[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@better-auth/passkey (source)	^1.7.14 → ^1.7.20
@cloudflare/vitest-plugin (source)	1.4.11 → 1.8.0
@comark/nuxt (source)	^0.8.1 → ^0.9.1
@iconify-json/lucide	^1.2.149 → ^1.2.153
@iconify-json/simple-icons	^1.2.101 → ^1.2.102
@nuxt/test-utils	^4.3.4 → ^4.4.0
@playwright/test (source)	^1.64.1 → ^1.65.0
better-auth (source)	^1.7.14 → ^1.7.20
comark (source)	0.8.1 → 0.9.1
jose	^6.2.14 → ^6.2.17
nodemailer (source)	^10.3.1 → ^10.5.0
pnpm (source)	12.16.1 → 12.18.0
vitest (source)	^5.0.5 → ^5.1.0
vue (source)	^3.5.44 → ^3.5.45
wrangler (source)	4.156.0 → 4.160.1

---

Release Notes

better-auth/better-auth (@​better-auth/passkey)

v1.7.20

Compare Source

v1.7.19

Compare Source

v1.7.18

Compare Source

v1.7.17

Compare Source

Patch Changes

• #​12225 3ab3dbf Thanks @​bytaesu! - Passkey registration and sign-in now work when one passkey() plugin is shared between auth instances where some set baseURL and others do not. Previously one of the instances could fail with ORIGIN_NOT_CONFIGURED or verify against the other instance's origin settings.

v1.7.16

Compare Source

Patch Changes

• #​12198 f25081a Thanks @​bytaesu! - Passkey registration, device authorization, two-factor enrollment and verification, social account linking, and phone number changes now reject a session revoked in the database or secondary storage, even when cookie caching is enabled. Sessions created from API keys are refused on these routes, except two-factor enrollment and phone number changes.

• #​12198 f25081a Thanks @​bytaesu! - The expected WebAuthn origin now comes from server configuration instead of the request: the origin option, or the baseURL origin plus a frontend origin listed exactly in trustedOrigins. Set origin when rpID is set and a wildcard in baseURL.allowedHosts covers it.

• #​12198 f25081a Thanks @​bytaesu! - authenticatorSelection.userVerification now applies to authentication as well as registration: it is requested in authentication options, and with required passkey registration and sign-in reject responses without user verification.

v1.7.15

Compare Source

cloudflare/workers-sdk (@​cloudflare/vitest-plugin)

v1.8.0

Compare Source

Minor Changes

• #​16682 5966749 Thanks @​ghostwriternr! - Run the Containers that cloudflare.config.ts attaches to Durable Objects

  Previously, projects that load cloudflare.config.ts through the config option ran those Durable Objects without their Containers. The plugin now prepares the Containers' images and runs them, as it does for Wrangler configuration files. Dockerfile and build context paths are relative to the directory that contains cloudflare.config.ts.

  cloudflare.config.ts has no setting that disables local Containers, so, as with the Vite plugin, projects with Container-backed Durable Objects need Docker to run their tests.

Patch Changes

• #​16824 877b249 Thanks @​jamesopstad! - Move streaming tail consumers to experimental.streamingTailConsumers in cloudflare.config.ts

  Streaming Tail Workers are now declared in a separate, experimental list instead of with streaming: true on a tailConsumers entry. tailConsumers now only lists Tail Workers with a tail() handler. This is a breaking change to the experimental config API: move each entry that set streaming: true to experimental.streamingTailConsumers, without the streaming field.

  export default defineConfig({
    worker: {
      tailConsumers: [{ worker: "tail-worker" }],
      experimental: {
        streamingTailConsumers: [{ worker: "streaming-tail-worker" }],
      },
    },
  });

  Fields under experimental may change or be removed without a major version bump. The wrangler-to-cf codemod now converts streaming_tail_consumers to experimental.streamingTailConsumers.

• #​16734 c47cca7 Thanks @​matingathani! - Fix CommonJS dependencies being loaded as ES modules under Vitest 5 inline projects

  A dependency with its own "type": "commonjs" package.json was treated as an ES module when an earlier .js file elsewhere in the project had been classified by the project's "type": "module" package.json. The dependency then failed at import with errors such as Cannot set properties of undefined or exports is not defined. The nearest package.json now always decides how a .js file is loaded.

