chore(deps): bump the production-minor-and-patch group across 1 directory with 13 updates by dependabot[bot] · Pull Request #57 · msinclair25/mdevolved

dependabot · 2026-09-01T07:34:45Z

Bumps the production-minor-and-patch group with 13 updates in the / directory:

Package	From	To
age-encryption	`0.3.0`	`0.3.1`
react	`19.2.7`	`19.2.8`
react-dom	`19.2.7`	`19.2.8`
@cloudflare/workers-oauth-provider	`0.10.1`	`0.10.3`
@simplewebauthn/server	`13.3.2`	`13.3.3`
agents	`0.20.1`	`0.22.0`
hono	`4.12.34`	`4.13.5`
partyserver	`0.3.2`	`0.5.10`
y-partyserver	`2.1.2`	`2.2.0`
yjs	`13.6.20`	`13.6.32`
zod	`4.4.3`	`4.5.2`
fflate	`0.8.2`	`0.8.3`
y-codemirror.next	`0.3.5`	`0.3.6`

Updates age-encryption from 0.3.0 to 0.3.1

Release notes

Sourced from age-encryption's releases.

v0.3.1

Minor compatibility and usability fixes.

Commits

38b8b10 v0.3.1
a410194 fido2prf: try built-in UV before requesting a PIN (#59)
8138fb8 Explain how to use generated fido2prf identities (#58)
b2ca21a Support non-compliant PRF extension implementations (#50)
4ddd194 Mark fido2prf recipients as post-quantum (#57)
29cc34b Handle long Bech32 encodings with scure-base 2.4 (#55)
4472215 Update sandboxed-step to v1.2.2 (#56)
647b5bb Remove global type augmentation for WebAuthn credential hints
cc9b292 Allow slow types in JSR for now
See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

Performance improvements when decoding (#37087 by @eps1lon)

Commits

1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
See full diff in compare view

Updates @cloudflare/workers-oauth-provider from 0.10.1 to 0.10.3

Release notes

Sourced from @cloudflare/workers-oauth-provider's releases.

v0.10.3

Patch Changes

#299 dc63ec8 Thanks @mattzcarey! - Scope default grant revocation to the authorizing redirect URI for Client ID Metadata Document clients. A CIMD client_id is the metadata document URL shared by every installation of the client, so completeAuthorization()'s default revocation logged the user out of all their other devices; it now revokes only grants created from the same redirect URI. Grants now record the redirect URI that created them, and grants created before this release are never auto-revoked by CIMD clients. Revocation for pre-registered and dynamically registered clients is unchanged.

v0.10.2

Patch Changes

#295 3a41fd7 Thanks @mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

Changelog

Sourced from @cloudflare/workers-oauth-provider's changelog.

0.10.3

Patch Changes

#299 dc63ec8 Thanks @mattzcarey! - Scope default grant revocation to the authorizing redirect URI for Client ID Metadata Document clients. A CIMD client_id is the metadata document URL shared by every installation of the client, so completeAuthorization()'s default revocation logged the user out of all their other devices; it now revokes only grants created from the same redirect URI. Grants now record the redirect URI that created them, and grants created before this release are never auto-revoked by CIMD clients. Revocation for pre-registered and dynamically registered clients is unchanged.

0.10.2

Patch Changes

#295 3a41fd7 Thanks @mattzcarey! - Fix client authentication method negotiation so ChatGPT can prefer private_key_jwt while offering the provider's supported none alternative.

DCR and CIMD now use one typed client metadata parser aligned with draft-ietf-oauth-client-id-metadata-document-00 (the revision pinned by MCP 2026-07-28) and OpenID Connect RP Metadata Choices 1.0. The CIMD resolver validates cross-field choices and prohibited credentials, rejects unsafe document URLs, applies response-size and timeout limits to the complete fetch, caches only validated documents with a 7-day lifetime cap, and recovers from a cached document that stops validating by re-resolving from origin in the same request.

