Update NPM Development dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@cloudflare/workers-types	4.20250525.0 -> 4.20250603.0
@eslint/js (source)	9.27.0 -> 9.28.0
@tailwindcss/vite (source)	4.1.7 -> 4.1.8
@types/react (source)	19.1.5 -> 19.1.6
@vitejs/plugin-react-swc (source)	3.10.0 -> 3.10.1
eslint (source)	9.27.0 -> 9.28.0
miniflare (source)	4.20250508.3 -> 4.20250525.0
tailwindcss (source)	4.1.7 -> 4.1.8
typescript-eslint (source)	8.32.1 -> 8.33.1
wrangler (source)	4.16.1 -> 4.18.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

cloudflare/workerd (@​cloudflare/workers-types)

v4.20250603.0

Compare Source

v4.20250601.0

Compare Source

v4.20250531.0

Compare Source

v4.20250529.0

Compare Source

v4.20250528.0

Compare Source

eslint/eslint (@​eslint/js)

v9.28.0

Compare Source

tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.1.8

Compare Source

Added

• Improve error messages when @apply fails (#​18059)

Fixed

• Upgrade: Do not migrate declarations that look like candidates in <style> blocks (#​18057, 18068)
• Upgrade: Don't error when looking for tailwindcss in pnpm monorepos (#​18065)
• Upgrade: Don't error when updating dependencies in pnpm monorepos (#​18065)
• Upgrade: Migrate deprecated order-none to order-0 (#​18126)
• Support Leptos class: attributes when extracting classes (#​18093)
• Fix "Cannot read properties of undefined" crash on malformed arbitrary value (#​18133)
• Upgrade: Migrate -mt-[0px] to mt-[0px] instead of the other way around (#​18154)
• Fix Haml pre-processing crash when there is no \n at the end of the file (#​18155)
• Ignore .pnpm-store folders by default (can be overridden by @source … rules) (#​18163)
• Fix PostCSS crash when calling toJSON() (#​18083)

vitejs/vite-plugin-react (@​vitejs/plugin-react-swc)

v3.10.1

Compare Source

Add explicit semicolon in preambleCode #​485

This fixes an edge case when using HTML minifiers that strips line breaks aggressively.

eslint/eslint (eslint)

v9.28.0

Compare Source

cloudflare/workers-sdk (miniflare)

v4.20250525.0

Compare Source

Minor Changes

• #​9387 e39a45f Thanks @​jamesopstad! - Add logReady method to Miniflare Log class. This makes it possible to override the messages printed on server start.

• #​9376 fdae3f7 Thanks @​jamesopstad! - Add support for Node.js style custom handlers for service bindings and outbound services. This makes it easier to integrate Miniflare with existing Node.js middleware and libraries as req and res objects can be used directly.

  new Miniflare({
  	serviceBindings: {
  		CUSTOM: {
  			node: (req, res) => {
  				res.end(`Hello world`);
  			},
  		},
  	},
  });

Patch Changes

• #​9366 d9d937a Thanks @​dependabot! - chore: update dependencies of "miniflare" package

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20250523.0	1.20250525.0
  @​cloudflare/workers-types	^4.20250523.0	^4.20250525.0

v4.20250523.0

Compare Source

Minor Changes

• #​9330 34c71ce Thanks @​edmundhung! - Add a new defaultPersistRoot option to control where plugins persist data when no path is provided.

  // Before this change / No `defaultPersistRoot`
  new Miniflare({
  	kvPersist: undefined, // → "/(tmp)/kv"
  	d1Persist: true, // → "$PWD/.mf/d1"
  	r2Persist: false, // → "/(tmp)/r2"
  	cachePersist: "/my-cache", // → "/my-cache"
  });
  
  // With `defaultPersistRoot`
  new Miniflare({
  	defaultPersistRoot: "/storage",
  	kvPersist: undefined, // → "/storage/kv"
  	d1Persist: true, // → "/storage/d1"
  	r2Persist: false, // → "/(tmp)/r2"
  	cachePersist: "/my-cache", // → "/my-cache"
  });

Patch Changes

• #​9184 f7c82a4 Thanks @​dependabot! - chore: update dependencies of "miniflare" package

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20250508.0	1.20250520.0
  @​cloudflare/workers-types	^4.20250508.0	^4.20250520.0

• #​9346 7ddd865 Thanks @​dependabot! - chore: update dependencies of "miniflare" package

  The following dependency versions have been updated:

  Dependency	From	To
  workerd	1.20250520.0	1.20250523.0
  @​cloudflare/workers-types	^4.20250520.0	^4.20250523.0

• #​9335 6479fc5 Thanks @​penalosa! - Redesign wrangler dev to more clearly present information and have a bit of a glow up ✨
  

• #​9106 e5ae13a Thanks @​edmundhung! - fix: decouple KV plugin from secrets store plugin

  The KV plugin previously configured both KV namespace and secrets store bindings with the same service name but different persistence paths, causing conflicts when both were defined. This change copies the KV binding implementation into the secrets store plugin and customizes its service name to prevent collisions.

typescript-eslint/typescript-eslint (typescript-eslint)

v8.33.1

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.33.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

cloudflare/workers-sdk (wrangler)

v4.18.0

Compare Source

Minor Changes

• #​9393 34b6174 Thanks @​jamesopstad! - Hard fail on Node.js < 20. Wrangler no longer supports Node.js 18.x as it reached end-of-life on 2025-04-30. See https://github.com/nodejs/release?tab=readme-ov-file#end-of-life-releases.

Patch Changes

• #​9308 d3a6eb3 Thanks @​dario-piotrowicz! - expose new utilities and types to aid consumers of the programmatic mixed-mode API

  Specifically the exports have been added:

  • Experimental_MixedModeSession: type representing a mixed-mode session
  • Experimental_ConfigBindingsOptions: type representing config-bindings
  • experimental_pickRemoteBindings: utility for picking only the remote bindings from a record of start-worker bindings.
  • unstable_convertConfigBindingsToStartWorkerBindings: utility for converting config-bindings into start-worker bindings (that can be passed to startMixedModeSession)

• #​9347 b8f058c Thanks @​penalosa! - Improve binding display on narrower terminals

• Updated dependencies [d9d937a, e39a45f, fdae3f7]:

  • miniflare@4.20250525.0

v4.17.0

Compare Source

Minor Changes

• #​9321 6c03bde Thanks @​petebacondarwin! - Add support for FedRAMP High compliance region

  Now it is possible to target Wrangler at the FedRAMP High compliance region.
  There are two ways to signal to Wrangler to run in this mode:

  • set "compliance_region": "fedramp_high" in a Wrangler configuration
  • set CLOUDFLARE_COMPLIANCE_REGION=fedramp_high environment variable when running Wrangler

  If both are provided and the values do not match then Wrangler will exit with an error.

  When in this mode OAuth authentication is not supported.
  It is necessary to authenticate using a Cloudflare API Token acquired from the Cloudflare FedRAMP High dashboard.

  Most bindings and commands are supported in this mode.

  • Unsupported commands may result in API requests that are not supported - possibly 422 Unprocessable Entity responses.
  • Unsupported bindings may work in local dev, as there is no local validation, but will fail at Worker deployment time.

  Resolves DEVX-1921.

• #​9330 34c71ce Thanks @​edmundhung! - Updated internal configuration to use Miniflare’s new defaultPersistRoot instead of per-plugin persist flags

• #​8973 cc7fae4 Thanks @​Caio-Nogueira! - Show latest instance by default on workflows instances describe command

Patch Changes

• #​9335 6479fc5 Thanks @​penalosa! - Redesign wrangler dev to more clearly present information and have a bit of a glow up ✨
  

• #​9329 410d985 Thanks @​penalosa! - Hide logs in the startMixedModeSession() API

• #​9325 c2678d1 Thanks @​edmundhung! - refactor: fallbacks to local image binding from miniflare when local mode is enabled

• Updated dependencies [34c71ce, f7c82a4, 7ddd865, 6479fc5, e5ae13a]:

  • miniflare@4.20250523.0

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.