chore(deps-dev): bump the development-dependencies group across 1 directory with 10 updates

[dependabot]

Bumps the development-dependencies group with 10 updates in the /website directory:

Package	From	To
@cloudflare/vite-plugin	1.47.0	1.54.1
@types/node	26.1.2	26.4.0
@types/react	19.2.17	19.2.18
@types/react-dom	19.2.3	19.2.5
@vitejs/plugin-react	6.0.4	6.1.1
@vitejs/plugin-rsc	0.5.32	0.5.34
eslint-config-next	16.2.12	16.3.3
vinext	0.0.50	0.2.1
vite	8.1.5	8.2.2
wrangler	4.114.0	4.127.0

Updates @cloudflare/vite-plugin from 1.47.0 to 1.54.1

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.54.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

@​cloudflare/vite-plugin@​1.54.0

Minor Changes

• #15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

  Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

• #15326 9fcb1c9 Thanks @​jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

  The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.

Patch Changes

• Updated dependencies [aa54b49, 4a67a28, 2d78137, 04e8564, d1cc3af, 693ca29, 693ca29, 693ca29, daefb3c, 37ed753, f76b68e, ad89456, c809851, c66d2d5, 693ca29, 74de3ab, 0cb8690, 9fcb1c9, 22182da, a4c3458, 433fa98, d589d30, dd5148d, 82d11fc]:
  • miniflare@5.20260825.0-alpha
  • wrangler@4.126.0

@​cloudflare/vite-plugin@​1.53.1

Patch Changes

• Updated dependencies [59872c4, c68f9cb, 99a1f49, 5ae9d5b, 4b52975, ce9b151, ef73a28, 649f667, 39dcea6, 99a1f49, 99a1f49, 99a1f49, f2437e6, 30c2d47]:
  • wrangler@4.125.0
  • miniflare@5.20260820.0-alpha

@​cloudflare/vite-plugin@​1.53.0

Minor Changes

• #15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

  A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

  {
    "name": "my-worker",
    "main": "worker.js",
    "compatibility_date": "2026-07-01",
    "containers": [
      { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
    ],
    "exports": {
      "MyContainerDO": {
        "type": "durable-object",
        "storage": "sqlite",

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.54.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

1.54.0

Minor Changes

• #15134 c66d2d5 Thanks @​gpanders! - Enable FUSE-capable local container development

  Miniflare now automatically passes the Docker privileges needed for FUSE to local Durable Object containers when using local rootless Docker on Linux with /dev/fuse available, or a local Docker engine on macOS or through WSL where Linux containers run in a VM. This applies to Wrangler, the Cloudflare Vite plugin, and direct Miniflare use.

• #15326 9fcb1c9 Thanks @​jamesopstad! - Record the selected mode in the Build Output Specification top-level config.json

  The mode a build was produced in is now written to .cloudflare/output/v0/config.json as a mode field, alongside the account and compliance settings.

Patch Changes

• Updated dependencies [aa54b49, 4a67a28, 2d78137, 04e8564, d1cc3af, 693ca29, 693ca29, 693ca29, daefb3c, 37ed753, f76b68e, ad89456, c809851, c66d2d5, 693ca29, 74de3ab, 0cb8690, 9fcb1c9, 22182da, a4c3458, 433fa98, d589d30, dd5148d, 82d11fc]:
  • miniflare@5.20260825.0-alpha
  • wrangler@4.126.0

1.53.1

Patch Changes

• Updated dependencies [59872c4, c68f9cb, 99a1f49, 5ae9d5b, 4b52975, ce9b151, ef73a28, 649f667, 39dcea6, 99a1f49, 99a1f49, 99a1f49, f2437e6, 30c2d47]:
  • wrangler@4.125.0
  • miniflare@5.20260820.0-alpha

1.53.0

Minor Changes

• #15026 6529f0c Thanks @​petebacondarwin! - Allow containers to be attached to a Durable Object from its exports entry

  A container can now be linked to its Durable Object from the export side, using a new container field that names an entry in the containers array. As a result containers[].class_name is now optional — a container that is referenced this way only needs a name:

  {
    "name": "my-worker",
    "main": "worker.js",
    "compatibility_date": "2026-07-01",
    "containers": [
      { "name": "my-container", "image": "./Dockerfile", "max_instances": 1 }
    ],

... (truncated)

Commits

• a831498 Version Packages (#15372)
• e9df120 Support multiple named Workers in the build output (#15371)
• 5377aae Version Packages (#15354)
• e56d2e6 Revert "Version Packages" (#15355)
• d765e10 Version Packages (#15291)
• 9fcb1c9 Include mode in build output (#15326)
• 38b4623 Version Packages (#15250)
• 8ee43f6 Version Packages (#15175)
• 1552bce [wrangler] Quieten warnings and stray output in tests (#15209)
• 3a4fc6b Pass access configuration to Router Worker (#15238)
• Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.4.0

Commits

• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.5

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.0.4 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• Additional commits viewable in compare view

Updates @vitejs/plugin-rsc from 0.5.32 to 0.5.34

Release notes

Sourced from @​vitejs/plugin-rsc's releases.

plugin-rsc@0.5.34

Features

• rsc: support inline "use cache" exports in file-level "use server" modules and vice versa (#1415) (5626b31)
• rsc: support inline directive methods (#1413) (40300f1)

Documentation

• rsc: document use cache examples (#1407) (4b0e3c7)

Miscellaneous Chores

• rsc: clarify use cache example (#1410) (fa4dba4)

Tests

• rsc: add persistent use cache example (#1411) (fc7ace5)

plugin-rsc@0.5.33

Features

• rsc: add ability to access client entry URL from ssr environment and deprecate loadBootstrapScriptContent (#1360) (c2e0273)
• rsc: allow transformWrapExport filter by node ast (#1385) (64ae63c)
• rsc: allow proxy export filter by node ast (#1397) (2fee299)
• rsc: provide ast node value metadata in transformHoistInlineDirective + update example to exclude undeclared caller arguments for use cache cache keys (inline directive) (#1404) (cd829da)
• rsc: support hoisting with runtime wrapper in transformHoistInlineDirective + add callable use cache example (#1330) (0f45d15)

Bug Fixes

• rsc: align transform API types with Vite AST (#1351) (2906fbf)
• rsc: avoid rewriting filtered exports in transformWrapExport (#1387) (fba021f)
• rsc: reject static non-function exports for use server file (#1383) (c046a90)
• rsc: reject uninitialized export in use server file (#1384) (96f3cdd)
• rsc: treat strings as directives only at the top (#1396) (fcb0ca5)
• rsc: use module export effect transform for use server file directive (#1355) (640d7d7)

Documentation

• rsc: prefer /rsc/server and /rsc/client entry points over /rsc (#1345) (8d4b7f2)

Miscellaneous Chores

• deps: update react-related dependencies (#1374) (ad9d77c)
• rsc: add use cache example with closure encryption (#1398) (f97d959)
• rsc: add action request routing example with cross-environment server reference module reachability (#1341) (b8c9264)
• rsc: align example framework baseline (#1344) (317f769)
• rsc: remove stale source map todo in transformServerActionServer (#1354) (88f7f0c)
• rsc: update action reachability example to validate progressive form action (#1364) (793a994)
• rsc: update example to exclude undeclared caller arguments for use cache cache keys (file directive only) (#1401) (b0521cc)

... (truncated)

Changelog

Sourced from @​vitejs/plugin-rsc's changelog.

0.5.34 (2026-08-07)

Features

• rsc: support inline "use cache" exports in file-level "use server" modules and vice versa (#1415) (5626b31)
• rsc: support inline directive methods (#1413) (40300f1)

Documentation

• rsc: document use cache examples (#1407) (4b0e3c7)

Miscellaneous Chores

• rsc: clarify use cache example (#1410) (fa4dba4)

Tests

• rsc: add persistent use cache example (#1411) (fc7ace5)

0.5.33 (2026-08-06)

Features

• rsc: add ability to access client entry URL from ssr environment and deprecate loadBootstrapScriptContent (#1360) (c2e0273)
• rsc: allow transformWrapExport filter by node ast (#1385) (64ae63c)
• rsc: allow proxy export filter by node ast (#1397) (2fee299)
• rsc: provide ast node value metadata in transformHoistInlineDirective + update example to exclude undeclared caller arguments for use cache cache keys (inline directive) (#1404) (cd829da)
• rsc: support hoisting with runtime wrapper in transformHoistInlineDirective + add callable use cache example (#1330) (0f45d15)

Bug Fixes

• rsc: align transform API types with Vite AST (#1351) (2906fbf)
• rsc: avoid rewriting filtered exports in transformWrapExport (#1387) (fba021f)
• rsc: reject static non-function exports for use server file (#1383) (c046a90)
• rsc: reject uninitialized export in use server file (#1384) (96f3cdd)
• rsc: treat strings as directives only at the top (#1396) (fcb0ca5)
• rsc: use module export effect transform for use server file directive (#1355) (640d7d7)

Documentation

• rsc: prefer /rsc/server and /rsc/client entry points over /rsc (#1345) (8d4b7f2)