Commits

d83b2e7 Version Packages (#300)
dc63ec8 fix(cimd): scope default grant revocation to the authorizing redirect URI (#299)
f3b8b27 Version Packages (#296)
3a41fd7 fix(cimd): centralize client metadata resolution (#295)
See full diff in compare view

Updates @simplewebauthn/server from 13.3.2 to 13.3.3

Release notes

Sourced from @simplewebauthn/server's releases.

v13.3.3

Changes:

[server] Updated MDS blob signature verification to support more algorithms (#788)

[server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

Changelog

Sourced from @simplewebauthn/server's changelog.

v13.3.3

Changes:

[server] Updated MDS blob signature verification to support more algorithms (#788)

[server] Updated MetadataService to know about the new FIDO MDS blob trust anchor certificate (#789)

Commits

4b189bd Update server version to 13.3.3
05db595 Add GlobalSign Root R46 to FIDO MDS default root certs (#789)
9bf80bf Use JWT header alg when verifying MDS blob (#788)
See full diff in compare view

Updates agents from 0.20.1 to 0.22.0

Release notes

Sourced from agents's releases.

agents@0.22.0

Minor Changes

#2071 9620b58 Thanks @ben-reitz! - Make durable chat recovery unconditional for AIChatAgent and Think.

Every chat turn now runs in a recovery fiber, including WebSocket, programmatic, retry, and continuation paths. chatRecovery accepts true or a configuration object; false is no longer supported. Previously compiled JavaScript that still supplies false safely receives the default recovery configuration.

To keep durable bookkeeping while preventing automatic inference after an interruption, return { continue: false } from onChatRecovery(). Use durable cancellation, side-effect, or spend state in that hook and tune chatRecovery budgets when retries must be bounded.

#2133 d536067 Thanks @mattzcarey! - Vendor the required PartyServer runtime into agents/lifecycle and add a reusable Durable Object lifecycle for startup, request interception, alarms, and WebSockets. Agent now directly extends Cloudflare's DurableObject and composes the same lifecycle used by standalone objects; standalone hosts use the explicit Lifecycle.install(this) factory (or the expanded new ... plus installHandlers() form). Both Agent subclasses and standalone hosts use the existing routeAgentRequest() API and /agents URL prefix; the lifecycle entry point does not introduce a second public router.

Lifecycle WebSockets always use Cloudflare's Hibernation API; the static options.hibernate switch and in-memory connection mode are removed. Named Durable Objects use native ctx.id.name, while a read-only __ps_name fallback migrates objects created by older releases without writing new compatibility state.

#2058 381b9bb Thanks @ben-reitz! - Throttle chat UI updates by default in useAgentChat

Streaming writes chat state once per chunk, and each write re-renders. When chunks arrive in a burst — a resumed stream replaying a long turn, for example — React reaches its 50-render limit and throws "Maximum update depth exceeded", which the AI SDK reports as a failed turn even though the server completed it (#1913).

useAgentChat now coalesces those updates every 50ms, which removes about 78% of renders on a fast stream and matches the value the AI SDK documents. The first chunk of a stream is never delayed. Pass throttle: false to render every chunk as it arrives, or a number to change the interval. The deprecated experimental_throttle is still honoured. Message snapshots, functional updates, and streamed continuations resolve against the current chat store, so coalescing renders cannot roll assistant content back to an older snapshot.

#1897 29b0107 Thanks @mattzcarey! - Add Scheduler, a reusable Lifecycle capability for persistent delayed, dated, cron, and interval callbacks, under agents/schedules. Scheduled callbacks are registered on the Scheduler itself (new Scheduler({ callbacks: { ... } })), and set() / every() type both the callback name and the payload against that registration, so the typed scheduling surface and the runtime dispatch target are the same object. LifecycleCapability supplies every capability with storage, readiness, startup state, alarm coordination, a host invocation boundary, best-effort events, and generic capability routing — Scheduler consumes only that standard surface plus its callbacks and policy options, so any host that installs it configures nothing else. Lifecycle owns the physical Durable Object alarm and routes matching capability messages between Agent facets through one internal transport aperture, preserving existing root-owned facet schedule rows without Scheduler-specific Agent RPC methods or an Agent adapter. Agent uses the same Scheduler behind its existing APIs — name-based this.schedule(60, "methodName") keeps dispatching to Agent methods through a composition-root resolver — and preserves callback context, observability, retries, OOM handling, and alarm behavior. MCP now receives storage from Lifecycle when installed. Explicit destruction disposes live capability resources once, then clears shared Durable Object storage with deleteAll(). Think workflow notifications now contribute their wake time through Lifecycle instead of writing the physical alarm directly. The previous agents/schedule parser entry point remains as a deprecated compatibility alias. Agent exposes the composition root as experimental this.lifecycle and this.scheduler properties. The agents/lifecycle entry point and the capability surfaces built on it (Scheduler, installing MCPClientManager directly as a capability) are experimental and may change between releases; Agent's established APIs are unaffected.

