[dependabot]

Bumps the npm-dependencies group with 5 updates:

Package	From	To
@cloudflare/workers-types	5.20261019.1	5.20261023.1
postal-mime	4.0.11	4.1.4
wrangler	4.151.1	4.152.0
happy-dom	21.0.3	21.0.4
vite	8.3.4	8.3.5

Updates @cloudflare/workers-types from 5.20261019.1 to 5.20261023.1

Commits

• See full diff in compare view

Updates postal-mime from 4.0.11 to 4.1.4

Release notes

Sourced from postal-mime's releases.

v4.1.4

4.1.4 (2026-10-22)

Bug Fixes

• end the header block at the first line that is neither a field nor a fold (0018555)
• honour only the utf-16 charset labels Python or iconv-lite decode (4d96a49)
• honour only the utf-16 charset labels that Python and iconv-lite both decode (afbe5a9)
• keep a base64 or quoted-printable message/rfc822 part as an attachment (0e0582e)
• percent encode a mailto address in runs instead of one character at a time (dd73f5c)
• percent encode the mailto address in the demo (7da508e)
• read a multipart whose boundary holds a non-ASCII character as text/plain (a7d4dad)
• read the transfer encoding token from the start of the value only (e66830a)
• reject a maxPartCount of zero as an invalid option (35bde9d)
• render the dates of forwarded headers with one shared formatter (ca27168)
• unfold format=flowed text in a text/plain part only (336378a)

v4.1.3

4.1.3 (2026-10-21)

Bug Fixes

• honour a byte order mark only under a utf-16 label that leaves the order open (db9a6ce)

v4.1.2

4.1.2 (2026-10-21)

Bug Fixes

• copy the characters of a structured header as runs instead of one at a time (f0edeee)

v4.1.1

4.1.1 (2026-10-21)

Bug Fixes

• decode a charset of the replacement encoding to the replacement character (0624f77)
• drop a script or style body holding any line terminator from the text of an html part (78e00e6)
• keep the whitespace around a field name in its key (8b79d3e)
• let a byte order mark decide the byte order under a utf-16 label (0624f77)
• match a boundary line against the outermost open boundary first (a2083ec)
• match the Content-Transfer-Encoding token whole, so x-base64 decodes nothing (8b79d3e)
• never read a mailbox out of an encoded word (e06badb)
• percent-encode the address of a mailto link in a rendered forwarded header (78e00e6)
• read the Content-Disposition type up to the first whitespace (8b79d3e)
• render the text of inline forwards once, at the root parser (a2083ec)

... (truncated)

Changelog

Sourced from postal-mime's changelog.

4.1.4 (2026-10-22)

Bug Fixes

• end the header block at the first line that is neither a field nor a fold (0018555)
• honour only the utf-16 charset labels Python or iconv-lite decode (4d96a49)
• honour only the utf-16 charset labels that Python and iconv-lite both decode (afbe5a9)
• keep a base64 or quoted-printable message/rfc822 part as an attachment (0e0582e)
• percent encode a mailto address in runs instead of one character at a time (dd73f5c)
• percent encode the mailto address in the demo (7da508e)
• read a multipart whose boundary holds a non-ASCII character as text/plain (a7d4dad)
• read the transfer encoding token from the start of the value only (e66830a)
• reject a maxPartCount of zero as an invalid option (35bde9d)
• render the dates of forwarded headers with one shared formatter (ca27168)
• unfold format=flowed text in a text/plain part only (336378a)

4.1.3 (2026-10-21)

Bug Fixes

• honour a byte order mark only under a utf-16 label that leaves the order open (db9a6ce)

4.1.2 (2026-10-21)

Bug Fixes

• copy the characters of a structured header as runs instead of one at a time (f0edeee)

4.1.1 (2026-10-21)

Bug Fixes

• decode a charset of the replacement encoding to the replacement character (0624f77)
• drop a script or style body holding any line terminator from the text of an html part (78e00e6)
• keep the whitespace around a field name in its key (8b79d3e)
• let a byte order mark decide the byte order under a utf-16 label (0624f77)
• match a boundary line against the outermost open boundary first (a2083ec)
• match the Content-Transfer-Encoding token whole, so x-base64 decodes nothing (8b79d3e)
• never read a mailbox out of an encoded word (e06badb)
• percent-encode the address of a mailto link in a rendered forwarded header (78e00e6)
• read the Content-Disposition type up to the first whitespace (8b79d3e)
• render the text of inline forwards once, at the root parser (a2083ec)
• trim trailing whitespace off a boundary parameter, as Python does (8b79d3e)

4.1.0 (2026-10-21)

... (truncated)

Commits

• d96e201 chore(master): release 4.1.4 (#121)
• c93049e docs: note that whitespace before the colon keeps a line a header
• afbe5a9 fix: honour only the utf-16 charset labels that Python and iconv-lite both de...
• faf1be5 docs: state that maxPartCount must be positive
• a29b895 test: consolidate the header block and utf-16 label tests
• dd0c2ec refactor: drop the whitespace-only line bookkeeping the header block rule sub...
• 060083d refactor: resolve the utf-16 charset labels through one table of their own
• fa4bbf0 refactor: encode a mailto address with one replace over its unsafe runs
• b4c129e docs: describe how a malformed message is read and which attachment fields ar...
• 33c4fc9 test: measure dated inline forwards and a long percent-encoded forwarded address
• Additional commits viewable in compare view

Updates wrangler from 4.151.1 to 4.152.0

Release notes

Sourced from wrangler's releases.

wrangler@4.151.3

Patch Changes

• #15611 4508172 Thanks @​taylorlee! - Allow wrangler dev to start module Workers without a default export

  Previously, wrangler dev failed to start module Workers that exported only named entrypoints, such as RPC services, unless an unused default export was added. These Workers now start normally in local development without that workaround.

• #16370 61fc739 Thanks @​WalshyDev! - Fetch the remote config diff from the configured compliance region

  When a Worker was last deployed from the dashboard, wrangler deploy and wrangler versions upload download its remote configuration to compare with the local one. These requests ignored the compliance_region field in the Wrangler configuration file and only honoured the CLOUDFLARE_COMPLIANCE_REGION environment variable. A FedRAMP High Worker configured through the config file would send them to api.cloudflare.com instead of api.fed.cloudflare.com, and the deploy would fail with authentication errors. They now use the same compliance region as the rest of the deploy.

• #15846 a88cac4 Thanks @​oddharsh! - Fail with an error instead of hanging when local dev requests can't work under Bun

  Bun's fetch() ignores the undici dispatcheroven-sh/bun#39247createTestHarness()'s server.fetch() and server.getWorker()'s fetch(), email() and scheduled() now throw a UserError, requests to the dev server URL get a 503 naming the cause, and starting remote bindings throws a UserError. Each of these used to hang with no error. server.getWorker().getEnv() and getExport() keep working under Bun.

• #16359 262021d Thanks @​tw4! - Stop --strict deploys and version uploads from aborting when the API omits optional binding fields

  Previously, wrangler deploy --strict and wrangler versions upload --strict could report a destructive change for an unchanged configuration, for example an R2 bucket in the default jurisdiction, because a field the API left out was compared as removed. Missing and unset optional fields are now treated as equal, so these commands proceed when the local configuration matches the deployed Worker.

• Updated dependencies [3464abc]:

  • miniflare@5.20261019.1-beta

wrangler@4.151.2

Patch Changes

• #16307 37ab91c Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261006.1	^5.20261016.1
  workerd	1.20261012.1	1.20261016.1

• #16352 0ae7926 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261016.1	^5.20261019.1
  workerd	1.20261016.1	1.20261019.1

• Updated dependencies [37ab91c, 0ae7926]:

  • miniflare@5.20261019.0-beta

Commits

• See full diff in compare view

Updates happy-dom from 21.0.3 to 21.0.4

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

Commits

• fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
• 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
• See full diff in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions