chore(deps): update npm minor and patch dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@anthropic-ai/claude-agent-sdk	^0.3.205 → ^0.3.212
@cloudflare/vitest-pool-workers (source)	^0.18.0 → ^0.18.6
@eslint/js (source)	^9.39.4 → ^9.39.5
@hono/node-server	^2.0.8 → ^2.0.10
@lovable.dev/vite-plugin-dev-server-bridge (source)	1.0.3 → 1.2.0
@lovable.dev/vite-plugin-hmr-gate (source)	1.1.2 → 1.1.4
@lovable.dev/vite-tanstack-config (source)	2.6.5 → 2.7.6
@radix-ui/react-accordion (source)	^1.2.15 → ^1.2.16
@radix-ui/react-alert-dialog (source)	^1.1.18 → ^1.1.19
@radix-ui/react-avatar (source)	^1.2.1 → ^1.2.2
@radix-ui/react-checkbox (source)	^1.3.6 → ^1.3.7
@radix-ui/react-collapsible (source)	^1.1.15 → ^1.1.16
@radix-ui/react-context-menu (source)	^2.3.2 → ^2.3.3
@radix-ui/react-dialog (source)	^1.1.18 → ^1.1.19
@radix-ui/react-dropdown-menu (source)	^2.1.19 → ^2.1.20
@radix-ui/react-hover-card (source)	^1.1.18 → ^1.1.19
@radix-ui/react-menubar (source)	^1.1.19 → ^1.1.20
@radix-ui/react-navigation-menu (source)	^1.2.17 → ^1.2.18
@radix-ui/react-popover (source)	^1.1.18 → ^1.1.19
@radix-ui/react-progress (source)	^1.1.11 → ^1.1.12
@radix-ui/react-radio-group (source)	^1.4.2 → ^1.4.3
@radix-ui/react-scroll-area (source)	^1.2.13 → ^1.2.14
@radix-ui/react-select (source)	^2.3.2 → ^2.3.3
@radix-ui/react-slider (source)	^1.4.2 → ^1.4.3
@radix-ui/react-switch (source)	^1.3.2 → ^1.3.3
@radix-ui/react-tabs (source)	^1.1.16 → ^1.1.17
@radix-ui/react-toggle (source)	^1.1.13 → ^1.1.14
@radix-ui/react-toggle-group (source)	^1.1.14 → ^1.1.15
@radix-ui/react-tooltip (source)	^1.2.11 → ^1.2.12
@scalar/api-reference-react (source)	^0.9.55 → ^0.9.58
@sentry/cloudflare (source)	^10.63.0 → ^10.66.0
@sentry/hono (source)	^10.63.0 → ^10.66.0
@sentry/node (source)	^10.63.0 → ^10.66.0
@sentry/node (source)	^10.63.0 → ^10.66.0
@sentry/opentelemetry (source)	^10.63.0 → ^10.66.0
@sentry/react (source)	^10.63.0 → ^10.66.0
@tailwindcss/vite (source)	^4.3.2 → ^4.3.3
@tanstack/react-router (source)	^1.170.17 → ^1.170.18
@tanstack/react-start (source)	^1.168.27 → ^1.168.28
@tanstack/router-plugin (source)	^1.168.19 → ^1.168.20
@types/node (source)	^22.20.0 → ^22.20.1
@types/node (source)	^22.20.0 → ^22.20.1
@types/node (source)	^24.13.2 → ^24.13.3
@types/react (source)	^19.2.7 → ^19.2.17
@vitejs/plugin-react (source)	^5.1.4 → ^5.2.0
@vitest/coverage-v8 (source)	^4.1.9 → ^4.1.10
agents (source)	^0.17.3 → ^0.17.4
eslint (source)	^9.39.4 → ^9.39.5
eslint-plugin-prettier	^5.5.5 → ^5.5.6
eslint-plugin-react-hooks (source)	^7.0.1 → ^7.1.1
eslint-plugin-react-refresh	^0.5.2 → ^0.5.3
fumadocs-core	^16.11.4 → ^16.11.5
fumadocs-mdx	^15.1.1 → ^15.2.0
globals	^17.4.0 → ^17.7.0
hono (source)	^4.12.27 → ^4.12.30
posthog-node (source)	^5.44.0 → ^5.45.2
prettier (source)	3.9.4 → 3.9.5
prettier (source)	^3.9.4 → ^3.9.5
prettier (source)	^3.8.1 → ^3.9.5
react-hook-form (source)	^7.80.0 → ^7.81.0
react-resizable-panels (source)	^4.12.0 → ^4.12.2
sharp (source, changelog)	^0.34.5 → ^0.35.3
tailwindcss (source)	^4.3.2 → ^4.3.3
tar	^7.5.19 → ^7.5.20
tsx (source)	^4.22.5 → ^4.23.1
typescript-eslint (source)	^8.62.1 → ^8.64.0
typescript-eslint (source)	^8.56.1 → ^8.64.0
vite (source)	^8.1.3 → ^8.1.5
vitest (source)	^4.1.9 → ^4.1.10
web-tree-sitter (source)	^0.20.8 → ^0.26.11
wrangler (source)	^4.107.0 → ^4.112.0
ws	^8.21.0 → ^8.21.1

Dependency PRs must keep npm run test:ci passing. The 97% coverage requirement is enforced as Codecov patch coverage on changed lines (codecov/patch), so dependency-only bumps satisfy it without new tests.

GitHub Actions updates must remain SHA-pinned.

Renovate is the sole dependency and security-update bot for this repo; GitHub Dependabot security updates are disabled to avoid duplicate PRs (e.g. the two hono advisory PRs).

---

Release Notes

anthropics/claude-agent-sdk-typescript (@​anthropic-ai/claude-agent-sdk)

v0.3.212

Compare Source

• Fixed dash-leading resumeSessionAt and sessionId values being passed to the CLI as separate argv tokens; both now use equals-form (--flag=value)
• Agent tool output now includes the resolved model when a mid-turn model swap changed the subagent's model

v0.3.211

Compare Source

• Fixed --replay-user-messages with --include-partial-messages emitting the turn-start user replay after the first content block instead of before the turn's content events
• Added SDKAssistantMessage.timestamp (ISO-8601) to the live stream, matching SDKUserMessage; older emitters omit it, consumers should fall back to receive time
• Added rate-limit message prefix buckets (USAGE_LIMIT_ERROR_PREFIXES and siblings) as @alpha exports for classifying rate-limit messages without hand-mirrored lists
• Improved process-exit errors to include the CLI's stderr output, so a failed child reports its actual cause instead of only an exit code

v0.3.210

Compare Source

• Added timedOutAfterMs to BashToolOutput, set when a command is auto-backgrounded on timeout

v0.3.209

Compare Source

• Updated to parity with Claude Code v2.1.209

v0.3.208

Compare Source

• Fixed a caller abort during a pending SDK hook callback being converted into hook success, which let PreToolUse-gated tools execute after the abort
• Fixed a per-query resource leak in the SDK's process tracking when spawning the CLI fails (nonexistent or inaccessible executable path)
• Fixed an SDK UserPromptSubmit hook callback exceeding its timeout killing the entire query with an empty error; it now blocks the prompt with a clear timeout message and the session continues
• Fixed extraArgs values that look like flags (e.g. resume: '--version') being parsed as their own CLI flags; dash-leading values are now bound with equals-form argv
• Fixed an abort-listener leak: streaming queries sharing one AbortController no longer accumulate abort listeners on its signal after each completed query
• Fixed createSdkMcpServer docs pointing at a nonexistent env var; the MCP tool-call timeout knob is MCP_TOOL_TIMEOUT
• Fixed an uncaught exception when writing to stdin after the Claude Code subprocess has exited

v0.3.207

Compare Source

• Fixed canUseTool returning {behavior: 'allow'} without updatedInput being rejected as a deny with a raw ZodError message; the tool now runs with the original input per the documented contract
• The Agent tool's structured result now has a published SDK type (AgentToolCompletedOutput) that matches the emitted object exactly

v0.3.206

Compare Source

• Added command_lifecycle frames to stream-json and SDK sessions, reporting each uuid-stamped message's terminal state (queued/started/completed/cancelled/discarded); zero-API results no longer report stale duration_api_ms

cloudflare/workers-sdk (@​cloudflare/vitest-pool-workers)

v0.18.6

Compare Source

Patch Changes

• #​14678 4e62bba Thanks @​apeacock1991! - Fix test runs hanging after a Durable Object logs and rejects blockConcurrencyWhile()

  Console messages emitted from another Durable Object are now buffered until execution returns to the test runner, avoiding I/O that cannot complete after the object's input gate breaks.

• Updated dependencies [34e696d, d39ae01, 3de70df, c79504f, 9f04a7e, 9f04a7e, cb30df3, cb6c3f9, c7dbe1a, 3f3afbb, e6fbc4e, 4e1a7a7, 9f04a7e]:

  • miniflare@​4.20260714.0
  • wrangler@​4.112.0

v0.18.5

Compare Source

Patch Changes

• Updated dependencies [7692a61, ed33326, 018574b, eb99ab1, cdf3148, 7692a61, 7692a61, 3015320, 899c297, 9da77ac, 317ce1f]:
  • miniflare@​4.20260710.0
  • wrangler@​4.111.0

v0.18.4

Compare Source

Patch Changes

• #​14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

  A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.

  await step.do(
    "call flaky API",
    {
      retries: {
        limit: 5,
        backoff: "constant",
        delay: ({ ctx }) => ctx.attempt * 1000,
      },
    },
    async () => {
      /* ... */
    }
  );

  The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

• Updated dependencies [0283a1f, 7b28392, 1b965c5]:

  • wrangler@​4.110.0
  • miniflare@​4.20260708.1

v0.18.3

Compare Source

Patch Changes

• #​14489 e3f0cd6 Thanks @​edmundhung! - Add listDurableObjectIds() to Miniflare

  Miniflare now exposes listDurableObjectIds() for listing persisted Durable Object instance IDs by binding name. The Vitest pool now uses this shared Miniflare API internally instead of duplicating Miniflare's storage listing logic.

• Updated dependencies [e3f0cd6, 8511ddf, 9f74a5f, e3f0cd6, c782e2a, 2fedb1f, 17d2fc1]:

  • miniflare@​4.20260708.0
  • wrangler@​4.109.0

v0.18.2

Compare Source

Patch Changes

• Updated dependencies [54f74b8, 0852346, 54f74b8]:
  • wrangler@​4.108.0
  • miniflare@​4.20260706.0

v0.18.1

Compare Source

Patch Changes

• #​14409 16fbf81 Thanks @​matingathani! - reset() from cloudflare:test now resets ratelimit binding state between tests. Previously, RATE_LIMITERS bindings retained their in-memory bucket counts across test boundaries, causing later tests in the same file to see stale rate-limit exhaustion state.

• Updated dependencies [e7e5780, d88555e, 5fd8bee, 5d9990e, bf49a41, 1ac96a1, f416dd9, 1ca8d8f, 16fbf81, b973ed3]:

  • miniflare@​4.20260702.0
  • wrangler@​4.107.1

eslint/eslint (@​eslint/js)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

honojs/node-server (@​hono/node-server)

v2.0.10

Compare Source

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

Compare Source

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in #​371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in #​372
• fix: recover complete request bodies after client disconnect by @​usualoma in #​375

New Contributors

• @​otnc made their first contribution in #​371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

lovablelabs/lovable (@​lovable.dev/vite-tanstack-config)

v2.7.0

Compare Source

radix-ui/primitives (@​radix-ui/react-accordion)

v1.2.16

• Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-collapsible@1.1.16, @radix-ui/react-collection@1.1.12

radix-ui/primitives (@​radix-ui/react-alert-dialog)

v1.1.19

• Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-dialog@1.1.19

radix-ui/primitives (@​radix-ui/react-avatar)

v1.2.2

• Updated dependencies: @radix-ui/react-context@1.2.0

radix-ui/primitives (@​radix-ui/react-checkbox)

v1.3.7

• Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-presence@1.1.7

radix-ui/primitives (@​radix-ui/react-collapsible)

v1.1.16

• Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-presence@1.1.7

radix-ui/primitives (@​radix-ui/react-context-menu)

v2.3.3

• Fixed ContextMenu not re-anchoring to the latest pointer position when re-triggered while already open.
• Fixed menu items, tab triggers, toolbar links, and select items intercepting Space/Enter keys that originate from focusable descendants.
• Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-menu@2.1.20

radix-ui/primitives (@​radix-ui/react-dialog)

v1.1.19

• Updated dependencies: @radix-ui/react-dismissable-layer@1.1.15, @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-focus-scope@1.1.12, @radix-ui/react-presence@1.1.7

radix-ui/primitives (@​radix-ui/react-dropdown-menu)

v2.1.20

• Fixed menu items, tab triggers, toolbar links, and select items intercepting Space/Enter keys that originate from focusable descendants.
• Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-menu@2.1.20

radix-ui/primitives (@​radix-ui/react-hover-card)

v1.1.19

• Updated dependencies: @radix-ui/react-dismissable-layer@1.1.15, @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-presence@1.1.7, @radix-ui/react-popper@1.3.3

radix-ui/primitives (@&#

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Phoenix)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: loopover@0.1.0
npm error Found: @cloudflare/workers-types@4.20260702.1
npm error node_modules/@cloudflare/workers-types
npm error   peerOptional @cloudflare/workers-types@">=4" from drizzle-orm@0.45.2
npm error   node_modules/drizzle-orm
npm error     drizzle-orm@"^0.45.2" from the root project
npm error     peerOptional drizzle-orm@"*" from db0@0.3.4
npm error     node_modules/db0
npm error       db0@"^0.3.4" from nitro@3.0.260429-beta
npm error       apps/loopover-ui/node_modules/nitro
npm error         dev nitro@"3.0.260429-beta" from @loopover/ui@0.0.0
npm error         apps/loopover-ui
npm error       1 more (unstorage)
npm error   peer @cloudflare/workers-types@"^4.20260424.1" from partyserver@0.5.8
npm error   node_modules/partyserver
npm error     partyserver@"^0.5.8" from agents@0.17.4
npm error     node_modules/agents
npm error       agents@"^0.17.4" from the root project
npm error   2 more (@sentry/cloudflare, @sentry/hono)
npm error
npm error Could not resolve dependency:
npm error dev wrangler@"^4.112.0" from the root project
npm error
npm error Conflicting peer dependency: @cloudflare/workers-types@5.20260717.1
npm error node_modules/@cloudflare/workers-types
npm error   peerOptional @cloudflare/workers-types@"^5.20260714.1" from wrangler@4.112.0
npm error   node_modules/wrangler
npm error     dev wrangler@"^4.112.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-07-20T20_10_31_519Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-07-20T20_10_31_519Z-debug-0.log

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	loopover-ui	a234aca	Jul 20 2026, 08:11 PM

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.