Compatibility notes: MCPClientManagerOptions.storage is removed — the manager receives storage from the Lifecycle it is installed on, so standalone construction with an explicit DurableObjectStorage is no longer supported. Scheduled callbacks now receive the documented parsed Schedule object as their second argument (previously the raw storage row, whose payload was an unparsed JSON string). The internal _cf_*ForFacet schedule RPC methods are replaced by the generic _cf_routeLifecycle capability aperture; facets always run the same deployed script, so no coordination is required.

#2161 ded09c6 Thanks @mattzcarey! - Remove the published agents command-line binary. Its advertised init, dev, deploy, and mcp commands were placeholders that printed "not implemented yet" and exited successfully. Use the documented C3 starter, Vite and Wrangler commands, and MCP APIs instead.

#1895 4ba9a37 Thanks @mattzcarey! - Make MCPClientManager a reusable Durable Object lifecycle capability. It now owns schema initialization, persisted HTTP and RPC connection restoration, and OAuth callback interception when installed with Lifecycle.use(), while preserving Agent.this.mcp and the existing Agent MCP APIs. agents/lifecycle exports the LifecycleObject host interface and canonical getCurrentAgent() accessor; Lifecycle supplies that context to host hooks while capability hooks remain self-contained.

Patch Changes

#2027 e87ad62 Thanks @cjol! - Route asynchronous callable and streaming responses through the facet WebSocket frame that originated each RPC.

#1978 b7c7696 Thanks @Ankcorn! - Add Agents SDK instrumentation and agent instance identity attributes to SDK-created spans.

#2050 3b43c33 Thanks @ben-reitz! - Batch replayed chunks during stream resume so long turns do not exceed React's update limit and report a false error.

#2120 b038440 Thanks @ben-reitz! - Keep Session compaction overlays scoped to their selected conversation branch and preserve deterministic ordering for overlays created in the same second.

#2090 2f957bc Thanks @ben-reitz! - Keep sub-agent WebSocket operations routable and ordered across live and delayed contexts and before broadcasts, report routing failures, and preserve nested sub-agent broadcasts across RPC callbacks.

... (truncated)

Changelog

Sourced from agents's changelog.

0.22.0

Minor Changes

#2071 9620b58 Thanks @ben-reitz! - Make durable chat recovery unconditional for AIChatAgent and Think.

Every chat turn now runs in a recovery fiber, including WebSocket, programmatic, retry, and continuation paths. chatRecovery accepts true or a configuration object; false is no longer supported. Previously compiled JavaScript that still supplies false safely receives the default recovery configuration.

To keep durable bookkeeping while preventing automatic inference after an interruption, return { continue: false } from onChatRecovery(). Use durable cancellation, side-effect, or spend state in that hook and tune chatRecovery budgets when retries must be bounded.

#2133 d536067 Thanks @mattzcarey! - Vendor the required PartyServer runtime into agents/lifecycle and add a reusable Durable Object lifecycle for startup, request interception, alarms, and WebSockets. Agent now directly extends Cloudflare's DurableObject and composes the same lifecycle used by standalone objects; standalone hosts use the explicit Lifecycle.install(this) factory (or the expanded new ... plus installHandlers() form). Both Agent subclasses and standalone hosts use the existing routeAgentRequest() API and /agents URL prefix; the lifecycle entry point does not introduce a second public router.

Lifecycle WebSockets always use Cloudflare's Hibernation API; the static options.hibernate switch and in-memory connection mode are removed. Named Durable Objects use native ctx.id.name, while a read-only __ps_name fallback migrates objects created by older releases without writing new compatibility state.

#2058 381b9bb Thanks @ben-reitz! - Throttle chat UI updates by default in useAgentChat

Streaming writes chat state once per chunk, and each write re-renders. When chunks arrive in a burst — a resumed stream replaying a long turn, for example — React reaches its 50-render limit and throws "Maximum update depth exceeded", which the AI SDK reports as a failed turn even though the server completed it (#1913).

useAgentChat now coalesces those updates every 50ms, which removes about 78% of renders on a fast stream and matches the value the AI SDK documents. The first chunk of a stream is never delayed. Pass throttle: false to render every chunk as it arrives, or a number to change the interval. The deprecated experimental_throttle is still honoured. Message snapshots, functional updates, and streamed continuations resolve against the current chat store, so coalescing renders cannot roll assistant content back to an older snapshot.

#1897 29b0107 Thanks @mattzcarey! - Add Scheduler, a reusable Lifecycle capability for persistent delayed, dated, cron, and interval callbacks, under agents/schedules. Scheduled callbacks are registered on the Scheduler itself (new Scheduler({ callbacks: { ... } })), and set() / every() type both the callback name and the payload against that registration, so the typed scheduling surface and the runtime dispatch target are the same object. LifecycleCapability supplies every capability with storage, readiness, startup state, alarm coordination, a host invocation boundary, best-effort events, and generic capability routing — Scheduler consumes only that standard surface plus its callbacks and policy options, so any host that installs it configures nothing else. Lifecycle owns the physical Durable Object alarm and routes matching capability messages between Agent facets through one internal transport aperture, preserving existing root-owned facet schedule rows without Scheduler-specific Agent RPC methods or an Agent adapter. Agent uses the same Scheduler behind its existing APIs — name-based this.schedule(60, "methodName") keeps dispatching to Agent methods through a composition-root resolver — and preserves callback context, observability, retries, OOM handling, and alarm behavior. MCP now receives storage from Lifecycle when installed. Explicit destruction disposes live capability resources once, then clears shared Durable Object storage with deleteAll(). Think workflow notifications now contribute their wake time through Lifecycle instead of writing the physical alarm directly. The previous agents/schedule parser entry point remains as a deprecated compatibility alias. Agent exposes the composition root as experimental this.lifecycle and this.scheduler properties. The agents/lifecycle entry point and the capability surfaces built on it (Scheduler, installing MCPClientManager directly as a capability) are experimental and may change between releases; Agent's established APIs are unaffected.

Compatibility notes: MCPClientManagerOptions.storage is removed — the manager receives storage from the Lifecycle it is installed on, so standalone construction with an explicit DurableObjectStorage is no longer supported. Scheduled callbacks now receive the documented parsed Schedule object as their second argument (previously the raw storage row, whose payload was an unparsed JSON string). The internal _cf_*ForFacet schedule RPC methods are replaced by the generic _cf_routeLifecycle capability aperture; facets always run the same deployed script, so no coordination is required.

#2161 ded09c6 Thanks @mattzcarey! - Remove the published agents command-line binary. Its advertised init, dev, deploy, and mcp commands were placeholders that printed "not implemented yet" and exited successfully. Use the documented C3 starter, Vite and Wrangler commands, and MCP APIs instead.

#1895 4ba9a37 Thanks @mattzcarey! - Make MCPClientManager a reusable Durable Object lifecycle capability. It now owns schema initialization, persisted HTTP and RPC connection restoration, and OAuth callback interception when installed with Lifecycle.use(), while preserving Agent.this.mcp and the existing Agent MCP APIs. agents/lifecycle exports the LifecycleObject host interface and canonical getCurrentAgent() accessor; Lifecycle supplies that context to host hooks while capability hooks remain self-contained.

Patch Changes

#2027 e87ad62 Thanks @cjol! - Route asynchronous callable and streaming responses through the facet WebSocket frame that originated each RPC.

#1978 b7c7696 Thanks @Ankcorn! - Add Agents SDK instrumentation and agent instance identity attributes to SDK-created spans.

#2050 3b43c33 Thanks @ben-reitz! - Batch replayed chunks during stream resume so long turns do not exceed React's update limit and report a false error.

#2120 b038440 Thanks @ben-reitz! - Keep Session compaction overlays scoped to their selected conversation branch and preserve deterministic ordering for overlays created in the same second.

#2090 2f957bc Thanks @ben-reitz! - Keep sub-agent WebSocket operations routable and ordered across live and delayed contexts and before broadcasts, report routing failures, and preserve nested sub-agent broadcasts across RPC callbacks.

... (truncated)

Commits

676b3d3 Version Packages (#2128)
29b0107 feat(lifecycle): add composable Scheduler (#1897)
2f957bc Fix delayed sub-agent WebSocket operations (#2090)
ded09c6 chore: remove stale artifacts and no-op CLI (#2161)
4ba9a37 feat(mcp): make the client manager a Durable Object capability (#1895)
381b9bb feat(chat): throttle chat UI updates by default (#2058)
3b43c33 fix(chat): batch replayed chunks on stream resume (#2050)
4890dc6 feat(channels): add stateless channels package (#2129)
e87ad62 Fix dropped async callable replies on facets (#2027)
a0e134b refactor(agents): keep request routing under routeAgentRequest (#2140)
Additional commits viewable in compare view

Updates hono from 4.12.34 to 4.13.5

Release notes

Sourced from hono's releases.

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

fix(request): handle params on unmatched requests in honojs/hono#5268

fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264

fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266

perf(router): share null object creation in honojs/hono#5267

fix(etag): match If-None-Match tags with optional whitespace before the comma in honojs/hono#5222

fix(client): skip undefined header and cookie values in honojs/hono#5244

fix(client): skip an undefined entry inside a query array in honojs/hono#5272

fix(client): skip an undefined entry inside a form array in honojs/hono#5280

fix(client): support custom buildSearchParams and filter undefined query in $ws() bin honojs/hono#5256

fix(accepts): support wildcard media types and specificity ordering in defaultMatch in honojs/hono#5255

fix(client): omit empty query delimiter in honojs/hono#5283

fix(request): drop stale content length for cloned FormData in honojs/hono#5282

fix(request): serialize cached JSON body in cloneRawRequest in honojs/hono#5288

fix(cookie): allow parsing signed cookies with empty string values in honojs/hono#5246

fix(utils/stream): do not let abort listeners crash abort() in honojs/hono#5274

Full Changelog: honojs/hono@v4.13.3...v4.13.4

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

... (truncated)

Commits

06880c4 4.13.5
531e9c5 Merge commit from fork
3a67f7f Merge commit from fork
9c28d72 Merge commit from fork
017000d 4.13.4
5e5b83d fix(utils/stream): do not let abort listeners crash abort() (#5274)
241ae4c fix(cookie): allow parsing signed cookies with empty string values (#5246)
c409d85 fix(request): serialize cached JSON body in cloneRawRequest (#5288)
612b59c fix(request): drop stale content length for cloned FormData (#5282)
73794bd fix(client): omit empty query delimiter (#5283)
Additional commits viewable in compare view

Updates partyserver from 0.3.2 to 0.5.10

Release notes

Sourced from partyserver's releases.

partyserver@0.5.10

Patch Changes

#417 5ce45b7 Thanks @threepointone! - Inherit hibernation settings when a Server subclass declares partial static options.

partyserver@0.5.9

Patch Changes

#415 1eb112f Thanks @mattzcarey! - Allow @cloudflare/workers-types v5 as a peer dependency. PartyServer remains compatible with v4 while projects using Wrangler 4.108 and newer can install the v5 runtime types without a peer dependency conflict.

partyserver@0.5.8

Patch Changes

#407 2be6104 Thanks @threepointone! - Encode the x-partykit-props header as base64 so props containing non-ASCII characters (e.g. accented names like "Usuário") no longer trigger workerd's "header value contains non-ASCII characters" warning, which would throw a TypeError in browser fetch implementations. The header is decoded back to the original Unicode payload on the server, and raw-JSON values from older callers are still accepted for backwards compatibility.

partyserver@0.5.7

Patch Changes

#405 7dbf92c Thanks @threepointone! - Accept non-hibernating WebSocket connections in half-open mode (accept({ allowHalfOpen: true })).

On compatibility dates >= 2026-04-07 the web_socket_auto_reply_to_close flag makes the runtime send a reciprocal Close frame and tear the socket down automatically. For a non-hibernating PartyServer (hibernate: false), the Durable Object sits on the server end of a connection that the runtime tunnels back to the client, so that auto-teardown could fire through an already-severed tunnel — surfacing as a spurious retryable Network connection lost. rejection (for example when a Durable Object is reset while a connection is still open). Half-open mode keeps PartyServer's existing close handling in control; it already reciprocates the peer's Close frame on every compatibility date, so client behavior is unchanged.

Also in this release, two related WebSocket fixes that keep behavior consistent across all compatibility dates:

Pin binaryType to "arraybuffer" for non-hibernating connections. On compatibility dates >= 2026-03-17 the websocket_standard_binary_type flag flips the default server-side binaryType from "arraybuffer" to "blob", so binary frames arrived as Blob instead of ArrayBuffer on the in-memory path. PartyServer (and frameworks built on it, e.g. Cloudflare Agents) have always received ArrayBuffer, so it is now pinned back in accept(). This is a no-op on older dates and corrective on newer ones; the Hibernation API is unaffected (it always delivers ArrayBuffer).

Stop reporting transport-teardown errors as onError. A retryable Network connection lost. / WebSocket peer disconnected error that fires on an already closing/closed connection is the socket going away during the close handshake, not an application error. It is now suppressed when the connection is CLOSING/CLOSED (detected via the structured retryable flag, with a message fallback), so it no longer spams logs on abrupt client disconnects. Genuine mid-connection (OPEN) errors still reach onError.

partyserver@0.5.6

Patch Changes

#399 f772382 Thanks @threepointone! - Retry transient Durable Object routing errors from routePartykitRequest and getServerByName, and expose route-level retry configuration.

partyserver@0.5.5

Patch Changes

#394 9a927a3 Thanks @threepointone! - Don't reciprocate the WebSocket close handshake when the runtime delivers a reserved close code (1005, 1006, 1015). These codes are synthesized by the runtime when the peer didn't actually send a Close frame — there is no handshake to complete. The earlier 0.5.4 change ([#393](https://github.com/cloudflare/partykit/issues/393)) normalized these to 1000 and tried to send a reciprocating Close frame anyway; in cross-isolate transports (notably WebSocket pairs that flow back through Durable Object RPC, e.g. Cloudflare Agents sub-agents) the reciprocation would succeed synchronously but schedule an outbound write on a transport whose peer was already gone. The runtime then rejected that write asynchronously with Network connection lost, escaping closeQuietly's synchronous try/catch and surfacing as an unhandled promise rejection in tests and production logs. The fix is to skip the reciprocation for reserved codes — there's nothing to acknowledge to a peer that didn't speak. The narrow user-visible behavior change: a client that calls ws.close() with no code on compat dates < 2026-04-07 (no auto-reply) will now observe a non-clean close instead of a clean 1000 close, because the framework no longer fabricates a reciprocation. Clients that pass an explicit close code are unaffected.

partyserver@0.5.4

Patch Changes

#391 6273c96 Thanks @threepointone! - Persist a __ps_name fallback for name-based Durable Objects during initialization. This lets alarm handlers recover this.name even when firing on a stale on-disk alarm record that was scheduled by an older workerd version that didn't yet persist name into the alarm record. See cloudflare/partykit#390.

#393 5335251 Thanks @threepointone! - Complete the WebSocket close handshake when a client initiates the close. Previously, both the hibernating webSocketClose handler and the non-hibernating close-event listener forwarded to user onClose but never sent a reciprocal Close frame, leaving clients stuck in CLOSING until they timed out and reported 1006 (abnormal closure). The framework now reciprocates the peer's Close frame in a finally block on both paths — required by the Hibernation API on every compat date, and required by the standard accept() API on compat dates before 2026-04-07 (where the runtime's web_socket_auto_reply_to_close flag isn't yet active). Calling close() on an already-closed socket is a silent no-op, so user code that already calls connection.close(...) from onClose is unaffected. Reserved close codes (1005, 1006, 1015) are normalized to 1000 before reciprocation so they don't throw InvalidAccessError. See cloudflare/partykit#389.

partyserver@0.5.3

Patch Changes

#386 8a3bc02 Thanks @threepointone! - Document and test the supported pattern for using PartyServer with Durable Object Facets. No runtime behavior change.

Background. Facets spawned via ctx.facets.get(name, factory) without an explicit id in FacetStartupOptions inherit the parent DO's ctx.id — including ctx.id.name. PartyServer's name getter reads ctx.id.name straight through, so on an implicit-id facet this.name returns the parent's name rather than the facet's logical name. This is a faithful reflection of the workerd contract, but it's almost never what framework authors expect.

... (truncated)

Commits

53f0c68 Version Packages
5ce45b7 inherit server hibernation options
d8027fd cleanup
5e216fd Version Packages
1eb112f fix: support Workers Types v5 in PartyServer
c9ab55f cleanup
886022d Version Packages
580d9bd fix ci
6b97742 Add terminal close reconnect predicate
e59f374 Version Packages
Additional commits viewable in compare view

Updates y-partyserver from 2.1.2 to 2.2.0

Release notes

Sourced from y-partyserver's releases.

y-partyserver@2.2.0

Minor Changes

#378 f3ab44f Thanks @threepointone! - Use native ctx.id.name to populate this.name.

