Skip to content

Faster stringify cookie with benchmarks - #262

Merged
blakeembrey merged 1 commit into
masterfrom
be/perf-stringify-cookie
Feb 19, 2026
Merged

Faster stringify cookie with benchmarks#262
blakeembrey merged 1 commit into
masterfrom
be/perf-stringify-cookie

Conversation

@blakeembrey

@blakeembrey blakeembrey commented Feb 13, 2026

Copy link
Copy Markdown
Member

I decided to try investigating if anything in #250 holds true, and found the opposite for string concatenation. Updated to use string concatenation to improve performance.

Before:

 ✓ src/stringify-cookie.bench.ts > cookie.stringifyCookie 7195ms
     name                         hz     min     max    mean     p75     p99    p995    p999     rme  samples
   · empty             19,138,902.74  0.0000  0.0572  0.0001  0.0000  0.0001  0.0001  0.0002  ±0.11%  9569452
   · simple             5,777,350.07  0.0001  0.3515  0.0002  0.0002  0.0002  0.0003  0.0006  ±0.39%  2888676
   · undefined values   3,129,664.63  0.0002  0.3241  0.0003  0.0003  0.0004  0.0004  0.0008  ±0.46%  1564833
   · 10 cookies           765,737.48  0.0012  0.4257  0.0013  0.0013  0.0014  0.0016  0.0020  ±0.34%   382869
   · 100 cookies           78,240.71  0.0122  0.4788  0.0128  0.0128  0.0137  0.0160  0.0424  ±0.39%    39121

After:

 ✓ src/stringify-cookie.bench.ts > cookie.stringifyCookie 7958ms
     name                         hz     min     max    mean     p75     p99    p995    p999     rme   samples
   · empty             21,654,747.61  0.0000  0.1649  0.0000  0.0000  0.0001  0.0001  0.0002  ±0.14%  10827374
   · simple             7,345,985.72  0.0000  0.0540  0.0001  0.0001  0.0002  0.0002  0.0003  ±0.10%   3672994
   · undefined values   3,820,139.53  0.0002  0.0491  0.0003  0.0003  0.0003  0.0004  0.0004  ±0.11%   1910070
   · 10 cookies           854,240.43  0.0010  0.4322  0.0012  0.0012  0.0013  0.0014  0.0019  ±0.44%    427121
   · 100 cookies           85,417.71  0.0110  0.4168  0.0117  0.0117  0.0126  0.0160  0.0470  ±0.44%     42709

@blakeembrey
blakeembrey requested a review from a team February 13, 2026 19:19
@blakeembrey blakeembrey mentioned this pull request Feb 13, 2026
Closed
sheplu
sheplu requested changes Feb 15, 2026
View reviewed changes

@sheplu sheplu left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a change for the folder that should host the two new bench files
Other than than LGTM!

Comment thread src/stringify-cookie.bench.ts
sheplu
sheplu approved these changes Feb 19, 2026
View reviewed changes

@sheplu sheplu left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@blakeembrey
blakeembrey merged commit e264dfa into master Feb 19, 2026
11 checks passed
@blakeembrey
blakeembrey deleted the be/perf-stringify-cookie branch February 19, 2026 19:42
jquagga added a commit to jquagga/swa that referenced this pull request Aug 2, 2026
@jquagga Justin jquagga-renovate
Reintegrate (#581)
f153806 
* Remove github dependencies on the codeberg version

* Url changes to codeberg (#2)

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/2

* chore(deps): update all non-major dependencies (#3)

* chore(deps): lock file maintenance (#4)

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "before 4am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzYuNyIsInVwZGF0ZWRJblZlciI6IjQzLjE3Ni43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/4

* Switch from npm to pnpm for building (#5)

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/5

* chore(deps): update dependency svelte to v5.55.7 [security] (#6)

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [svelte](https://svelte.dev) ([source](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | [`5.55.5` → `5.55.7`](https://renovatebot.com/diffs/npm/svelte/5.55.5/5.55.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/svelte/5.55.7?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/svelte/5.55.7?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/svelte/5.55.5/5.55.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/svelte/5.55.5/5.55.7?slim=true) |

---

### Svelte: ReDoS in `<svelte:element>` Tag Validation
[CVE-2026-42567](https://nvd.nist.gov/vuln/detail/CVE-2026-42567) / [GHSA-9rmh-mm8f-r9h6](https://github.com/advisories/GHSA-9rmh-mm8f-r9h6)

<details>
<summary>More information</summary>

#### Details
An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to `svelte:element`, you are safe.

#### Severity
- CVSS Score: 5.9 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6](https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-9rmh-mm8f-r9h6) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Svelte: SSR XSS via Insecure Promise Serialization in hydratable
[GHSA-f3cj-j4f6-wq85](https://github.com/advisories/GHSA-f3cj-j4f6-wq85)

<details>
<summary>More information</summary>

#### Details
Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
- you are using `hydratable` (an experimental feature at the time of this report)
- you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () => [synchronousValue, promiseValue])`

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N`

#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85](https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85)
- [https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4](https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-f3cj-j4f6-wq85) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Svelte SSR vulnerable to cross-site scripting via spread attributes
[CVE-2026-42599](https://nvd.nist.gov/vuln/detail/CVE-2026-42599) / [GHSA-pr6f-5x2q-rwfp](https://github.com/advisories/GHSA-pr6f-5x2q-rwfp)

<details>
<summary>More information</summary>

#### Details
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability _only_ triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.

This is similar to but different from [CVE-2026-27121](https://nvd.nist.gov/vuln/detail/CVE-2026-27121).

#### Severity
- CVSS Score: 5.1 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N`

#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp](https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-27121](https://nvd.nist.gov/vuln/detail/CVE-2026-27121)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
[CVE-2026-42573](https://nvd.nist.gov/vuln/detail/CVE-2026-42573) / [GHSA-rcqx-6q8c-2c42](https://github.com/advisories/GHSA-rcqx-6q8c-2c42)

<details>
<summary>More information</summary>

#### Details
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

You are vulnerable if all of the following is true:
- you are using attribute spreading on a form element
- you are using attribute spreading or allow a dynamic value for the `name` attribute on an input or button element within that form
- both of these are simultaneously user-controllable

```svelte
<form {...spread1}>
  <input {...spread2}>
</form>
```

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N`

#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42](https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-rcqx-6q8c-2c42) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>sveltejs/svelte (svelte)</summary>

### [`v5.55.7`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5557)

[Compare Source](https://github.com/sveltejs/svelte/compare/[email protected]@5.55.7)

##### Patch Changes

- fix: prevent XSS on `hydratable` from user contents ([`a16ebc67bbcf8f708360195687e1b2719463e1a4`](https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4))

- chore: bump devalue ([#&#8203;18219](https://github.com/sveltejs/svelte/pull/18219))

- fix: disallow empty attribute names during SSR ([`547853e2406a2147ad7fb5ffeba95b01bd9642da`](https://github.com/sveltejs/svelte/commit/547853e2406a2147ad7fb5ffeba95b01bd9642da))

- fix: harden regex ([`d2375e2ebcab5c88feb5652f1a9d621b8f06b259`](https://github.com/sveltejs/svelte/commit/d2375e2ebcab5c88feb5652f1a9d621b8f06b259))

- fix: move Svelte runtime properties to symbols ([`e1cbbd96441e82c9eb8a23a2903c0d06d3cda991`](https://github.com/sveltejs/svelte/commit/e1cbbd96441e82c9eb8a23a2903c0d06d3cda991))

### [`v5.55.6`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5556)

[Compare Source](https://github.com/sveltejs/svelte/compare/[email protected]@5.55.6)

##### Patch Changes

- fix: leave stale promises to wait for a later resolution, instead of rejecting ([#&#8203;18180](https://github.com/sveltejs/svelte/pull/18180))

- fix: keep dependencies of `$state.eager/pending` ([#&#8203;18218](https://github.com/sveltejs/svelte/pull/18218))

- fix: reapply context after transforming error during SSR ([#&#8203;18099](https://github.com/sveltejs/svelte/pull/18099))

- fix: don't rebase just-created batches ([#&#8203;18117](https://github.com/sveltejs/svelte/pull/18117))

- chore: allow `null` for `pending` in typings ([#&#8203;18201](https://github.com/sveltejs/svelte/pull/18201))

- fix: flush eager effects in production ([#&#8203;18107](https://github.com/sveltejs/svelte/pull/18107))

- fix: rethrow error of failed iterable after calling `return()` ([#&#8203;18169](https://github.com/sveltejs/svelte/pull/18169))

- fix: account for proxified instance when updating `bind:this` ([#&#8203;18147](https://github.com/sveltejs/svelte/pull/18147))

- fix: ensure scheduled batch is flushed if not obsolete ([#&#8203;18131](https://github.com/sveltejs/svelte/pull/18131))

- fix: resolve stale deriveds with latest value ([#&#8203;18167](https://github.com/sveltejs/svelte/pull/18167))

- chore: remove unnecessary `increment_pending` calls ([#&#8203;18183](https://github.com/sveltejs/svelte/pull/18183))

- fix: correctly compile component member expressions for SSR ([#&#8203;18192](https://github.com/sveltejs/svelte/pull/18192))

- fix: reset `source.updated` stack traces after `flush` ([#&#8203;18196](https://github.com/sveltejs/svelte/pull/18196))

- fix: replacing async 'blocking' strategy with 'merging' ([#&#8203;18205](https://github.com/sveltejs/svelte/pull/18205))

- fix: allow `@debug` tags to reference awaited variables ([#&#8203;18138](https://github.com/sveltejs/svelte/pull/18138))

- fix: re-run fallback props if dependencies update ([#&#8203;18146](https://github.com/sveltejs/svelte/pull/18146))

- fix: abort running obsolete async branches ([#&#8203;18118](https://github.com/sveltejs/svelte/pull/18118))

- fix: ignore comments when reading CSS values ([#&#8203;18153](https://github.com/sveltejs/svelte/pull/18153))

- fix: wrap `Promise.all` in `save` during SSR ([#&#8203;18178](https://github.com/sveltejs/svelte/pull/18178))

- fix: ignore false-positive errors of `$inspect` dependencies ([#&#8203;18106](https://github.com/sveltejs/svelte/pull/18106))

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJzZWN1cml0eSJdfQ==-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/6

* chore(deps): update all non-major dependencies (#7)

* chore(deps): lock file maintenance (#8)

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "before 4am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/8

* chore(deps): update all non-major dependencies (#9)

* chore(deps): update dependency svelte to v5.55.9 (#10)

* chore(deps): lock file maintenance (#11)

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "before 4am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/11

* chore(deps): update all non-major dependencies (#12)

* Small tidy updates (#13)

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/13

* chore(deps): pin dependency @types/node to 25.9.1 (#14)

This PR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | pin | [`^25.9.1` → `25.9.1`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.1/25.9.1) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |

⚠️ Renovate's pin functionality [does not currently](https://github.com/renovatebot/renovate/issues/40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "before 4am on sunday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDQuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/14

* Add setopt to the shellscript (#16)

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/16

* chore(deps): lock file maintenance (#15)

* wrangler changes (#17)

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/17

* renovate updates (#18)

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/18

* Change User Agent to codeberg (#19)

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/19

* chore(deps): update all dependencies (#20)

* chore(deps): update (#21)

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTQuNiIsInVwZGF0ZWRJblZlciI6IjQzLjIxNC42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/21

* chore(deps): update all dependencies (#22)

* chore(deps): update (#23)

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIyMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/23

* chore(deps): update all dependencies (#24)

* chore(deps): update all dependencies (#25)

This PR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [@sveltejs/kit](https://svelte.dev) ([source](https://github.com/sveltejs/kit/tree/HEAD/packages/kit)) | devDependencies | minor | [`2.66.0` → `2.68.0`](https://renovatebot.com/diffs/npm/@sveltejs%2fkit/2.66.0/2.68.0) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/kit/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/kit) |
| [@types/luxon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/luxon) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/luxon)) | devDependencies | patch | [`3.7.1` → `3.7.2`](https://renovatebot.com/diffs/npm/@types%2fluxon/3.7.1/3.7.2) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | patch | [`25.9.3` → `25.9.4`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.3/25.9.4) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
| [cookie](https://github.com/jshttp/cookie) | overrides | major | [`1.1.1` → `2.0.0`](https://renovatebot.com/diffs/npm/cookie/1.1.1/2.0.0) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/jshttp/cookie/badge)](https://securityscorecards.dev/viewer/?uri=github.com/jshttp/cookie) |
| [svelte](https://svelte.dev) ([source](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | devDependencies | patch | [`5.56.3` → `5.56.4`](https://renovatebot.com/diffs/npm/svelte/5.56.3/5.56.4) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/svelte/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/svelte) |
| [svelte-check](https://github.com/sveltejs/language-tools) | devDependencies | minor | [`4.6.0` → `4.7.1`](https://renovatebot.com/diffs/npm/svelte-check/4.6.0/4.7.1) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/language-tools/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/language-tools) |
| [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | devDependencies | minor | [`8.0.16` → `8.1.0`](https://renovatebot.com/diffs/npm/vite/8.0.16/8.1.0) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/vitejs/vite/badge)](https://securityscorecards.dev/viewer/?uri=github.com/vitejs/vite) |
| [wrangler](https://github.com/cloudflare/workers-sdk) ([source](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)) | devDependencies | minor | [`4.102.0` → `4.105.0`](https://renovatebot.com/diffs/npm/wrangler/4.102.0/4.105.0) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cloudflare/workers-sdk/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cloudflare/workers-sdk) |

---

### Release Notes

<details>
<summary>sveltejs/kit (@&#8203;sveltejs/kit)</summary>

### [`v2.68.0`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2680)

##### Minor Changes

- feat: expose `RemoteFormEnhanceInstance` and `RemoteFormEnhanceCallback` types ([#&#8203;15816](https://github.com/sveltejs/kit/pull/15816))

- feat: set value of `submit` fields when form is submitted ([#&#8203;15979](https://github.com/sveltejs/kit/pull/15979))

##### Patch Changes

- fix: skip `native_navigation` when `__data.json` returns 404 on a static fallback page ([#&#8203;16135](https://github.com/sveltejs/kit/pull/16135))

- fix: ignore third-party monkeypatches in `pushState`/`replaceState` warning detection ([#&#8203;15267](https://github.com/sveltejs/kit/pull/15267))

- fix: snapshot form fields on read ([#&#8203;16150](https://github.com/sveltejs/kit/pull/16150))

- fix: strip field prefix before erroring on duplicates ([#&#8203;16151](https://github.com/sveltejs/kit/pull/16151))

- fix: call reset function via prototype ([#&#8203;16138](https://github.com/sveltejs/kit/pull/16138))

- chore: fix navigation `type` hover info ([#&#8203;16147](https://github.com/sveltejs/kit/pull/16147))

### [`v2.67.0`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2670)

[Compare Source](https://github.com/sveltejs/kit/compare/@sveltejs/[email protected]...@sveltejs/[email protected])

##### Minor Changes

- feat: add `prerender.handleInvalidUrl` option for invalid URLs discovered while crawling ([#&#8203;16088](https://github.com/sveltejs/kit/pull/16088))

##### Patch Changes

- fix: support `exactOptionalPropertyTypes` for optional form schema fields ([#&#8203;15866](https://github.com/sveltejs/kit/pull/15866))

- fix: avoid unnecessarily overriding a user's Vite 8 `codeSplitting` setting ([#&#8203;16118](https://github.com/sveltejs/kit/pull/16118))

</details>

<details>
<summary>jshttp/cookie (cookie)</summary>

### [`v2.0.0`](https://github.com/jshttp/cookie/releases/tag/v2.0.0)

[Compare Source](https://github.com/jshttp/cookie/compare/v1.1.1...v2.0.0)

**Important:** This release moves the package to ESM only. In node 22+ you can `require(esm)`, and older node versions are not supported.

**Changed**

- Switch to ESM ([#&#8203;273](https://github.com/jshttp/cookie/pull/273))
- Remove deprecated code paths ([#&#8203;272](https://github.com/jshttp/cookie/pull/272))
  - The old `parse` and `stringify` methods have been renamed: `parseCookie` and `stringifySetCookie`
  - `stringifySetCookie` only supports object mode (e.g. `{ name: "", value: "" }`)

**Improvements**

- Faster stringify cookie ([#&#8203;262](https://github.com/jshttp/cookie/issues/262))
- Optimize encode performance ([#&#8203;269](https://github.com/jshttp/cookie/pull/269))
- Apply `encode` to empty cookie values ([#&#8203;277](https://github.com/jshttp/cookie/pull/277))

**Fixed**

- Omit leading semicolon when stringifying cookies with skipped values ([#&#8203;267](https://github.com/jshttp/cookie/issues/267))

</details>

<details>
<summary>sveltejs/svelte (svelte)</summary>

### [`v5.56.4`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5564)

[Compare Source](https://github.com/sveltejs/svelte/compare/[email protected]@5.56.4)

##### Patch Changes

- fix: include wrapping parentheses in `{@&#8203;const}` declarator `end` position ([#&#8203;18436](https://github.com/sveltejs/svelte/pull/18436))

- fix: always unset reactivity context after restoring it ([#&#8203;18453](https://github.com/sveltejs/svelte/pull/18453))

- fix: don't notify `searchParams` subscribers when the URL changes without affecting the search string ([#&#8203;18425](https://github.com/sveltejs/svelte/pull/18425))

- fix: strip `?` from optional parameters in `<script lang="ts">` so generated JavaScript is valid ([#&#8203;18448](https://github.com/sveltejs/svelte/pull/18448))

</details>

<details>
<summary>sveltejs/language-tools (svelte-check)</summary>

### [`v4.7.1`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.1)

[Compare Source](https://github.com/sveltejs/language-tools/compare/[email protected]@4.7.1)

##### Patch Changes

- fix: correctly parse --tsgo-experimental-api flag ([#&#8203;3067](https://github.com/sveltejs/language-tools/pull/3067))

### [`v4.7.0`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.0)

[Compare Source](https://github.com/sveltejs/language-tools/compare/[email protected]@4.7.0)

##### Minor Changes

- feat: add `--config` option ([#&#8203;3066](https://github.com/sveltejs/language-tools/pull/3066))

- feat: svelte-check tsgo support with experimental api ([#&#8203;3036](https://github.com/sveltejs/language-tools/pull/3036))

##### Patch Changes

- fix: load esm version of Vite ([#&#8203;3065](https://github.com/sveltejs/language-tools/pull/3065))

- fix: stop excluding workspaces under dot-prefixed ancestors ([#&#8203;3037](https://github.com/sveltejs/language-tools/pull/3037))

- Updated dependencies \[[`7a3464b`](https://github.com/sveltejs/language-tools/commit/7a3464b54b997c703d5b60cc6ab1ed74c49efffc), [`a2561fc`](https://github.com/sveltejs/language-tools/commit/a2561fc2c52bdcd0bad746261222196fd94d5396)]:
  - [@&#8203;sveltejs/load-config](https://github.com/sveltejs/load-config)@&#8203;0.2.0

</details>

<details>
<summary>vitejs/vite (vite)</summary>

### [`v8.1.0`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#810-2026-06-23)

[Compare Source](https://github.com/vitejs/vite/compare/v8.0.16...v8.1.0)

##### Features

- extend `server.fs.deny` list with common files ([#&#8203;22707](https://github.com/vitejs/vite/issues/22707)) ([61ba8fd](https://github.com/vitejs/vite/commit/61ba8fdc6500e8aa668021833ae5e6ebd200466d))
- update rolldown to 1.1.2 ([#&#8203;22695](https://github.com/vitejs/vite/issues/22695)) ([4f008a6](https://github.com/vitejs/vite/commit/4f008a6213014fe5e898f42561bdc621e103903e))
- use `~` for Rolldown ([#&#8203;22693](https://github.com/vitejs/vite/issues/22693)) ([9928722](https://github.com/vitejs/vite/commit/9928722f7d08de27907c48b65ddc071244166e05))

##### Bug Fixes

- **bundled-dev:** errors should be kept when incremental build fails ([#&#8203;22617](https://github.com/vitejs/vite/issues/22617)) ([9a0dd48](https://github.com/vitejs/vite/commit/9a0dd481ac2160078b8173879e0fa86e5e6af05d))
- cache falsy values in perEnvironmentState ([#&#8203;22715](https://github.com/vitejs/vite/issues/22715)) ([0e91e79](https://github.com/vitejs/vite/commit/0e91e79841b501d29dc86a6b7c0313660781196a))
- **glob:** respect caseSensitive option in hmr matcher ([#&#8203;22711](https://github.com/vitejs/vite/issues/22711)) ([65f525e](https://github.com/vitejs/vite/commit/65f525e643ba31faeaeafbc5d888b61465e6b48d))
- **html:** omit nonce on import map when cspNonce is unset ([#&#8203;22713](https://github.com/vitejs/vite/issues/22713)) ([8340bb5](https://github.com/vitejs/vite/commit/8340bb51cab703427a13d5df40b0005352c1b676))
- **optimizer:** skip null-valued exports in expandGlobIds glob resolution ([#&#8203;22611](https://github.com/vitejs/vite/issues/22611)) ([8b9f5cd](https://github.com/vitejs/vite/commit/8b9f5cd9f19f6002e1323b10155ab943219e86aa))
- resolved build options should be kept as a getter ([#&#8203;22691](https://github.com/vitejs/vite/issues/22691)) ([3527191](https://github.com/vitejs/vite/commit/3527191cad6c935a3d129506cc9a893c84009037))
- **server:** handle malformed URI in memory files middleware ([#&#8203;22714](https://github.com/vitejs/vite/issues/22714)) ([df9e0a5](https://github.com/vitejs/vite/commit/df9e0a589ff64e09c32beca9494bff4757d4ea37))
- use literal envPrefix queries for Vite Task ([#&#8203;22706](https://github.com/vitejs/vite/issues/22706)) ([da72733](https://github.com/vitejs/vite/commit/da727337b13ac6144e523eb06852b2a52c377f22))
- warn on deprecated envFile ([#&#8203;22555](https://github.com/vitejs/vite/issues/22555)) ([ed7b283](https://github.com/vitejs/vite/commit/ed7b28352e347dc7c95d590d2e696c3e5bd1e3d7))

##### Code Refactoring

- **client:** inline dev-id value in CSS selector ([#&#8203;22736](https://github.com/vitejs/vite/issues/22736)) ([57f59bc](https://github.com/vitejs/vite/commit/57f59bc843dd527a81c503684b7f408872edaef3))
- remove unused removeRawQuery util ([#&#8203;22724](https://github.com/vitejs/vite/issues/22724)) ([403cc60](https://github.com/vitejs/vite/commit/403cc608e4e8633b0335f5e8221c83dfca4994f8))
- use `rolldownOptions` property for chunkImportMap ([#&#8203;22692](https://github.com/vitejs/vite/issues/22692)) ([8e8816c](https://github.com/vitejs/vite/commit/8e8816ca9fa249d210150c5590bac06af3560aa7))

</details>

<details>
<summary>cloudflare/workers-sdk (wrangler)</summary>

### [`v4.105.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41050)

[Compare Source](https://github.com/cloudflare/workers-sdk/compare/[email protected]@4.105.0)

##### Minor Changes

- [#&#8203;14311](https://github.com/cloudflare/workers-sdk/pull/14311) [`34e0cef`](https://github.com/cloudflare/workers-sdk/commit/34e0cefcd54130be4ca3f9cf4de1e9867252ead0) Thanks [@&#8203;sherryliu-lsy](https://github.com/sherryliu-lsy)! - Add Google Artifact Registry support to `containers registries configure`

  `wrangler containers registries configure` now recognizes `*-docker.pkg.dev` (Google Artifact Registry) domains.

  - The Google service account email is the public credential, supplied with `--gar-email`. It must match the `client_email` in the service account key.
  - The service account JSON key is the private credential. It is provided via stdin (a file path, raw JSON, or base64) or an interactive prompt (a file path or base64) — never as a CLI flag, so it does not appear in shell history. The key is validated against `--gar-email` and stored base64-encoded.
  - Secret reuse inherits the existence-first flow: when the target Secrets Store secret already exists, it is reused by reference and the key is not required. In that case the email cannot be verified locally; it is validated against the key when images are pulled.

  ```sh
  <path-to-key>.json | npx wrangler@latest containers registries configure <region>-docker.pkg.dev --gar-email=<service-account-email> --secret-name=Google_Service_Account_JSON_Key
  ```

##### Patch Changes

- [#&#8203;14424](https://github.com/cloudflare/workers-sdk/pull/14424) [`5f40dd5`](https://github.com/cloudflare/workers-sdk/commit/5f40dd5d2897c4c8a1fb30f29af038baefcf67a4) Thanks [@&#8203;MattieTK](https://github.com/MattieTK)! - Bump `am-i-vibing` from 0.4.0 to 0.5.0

  This updates the agentic environment detection library to the latest version, which adds detection for the Pi coding agent (`earendil-works/pi`).

- [#&#8203;14406](https://github.com/cloudflare/workers-sdk/pull/14406) [`3b743c1`](https://github.com/cloudflare/workers-sdk/commit/3b743c1b86ad80c40fd9d2d678cd5a8cb66e86fa) Thanks [@&#8203;dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From         | To           |
  | ---------- | ------------ | ------------ |
  | workerd    | 1.20260623.1 | 1.20260625.1 |

- [#&#8203;14343](https://github.com/cloudflare/workers-sdk/pull/14343) [`daa5389`](https://github.com/cloudflare/workers-sdk/commit/daa5389863bd20ab655cf68a5f7cd63afeb30904) Thanks [@&#8203;th0m](https://github.com/th0m)! - Use digest-pinned image references for Dockerfile container deploys

  Dockerfile-backed container deploys now use the pushed image digest when deploying the container application. This lets snapshot-enabled container apps pass Cloudchamber validation while keeping local, non-pushed builds and registry image URI deploys unchanged.

- [#&#8203;14394](https://github.com/cloudflare/workers-sdk/pull/14394) [`8a5cf8c`](https://github.com/cloudflare/workers-sdk/commit/8a5cf8c2e61bf3c01a836aad260fa3a5f29e1e7c) Thanks [@&#8203;Partha-Shankar](https://github.com/Partha-Shankar)! - fix(d1): escape `migrationsTableName` and filenames in SQLite queries

  D1 migration commands in both `wrangler` and `@cloudflare/vitest-pool-workers` interpolated the `migrationsTableName` config value and migration filenames directly into SQL strings without any escaping. This meant:

  - A table name such as `my"table` would produce invalid SQL in `CREATE TABLE`, `SELECT`, and `INSERT` statements, and
  - A migration filename containing an apostrophe (e.g. `what's-new.sql`) would break the `INSERT INTO ... VALUES ('...')` statement appended after each migration in `wrangler`.

  Both identifiers are now properly escaped before interpolation: `migrationsTableName` is wrapped in double-quotes with internal double-quotes doubled (SQL-standard identifier quoting), and migration filenames used as string literals have their single-quotes doubled before insertion.

- Updated dependencies \[[`3b743c1`](https://github.com/cloudflare/workers-sdk/commit/3b743c1b86ad80c40fd9d2d678cd5a8cb66e86fa)]:
  - miniflare\@&#8203;4.20260625.0

### [`v4.104.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41040)

[Compare Source](https://github.com/cloudflare/workers-sdk/compare/[email protected]@4.104.0)

##### Minor Changes

- [#&#8203;14369](https://github.com/cloudflare/workers-sdk/pull/14369) [`e312dec`](https://github.com/cloudflare/workers-sdk/commit/e312decf71f8d1a435ca178f209844363f24014a) Thanks [@&#8203;edmundhung](https://github.com/edmundhung)! - Add `getEnv()` to `createTestHarness()` Worker handles

  Tests can now access the full `env` object for a Worker with `await server.getWorker<Env>().getEnv()`, including vars, secrets, and bindings.

##### Patch Changes

- [#&#8203;14364](https://github.com/cloudflare/workers-sdk/pull/14364) [`a085dec`](https://github.com/cloudflare/workers-sdk/commit/a085deca12d7126c21e500b3dd4298edfd13f8cd) Thanks [@&#8203;dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From         | To           |
  | ---------- | ------------ | ------------ |
  | workerd    | 1.20260617.1 | 1.20260619.1 |

- [#&#8203;14383](https://github.com/cloudflare/workers-sdk/pull/14383) [`9a0de8f`](https://github.com/cloudflare/workers-sdk/commit/9a0de8f71f50bb7d1884288e376259082084a315) Thanks [@&#8203;dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From         | To           |
  | ---------- | ------------ | ------------ |
  | workerd    | 1.20260619.1 | 1.20260621.1 |

- [#&#8203;14397](https://github.com/cloudflare/workers-sdk/pull/14397) [`fab565f`](https://github.com/cloudflare/workers-sdk/commit/fab565fdb1a912c73232d72ccdf1963fd96f9ad5) Thanks [@&#8203;dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From         | To           |
  | ---------- | ------------ | ------------ |
  | workerd    | 1.20260621.1 | 1.20260623.1 |

- [#&#8203;14388](https://github.com/cloudflare/workers-sdk/pull/14388) [`3f02864`](https://github.com/cloudflare/workers-sdk/commit/3f028644284236fbfe36567052200cf00e707d85) Thanks [@&#8203;petebacondarwin](https://github.com/petebacondarwin)! - Stop erroring when `find_additional_modules` discovers a file that only matches a inactive module rule

  Module rules assign module *types* to imported files — they are not include/exclude filters. Also, setting `fallthrough: false` in a rule will cause subsequent rules to become inactive. Previously, when `find_additional_modules` walked the filesystem and discovered a file whose only matching rule is inactive, Wrangler would throw an error and fail the build.

  This meant that adding a user rule like the one below would break the build for any `.txt`, `.html`, `.sql`, `.bin` or `.wasm` file that didn't match the user-supplied globs but lived somewhere under the module root:

  ```jsonc
  // wrangler.json
  {
    "rules": [
      {
        "type": "Text",
        "globs": ["html/includeme.html"],
        "fallthrough": false
      }
    ]
  }
  ```

  Discovered files that only match an inactive rule are now silently skipped (a `debug`-level log records each skip for troubleshooting), so users can use `fallthrough: false` to narrow the set of files attached to their Worker without having to delete or move untouched files on disk.

  The direct-import path is unchanged: importing a file in code that only matches an inactive rule is still a hard error, because the imported file genuinely needs a defined module type.

  Fixes [#&#8203;14257](https://github.com/cloudflare/workers-sdk/issues/14257).

- [#&#8203;14358](https://github.com/cloudflare/workers-sdk/pull/14358) [`4ef872f`](https://github.com/cloudflare/workers-sdk/commit/4ef872fe530282d26ec8f2f8c52f23b8702ae757) Thanks [@&#8203;gabivlj](https://github.com/gabivlj)! - Fix container egress interception on arm64 Docker runtimes

  Both `wrangler dev` and the Cloudflare Vite plugin no longer force the `proxy-everything` sidecar image to pull as `linux/amd64`, allowing Docker to select the native image from the multi-platform manifest. Set `MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM` to force a specific platform when needed.

- [#&#8203;14362](https://github.com/cloudflare/workers-sdk/pull/14362) [`2a02858`](https://github.com/cloudflare/workers-sdk/commit/2a028589543aa7692f99a053952bfc1c5eb8302f) Thanks [@&#8203;sherryliu-lsy](https://github.com/sherryliu-lsy)! - Don't require the private credential when reusing an existing Secrets Store secret in `containers registries configure`

  `wrangler containers registries configure` now checks whether the target Secrets Store secret already exists before resolving the private credential. When the secret already exists it is reused by reference, so the private credential no longer needs to be supplied (via stdin in non-interactive mode, or via a prompt interactively). This applies to all external registries.

  The new-secret path is unchanged: the credential is still required and stored. The only visible interactive change is that the secret prompt now appears last and only when a new secret is being created.

- Updated dependencies \[[`a085dec`](https://github.com/cloudflare/workers-sdk/commit/a085deca12d7126c21e500b3dd4298edfd13f8cd), [`9a0de8f`](https://github.com/cloudflare/workers-sdk/commit/9a0de8f71f50bb7d1884288e376259082084a315), [`fab565f`](https://github.com/cloudflare/workers-sdk/commit/fab565fdb1a912c73232d72ccdf1963fd96f9ad5)]:
  - miniflare\@&#8203;4.20260623.0

### [`v4.103.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41030)

[Compare Source](https://github.com/cloudflare/workers-sdk/compare/[email protected]@4.103.0)

##### Minor Changes

- [#&#8203;14295](https://github.com/cloudflare/workers-sdk/pull/14295) [`cfd6205`](https://github.com/cloudflare/workers-sdk/commit/cfd6205fe86f6afd74b5881f09524c93c83b8359) Thanks [@&#8203;dario-piotrowicz](https://github.com/dario-piotrowicz)! - Move `unstable_getWorkerNameFromProject` from wrangler to `@cloudflare/workers-utils`

  The `unstable_getWorkerNameFromProject` export has been removed from the `wrangler` package. This function is now available as `getWorkerNameFromProject` (without the `unstable_` prefix) from `@cloudflare/workers-utils`. If you were importing this function from `wrangler`, update your import to use `@cloudflare/workers-utils` instead.

- [#&#8203;14295](https://github.com/cloudflare/workers-sdk/pull/14295) [`cfd6205`](https://github.com/cloudflare/workers-sdk/commit/cfd6205fe86f6afd74b5881f09524c93c83b8359) Thanks [@&#8203;dario-piotrowicz](https://github.com/dario-piotrowicz)! - Remove experimental autoconfig exports

  The experimental autoconfig exports (`experimental_getDetailsForAutoConfig`, `experimental_runAutoConfig`, `experimental_AutoConfigFramework`) have been removed. This logic has been moved to the `@cloudflare/autoconfig` package (without the `experimental_` prefixes since the package itself is pre-v1).

##### Patch Changes

- [#&#8203;14366](https://github.com/cloudflare/workers-sdk/pull/14366) [`c6579d3`](https://github.com/cloudflare/workers-sdk/commit/c6579d30bd6fd7705fe3f10c7655d74a0476df86) Thanks [@&#8203;jamesopstad](https://github.com/jamesopstad)! - Resolve relative `cf-worker` entrypoint imports relative to the importing module

  When loading the experimental `cloudflare.config.ts`, a relative entrypoint imported with `import ... with { type: "cf-worker" }` (e.g. `./src/index.ts`) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.

  Bare specifiers (such as `@scope/pkg`) and virtual modules (such as `virtual:foo`) are still left unresolved so that consumers can apply their own resolution.

- [#&#8203;14316](https://github.com/cloudflare/workers-sdk/pull/14316) [`444b75e`](https://github.com/cloudflare/workers-sdk/commit/444b75e75492738d10e7dc89ec645f7e2fad6b97) Thanks [@&#8203;matingathani](https://github.com/matingathani)! - Prevent `wrangler dev` crash when source-mapping a truncated error chunk

  When a worker logs many errors in quick succession, the stderr chunks received by `wrangler dev` can be truncated mid-stack-frame, leaving a call site with an invalid column number. The source map library throws in that case, which was crashing the wrangler process entirely. The error is now caught and the original (un-source-mapped) text is returned instead.

- [#&#8203;14118](https://github.com/cloudflare/workers-sdk/pull/14118) [`b38823f`](https://github.com/cloudflare/workers-sdk/commit/b38823fb35a8bdcd00004e74404ab18d7b070dbf) Thanks [@&#8203;aicayzer](https://github.com/aicayzer)! - Fix `Uint8Array` step outputs in local Workflows being persisted with the full backing `ArrayBuffer`

  A `Uint8Array` returned from a Workflows step under `wrangler dev` was serialised together with its full underlying `ArrayBuffer`, causing a raw `SQLITE_TOOBIG` error at view sizes well below the documented 1MiB step-output limit. For example, a 200KB view sliced from an 800KB buffer (a common pattern from `crypto.getRandomValues` or `arr.slice(...)` on a larger pool) would fail. The view's bytes are now copied to a tight buffer before persistence, bringing local behaviour in line with production. Fixes [#&#8203;14101](https://github.com/cloudflare/workers-sdk/issues/14101).

- Updated dependencies \[[`b38823f`](https://github.com/cloudflare/workers-sdk/commit/b38823fb35a8bdcd00004e74404ab18d7b070dbf)]:
  - miniflare\@&#8203;4.20260617.1

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDYuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI0Ni4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/25

* Correct duplicate alert IDs (#26)

Correct an issue when there are two alerts with the same properties issued at the same time.  Previously we used the event name and issue date; now let's use event id and issue date as a unique identifier.  This corrects a svelte for_each issue when two alerts have the same index. Basically add the upstream index to keep alerts unique.

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/26

* Remove humidity check when calculating Heat Index. (#27)

It seems to clamp down in certain cases which isn't desireable.

Co-authored-by: Justin Settle <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/27

* chore(deps): update (#28)

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <[email protected]>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/28

* chore(deps): update all dependencies (#29)

* chore(deps): update (#30)

* chore(deps): update all dependencies (#31)

This PR contains the following updates:

| Package | Type | Update | Change | Pending | OpenSSF |
|---|---|---|---|---|---|
| [@sveltejs/kit](https://svelte.dev) ([source](https://github.com/sveltejs/kit/tree/HEAD/packages/kit)) | devDependencies | patch | [`2.69.1` → `2.69.2`](https://renovatebot.com/diffs/npm/@sveltejs%2fkit/2.69.1/2.69.2) | `2.69.3` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/kit/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/kit) |
| [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte) ([source](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte)) | devDependencies | minor | [`7.1.2` → `7.2.0`](https://renovatebot.com/diffs/npm/@sveltejs%2fvite-plugin-svelte/7.1.2/7.2.0) |  | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/vite-plugin-svelte/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/vite-plugin-svelte) |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | patch | [`25.9.4` → `25.9.5`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.4/25.9.5) |  | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
| [svelte-check](https://github.com/sveltejs/language-tools) | devDependencies | patch | [`4.7.1` → `4.7.2`](https://renovatebot.com/diffs/npm/svelte-check/4.7.1/4.7.2) |  | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/language-tools/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/language-tools) |
| [typescript](https://www.typescriptlang.org/) ([source](https://github.com/microsoft/TypeScript)) | devDependencies | major | [`6.0.3` → `7.0.2`](https://renovatebot.com/diffs/npm/typescript/6.0.3/7.0.2) |  | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/microsoft/TypeScript/badge)](https://securityscorecards.dev/viewer/?uri=github.com/microsoft/TypeScript) |
| [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | devDependencies | patch | [`8.1.3` → `8.1.4`](https://renovatebot.com/diffs/npm/vite/8.1.3/8.1.4) |  | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/vitejs/vite/badge)](https://securityscorecards.dev/viewer/?uri=github.com/vitejs/vite) |
| [wrangler](https://github.com/cloudflare/workers-sdk) ([source](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)) | devDependencies | minor | [`4.107.0` → `4.110.0`](https://renovatebot.com/diffs/npm/wrangler/4.107.0/4.110.0) |  | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cloudflare/workers-sdk/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cloudflare/workers-sdk) |

---

### Release Notes

<details>
<summary>sveltejs/kit (@&#8203;sveltejs/kit)</summary>

### [`v2.69.2`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2692)

[Compare Source](https://github.com/sveltejs/kit/compare/@sveltejs/[email protected]...@sveltejs/[email protected])

##### Patch Changes

- fix: set `define` values on `globalThis` when running Vitest ([#&#8203;16246](https://github.com/sveltejs/kit/pull/16246))

</details>

<details>
<summary>sveltejs/vite-plugin-svelte (@&#8203;sveltejs/vite-plugin-svelte)</summary>

### [`v7.2.0`](https://github.com/sveltejs/vite-plugin-svelte/blob/HEAD/packages/vite-plugin-svelte/CHANGELOG.md#720)

[Compare Source](https://github.com/sveltejs/vite-plugin-svelte/compare/@sveltejs/[email protected]...@sveltejs/[email protected])

##### Minor Changes

- feat(inspector): add a context menu with current component stack ([#&#8203;1370](https://github.com/sveltejs/vite-plugin-svelte/pull/1370))

### [`v7.1.4`](https://github.com/sveltejs/vite-plugin-svelte/blob/HEAD/packages/vite-plugin-svelte/CHANGELOG.md#714)

[Compare Source](https://github.com/sveltejs/vite-plugin-svelte/compare/@sveltejs/[email protected]...@sveltejs/[email protected])

##### Patch Changes

- fix: enforce ltr styles for inspector ([#&#8203;1324](https://github.com/sveltejs/vite-plugin-svelte/pull/1324))

### [`v7.1.3`](https://github.com/sveltejs/vite-plugin-svelte/blob/HEAD/packages/vite-plugin-svelte/CHANGELOG.md#713)

[Compare Source](https://github.com/sveltejs/vite-plugin-svelte/compare/@sveltejs/[email protected]...@sveltejs/[email protected])

##### Patch Changes

- fix: ensure the inspector is injected into the client correctly for Vite+ projects ([#&#8203;1355](https://github.com/sveltejs/vite-plugin-svelte/pull/1355))

</details>

<details>
<summary>sveltejs/language-tools (svelte-check)</summary>

### [`v4.7.2`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.2)

[Compare Source](https://github.com/sveltejs/language-tools/compare/[email protected]@4.7.2)

##### Patch Changes

- fix: resolve tsgo bin path with package.json ([#&#8203;3074](https://github.com/sveltejs/language-tools/pull/3074))

- fix: report tsconfig errors in --tsgo-experimental-api ([#&#8203;3070](https://github.com/sveltejs/language-tools/pull/3070))

</details>

<details>
<summary>microsoft/TypeScript (typescript)</summary>

### [`v7.0.2`](https://github.com/microsoft/TypeScript/compare/v6.0.3...2bd066d87f5bafd315be9f40889d0a60b9e58e0b)

[Compare Source](https://github.com/microsoft/TypeScript/compare/v6.0.3...2bd066d87f5bafd315be9f40889d0a60b9e58e0b)

</details>

<details>
<summary>vitejs/vite (vite)</summary>

### [`v8.1.4`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-814-2026-07-09-small)

[Compare Source](https://github.com/vitejs/vite/compare/v8.1.3...v8.1.4)

##### Features

- **legacy:** prefer oxc as minifier (fix [#&#8203;21973](https://github.com/vitejs/vite/issues/21973)) ([#&#8203;22468](https://github.com/vitejs/vite/issues/22468)) ([ab5dafa](https://github.com/vitejs/vite/commit/ab5dafa8e66296ef201f615489fb57954bb740ce))

##### Bug Fixes

- **build:** add workaround for building on stackblitz ([#&#8203;22840](https://github.com/vitejs/vite/issues/22840)) ([575c32c](https://github.com/vitejs/vite/commit/575c32c29925c554f4ef4068738ab89c6878f615))
- **build:** keep `import.meta.url` in preload function as-is ([#&#8203;22839](https://github.com/vitejs/vite/issues/22839)) ([f1f90ed](https://github.com/vitejs/vite/commit/f1f90ed4742b3cf453428c7e581a6016a4d47321))
- **deps:** update all non-major dependencies ([#&#8203;22865](https://github.com/vitejs/vite/issues/22865)) ([d4295a9](https://github.com/vitejs/vite/commit/d4295a9ffce428c0e51892373e00c07fccc0498a))
- **deps:** update rolldown-related dependencies ([#&#8203;22866](https://github.com/vitejs/vite/issues/22866)) ([7cf07e4](https://github.com/vitejs/vite/commit/7cf07e4c5f7a6af276012e0c2ec06e08499e951e))
- **html:** avoid backtracking in import-only check ([#&#8203;22848](https://github.com/vitejs/vite/issues/22848)) ([b5868c0](https://github.com/vitejs/vite/commit/b5868c01a124d345664450aaebd677bfba964c05))
- **optimizer:** avoid optimizer run for transform request before init ([#&#8203;22852](https://github.com/vitejs/vite/issues/22852)) ([72a5e21](https://github.com/vitejs/vite/commit/72a5e2192506f51a5efd09c059815a5c43a9eacb))
- **ssr:** align named export function call stacktrace column with Node ([#&#8203;22829](https://github.com/vitejs/vite/issues/22829)) ([173a1b6](https://github.com/vitejs/vite/commit/173a1b648c321e0f836e5a94fc47c4fa9b081bfc))
- strip pure CSS chunk imports when chunkImportMap is enabled ([#&#8203;22841](https://github.com/vitejs/vite/issues/22841)) ([648bd04](https://github.com/vitejs/vite/commit/648bd04933093d0aac9565f21a49811437776886))

##### Documentation

- fix incorrect `@default` for `server.cors` ([#&#8203;22859](https://github.com/vitejs/vite/issues/22859)) ([70435b2](https://github.com/vitejs/vite/commit/70435b2551ee4fe3a0d55c8a3bb61b96f44d2763))

##### Miscellaneous Chores

- **deps:** update dependency postcss-modules to v9 ([#&#8203;22867](https://github.com/vitejs/vite/issues/22867)) ([a9539d6](https://github.com/vitejs/vite/commit/a9539d69efc7a4ccf988bbf5da31c2b416ba990e))

##### Code Refactoring

- eliminate ineffectiveDynamicImport warn ([#&#8203;22876](https://github.com/vitejs/vite/issues/22876)) ([ea22fb3](https://github.com/vitejs/vite/commit/ea22fb352aad9a42c0a9d08f39d8a0bae8c111a5))

##### Tests

- avoid warnings ([#&#8203;22851](https://github.com/vitejs/vite/issues/22851)) ([af21ab6](https://github.com/vitejs/vite/commit/af21ab68adac3380dc9a854d2fe3f776654301cd))

##### Build System

- remove the custom onLog function ([#&#8203;22878](https://github.com/vitejs/vite/issues/22878)) ([2c4a217](https://github.com/vitejs/vite/commit/2c4a217a63dc0a7fcb10bc710a988f32b173f481))
- replace deprecated `onwarn` with `onLog` ([#&#8203;22741](https://github.com/vitejs/vite/issues/22741)) ([c581b55](https://github.com/vitejs/vite/commit/c581b5588cb8e94603d17bce2ff9fec8e8e0a3bf))

</details>

<details>
<summary>cloudflare/workers-sdk (wrangler)</summary>

### [`v4.110.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41100)

[Compare Source](https://github.com/cloudflare/workers-sdk/compare/[email protected]@4.110.0)

##### Minor Changes

- [#&#8203;14591](https://github.com/cloudflare/workers-sdk/pull/14591) [`0283a1f`](https://github.com/cloudflare/workers-sdk/commit/0283a1fcdc635244f731010422e513e8b4ab0be3) Thanks [@&#8203;dario-piotrowicz](https://github.com/dario-piotrowicz)! - Send npm package dependency metadata with worker uploads

  Wrangler now collects npm package dependency information from the project's `package.json` at deploy and version upload time, and includes it in the upload metadata sent to the Cloudflare API. This enables dependency analytics and future features like vulnerability alerting.

  The collected data includes the package name, the version constraint from `package.json`, and the exact installed version from `node_modules`. Both `dependencies` and `devDependencies` are included, while workspace packages, local packages, and unresolvable packages are excluded. The list is capped at 200 entries per upload.

  To opt out, set `dependencies_instrumentation.enabled` to `false` in your Wrangler configuration file:

  ```json
  {
    "dependencies_instrumentation": {
      "enabled": false
    }
  }
  ```

- [#&#8203;14535](https://github.com/cloudflare/workers-sdk/pull/14535) [`1b965c5`](https://github.com/cloudflare/workers-sdk/commit/1b965c51babff16ae7657335d93badebd50c310f) Thanks [@&#8203;Naapperas](https://github.com/Naapperas)! - Support dynamic retry delays for Workflow steps in local dev

  A step's `retries.delay` can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives `{ ctx, error }` and returns a delay (a number of milliseconds or a duration string like `"30 seconds"`), and its result is fed into the configured `backoff`.

  ```js
  await step.do(
    "call flaky API",
    {
      retries: {
        limit: 5,
        backoff: "constant",
        delay: ({ ctx }) => ctx.attempt * 1000,
      },
    },
    async () => {
      /* ... */
    }
  );
  ```

  The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

##### Patch Changes

- [#&#8203;14589](https://github.com/cloudflare/workers-sdk/pull/14589) [`7b28392`](https://github.com/cloudflare/workers-sdk/commit/7b2839290a707e7ee22dde17de68116e88f8a2dc) Thanks [@&#8203;jamesopstad](https://github.com/jamesopstad)! - Fix runtime type caching when `wrangler dev` auto-regenerates types

  When `dev.generate_types` (or `wrangler dev --types`) regenerated an out-of-date `worker-configuration.d.ts`, the written file omitted the `// Begin runtime types` marker (and the `/* eslint-disable */` header) that `wrangler types` writes. As a result, later runs could not detect the cached runtime types and always regenerated them. The auto-regenerated file now matches `wrangler types` output, restoring the cache.

- Updated dependencies \[[`1b965c5`](https://github.com/cloudflare/workers-sdk/commit/1b965c51babff16ae7657335d93badebd50c310f)]:
  - miniflare\@&#8203;4.20260708.1

### [`v4.109.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41090)

[Compare Source](https://github.com/cloudflare/workers-sdk/compare/[email protected]@4.109.0)

##### Minor Changes

- [#&#8203;14489](https://github.com/cloudflare/workers-sdk/pull/14489) [`e3f0cd6`](https://github.com/cloudflare/workers-sdk/commit/e3f0cd69e08c0eed9d75f61221d1076b6c287eef) Thanks [@&#8203;edmundhung](https://github.com/edmundhung)! - Add `listDurableObjectIds()` to `createTestHarness` Worker handles

  Tests using `createTestHarness` can now list persisted Durable Object instance IDs for a Durable Object binding. This helps integration tests discover objects created by app behavior without adding test-only endpoints.

- [#&#8203;14465](https://github.com/cloudflare/workers-sdk/pull/14465) [`2fedb1f`](https://github.com/cloudflare/workers-sdk/commit/2fedb1fc811efb3f7544c569e57383cabd4f14f8) Thanks [@&#8203;vaishnav-mk](https://github.com/vaishnav-mk)! - Add rollback support when terminating Workflow instances

  `WorkflowInstance.terminate({ rollback: true })` now runs registered rollback handlers before marking a local Workflow instance as terminated. Wrangler also supports this via `wrangler workflows instances terminate --rollback`, including local mode.

  The rollback option is only sent for terminate operations and is rejected by the Local Explorer API for pause, resume, and restart actions.

- [#&#8203;14511](https://github.com/cloudflare/workers-sdk/pull/14511) [`17d2fc1`](https://github.com/cloudflare/workers-sdk/commit/17d2fc12989f72a2fcd42e62fb152f270d61ab38) Thanks [@&#8203;juleslemee](https://github.com/juleslemee)! - Add `wrangler turnstile widget` commands for managing Turnstile widgets

  You can now create, list, inspect, update, and delete Turnstile widgets from the CLI:

  ```
  wrangler turnstile widget create <name> --domain example.com --mode managed
  wrangler turnstile widget list
  wrangler turnstile widget get <sitekey>
  wrangler turnstile widget update <sitekey> --name "Renamed"
  wrangler turnstile widget delete <sitekey>
  ```

  All five subcommands accept `--json` for machine-readable output (`get` prints a formatted view by default; the rest print a short human summary). `--domain` accepts comma-separ…
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sheplu sheplu sheplu approved these changes
+1 more reviewer
@bjohansebas bjohansebas bjohansebas approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@blakeembrey @sheplu @bjohansebas