• Updated dependencies [877b249, 69e650c]:

  • miniflare@5.20261110.1-beta
  • wrangler@​4.160.1

v1.7.0

Compare Source

Minor Changes

• #​15695 d437be3 Thanks @​ghostwriternr! - Run the Containers that the Wrangler configuration attaches to Durable Objects

  Previously, the plugin disabled Containers, so those Durable Objects ran without ctx.container. The plugin now builds or pulls the Containers' images before each project's tests run and gives the Durable Objects a real ctx.container, so these projects now need Docker. To keep running their tests without Docker, set dev.enable_containers to false in the Wrangler configuration, which disables the Containers. Cloudflare-managed registry images are not supported yet.

Patch Changes

• #​16810 cdc970b Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-10

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• Updated dependencies [cb9534f, 6af492e, cdc970b, cdc970b, 4e7e9f1, 267dadb, 022ee9d, 44b39b0, 325dc69]:

  • wrangler@​4.160.0
  • miniflare@5.20261110.0-beta

v1.6.1

Compare Source

Patch Changes

• #​16793 fea323a Thanks @​vicb! - Bump capnp-es to 0.0.17

  This release fixes 3 issues. See the release notes for details.

• #​16683 6f29f97 Thanks @​jamesopstad! - Stop persisting account selections made by cf and the Cloudflare Vite and Vitest plugins

  Profiles continue to select credentials rather than accounts. If the active credentials can access one account, it is selected automatically. If they can access multiple accounts, cf and the Vite and Vitest plugins reuse the selection while running but ask again the next time they start. Configure accountId in cloudflare.config.ts or set the CLOUDFLARE_ACCOUNT_ID environment variable to avoid repeated prompts.

  Wrangler's existing persistent account selection remains unchanged.

• #​16648 56459a5 Thanks @​dario-piotrowicz! - Update bundled third-party dependencies with known security fixes

  Local development and Workers Vitest tests now include security fixes for their bundled dependencies. Local browser rendering also includes security fixes for browser downloads, archive extraction, and proxy support.

  Miniflare and Wrangler now require Node.js 22.12.0 or later, matching the supported runtime range of the new browser installer.

• #​16746 abf924e Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-06

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16792 de10016 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-09

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​15693 307a69a Thanks @​ghostwriternr! - Dispose Miniflare when a Vitest runtime fails to start

  Previously, a Miniflare instance whose startup failed was never disposed, so anything it had already started kept running. If disposal also fails, the original startup error is still reported.

• #​16699 cd24b27 Thanks @​matingathani! - Fix vi.mock() factories failing under Vitest 5.1

  Mock factories in vi.mock() now work when running tests with Vitest 5.1 and later. Previously, any test file that used a mock factory failed during import with asyncLocalStorage.disable() is not implemented.

• Updated dependencies [fea323a, a589d23, 56459a5, fe69809, abf924e, de10016, abf924e, de10016, 2fb01e7, dee7a1d, dc4e093, cff83d0, 3ef2afd, 4112820, 66bc0d6, cff83d0, 9b6582c, c64fdfb, 4112820]:

  • miniflare@5.20261109.0-beta
  • wrangler@​4.159.0

v1.6.0

Compare Source

Minor Changes

• #​16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

  Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

  In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

• #​16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

  These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

• #​16700 dc35efb Thanks @​cjol! - Bump bundled devalue from 5.6.3 to 5.9.3 to pick up security fixes

  devalue is bundled into these packages, which use it to serialise values between Node.js and workerd. Version 5.6.3 is affected by several published advisories, and 5.9.3 includes their fixes. Serialisation behaviour does not change.

• #​16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

  These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

• #​16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, fa3edb3, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:

  • wrangler@​4.158.0
  • miniflare@5.20261104.0-beta

v1.5.1

Compare Source

Patch Changes

• #​16670 b14b9dc Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16609 da26b7f Thanks @​gpanders! - Fix tests failing to start with resolve.preserveSymlinks in isolated node_modules layouts

  With resolve.preserveSymlinks: true in a pnpm project, tests failed to start with No such module ".../node_modules/vitest/dist/chai", because a package's own dependencies are linked only next to its real path. Packages linked from a store inside node_modules now load from their real paths, and other files keep their symlinked paths.

• Updated dependencies [b14b9dc, 44d1ee4, b14b9dc, d2eda1c, 2750917, 34f34b3]:

  • miniflare@5.20261103.0-beta
  • wrangler@​4.157.0

v1.5.0

Compare Source

Minor Changes

• #​16424 1598fd3 Thanks @​edmundhung! - Promote experimental.newConfig to a stable config option

  The experimental experimental.newConfig option is now the stable config option. Pass config: true to cloudflareTest() to load your Worker's bindings, entrypoint and compatibility settings from cloudflare.config.ts in the project root, or pass the path of a cloudflare.config.ts elsewhere:

  cloudflareTest({ config: true });
  cloudflareTest({ config: "./worker/cloudflare.config.ts" });

  config can't be combined with wrangler. miniflare options are merged over the Worker from cloudflare.config.ts, with miniflare values taking precedence. Config functions receive Vitest's mode as ctx.mode, which defaults to test and can be changed with --mode.