Durable Objects now expose ctx.id.name on every entry point (constructor, fetch, alarm, hibernating websocket handlers) when the DO is addressed via idFromName()/getByName(). PartyServer now uses this as the primary source of this.name, which simplifies routing, eliminates storage writes, and makes this.name available inside the constructor.

Changes in partyserver:

this.name resolves from this.ctx.id.name. The apologetic workerd#2240 error message is gone.

this.name is now available inside the constructor and from class field initializers, not just after setName()/fetch() has run.

routePartykitRequest no longer issues a setName()/_initAndFetch() RPC before fetch(). The WebSocket path goes from 2 RPCs to 1; the HTTP path remains 1 RPC. Props, when supplied, are delivered to the DO via the x-partykit-props request header, set after onBeforeConnect/onBeforeRequest hooks run.

getServerByName continues to perform a single RPC to ensure onStart() has completed before returning, so user-defined RPC methods on the returned stub can rely on initialization being done. That RPC is now cheaper internally (no storage write; name is read from ctx.id.name).

Server no longer writes the __ps_name record to storage. Existing records remain on disk for backward compatibility and are only read inside alarm() as a fallback for alarms that were scheduled before 2026-03-15 (where ctx.id.name is not carried into the alarm handler — see the Durable Objects ID docs).

setName() and _initAndFetch() are marked @deprecated. They continue to work for backward compatibility. setName(name) now throws if name does not match ctx.id.name.

The x-partykit-room header is still accepted as a fallback when ctx.id.name is not available.

Error message when the name cannot be resolved has been rewritten to list the three real causes (unsupported addressing via idFromString()/newUniqueId(), runtime too old to expose ctx.id.name, or direct stub.fetch() without routePartykitRequest/getServerByName).

When reading this.name throws, it is because ctx.id.name is undefined and no legacy fallback has populated the name: the DO was addressed via idFromString() or newUniqueId() (both unsupported), the runtime is too old to expose ctx.id.name, or a pre-2026-03-15 alarm fired before the legacy storage fallback ran.

Changes in all affected packages (partyserver, partysub, partysync, y-partyserver, hono-party):

@cloudflare/workers-types peer dependency bumped from ^4.20240729.0 to ^4.20260424.1. The old range predates ctx.id.name in the type surface.

Not supported: addressing PartyServer DOs via idFromString() or newUniqueId(). These paths return ctx.id.name === undefined inside the DO and will surface as a clear error from this.name. PartyServer has always assumed name-based addressing via getServerByName / routePartykitRequest; this release makes that assumption explicit.

y-partyserver@2.1.4

Patch Changes

#368 c0da6f4 Thanks @threepointone! - Fix params() not being re-evaluated on WebSocket reconnect

When params was passed as a function to YProvider, it was only evaluated on the initial connection. On automatic reconnects (e.g. after a network drop), the params function was not called again, causing dynamic values like auth tokens to go stale.

The reconnection path now goes through an overridable _reconnectWS() method that YProvider uses to re-resolve params before re-establishing the WebSocket.

y-partyserver@2.1.3

Patch Changes

4e315b4 Thanks @threepointone! - update

Commits

f661aa7 Version Packages
f410527 Correct changeset: add peer-dep bump, list affected packages, clarify
b99c1da Bump workers-types peer deps, clarify error, guard constructor access

…tory with 13 updates Bumps the production-minor-and-patch group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [age-encryption](https://github.com/FiloSottile/typage) | `0.3.0` | `0.3.1` | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` | | [@cloudflare/workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider) | `0.10.1` | `0.10.3` | | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `13.3.2` | `13.3.3` | | [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.20.1` | `0.22.0` | | [hono](https://github.com/honojs/hono) | `4.12.34` | `4.13.5` | | [partyserver](https://github.com/cloudflare/partykit) | `0.3.2` | `0.5.10` | | [y-partyserver](https://github.com/cloudflare/partykit) | `2.1.2` | `2.2.0` | | [yjs](https://github.com/yjs/yjs) | `13.6.20` | `13.6.32` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.2` | | [fflate](https://github.com/101arrowz/fflate) | `0.8.2` | `0.8.3` | | [y-codemirror.next](https://github.com/yjs/y-codemirror.next) | `0.3.5` | `0.3.6` | Updates `age-encryption` from 0.3.0 to 0.3.1 - [Release notes](https://github.com/FiloSottile/typage/releases) - [Commits](FiloSottile/typage@v0.3.0...v0.3.1) Updates `react` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `react-dom` from 19.2.7 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom) Updates `@cloudflare/workers-oauth-provider` from 0.10.1 to 0.10.3 - [Release notes](https://github.com/cloudflare/workers-oauth-provider/releases) - [Changelog](https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md) - [Commits](cloudflare/workers-oauth-provider@v0.10.1...v0.10.3) Updates `@simplewebauthn/server` from 13.3.2 to 13.3.3 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v13.3.3/packages/server) Updates `agents` from 0.20.1 to 0.22.0 - [Release notes](https://github.com/cloudflare/agents/releases) - [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md) - [Commits](https://github.com/cloudflare/agents/commits/agents@0.22.0/packages/agents) Updates `hono` from 4.12.34 to 4.13.5 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.34...v4.13.5) Updates `partyserver` from 0.3.2 to 0.5.10 - [Release notes](https://github.com/cloudflare/partykit/releases) - [Commits](https://github.com/cloudflare/partykit/compare/partyserver@0.3.2...partyserver@0.5.10) Updates `y-partyserver` from 2.1.2 to 2.2.0 - [Release notes](https://github.com/cloudflare/partykit/releases) - [Commits](https://github.com/cloudflare/partykit/compare/y-partyserver@2.1.2...y-partyserver@2.2.0) Updates `yjs` from 13.6.20 to 13.6.32 - [Release notes](https://github.com/yjs/yjs/releases) - [Commits](yjs/yjs@v13.6.20...v13.6.32) Updates `zod` from 4.4.3 to 4.5.2 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.2) Updates `fflate` from 0.8.2 to 0.8.3 - [Release notes](https://github.com/101arrowz/fflate/releases) - [Changelog](https://github.com/101arrowz/fflate/blob/master/CHANGELOG.md) - [Commits](101arrowz/fflate@v0.8.2...v0.8.3) Updates `y-codemirror.next` from 0.3.5 to 0.3.6 - [Release notes](https://github.com/yjs/y-codemirror.next/releases) - [Commits](yjs/y-codemirror.next@v0.3.5...v0.3.6) --- updated-dependencies: - dependency-name: age-encryption dependency-version: 0.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@cloudflare/workers-oauth-provider" dependency-version: 0.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@simplewebauthn/server" dependency-version: 13.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: agents dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: hono dependency-version: 4.13.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: partyserver dependency-version: 0.5.10 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: y-partyserver dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: yjs dependency-version: 13.6.32 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: zod dependency-version: 4.5.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: fflate dependency-version: 0.8.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: y-codemirror.next dependency-version: 0.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026

dependabot Bot requested a review from msinclair25 as a code owner September 1, 2026 07:34

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026

Navigation Menu

chore(deps): bump the production-minor-and-patch group across 1 directory with 13 updates - #57

chore(deps): bump the production-minor-and-patch group across 1 directory with 13 updates#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-minor-and-patch-77806892a9

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026

v0.3.1

19.2.8 (July 21st, 2026)

React Server Components

19.2.8 (July 21st, 2026)

React Server Components

v0.10.3

Patch Changes

v0.10.2

Patch Changes

0.10.3

Patch Changes

0.10.2

Patch Changes

v13.3.3

v13.3.3

agents@0.22.0

Minor Changes

Patch Changes

0.22.0

Minor Changes

Patch Changes

v4.13.5

Security fixes

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

v4.13.4

What's Changed

v4.13.3

What's Changed

partyserver@0.5.10

Patch Changes

partyserver@0.5.9

Patch Changes

partyserver@0.5.8

Patch Changes

partyserver@0.5.7

Patch Changes

partyserver@0.5.6

Patch Changes

partyserver@0.5.5

Patch Changes

partyserver@0.5.4

Patch Changes

partyserver@0.5.3

Patch Changes

y-partyserver@2.2.0

Minor Changes

y-partyserver@2.1.4

Patch Changes

y-partyserver@2.1.3

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion