • 9fcdfca feat: add ai_search_namespaces and ai_search binding types (#13027)
  • 53ed15a Add support for WVPC TCP services, and using them as Hyperdrive origins (#12874)
  • 9c5ebf5 [wrangler] Only allow "worker" queue consumer type in wrangler config (#13018)
  • 535582d [wrangler] fix: resolve secondary worker types when environment overrides wor...
  • 8c08b3f [wrangler] Fix R2 e2e snapshot for data catalog confirmation prompt (#13059)
  • 25cb184 [wrangler] fix e2e flakiness: use waitForLong to verify response body after d...
  • 6b50bfa [wrangler] add validation to actions that could affect r2 data catalog state ...
  • 0386553 [Stream] Add Stream binding local mode (#13030)
  • f6cdab2 [wrangler] Support source phase imports (#12996)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-npm-dependencies group with 4 updates in the / directory: [jose](https://github.com/panva/jose), [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `jose` from 6.2.1 to 6.2.2
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.1...v6.2.2)

Updates `@cloudflare/vitest-pool-workers` from 0.13.2 to 0.13.5
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.13.5/packages/vitest-pool-workers)

Updates `@typescript-eslint/eslint-plugin` from 8.56.1 to 8.57.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/eslint-plugin)

Updates `@typescript-eslint/parser` from 8.56.1 to 8.57.2
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.57.2/packages/parser)

Updates `vitest` from 4.1.0 to 4.1.2
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.2/packages/vitest)

Updates `wrangler` from 4.75.0 to 4.78.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.78.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: jose
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-npm-dependencies
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.13.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-npm-dependencies
- dependency-name: "@typescript-eslint/eslint-plugin"
  dependency-version: 8.57.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-npm-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.57.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-npm-dependencies
- dependency-name: vitest
  dependency-version: 4.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-npm-dependencies
- dependency-name: wrangler
  dependency-version: 4.78.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 30, 2026
@dependabot @github

dependabot Bot commented on behalf of github Apr 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 10, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-npm-dependencies-37dcd50f5c branch April 10, 2026 18:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants