Bump the npm-dependencies group with 4 updates

[dependabot]

Bumps the npm-dependencies group with 4 updates: astro, zod, @cloudflare/workers-types and wrangler.

Updates astro from 7.3.1 to 7.3.2

Release notes

Sourced from astro's releases.

astro@7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

Changelog

Sourced from astro's changelog.

7.3.2

Patch Changes

• #17896 a548223 Thanks @​matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

• #17931 c1a6a89 Thanks @​astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

• #17908 42e9188 Thanks @​astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

• #17936 4b92ddc Thanks @​astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

• Updated dependencies [a548223]:

  • @​astrojs/markdown-satteri@​0.4.1

Commits

• aa4949e [ci] release (#17915)
• 42e9188 fix(i18n): replace locale segment by index in fallback routing (#17907) (#17908)
• 4b92ddc Guard setFetchHandler call in non-runnable dev entrypoint to fix sessions + m...
• c1a6a89 fix: include .astro files in client optimizeDeps entries to prevent 504 on la...
• a548223 Only treat literal script/style content as raw in MDX rendering (#17896)
• See full diff in compare view

Updates zod from 4.5.4 to 4.6.2

Release notes

Sourced from zod's releases.

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

• .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
• z.instanceof().properties() — validates properties of an instance
• fromJSONSchema() — enforces six validation keywords it used to ignore
• z.iban() — electronic-format IBAN plus mod-97 checksum
• z.withParser() — installs a parser generated elsewhere, for environments without new Function
• Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
• Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
• @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});
</tr></table>

... (truncated)

Commits

• e359f73 4.6.2
• 9446b5c fix: preserve undefined prefault outputs and object keys (#6587)
• 0c483c5 docs: Zod 4.6 announcement post (#6546)
• a00c3f3 docs: use Trigger.dev's brand-kit lockups for the platinum card
• 62311eb 4.6.1
• 2efa8b8 ci: give the npm wait a real budget and drop the back-publish path (#6583)
• b12aa52 fix: preserve unique tags with defaulted discriminators (#6582)
• dd9c36f fix(v4): defer recursive object index inference (#6580)
• 574d480 fix(locales): clarify Tajik discriminator value message
• c532d76 test(locales): cover Tajik error branches
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260904.1 to 5.20260911.1

Commits

• See full diff in compare view

Updates wrangler from 4.129.0 to 4.131.0

Release notes

Sourced from wrangler's releases.

wrangler@4.131.0

Minor Changes

• #15480 36aed7f Thanks @​skepticfx! - Add Durable Object-managed Containers to top-level container configuration

  Wrangler now accepts scheduling_policy: "durable_object" in the top-level containers array and creates its namespace-backed application after the Worker upload resolves the Durable Object namespace ID. The namespace ID is also the application ID, so repeated deploys idempotently ensure the same application without name-based lookup, modification, or a Containers rollout.

  Durable Object-managed entries accept class_name, scheduling_policy, an optional name, and an optional named images map. Scheduler-only fields are rejected. Each image provides either a local dockerfile or a digest-pinned managed-registry image. Wrangler builds or resolves each image, waits while Cloudflare prepares it for the Containers runtime, and uploads the resulting references with the Worker version for access through ctx.container.images and env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Local development support for these entries is deferred to a follow-up.

  Existing scheduler-backed entries and Durable Object migrations continue to work unchanged.

  With --containers-rollout=none, existing Workers retain their deployed Container metadata and image binding even when local containers is omitted or empty; local scheduler edits are also ignored. The upload stops if the deployed versions cannot be recovered. Existing Workers for Platforms dispatch scripts reject this flag before upload because their API does not expose enough metadata to preserve Container associations safely. First deployments can still skip Container preparation and rollout. Without this flag, removing managed Containers, including by omitting containers entirely, clears the experimental image binding even with keep_vars.

  versions deploy validates the selected versions before changing traffic and creates their Durable Object-managed applications only after deployment succeeds. Both deploy and versions deploy report partial completion if application creation fails afterward, with instructions to retry the same command.

  EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES is a temporary, reserved Wrangler binding until native Container image metadata is available. Its class keys identify managed applications during versions deploy, including classes with empty image maps. User configuration cannot declare a binding with this name; existing versions that already use it are treated as Container configuration.

• #15493 493e635 Thanks @​GregBrimble! - Remove wrangler preview settings commands

  The private-beta wrangler preview settings and wrangler preview settings update commands are no longer available.

Patch Changes

• #15411 0b43395 Thanks @​xgame92! - Fail wrangler versions upload early when a Worker has a pending Durable Object migration

  Wrangler now directs users to run wrangler deploy to apply the migration instead of sending a version upload request that the API will reject.

• #15518 9d75006 Thanks @​taylorlee! - Detect named-only module Worker entrypoints correctly

  Wrangler now distinguishes named-only module Workers from legacy Service Workers that happen to have named exports. A default export identifies a module Worker; otherwise, legacy addEventListener registration identifies Service Worker format.

• #15581 b605aa6 Thanks @​MattieTK! - Correct Pages-to-Workers delegation analytics for forced and ineligible commands

  The legacy forced result counted every agent-driven Pages command using --force, including commands that could never have been delegated. Wrangler now emits eligible_forced only when --force prevents an otherwise eligible delegation, and records other agent commands as ineligible with a bounded reason and whether force was used.

• #15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• #15585 f69f95a Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260908.1	^5.20260910.1
  workerd	1.20260908.1	1.20260910.1

• #15554 bff525d Thanks @​XiaoZ-0218! - Add the missing transferred_classes migration to the config schema

... (truncated)

Commits

• 41d7366 Version Packages (#15568)
• b605aa6 [wrangler] Correct Pages delegation analytics (#15581)
• 96688b3 fix(deps): bump shell-quote to patch CVE-2026-9277 / CVE-2026-13311 (#15584)
• 24ef86b [wrangler] Handle dynamic retry delays in workflows instances describe (#15569)
• 36aed7f CC-8364 Add top-level Durable Object-managed Containers (#15480)
• f8aea7e Replace remaining preview_defaults references with previews_base_config (...
• 9d75006 [wrangler] Fix named-only module Worker format detection (#15518)
• 128235a [wrangler] Fix types --strict-vars=false emitting invalid TypeScript for an...
• bff525d fix(wrangler): include transferred_classes in DurableObjectMigration schema (...
• 493e635 Remove the wrangler preview settings and wrangler preview settings update...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	devcongress-website	bfd9ce2	Commit Preview URL Branch Preview URL	Sep 14 2026, 05:22 AM