Miscellaneous Chores

• deps: update react-related dependencies (#1374) (ad9d77c)
• rsc: add use cache example with closure encryption (#1398) (f97d959)
• rsc: add action request routing example with cross-environment server reference module reachability (#1341) (b8c9264)
• rsc: align example framework baseline (#1344) (317f769)
• rsc: remove stale source map todo in transformServerActionServer (#1354) (88f7f0c)
• rsc: update action reachability example to validate progressive form action (#1364) (793a994)
• rsc: update example to exclude undeclared caller arguments for use cache cache keys (file directive only) (#1401) (b0521cc)

... (truncated)

Commits

• 72f1fc7 release: plugin-rsc@0.5.34 (#1416)
• 5626b31 feat(rsc): support inline "use cache" exports in file-level "use server" ...
• 40300f1 feat(rsc): support inline directive methods (#1413)
• fc7ace5 test(rsc): add persistent use cache example (#1411)
• 4b0e3c7 docs(rsc): document use cache examples (#1407)
• fa4dba4 chore(rsc): clarify use cache example (#1410)
• 11ad0af release: plugin-rsc@0.5.33 (#1408)
• 42ce5d4 test(rsc): decrypt cache captures once in use cache example (#1403)
• cd829da feat(rsc): provide ast node value metadata in transformHoistInlineDirective...
• c5683a6 test(rsc): migrate hoist output fixtures (#1406)
• Additional commits viewable in compare view

Updates eslint-config-next from 16.2.12 to 16.3.3

Release notes

Sourced from eslint-config-next's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in vercel/next.js#97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in vercel/next.js#97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in vercel/next.js#97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in vercel/next.js#97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in vercel/next.js#97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in vercel/next.js#97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in vercel/next.js#97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in vercel/next.js#97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in vercel/next.js#97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @​gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits

• a9a1cb7 v16.3.3
• d0ac882 v16.3.2
• 3d32eb8 v16.3.1
• d73f562 v16.3.0
• 4fd843f v16.3.0-canary.107
• 9480f7f v16.3.0-canary.106
• a8dcd25 v16.3.0-canary.105
• 38f0cde v16.3.0-canary.104
• f3edea1 v16.3.0-canary.103
• 0d5ff0d v16.3.0-canary.102
• Additional commits viewable in compare view

Updates vinext from 0.0.50 to 0.2.1

Release notes

Sourced from vinext's releases.

vinext@0.2.1

Bug Fixes

App Router

• limit mounted slot cache variants (#2497)
• omit pending RSC cache state for query renders (#2488)
• isolate global not-found css (#2444)
• expose app rewrites to pages data clients (#2468)
• publish committed no-prefetch navigations (#2469)
• cache segment prefetches by rendered search params (#2477)
• skip readiness waits for speculative prerenders (#2457)
• align app static ISR lifecycle (#2472)
• reuse metadata rewrite prefetches (#2455)
• avoid runtime route-tree prefetch sizing (#2467)
• start optimistic prefetches immediately (#2440)
• normalize rsc reference validation ids (#2480)
• send deployment id on RSC responses (#2452)
• separate header-only full-route rsc requests (#2445)
• preserve app rewrite filtering (#2441)
• revalidate dynamic intercepted actions (#2443)
• evict segment prefetches under memory pressure (#2466)
• honor basePath false rewrites (#2370)
• preserve rewritten route identity (#2358)
• support styled-jsx from next (#2341)

Pages

• align middleware data prefetch caching (#2451)
• honor basePath false rewrites (#2442)
• normalize data routes for trailing slash middleware (#2470)
• align prerender functional parity (#2471)
• enforce reactStrictMode by wrapping client root in (#2433)
• preload initial dev stylesheets (#2423)
• route dotted dynamic paths in dev (#2424)

Misc

• fully elide inline type-only import specifiers (#2498)
• Config: escape destination query params (#2494)
• Link: avoid reusing dynamic app route prefetches (#2450)
• Build: handle dynamic requests in JS files with JSX (#1736)
• Dev: treat .js as JSX in the optimizeDeps scanner (#2434)
• Config: resolve and bundle extensionless .cjs config imports (#2435)
• CSS: preserve Sass partial asset URLs (#2338)
• Link: reuse full prefetch loading shells (#2332)
• Dev: seed Cloudflare Pages Router worker deps (#2430)
• Cloudflare: support Sentry request errors on Workers (#2425)
• use normalizePathSeparators in formatAppFilePath for Windows compatibility (#2426)
• Routing: use normalizePathSeparators(path.relative) instead of path.posix.relative (#2308)

... (truncated)

Commits

• 5471b41 chore: version packages (#2428)
• b7455c3 fix: fully elide inline type-only import specifiers (#2498)
• 5915c87 fix(app-router): limit mounted slot cache variants (#2497)
• 336450a fix(config): escape destination query params (#2494)
• e0db846 fix(cloudflare): respect TPR c...

  Description has been truncated