  If you're moving from experimental.newConfig, secrets are now read from Vite's envDir instead of the directory containing cloudflare.config.ts, and remote bindings authenticate with cf instead of Wrangler.

Patch Changes

• #​16642 d38cb02 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-02

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #​16623 51bbf8b Thanks @​petebacondarwin! - Deprecate shared tooling helper exports from Miniflare

  Miniflare continues to export getNodeCompat, NodeJSCompatMode, and getFreshSourceMapSupport for compatibility. These exports are deprecated and now use the implementations in @cloudflare/workers-utils. Add a dependency on that package and replace the Miniflare imports with:

  import {
    getNodeCompat,
    type NodeJSCompatMode,
  } from "@cloudflare/workers-utils/node-compat";
  import { getFreshSourceMapSupport } from "@cloudflare/workers-utils/sourcemap";

  Wrangler and the Cloudflare Vite and Vitest plugins now use the shared helpers directly. The helpers retain their behavior and can be imported without loading the Workers runtime.

  The deprecated Miniflare exports will be removed in a later release, allowing downstream tools such as cf to migrate and release independently first.

• Updated dependencies [d38cb02, d38cb02, 51bbf8b, e5b1798]:

  • miniflare@5.20261102.0-beta
  • wrangler@​4.156.2

v1.4.12

Compare Source

Patch Changes

• #​16635 76e18a8 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-01

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• Updated dependencies [effe4ed, 76e18a8, 76e18a8, 009ca6e, 5740867, d174de8, aece4df, 2667a9f, ed7fb41, f9dbb22]:

  • wrangler@​4.156.1
  • miniflare@5.20261101.0-beta

comarkdown/comark (@​comark/nuxt)

v0.9.1

Compare Source

v0.9.1 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements

• vue: ship the Nuxt module as @comark/vue/nuxt (#​576)

[!important]
If you are using @comark/nuxt, please migrate to modules: ['@comark/vue']

🩹 Fixes

• restrict object values in bound props (#​579)
• autoclose: do not close a word-internal * run paired after punctuation (#​498)
• render: number heading ids across components when rendering markdown (#​578)
• stringify: keep inline HTML comments inside their paragraph (#​501)

📖 Documentation

• add release-image component and playground template (#​573)
• fix formatting in title-description.md usage section (1beef610)

🎉 New Contributors

• Mochammad Fadhlan Al-Ghiffari (@​MFA-G)
• froQ (@​0froq)

❤️ Contributors

• Farnabaz (@​farnabaz)
• Mochammad Fadhlan Al-Ghiffari (@​MFA-G)
• Baptiste Leproux (@​larbish)
• Sébastien Chopin (@​atinux)
• froQ (@​0froq)

v0.9.0

Compare Source

v0.9.0 is the next major release.

👉 Changelog

⚠️ Breaking Changes

• linkify: linkify is now a default plugin and uses linkify-it 6, with fuzzy matching off by default. Bare domains (www.example.com) and user:pass@ URLs are no longer linked. Use linkify({ fuzzyLink: true, urlAuth: true }) to restore the old behavior. With registerDefaultPlugins: false, autolinking is now off. Upgraded markdown-exit to 2.1 (#​549)
• parser: removed the deprecated html option. Use registerDefaultPlugins: false and register html() yourself (#​557)
• html: HTML attribute values are now decoded the way browsers decode attributes (e.g. ?a=1&copy=2 stays as written) (#​511)
• utils: removed the decodeHTML re-export from comark/utils. textContent(node, { decodeUnicodeEntities }) is now textContent(node, { decodeHTML }), where you pass the decoder yourself (#​511)
• @​comark/html: @comark/html/render no longer re-exports all of comark/render. Import render, renderMarkdown, renderFrontmatter and resolveAttributes from comark/render or comark/utils. Output is always HTML, and components only get the html and comment handlers (#​517)

Deprecations

• The linkify parser option is deprecated in favor of registerDefaultPlugins with linkify() (#​549)
• The headings plugin is renamed to title-description, and its plugin name is now 'title-description' (#​554)
• renderMath(), validateMath() and MathConfig.throwOnError will be removed in next rmajor (#​510)

compare changes

🚀 Enhancements

• ⚠️ linkify: move to markdown-exit 2.1 and make linkify a default plugin (#​549)
• add transformNode render hook to every renderer (#​556)
• ⚠️ introduce comark/core and remove deprecated html option (#​557)
• plugins: add heading-links plugin (#​555)
• plugins: rename headings plugin to title-description (#​554)
• ⚠️ html: decode HTML attributes with attribute semantics, pluggable textContent decoder (#​511)
• html: add a smaller document renderer (#​517)
• math: parse \(…\) and \[…\] delimiters with brackets (#​515)

🔥 Performance

• react: reuse the parser during streaming (#​397)

🩹 Fixes

• stringify: fix renderMarkdown round-trip losses from #​525 (#​527)
• deps: pin nuxt to 4.6.3 to avoid devServer.host crash (#​560)
• auto-close: keep markdown-it-sub pairs unescaped (#​563)
• shiki: join classes that transformers add to lines (#​565)
• docs: resolve every comark dependency to the workspace (#​561)
• angular: keep nested custom components inside their parent element (#​551)
• parse: keep inline HTML content inside components and emphasis (#​539)
• render: only render br as a trailing-space break if it round-trips (#​535)
• render: don't indent a nested component that follows a list (#​537)
• render: skip $ metadata when rendering markdown attributes (#​540)
• render: separate a block comment from the para before it in a list item (#​543)
• render: keep raw HTML attribute names + values verbatim (#​536)
• auto-close: don't rewrite a trailing table row that contains a dash (#​542)
• render: write edge non-breaking spaces in table cells as   (#​541)
• render: don't end a paragraph after an inline comment (#​544)
• invalid attribute detection within text (#​547)
• parse: read a stray </br> as a line break (#​538)
• docs: bump vue catalog pins to 3.5.44 to fix broken docs build (#​524)
• shiki: avoid exponential backtracking in component attributes (#​523)

📖 Documentation

• update npm download badge link in README.md (b0d2d236)
• lint docs content with comark-linter (#​546)
• add remark-to-comark to the ecosystem (#​531)
• share playground links that carry the Markdown in the URL (#​526)
• list comark-ui, comark-linter, and the badge builder in the ecosystem (#​520)

🏡 Chore

• stop shipping agent skills in the comark package (#​569)
• add MIT license field to all published packages (#​559)
• math: deprecate renderMath and validateMath (#​510)
• docs: upgrade comark-docs layer to 217ac74 (#​521)

🤖 CI

• automate releases with uppt and npm trusted publishing (#​562)

🎉 New Contributors

• Ali Assar (@​aliassar)
• shkomg (@​shkomg)

❤️ Contributors

• Farnabaz (@​farnabaz)
• Ali Assar (@​aliassar)
• Max (@​onmax)
• Sébastien Chopin (@​atinux)
• shkomg (@​shkomg)
• Daniel Roe (@​danielroe)

nuxt/test-utils (@​nuxt/test-utils)

v4.4.0

Compare Source

v4.4.0 is the next minor release.

👉 Changelog

compare changes

🚀 Enhancements

• module,runtime-utils: return mock from mockNuxtImport (#​1864)
• module: add option to remove data-testid (#​1884)
• runtime-utils: improve setupState type mount + render helpers (#​1870)
• module,vitest-environment: support vite-plus test (#​1861)

🩹 Fixes

• runtime-utils: make registerEndpoint work with Headers instances in happy-dom (#​1876)
• e2e: retry server start when the picked port is taken (#​1886)
• config: override NODE_ENV in the client environment (#​1882)
• config: disable dep discovery in vitest browser mode (#​1881)
• e2e: improve mockLogger to work properly (#​1867)

🎉 New Contributors

• Summar (@​devsummar)

❤️ Contributors

• Yoshihiro Yamaguchi (@​yamachi4416)
• Summar (@​devsummar)
• Daniel Roe (@​danielroe)

microsoft/playwright (@​playwright/test)

v1.65.0

Compare Source

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass t

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: niklhut/libroo
• Branch: main
• File: .coderabbit.yaml
• Commit: 8eae16f
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3a0d2484-ebf7-479c-a1e2-5cc2900afc90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Cloudflare preview

🧹 Preview resources were cleaned up.

Worker: libroo-pr-341
D1 / R2: libroo-preview-pr-341
Access: libroo-preview-pr-341

View cleanup run