chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	^5.20261013.1 → ^5.20261014.1
motion-v	^2.6.0 → ^2.7.0
oxfmt (source)	>=0.72.0 → >=0.73.0
rolldown (source)	^1.2.13 → ^1.2.14
wrangler (source)	^4.150.0 → ^4.151.0

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

cloudflare/workerd (@​cloudflare/workers-types)

v5.20261014.1

Compare Source

motiondivision/motion-vue (motion-v)

v2.7.0

Compare Source

   🚀 Features

• animate-presence: Add usePresence, and apply transformTemplate on patch  -  by @​mattgperry and Claude Opus 5.5 (1M context) in #​280 (d6dc3)
• deps: Sync upstream motion v14.1.0  -  by @​rick-hup in #​284 (98aea)

   🐞 Bug Fixes

• animate-presence: Inject popLayout styles into element's own document  -  by @​rick-hup in #​283 (5b0c0)

    View changes on GitHub

rolldown/rolldown (rolldown)

v1.2.14

Compare Source

🚀 Features

• add output.charset option (#​11194) by @​sapphi-red
• code-splitting: route independent ESM re-exports per consumer (#​11177) by @​hyfdev

🐛 Bug Fixes

• handle output.charset: 'ascii' + output.minify: false (#​11207) by @​sapphi-red
• tree-shaking: preserve initialization of wrapped ESM re-exports (#​11167) by @​hyfdev
• sourcemap: preserve boundaries when tracing has no mapping (#​11170) by @​sapphi-red
• strict-execution-order: account for init imports during code splitting (#​11162) by @​hyfdev
• strict-execution-order: avoid eager loading through mixed re-exports (#​11151) by @​hyfdev
• tree-shake expression statements that coerce known constants (#​10825) by @​IWANABETHATGUY
• shim-missing-exports: shim deep namespace reads through default imports (#​11184) by @​IWANABETHATGUY
• shim-missing-exports: shim missing static namespace members (#​11179) by @​hyfdev
• preserve-entry-signatures: keep internal bindings out of entry exports (#​11094) by @​hyfdev
• report ASSIGN_TO_IMPORT for writes to re-exported namespace members (#​11148) by @​IWANABETHATGUY
• dev: keep files loaded by the HMR stage watched when the same task rebuilds (#​11154) by @​Brooooooklyn
• dev: watch lazily compiled files even when a build starts first (#​11152) by @​Brooooooklyn
• cjs: print a CommonJS module's top-level this as a wrapper parameter rolldown names (#​11135) by @​IWANABETHATGUY
• renamer: keep fixed names off the bindings that would capture them (#​11134) by @​IWANABETHATGUY
• renamer: keep an external require() local in a CJS module off the top-level names (#​11133) by @​IWANABETHATGUY
• rolldown: make a repeated close() a no-op (#​11142) by @​Brooooooklyn
• avoid renaming entry top-level bindings onto their nested bindings (#​11122) by @​IWANABETHATGUY
• renamer: keep generated top-level names off inner bindings (#​11121) by @​IWANABETHATGUY

🚜 Refactor

• renamer: treat a CJS-wrapped module's root scope as an inner scope (#​11130) by @​IWANABETHATGUY

📚 Documentation

• add renaming design and implementation docs (#​11131) by @​IWANABETHATGUY

⚡ Performance

• ci: overlap independent setup, checks, and artifacts (#​11169) by @​hyfdev

🧪 Testing

• dev: use dunce::canonicalize so dev engine tests pass on Windows (#​11192) by @​shulaoda
• preserve-entry-signatures: cover nested dynamic imports (#​11164) by @​hyfdev

⚙️ Miscellaneous Tasks

• deps: upgrade oxc to 0.154.0 (#​11209) by @​shulaoda
• make Security Analysis pass again (security-action v1.0.10, serde_yaml -> saphyr) (#​11197) by @​Brooooooklyn
• deps: update rollup submodule for tests to v4.64.5 (#​11190) by @​rolldown-guard[bot]
• deps: update test262 submodule for tests (#​11191) by @​rolldown-guard[bot]
• deps: update crate-ci/typos action to v1.51.1 (#​11174) by @​renovate[bot]
• vite-tests: link the workspace rolldown into the Vite clone again (#​11147) by @​Brooooooklyn

cloudflare/workers-sdk (wrangler)

v4.151.0

Compare Source

Minor Changes

• #​16245 d6b1c82 Thanks @​WalshyDev! - Include source maps by default in wrangler build --experimental-cf-build-output

  Build Output now matches wrangler deploy and wrangler versions upload, which upload source maps by default, so Workers built for tools like cf get stack traces that point at the original source. Source maps that can't be resolved are skipped rather than failing the build. Set upload_source_maps = false to opt out.

Patch Changes

• #​16220 97b2fb1 Thanks @​FlorentCollin! - Support local D1 queries through the experimental d1_binding_jsrpc compatibility flag

  Local D1 bindings now implement the RPC query backend used by D1Database.query() and prepared-statement methods when the flag is enabled. Queries reuse local SQLite execution, including transactional batches, execution metadata, and session bookmarks, while bindings without the flag continue to use HTTP. Update the bundled workerd runtime to 1.20261012.1 and align the default compatibility date with that release.

• Updated dependencies [f360829, 97b2fb1, 97b2fb1, acd2822]:

  • miniflare@5.20261012.0-beta

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nitro.build	Ready	Preview	Oct 17, 2026 12:25pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 701b0925-cd9c-4d44-a95f-46bc052190d2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rolldown@​1.2.14
	vitest@​5.0.5
	wrangler@​4.150.0 ⏵ 4.151.1	+1		+1
	@​cloudflare/​workers-types@​5.20261013.1 ⏵ 5.20261016.1	+1
	motion-v@​2.8.0

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4802

commit: 6707dfe