chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	^5.20260921.1 → ^5.20260926.1
@cloudflare/workers-utils (source)	^0.41.0 → ^0.44.0
@scalar/api-reference (source)	^1.70.0 → ^1.72.1
@scalar/openapi-types (source)	^0.9.6 → ^0.9.7
@types/node (source)	^26.6.2 → ^26.6.3
@​vercel/queue	^0.6.0 → ^0.7.0
dotenv	^18.0.2 → ^18.0.4
env-runner	^0.2.3 → ^0.3.0
pnpm (source)	11.27.1 → 11.28.0
pretty-bytes	^7.1.3 → ^7.2.0
rolldown (source)	^1.2.9 → ^1.2.11
rollup (source)	^4.63.4 → ^4.63.5
undocs	0.10.1-20260909-093809-9b3fed7 → 0.10.1-20260922-215730-10f5034
vite (source)	^8.3.0 → ^8.3.1
wrangler (source)	^4.136.1 → ^4.141.0
zephyr-agent (source)	^1.4.0 → ^1.4.1

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/workers-utils)

v0.44.0

Compare Source

Minor Changes

• #​15658 8280086 Thanks @​jqmmes! - Add Durable Objects code update strategies to Worker deployments

  Use --durable-objects-code-update-mode immediate with wrangler deploy, wrangler versions deploy, and wrangler rollback to update code without waiting for active instances to hibernate. Use --durable-objects-code-update-mode deferred 30s to set a maximum delay, or configure durable_objects.code_update_strategy with mode and max_delay. When unset, the strategy defaults to deferred with a 5-minute maximum delay; delays cannot exceed 24 hours and must use millisecond precision.

Patch Changes

• #​15870 8c4b8a3 Thanks @​dario-piotrowicz! - Keep Node.js ESM packages working when consumers rebundle them as CommonJS

  Node.js-targeted ESM bundles now provide a real require implementation for bundled CommonJS dependencies. This avoids downstream patches for dynamic require calls and keeps the packages usable when a consumer rebundles them to CommonJS.

v0.43.0

Compare Source

Minor Changes

• #​15822 8f7916c Thanks @​GregBrimble! - Expose a helper for identifying live Durable Object exports

  Use isLiveDurableObjectExport() to distinguish created and incoming-transfer exports from deleted, renamed, and transferred tombstones.

v0.42.0

Compare Source

Minor Changes

• #​15792 479e1e8 Thanks @​flakey5! - Configure SSH for experimental Durable Object-managed Containers

  Set containers[].ssh and containers[].authorized_keys when using scheduling_policy: "durable_object". These are application-wide settings that follow the same rules as the existing Durable Object-managed Container settings: normal deployments create missing applications and update explicitly configured values, while omitted settings preserve the existing application configuration.

  // wrangler.jsonc
  {
    "containers": [
      {
        "name": "sandbox",
        "class_name": "Sandbox",
        "scheduling_policy": "durable_object",
        "ssh": { "enabled": true },
        "authorized_keys": [
          { "name": "laptop", "public_key": "ssh-ed25519 AAAA..." }
        ]
      }
    ]
  }

• #​15786 bdda4c3 Thanks @​ThomasRubini! - Support UDP connect handlers in local development

  The experimental connect configuration now accepts protocol: "udp", with optional idle_timeout_ms and max_pending_bytes settings. UDP datagrams are delivered to the Worker's connect() handler using workerd's value-mode socket streams, and can be tested with Miniflare#dispatchConnect({ protocol: "udp" }).

• #​15779 fc3cbaa Thanks @​Naapperas! - Support workflow entries in the exports configuration map

  A Worker can now declare the Workflows it defines in exports, keyed by the WorkflowEntrypoint class name:

  {
    "exports": {
      "MyWorkflow": {
        "type": "workflow",
        "name": "my-workflow",
        "limits": { "steps": 100 },
        "schedules": "0 * * * *"
      }
    }
  }

  A workflow export accepts the same settings as a workflows binding: limits, concurrency, schedules, and default_retention. wrangler deploy and wrangler versions upload send these entries to the upload API by name, and wrangler deploy and wrangler triggers deploy provision the Workflow with its settings, just as they do for workflows bindings owned by the Worker. A Workflow may be declared both as a binding and as an export, as long as both declarations use the same class and do not set the same setting to different values. A binding to another Worker's Workflow cannot share a name with an export. @cloudflare/config adds the matching exports.workflow() helper. Local development does not yet act on these entries.

Patch Changes

• #​15838 15799d4 Thanks @​oddharsh! - Update smol-toml to 1.9.0 to fix slow parsing of very large TOML files

  Parse time for TOML config files now grows linearly with their size, instead of with its square: a 40,000-line file that took 259 ms to parse now takes 17 ms, while typical wrangler.toml files parse in the same time as before. This addresses the GHSA-r4xh-jqrq-34v2 advisory against earlier versions of the parser.

  Some TOML syntax errors now point at the character that caused them. For example, a wrangler.toml containing INVALID "FILE is now reported as illegal character in key at the ", rather than incomplete key-value at the start of the line.

unjs/env-runner (env-runner)

v0.3.0

Compare Source

compare changes

🚀 Enhancements

• miniflare: Support a module specifier for exports (#​60)
• ⚠️ Virtual modules improvements (#​61)

🩹 Fixes

• miniflare: Return worker redirects instead of following them (d01fca7)
• miniflare: Keep IPC env across requests (358bff6)
• miniflare: Support miniflare v5 (0838ef3)

🏡 Chore

• Update deps (6d01008)

⚠️ Breaking Changes

• ⚠️ Virtual modules improvements (#​61)

❤️ Contributors

• Pi0x x@pi0.io
• Rihan Arfan (@​RihanArfan)
• Pooya Parsa (@​pi0)

pnpm/pnpm (pnpm)

v11.28.0

Compare Source

unjs/undocs (undocs)

v0.10.1-20260922-215730-10f5034

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nitro.build	Ready	Preview	Sep 29, 2026 2:41pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 86f87377-e73e-4fdb-8592-3c7d54099386

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cloudflare/​workers-utils@​0.41.2 ⏵ 0.44.0			+1	+1
	undocs-nightly@​0.10.1-20260909-093809-9b3fed7 ⏵ 0.10.1-20260922-215730-10f5034	+1
	env-runner@​0.3.2
	@​vercel/​queue@​0.6.0 ⏵ 0.7.0			+1	+1

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4669

commit: d970aa0