[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/vitest-plugin (source)	1.4.12 → 1.5.0
@tailwindcss/postcss (source)	4.3.3 → 4.3.4
@vitest/coverage-v8 (source)	5.0.5 → 5.1.0
eslint-config-next (source)	16.4.3 → 16.4.4
minimatch	11.0.3 → 11.0.4
next (source)	16.4.3 → 16.4.4
tailwindcss (source)	4.3.3 → 4.3.4
vitest (source)	5.0.5 → 5.1.0
wrangler (source)	4.156.1 → 4.156.2

---

Release Notes

cloudflare/workers-sdk (@​cloudflare/vitest-plugin)

v1.5.0

Compare Source

Minor Changes

• #​16424 1598fd3 Thanks @​edmundhung! - Promote experimental.newConfig to a stable config option

  The experimental experimental.newConfig option is now the stable config option. Pass config: true to cloudflareTest() to load your Worker's bindings, entrypoint and compatibility settings from cloudflare.config.ts in the project root, or pass the path of a cloudflare.config.ts elsewhere:

  cloudflareTest({ config: true });
  cloudflareTest({ config: "./worker/cloudflare.config.ts" });

  config can't be combined with wrangler. miniflare options are merged over the Worker from cloudflare.config.ts, with miniflare values taking precedence. Config functions receive Vitest's mode as ctx.mode, which defaults to test and can be changed with --mode.

  If you're moving from experimental.newConfig, secrets are now read from Vite's envDir instead of the directory containing cloudflare.config.ts, and remote bindings authenticate with cf instead of Wrangler.

Patch Changes

• #​16642 d38cb02 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-02

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16623 51bbf8b Thanks @​petebacondarwin! - Deprecate shared tooling helper exports from Miniflare

  Miniflare continues to export getNodeCompat, NodeJSCompatMode, and getFreshSourceMapSupport for compatibility. These exports are deprecated and now use the implementations in @cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:

  import {
    getNodeCompat,
    type NodeJSCompatMode,
  } from "@cloudflare/workers-utils/node-compat";
  import { getFreshSourceMapSupport } from "@cloudflare/workers-utils/sourcemap";

  Wrangler and the Cloudflare Vite and Vitest plugins now use the shared helpers directly. The helpers retain their behavior and can be imported without loading the Workers runtime.

  The deprecated Miniflare exports will be removed in a later release, allowing downstream tools such as cf to migrate and release independently first.

• Updated dependencies [d38cb02, d38cb02, 51bbf8b, e5b1798]:

  • miniflare@5.20261102.0-beta
  • wrangler@​4.156.2

tailwindlabs/tailwindcss (@​tailwindcss/postcss)

v4.3.4

Compare Source

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#​20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#​20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#​20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#​20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#​20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#​20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#​20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#​20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#​20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#​20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#​20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#​20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#​20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#​20408)
• Drop invalid UTF-8 candidates during class detection (#​20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#​20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#​20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#​20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#​20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#​20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#​20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#​20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#​20508)
• Improve style invalidation performance of group-* and peer-* variants (#​20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#​20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#​20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#​20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#​20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#​20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#​20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#​20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#​20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#​20547, #​20572)
• Underline the correct occurrence of an unsupported data type in --value(…) warnings (#​20554)
• Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#​20540)
• Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#​20574)
• Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#​20576)
• Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#​20575)
• Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#​20577)
• Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#​20558)
• Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#​20486)
• Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#​20578)
• Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#​20582)
• Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#​20593)
• Decode single-digit hexadecimal escapes in theme variable and @utility names as the CSS spec does (e.g. @theme { --color-\0: red; } no longer registers --color-0) (#​20591)
• Don't treat !important inside strings, comments or url() in declaration values as the important flag (e.g. content: "a !important b") (#​20627)
• Parse a custom property at the end of the input when it has no trailing ; (e.g. --foo: bar as the last declaration) (#​20653)
• Keep a declaration without a ; at the end of the CSS input (e.g. color: red) (#​20655)

vitest-dev/vitest (@​vitest/coverage-v8)

v5.1.0

Compare Source

   🚀 Features

• Add --last-failed to run only failed tests  -  by @​sheremet-va in #​11558 (82f63)
• Support Temporal.Instant and Temporal.ZonedDateTime in vi.setSystemTime()  -  by @​Prajwal2246, Prajwal2246, Claude Opus 5.5 (1M context), @​hi-ogawa and Codex (GPT-6) in #​11321 (f150f)
• Introduce --since-last-run flag  -  by @​sheremet-va in #​11516 (08bd9)
• Expose per-retry/repeat attempt result  -  by @​hi-ogawa, Codex (GPT-6) and Claude Opus 5.5 (1M context) in #​11232 (21be4)
• Support fake timers for node:timers and node:timers/promise  -  by @​hi-ogawa, OpenCode and Codex (GPT-6) in #​10899 (fbe97)
• Allow coverage providers to store data in fs module cache  -  by @​AriPerkkio in #​11747 (54a2b)
• Interactively review failed snapshots  -  by @​macarie and @​hi-ogawa in #​11325 (54e5b)
• browser:
  • Mock modules through an import map  -  by @​sheremet-va in #​11534 (707f8)
  • Drop experimental label from trace view  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11518 (44c3c)
  • Introduce experimental pointer API  -  by @​macarie in #​10780 (5dc09)
  • Capture aria snapshot in trace view  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11492 (0cc39)
  • Show trace steps timeline on terminal on test failure  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11594 (973dc)
  • Add failure-only trace view mode  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11612 (d5d7d)
  • Enable failure-only trace view by default  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11766 (f37b6)
• coverage:
  • V8 to support ignoreNode option  -  by @​erickserra and @​AriPerkkio in #​11688 (e02db)
• experimental:
  • Add trace timeline for node  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11753 (4e985)
  • Add message option to vi.waitFor and vi.waitUntil  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11754 (fd145)

   🐞 Bug Fixes

• Rerun setup files after --changed filtering  -  by @​sheremet-va in #​11621 (3a39c)
• Return the mock to concurrent imports  -  by @​sheremet-va in #​11623 (1453b)
• Don't fail on console log pending at teardown  -  by @​sheremet-va in #​11619 (a60b8)
• Reference chai types in every d.ts chunk  -  by @​sheremet-va in #​11618 (fb150)
• Detect mock factory cycles that form later  -  by @​sheremet-va in #​11642 (e9554)
• Skip fs module cache for typed import.meta.glob  -  by @​sheremet-va in #​11666 (79501)
• Run tests that import a deleted file  -  by @​sheremet-va in #​11669 (80aa1)
• Keep syntax highlighting in code frames  -  by @​sheremet-va in #​11705 (d39f5)
• Respect CLI filters when prewarming browsers  -  by @​sheremet-va and Benjamin Tang in #​11706 (10947)
• Read cached source as utf-8  -  by @​juan-fernandez in #​11682 and #​11709 (867a5)
• Inherit watch from the root config in projects  -  by @​nstepien and Claude Opus 5.5 (1M context) in #​11724 (77c12)
• Prefix expect.poll message to all errors  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11756 (cab58)
• Support api.port 0  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11641 (3667c)
• Show attempts in test error logs of retried tests  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11696 (77a94)
• Preserve rootDir in project paths  -  by @​btea in #​11816 (bf96d)
• browser:
  • Change default port to 23315  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11640 (a2ec4)
  • Advance fake timers in actions and expect.element  -  by @​julienw, @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11242 (68190)
  • Drop trace view warning without html reporter  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11665 (e6407)
  • Detect shared chunks via the optimizer  -  by @​sheremet-va in #​11661 (e2e9c)
  • Clear screenshot stability timeout  -  by @​sheremet-va in #​11659 (fbe37)
  • Measure prepare duration with one clock  -  by @​sheremet-va in #​11667 (a3ed4)
  • Keep failure screenshot per attempt  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11694 (a5022)
  • Print trace timeline of each attempt  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11695 (27229)
  • Don't hang in page.viewport()  -  by @​sheremet-va in #​11738 (49ff4)
  • Skip trace entries after their attempt ended  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11771 (7a56f)
  • Focus the iframe before clicking in playwright  -  by @​sheremet-va in #​11798 (eb20a)
  • Fail the run when a tester cannot connect  -  by @​sheremet-va in #​11802 (605bf)
  • Treat edge as chromium in toHaveStyle  -  by @​aliamanatali in #​11813 (f4dd9)
• cache:
  • Handle concurrent cache clearing  -  by @​7rulnik in #​11697 (09076)
  • Key module cache on the deps optimizer  -  by @​MO2k4 and Martin Oehlert in #​11775 (52485)
  • Do not fail when the cache dir is unwritable  -  by @​ezefernandezyf in #​11781 (274ab)
• cli:
  • Use camelCase for sinceLastRun help  -  by @​fengmk2 in #​11707 (5c674)
• coverage:
  • V8 autoAttachSubprocess to use .tmp directory  -  by @​AriPerkkio in #​11632 (de5af)
  • V8 to ignore Vite's generated CJS namespace import helper  -  by @​AriPerkkio in #​11676 (5901f)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in #​11637 (2b18e)
• expect:
  • Keep soft .resolves/.rejects error location  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11792 (42770)
• mocker:
  • Don't change the original prototype chain  -  by @​sheremet-va and Max Schwenk in #​11737 (cca42)
  • Use root mocks for linked packages  -  by @​sheremet-va in #​7708 and #​11739 (810ec)
• runner:
  • Don't drop throttled task updates  -  by @​sheremet-va in #​11795 (8e837)
• ui:
  • Escape search text in explorer highlight  -  by @​sheremet-va in #​11672 (3c6d6)
  • Fix html reporter crash when --bail cancels files  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11693 (36a5f)
  • Fix quirks mode in trace view replay  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11744 (b9b73)
  • Let coverage report follow UI color scheme  -  by @​AriPerkkio in #​11765 (59c2d)
  • Open trace view only for tests with a trace  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11770 (c022d)
• vm:
  • Strip hashbang before compiling CommonJS dependencies  -  by @​cwoebker in #​11731 (1a77c)
  • Keep node globals after teardown  -  by @​francesco-agnoletto in #​11380 and #​11681 (a57b4)
  • Reset fake timers after each test file  -  by @​francesco-agnoletto in #​11679 and #​11779 (78c46)
  • Keep assignable accessor globals writable in node environment  -  by @​MO2k4 and Martin Oehlert in #​11834 (a5ec3)

