Skip to content

Bump the npm_and_yarn group across 1 directory with 9 updates#1

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-1943f51106
Open

Bump the npm_and_yarn group across 1 directory with 9 updates#1
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-1943f51106

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Mar 17, 2026

Bumps the npm_and_yarn group with 4 updates in the / directory: @opennextjs/cloudflare, next, @isaacs/brace-expansion and minimatch.

Updates @opennextjs/cloudflare from 1.14.4 to 1.17.1

Release notes

Sourced from @​opennextjs/cloudflare's releases.

@​opennextjs/cloudflare@​1.17.1

Patch Changes

@​opennextjs/cloudflare@​1.17.0

Minor Changes

  • #1133 25d5835 Thanks @​dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.

@​opennextjs/cloudflare@​1.16.6

Patch Changes

  • #1138 4487f1f Thanks @​james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.

@​opennextjs/cloudflare@​1.16.5

Patch Changes

@​opennextjs/cloudflare@​1.16.4

Patch Changes

@​opennextjs/cloudflare@​1.16.3

Patch Changes

... (truncated)

Changelog

Sourced from @​opennextjs/cloudflare's changelog.

1.17.1

Patch Changes

1.17.0

Minor Changes

  • #1133 25d5835 Thanks @​dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.

1.16.6

Patch Changes

  • #1138 4487f1f Thanks @​james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.

1.16.5

Patch Changes

1.16.4

Patch Changes

1.16.3

... (truncated)

Commits
  • 206794f Version Packages (#1149)
  • f5bd138 make dev /cdn-cgi/image behaves like prod for consistency (#1147)
  • e965e4d refactor: creation of config files (#1146)
  • 7d86f42 Version Packages (#1143)
  • 25d5835 Update the migrate command to attempt to create an R2 bucket for caching as...
  • 2e4e595 Version Packages (#1140)
  • 4487f1f fix: future compat date set in wrangler config (#1138)
  • 63e29f2 Version Packages (#1128)
  • 2b437f1 In the migrate command, add an initial step to create a Next.js config file...
  • 8c3a36e fix: prevent Worker hang on HEAD requests to static assets (#1126)
  • Additional commits viewable in compare view

Updates next from 15.5.7 to 16.1.7

Release notes

Sourced from next's releases.

v16.1.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • [Cache Components] Prevent streaming fetch calls from hanging in dev (#89194)
  • Apply server actions transform to node_modules in route handlers (#89380)
  • ensure maxPostponedStateSize is always respected (See: CVE-2026-27979)
  • feat(next/image): add lru disk cache and images.maximumDiskCacheSize (See: CVE-2026-27980)
  • Allow blocking cross-site dev-only websocket connections from privacy-sensitive origins (See: CVE-2026-27977)
  • Disallow Server Action submissions from privacy-sensitive contexts by default (See: CVE-2026-27978)
  • fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

Credits

Huge thanks to @​unstubbable, @​styfle, @​eps1lon, and @​ztanner for helping!

v16.1.6

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • Upgrade to swc 54 (#88207)
  • implement LRU cache with invocation ID scoping for minimal mode response cache (#88509)
  • tweak LRU sentinel key (#89123)

Credits

Huge thanks to @​mischnic, @​wyattjoh, and @​ztanner for helping!

v16.1.5

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summaries-of-cve-2025-59471-and-cve-2025-59472 https://vercel.com/changelog/summary-of-cve-2026-23864

v16.0.11

Please see this changelog for more information about this security patch.

v15.6.0-canary.61

Please refer the following changelogs for more information about this security release:

v15.5.13

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

  • fix: patch http-proxy to prevent request smuggling in rewrites (See: CVE-2026-29057)

... (truncated)

Commits
  • bdf3e35 v16.1.7
  • dc98c04 [backport]: fix: patch http-proxy to prevent request smuggling in rewrites (#...
  • 9023c0a [backport] Disallow Server Action submissions from privacy-sensitive contexts...
  • 36a97b9 Allow blocking cross-site dev-only websocket connections from privacy-sensiti...
  • 93c3993 [backport]: feat(next/image): add lru disk cache and `images.maximumDiskCache...
  • c68d62d Backport documentation fixes for 16.1.x (#90655)
  • 5214ac1 [backport]: ensure maxPostponedStateSize is always respected (#90060) (#90471)
  • c95e357 Backport/docs fixes 16.1.x (#90125)
  • cba6144 [backport] Apply server actions transform to node_modules in route handlers...
  • 3db9063 [backport] [Cache Components] Prevent streaming fetch calls from hanging in d...
  • Additional commits viewable in compare view

Updates wrangler from 4.53.0 to 4.75.0

Release notes

Sourced from wrangler's releases.

wrangler@4.75.0

Minor Changes

  • #12492 3b81fc6 Thanks @​thomasgauvin! - feat: add wrangler tunnel commands for managing Cloudflare Tunnels

    Adds a new set of commands for managing remotely-managed Cloudflare Tunnels directly from Wrangler:

    • wrangler tunnel create <name> - Create a new Cloudflare Tunnel
    • wrangler tunnel list - List all tunnels in your account
    • wrangler tunnel info <tunnel> - Display details about a specific tunnel
    • wrangler tunnel delete <tunnel> - Delete a tunnel (with confirmation)
    • wrangler tunnel run <tunnel> - Run a tunnel using cloudflared
    • wrangler tunnel quick-start <url> - Start a temporary tunnel (Try Cloudflare)

    The run and quick-start commands automatically download and manage the cloudflared binary, caching it in ~/.wrangler/cloudflared/. Users are prompted before downloading and warned if their PATH-installed cloudflared is outdated. You can override the binary location with the CLOUDFLARED_PATH environment variable.

    All commands are marked as experimental.

Patch Changes

  • #12927 c9b3184 Thanks @​penalosa! - Bump undici from 7.18.2 to 7.24.4

  • #12875 13df6c7 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260312.1 1.20260316.1
  • #12935 df0d112 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260316.1 1.20260317.1
  • #12928 81ee98e Thanks @​petebacondarwin! - Migrate chrome-devtools-patches deployment from Cloudflare Pages to Workers + Assets

    The DevTools frontend is now deployed as a Cloudflare Workers + Assets project instead of a Cloudflare Pages project. This uses wrangler deploy for production deployments and wrangler versions upload for PR preview deployments.

    The inspector proxy origin allowlists in both wrangler and miniflare have been updated to accept connections from the new workers.dev domain patterns, while retaining the legacy pages.dev patterns for backward compatibility.

  • #12835 c600ce0 Thanks @​dario-piotrowicz! - Fix execution freezing on debugger statements when DevTools is not attached

    Previously, wrangler always sent Debugger.enable to the runtime on connection, even when DevTools wasn't open. This caused scripts to freeze on debugger statements. Now Debugger.enable is only sent when DevTools is actually attached, and Debugger.disable is sent when DevTools disconnects to stop the runtime from performing debugging work.

  • #12894 f509d13 Thanks @​gpanders! - Simplify description of --json option

... (truncated)

Commits
  • a671740 Version Packages (#12923)
  • e25bd0e Update prettier to 3.8.1 (#12939)
  • df0d112 Bump the workerd-and-workers-types group with 2 updates (#12935)
  • 81ee98e [chrome-devtools-patches] Migrate deployment from Cloudflare Pages to Workers...
  • 3b81fc6 feat(wrangler): add wrangler tunnel (#12492)
  • 13df6c7 Bump the workerd-and-workers-types group with 2 updates (#12875)
  • 0a7fef9 wrangler: reject cross-drive module paths (#11888)
  • f509d13 Remove superfluous adjective from --json description (#12894)
  • c600ce0 Fix execution freezing on debugger statements when DevTools is not attached...
  • 2e6b4ab Version Packages (#12876)
  • Additional commits viewable in compare view

Updates @smithy/config-resolver from 2.2.0 to 4.4.11

Release notes

Sourced from @​smithy/config-resolver's releases.

@​smithy/config-resolver@​4.4.11

Patch Changes

  • Updated dependencies [5340b11]
    • @​smithy/types@​4.13.1
    • @​smithy/node-config-provider@​4.3.12
    • @​smithy/util-endpoints@​3.3.3
    • @​smithy/util-middleware@​4.2.12
Changelog

Sourced from @​smithy/config-resolver's changelog.

4.4.11

Patch Changes

  • Updated dependencies [5340b11]
    • @​smithy/types@​4.13.1
    • @​smithy/node-config-provider@​4.3.12
    • @​smithy/util-endpoints@​3.3.3
    • @​smithy/util-middleware@​4.2.12

4.4.10

Patch Changes

  • a4d95e6: Set downlevel types to be used in typescript@'<4.5'
  • Updated dependencies [a4d95e6]
    • @​smithy/node-config-provider@​4.3.11
    • @​smithy/util-config-provider@​4.2.2
    • @​smithy/util-middleware@​4.2.11
    • @​smithy/util-endpoints@​3.3.2

4.4.9

Patch Changes

  • Updated dependencies [d0954cc]
    • @​smithy/types@​4.13.0
    • @​smithy/node-config-provider@​4.3.10
    • @​smithy/util-endpoints@​3.3.1
    • @​smithy/util-middleware@​4.2.10

4.4.8

Patch Changes

  • Updated dependencies [2bf677c]
    • @​smithy/util-endpoints@​3.3.0

4.4.7

Patch Changes

  • 03c3dc8: update for rollup build externalLiveBindings=false
  • Updated dependencies [03c3dc8]
    • @​smithy/node-config-provider@​4.3.9
    • @​smithy/types@​4.12.1
    • @​smithy/util-config-provider@​4.2.1
    • @​smithy/util-endpoints@​3.2.9
    • @​smithy/util-middleware@​4.2.9

... (truncated)

Commits

Updates fast-xml-parser from 4.2.5 to 5.4.1

Release notes

Sourced from fast-xml-parser's releases.

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

Migration

To migrate to fast-xml-builder;

From

import { XMLBuilder } from "fast-xml-parser";

To

import  XMLBuilder  from "fast-xml-builder";

XMLBuilder will be removed from current package in any next major version of this library. So better to migrate.

support strictReservedNames

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.9...v5.3.9

handle non-array input for XML builder && support maxNestedTags

CJS typing fix

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.6...v5.3.7

Entity security and performance

  • Improve security and performance of entity processing
    • new options maxEntitySize, maxExpansionDepth, maxTotalExpansions, maxExpandedLength, allowedTags,tagFilter
    • fast return when no edtity is present
    • improvement replacement logic to reduce number of calls

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.5...v5.3.6

v5.3.5

What's Changed

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.5.6 / 2026-03-16

  • update builder dependency
  • fix incorrect regex to replace . in entity name
  • fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

  • sanitize dangerous tag or attribute name
  • error on critical property name
  • support onDangerousProperty option

5.5.4 / 2026-03-13

  • declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

  • upgrade builder

5.5.2 / 2026-03-11

  • update dependency to fix typings

5.5.1 / 2026-03-10

  • fix dependency

5.5.0 / 2026-03-10

  • support path-expression-matcher
  • fix: stopNode should not be parsed
  • performance improvement for stopNode checking

5.4.2 / 2026-03-03

  • support maxEntityCount option

5.4.1 / 2026-02-25

  • fix (#785) unpairedTag node should not have tag content

5.4.0 / 2026-02-25

  • migrate to fast-xml-builder

5.3.9 / 2026-02-25

  • support strictReservedNames

5.3.8 / 2026-02-25

  • support maxNestedTags
  • handle non-array input for XML builder when preserveOrder is true (By Angelo Coetzee)
  • save use of js properies

5.3.7 / 2026-02-20

... (truncated)

Commits
  • 4e7ca80 update release info
  • 36023b4 fix (#785) unpairedTag node should not have tag content
  • b366026 separate builder
  • 6f333a8 update release info
  • c3ffbab support strictReservedNames
  • c692040 update release info
  • 107e34c avoid {} to create an empty object
  • 60835a4 support maxNestedTags
  • f55657c avoid direct call to hasOwnProperty
  • c13a961 handle non-array input for XML builder when preserveOrder is true
  • Additional commits viewable in compare view

Updates @isaacs/brace-expansion from 5.0.0 to 5.0.1

Updates minimatch from 3.1.2 to 3.1.5

Commits

Updates qs from 6.14.0 to 6.15.0

Changelog

Sourced from qs's changelog.

6.15.0

  • [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
  • [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

  • [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
  • [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
  • [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
  • [Fix] parse: enforce arrayLimit on comma-parsed values
  • [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
  • [Robustness] avoid .push, use void
  • [readme] document that addQueryPrefix does not add ? to empty output (#418)
  • [readme] clarify parseArrays and arrayLimit documentation (#543)
  • [readme] replace runkit CI badge with shields.io check-runs badge
  • [meta] fix changelog typo (arrayLengtharrayLimit)
  • [actions] fix rebase workflow permissions

6.14.1

  • [Fix] ensure arrayLimit applies to [] notation as well
  • [Fix] parse: when a custom decoder returns null for a key, ignore that key
  • [Refactor] parse: extract key segment splitting helper
  • [meta] add threat model
  • [actions] add workflow permissions
  • [Tests] stringify: increase coverage
  • [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect
Commits
  • d9b4c66 v6.15.0
  • cb41a54 [New] parse: add strictMerge option to wrap object/primitive conflicts in...
  • 88e1563 [Fix] duplicates option should not apply to bracket notation keys
  • 9d441d2 Merge backport release tags v6.0.6–v6.13.3 into main
  • 85cc8ca v6.12.5
  • ffc12aa v6.11.4
  • 0506b11 [actions] update reusable workflows
  • 6a37faf [actions] update reusable workflows
  • 8e8df5a [Fix] fix regressions from robustness refactor
  • d60bab3 v6.10.7
  • Additional commits viewable in compare view

Updates undici from 7.14.0 to 7.24.4

Release notes

Sourced from undici's releases.

v7.24.4

What's Changed

Full Changelog: nodejs/undici@v7.24.3...v7.24.4

v7.24.3

What's Changed

Full Changelog: nodejs/undici@v7.24.2...v7.24.3

v7.24.2

What's Changed

Full Changelog: nodejs/undici@v7.24.1...v7.24.2

v7.24.1

What's Changed

Full Changelog: nodejs/undici@v7.24.0...v7.24.1

v7.24.0

Undici v7.24.0 Security Release Notes

This release addresses multiple security vulnerabilities in Undici.

Upgrade guidance

All users on v7 should upgrade to v7.24.0 or later.

Fixed advisories

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for undici since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 4 updates in the / directory: [@opennextjs/cloudflare](https://github.com/opennextjs/opennextjs-cloudflare/tree/HEAD/packages/cloudflare), [next](https://github.com/vercel/next.js), @isaacs/brace-expansion and [minimatch](https://github.com/isaacs/minimatch).


Updates `@opennextjs/cloudflare` from 1.14.4 to 1.17.1
- [Release notes](https://github.com/opennextjs/opennextjs-cloudflare/releases)
- [Changelog](https://github.com/opennextjs/opennextjs-cloudflare/blob/main/packages/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/opennextjs/opennextjs-cloudflare/commits/@opennextjs/cloudflare@1.17.1/packages/cloudflare)

Updates `next` from 15.5.7 to 16.1.7
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.5.7...v16.1.7)

Updates `wrangler` from 4.53.0 to 4.75.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.75.0/packages/wrangler)

Updates `@smithy/config-resolver` from 2.2.0 to 4.4.11
- [Release notes](https://github.com/smithy-lang/smithy-typescript/releases)
- [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md)
- [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@4.4.11/packages/config-resolver)

Updates `fast-xml-parser` from 4.2.5 to 5.4.1
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.2.5...v5.4.1)

Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `qs` from 6.14.0 to 6.15.0
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.0...v6.15.0)

Updates `undici` from 7.14.0 to 7.24.4
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.14.0...v7.24.4)

---
updated-dependencies:
- dependency-name: "@opennextjs/cloudflare"
  dependency-version: 1.17.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 16.1.7
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: wrangler
  dependency-version: 4.75.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@smithy/config-resolver"
  dependency-version: 4.4.11
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-version: 5.4.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@isaacs/brace-expansion"
  dependency-version: 5.0.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.24.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 17, 2026
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented Mar 17, 2026

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
⛔ Deployment terminated
View logs
cfstatus 1ca73d8 Mar 17 2026, 10:19 PM

@kilo-code-bot
Copy link
Copy Markdown

kilo-code-bot Bot commented Mar 17, 2026

Code Review Summary

Status: 1 Warning Found | Recommendation: Address before merge

Overview

Severity Count
CRITICAL 0
WARNING 1
SUGGESTION 0
Issue Details (click to expand)

WARNING

File Line Issue
package.json 16 Next.js 16.x Major Upgrade - Upgrading from 15.5.7 to 16.1.7 is a major version bump. Next.js 16 deprecates next/head (used on line 4 of src/app/page.tsx). While the current code will still work, it will show deprecation warnings. Consider migrating to the new Metadata API.
Other Observations (not in diff)

This PR only updates dependencies in package.json and package-lock.json. No source code changes are included. Key observations:

File Line Issue
src/app/page.tsx 4 Uses deprecated Head from next/head. Should migrate to Next.js Metadata API.

Positive changes in this update:

Files Reviewed (2 files)
  • package.json - 1 warning
  • package-lock.json - (lock file only, no inline review)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants