build(deps-dev): bump the development-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the development-dependencies group with 6 updates in the / directory:

Package	From	To
@cloudflare/vite-plugin	1.54.1	1.54.7
@cloudflare/workers-types	5.20260828.1	5.20260910.1
eslint-config-next	16.3.3	16.3.4
react-server-dom-webpack	19.2.8	19.3.0
vite	8.2.2	8.3.0
wrangler	4.127.0	4.131.0

Updates @cloudflare/vite-plugin from 1.54.1 to 1.54.7

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.54.7

Patch Changes

• #15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• Updated dependencies [0b43395, 9d75006, b605aa6, f45b596, f69f95a, a549e58, 36aed7f, 493e635, bff525d, dbb3ff4, fea3cd0, 96688b3, 6bd7b6c, 15cd6e1, be1caec, ed5797a, dbc9506, 128235a, f8aea7e, 24ef86b]:

  • wrangler@4.131.0
  • miniflare@5.20260910.0-alpha

@​cloudflare/vite-plugin@​1.54.6

Patch Changes

• Updated dependencies [edb3631, dbf6aad, bcebf08, e20df20, e20df20, 63c7ff1, a4e41df]:
  • miniflare@5.20260908.0-alpha
  • wrangler@4.130.0

@​cloudflare/vite-plugin@​1.54.5

Patch Changes

• #15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

  When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

• Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

  • miniflare@5.20260907.0-alpha
  • wrangler@4.129.1

@​cloudflare/vite-plugin@​1.54.4

Patch Changes

• #15407 7662118 Thanks @​xgame92! - Surface Worker export type fetch errors during development

  The Vite plugin now reports the Worker name, HTTP status, and response body when fetching export types fails. This preserves the underlying error instead of replacing it with a JSON parsing error.

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6, 93d72a5, f6fb347, f6fb347, dc24057, d2d8eea]:

  • miniflare@5.20260903.0-alpha
  • wrangler@4.129.0

@​cloudflare/vite-plugin@​1.54.3

Patch Changes

• Updated dependencies [dbbb795, 200780f, b3f2628, 87a7acf, 1809c5e, ea28cc3, b3fb2bf, 707cb6f]:
  • wrangler@4.128.0
  • miniflare@5.20260831.0-alpha

@​cloudflare/vite-plugin@​1.54.2

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.54.7

Patch Changes

• #15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• Updated dependencies [0b43395, 9d75006, b605aa6, f45b596, f69f95a, a549e58, 36aed7f, 493e635, bff525d, dbb3ff4, fea3cd0, 96688b3, 6bd7b6c, 15cd6e1, be1caec, ed5797a, dbc9506, 128235a, f8aea7e, 24ef86b]:

  • wrangler@4.131.0
  • miniflare@5.20260910.0-alpha

1.54.6

Patch Changes

• Updated dependencies [edb3631, dbf6aad, bcebf08, e20df20, e20df20, 63c7ff1, a4e41df]:
  • miniflare@5.20260908.0-alpha
  • wrangler@4.130.0

1.54.5

Patch Changes

• #15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

  When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

• Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

  • miniflare@5.20260907.0-alpha
  • wrangler@4.129.1

1.54.4

Patch Changes

• #15407 7662118 Thanks @​xgame92! - Surface Worker export type fetch errors during development

  The Vite plugin now reports the Worker name, HTTP status, and response body when fetching export types fails. This preserves the underlying error instead of replacing it with a JSON parsing error.

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6, 93d72a5, f6fb347, f6fb347, dc24057, d2d8eea]:

  • miniflare@5.20260903.0-alpha
  • wrangler@4.129.0

1.54.3

Patch Changes

• Updated dependencies [dbbb795, 200780f, b3f2628, 87a7acf, 1809c5e, ea28cc3, b3fb2bf, 707cb6f]:
  • wrangler@4.128.0

... (truncated)

Commits

• 41d7366 Version Packages (#15568)
• 36aed7f CC-8364 Add top-level Durable Object-managed Containers (#15480)
• 5705262 Version Packages (#15555)
• 87fd28c Revert "graduate miniflare v5" (#15551)
• 7f14caa Version Packages (#15510)
• e004845 [vite-plugin-cloudflare] fix: preserve :authority and port in HTTP/2 requests...
• be87ff0 Version Packages (#15461)
• 7662118 [vite-plugin-cloudflare] Surface export type fetch errors (#15407)
• b7b4ff8 Version Packages (#15450)
• 10d6bfb Support partial manifests in build output (#15388)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260828.1 to 5.20260910.1

Commits

• See full diff in compare view

Updates eslint-config-next from 16.3.3 to 16.3.4

Release notes

Sourced from eslint-config-next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits

• 299180d v16.3.4
• See full diff in compare view

Updates react-server-dom-webpack from 19.2.8 to 19.3.0

Release notes

Sourced from react-server-dom-webpack's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)

... (truncated)

Changelog

Sourced from react-server-dom-webpack's changelog.

19.3.0 (September 9, 2026)

New React Features

• <ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@​sebmarkbage, @​jackpope, @​gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)
• Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@​jackpope, @​sebmarkbage, @​eps1lon, @​Dhakshin2007, @​chirokas, @​teamleaderleo, @​fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

• browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@​gnoff: #37143, #37241)
  • Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@​gnoff #37193)

Notable changes

• Enable Trusted Types API integration (@​rickhanlonii #35816)
• Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@​acdlite #37290)
• Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@​hoxyq, @​eps1lon: #37104, #37203, #37491)

All Changes

React

• Fast Refresh Fixes
  • Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@​sophiebits #36965)
  • Fix Fast Refresh so edits to a memo() comparison function take effect (@​sophiebits #36964)
  • Fix Fast Refresh crash when an edit changes the kind of a component's type (@​sophiebits #36963)
  • Unify hot reload type resolution for Fast Refresh (@​sophiebits #36962)
  • Fix Fast Refresh to remount correctly when an edit changes the component kind (@​sophiebits #36950)
  • Double invoke effects in StrictMode after Fast Refresh (@​eps1lon #35962)
• Performance Track Fixes
  • Prevent crash when accessing $$typeof in Performance Tracks (@​eps1lon #35679)
  • Handle non-string function names in Performance Tracks (@​eps1lon #35659)
  • Use minus (-) instead of en dash for removed props in Performance Tracks (@​eps1lon #35649)
  • Handle arrays with bigints in deep objects in Performance Tracks (@​eps1lon #35648)
  • Don't enumerate typed array props in Performance Tracks in DEV (@​UditDewan #36913)
  • Bail out of diffing wide objects and arrays in Performance Tracks (@​eps1lon #34742)
  • Clear potentially large performance measures in DEV (@​hoxyq #34803)
  • Fix missing else branch for renders with no props change in Performance Tracks (@​hoxyq #34837)
• Activity Fixes
  • Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@​sophiebits #36947)
  • Hide portal contents when an Activity is hidden (@​acdlite #35091)
  • Prevent metadata hoisting in hidden <Activity> trees (@​ronnakamoto #34983)
  • Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@​acdlite #35074)
  • Don't unhide a node if a direct parent Offscreen is still hidden (@​sebmarkbage #34821)
  • Don't show internal <Offscreen> component in error messages (@​rickhanlonii #35763)
• Warn in DEV when a component appears to have been unblocked by a conditional use() (@​hoxyq, @​eps1lon: #37104, #37203, #37491)
• Render transitions independently instead of entangling them into a single render (@​acdlite #37290)
• Fix hang when updating a dehydrated boundary inside a hidden tree (@​gaearon #37135)
• Don't reacquire Host Singletons during dev effect validation (@​gnoff #37113)
• Only remove properties from Host Singletons on release (@​gnoff #37112)

... (truncated)

Commits

• 6c0e104 [Flight] Keep an element pending while a referenced row is resolving (#37542)
• 8f00437 [Flight] Fix RangeError from exponential debug info growth (#37481)
• 2dc7da7 [test] Bump Jest to 30.4 (#37382)
• 3c397fe [test] Stop leaking mocked performance clocks into later test files (#37379)
• dc631ef [Flight] Outline and dedupe repeated strings (#37147)
• 055705c [Flight] Abort the cache signal when debug objects are retained (#37342)
• 77ed3f5 [Flight/Fizz] Stop the caller's signal from retaining a finished render (#37315)
• 8366f33 [Flight] Transfer key validation of lazy nodes when they are unwrapped (#37258)
• 9b5b4d5 [Flight] Add 'pending_weak' to Flight thenable protocol (#37154)
• 9ceb1e7 [Flight] Define Flight chunk .then with Object.defineProperty (#37109)
• Additional commits viewable in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules pat...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.