   🏎 Performance

• Reuse fsModuleCache in static collection  -  by @​sheremet-va in #​11622 (1766c)
• Cache setup/mock resolves in reused workers  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11760 (5de10)
• Don't refetch warm modules in reused runners  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11761 (4f135)
• browser:
  • Map only first frame for trace locations  -  by @​hi-ogawa and Claude Opus 5.5 (1M context) in #​11613 (a967d)
  • Disable WebSocketServer's allowSynchronousEvents  -  by @​nstepien in #​11794 (d4572)
• coverage:
  • Istanbul to use magic-string+rolldown for instrumentation  -  by @​AriPerkkio in #​11648 (2470b)
  • Istanbul to collect uncovered files in Promise.all  -  by @​AriPerkkio in #​11713 (f1092)
  • Istanbul to not store input source maps in coverage data  -  by @​AriPerkkio in #​11686 (2debb)
• expect:
  • Compare typed arrays in one loop  -  by @​sheremet-va in #​11658 (908eb)

    View changes on GitHub

vercel/next.js (eslint-config-next)

v16.4.4

Compare Source

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary. The announced security released for November will be published tomorrow.

Core Changes

• [lts-active] test: disable the reads fallback params after a client navigation deployment test (#​100668)
• [lts-active] Reload on missed Turbopack startup CSS updates (#​100619)
• [lts-active] Revert "Optimize strict module factory chunks (#​98421)" (#​100866)
• [lts-active] Emit the Turbopack shared-runtime bootstrap in the PPR resume so it gets the CSP nonce (#​100907)
• [lts-active] [ci] Pin deploy test deployments to Node.js 22.x (#​100886)
• [lts-active] fix(analyze): use route summaries as the analyzer route index (#​100974)
• [lts-active] Use fast-jwt instead of jsonwebtoken (#​100885)

Credits

Huge thanks to @​icyJoseph, @​mischnic, @​wbinnssmith, @​lukesandberg, and @​eps1lon for helping!

isaacs/minimatch (minimatch)

v11.0.4

Compare Source

cloudflare/workers-sdk (wrangler)

v4.156.2

Compare Source

Patch Changes

• #​16642 d38cb02 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-02

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16642 d38cb02 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20261101.1	^5.20261102.1
  workerd	1.20261101.1	1.20261102.1

• #​16623 51bbf8b Thanks @​petebacondarwin! - Deprecate shared tooling helper exports from Miniflare

  Miniflare continues to export getNodeCompat, NodeJSCompatMode, and getFreshSourceMapSupport for compatibility. These exports are deprecated and now use the implementations in @cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:

  import {
    getNodeCompat,
    type NodeJSCompatMode,
  } from "@cloudflare/workers-utils/node-compat";
  import { getFreshSourceMapSupport } from "@cloudflare/workers-utils/sourcemap";

  Wrangler and the Cloudflare Vite and Vitest plugins now use the shared helpers directly. The helpers retain their behavior and can be imported without loading the Workers runtime.

  The deprecated Miniflare exports will be removed in a later release, allowing downstream tools such as cf to migrate and release independently first.

• #​16531 e5b1798 Thanks @​dario-piotrowicz! - Avoid unrelated route permission checks when comparing dashboard configuration

  When a Worker was last updated from the dashboard, wrangler deploy and wrangler versions upload fetched route and custom-domain metadata even when the command could not change it. Wrangler now fetches only the route categories configured for deployment, allowing Worker-scoped Editor tokens to upload Workers without routes or custom domains.

• Updated dependencies [d38cb02, d38cb02, 51bbf8b]:

  • miniflare@5.20261102.0-beta

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.4.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-11-08T04_07_52_498Z-debug-0.log

[swu-wise]

@kody start-review

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.