Update dependency @opennextjs/cloudflare to v1.20.12 by renovate[bot] · Pull Request #14 · Boomchainlab/web4

Patch Changes

#1453 5d8c5bc Thanks @vicb! - chore: bump @opennextjs/aws to 4.1.11

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.11
- Add support for Next.js 16.4
- Bump Next.js dependencies following the Next.js security update on Oct 14
#1356 f993c8c Thanks @chargome! - fix(patches): include preview-props.json in loadManifest build-time inlining

`v1.20.11`

Patch Changes

#1451 a6893b8 Thanks @vicb! - chore: bump @opennextjs/aws to 4.1.10

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.10
#1437 6be5daf Thanks @mathurshubham! - fix: do not bundle @vercel/og into the Node.js middleware when it is not used

`v1.20.10`

Patch Changes

#1426 66b4a2d Thanks @vicb! - chore: bump @opennextjs/aws to 4.1.9

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.9
#1419 8327c21 Thanks @Adnan-Husayn! - fix: set the image Content-Type from the format produced by the Images binding

The Images binding can fall back to another format than the requested one, i.e. from AVIF to WebP for large images. /_next/image responses were labelled with the requested format, so the Content-Type could disagree with the image bytes.
#1420 afea1a0 Thanks @cpruijsen! - fix: skip route directories matching the loadManifest globs

opennextjs-cloudflare build no longer fails with EISDIR or an unresolved import when an App Router route directory matches an internal manifest glob. Only manifest files are now inlined.
#1423 a515128 Thanks @Adnan-Husayn! - fix: do not log Failed to copy for packages whose exports is a string

`v1.20.9`

Patch Changes

#1416 63cbece Thanks @vicb! - chore: bump @opennextjs/aws to 4.1.8

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.8
#1416 63cbece Thanks @vicb! - fix: isolate module-loading cache signals between requests

Prevent Next.js 15.4 and newer Cache Components from failing under concurrent traffic with Cannot perform I/O on behalf of a different request when module-loading timers cross Cloudflare Worker request contexts.

`v1.20.8`

Patch Changes

#1411 1551d6f Thanks @vicb! - chore: bump @opennextjs/aws to 4.1.7

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.7
#1411 31009e1 Thanks @vicb! - chore: require Next.js 15.5.27 or 16.3.8

Raise the supported Next.js version floor to 15.5.27 and 16.3.8 to include the latest security fixes.

`v1.20.7`

Patch Changes

#1403 dc3c0ab Thanks @aa-sikkkk! - fix: replace the whole loadCustomCacheHandlers body so Next.js 16.3 chunks don't throw ReferenceError

Next.js 16.3 rewrote loadCustomCacheHandlers: the declaration that binds cacheHandlers now also binds
cacheMaxMemorySize, and the native method body consumes both. The composable cache patch replaced only that
declaration, so on the minified runtime chunks (dist/compiled/next-server/*.runtime.prod.js) the surviving
native code referenced bindings that were no longer declared. Every request to the Worker then failed with
ReferenceError: <minified identifier> is not defined inside loadCustomCacheHandlers (site-wide 500s on
Next.js 16.3.x), while builds stayed green because the unminified next-server.js short-circuits on
if (!cacheHandlers) return before the orphaned binding is read.

The patch now replaces the whole method body while preserving its signature and wires the composable cache
registry to the static require() as before, so no native reference to a dropped binding can survive. The
rule still matches pre-16.3 chunks, so older Next.js versions are unaffected.
#1399 2b3e3a1 Thanks @JT1974! - fix: throw MODULE_NOT_FOUND from the stub of a missing optional dependency

With React 18, every Pages Router page rendered by the Worker failed with TypeError: Cannot read properties of undefined (reading 'contexts'), caused by Error: Missing optional dependency "react-dom/server.edge". React 18 has no react-dom/server.edge, and Next.js falls back to react-dom/server.browser only when the error carries the MODULE_NOT_FOUND code. The stub now sets that code, so the fallback works again.
#1406 8ea9eb9 Thanks @mgarbacz! - fix: only rename esbuild's __require helper, not __require properties

Restoring esbuild's __require helper to a bare require was a text replacement over the
whole bundle, so it also rewrote unrelated __require members. @rollup/plugin-commonjs
emits exports.__require lazy-init wrappers, whose declarations the replacement never
matched — leaving the two halves disagreeing and throwing
TypeError: __webpack_require__(...).require is not a function when such a package was
imported during SSR. Packages built that way (for example smartystreets-javascript-sdk)
500'd every route. The rename now skips property accesses.
#1404 ca4415b Thanks @vicb! - chore: require Next.js 15.5.26 or 16.3.6

Raise the supported Next.js version floor to 15.5.26 and 16.3.6. Next.js 16.2.0 through 16.3.5 are affected
by the critical next/og remote code execution vulnerability CVE-2026-94545.
#1404 ca4415b Thanks @vicb! - chore: bump @opennextjs/aws to 4.1.6

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.6

Patch Changes

#1361 8c31fbc Thanks @vicb! - chore: bump @opennextjs/aws to 4.1.1

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.1
#1359 65e4487 Thanks @vicb! - chore: bump the Next.js peer dependency to 15.5.24 / 16.3.3
#1359 65e4487 Thanks @vicb! - fix: patch the Turbopack wasm helpers that Next.js 16.3 emits in the chunks

Until Next.js 16.2 the Turbopack wasm loaders were named loadWebAssembly and
loadWebAssemblyModule functions living in [turbopack]_runtime.js, which the adapter rewrote to
resolve the chunk through a static import(). Next.js 16.3 emits them on demand in the chunks
instead ([turbopack-wasm]/node/loadWasm.ts), so the existing patch silently stopped matching and
WebAssembly.compileStreaming - which workerd does not implement - survived into the Worker.

Every wasm backed import then threw TypeError: WebAssembly.compileStreaming is not a function at
runtime, most visibly breaking Prisma with the workerd client runtime.

The chunks emitted by Turbopack are now patched as well, for both the server and the Node.js
middleware bundles.
#1309 56dfacc Thanks @ScienHAC! - feature: support Node.js middleware (proxy.ts)

Next.js 16 replaces middleware.ts with proxy.ts which always runs on the Node.js runtime.

The Node.js middleware is now bundled into a Workers compatible middleware/handler.mjs:
the OpenNext config manifests are inlined at build time (as for the edge middleware) and the
middleware compiled by Next.js is statically bundled instead of being loaded from the
filesystem at runtime (workerd can not access the filesystem nor load modules at runtime).

The support is experimental and requires the nodejs_compat compatibility flag.
#1359 65e4487 Thanks @vicb! - fix: do not load the instrumentation hook from the Node.js middleware bundle

Next.js 16.3 registers the instrumentation hook from the middleware itself when the middleware
does not run on the edge runtime, by dynamically requiring .next/server/instrumentation.js.
workerd does not support dynamic requires so every request handled by the Node.js middleware
(proxy.ts) failed with Dynamic require of ".next/server/instrumentation.js" is not supported.

The guard Next.js uses (process.env.NEXT_RUNTIME !== "edge") is inlined by Next.js when it
compiles the middleware, so it can not be eliminated when the middleware is re-bundled. The loader
is stubbed out instead, which matches the edge runtime behaviour: the server function - which
shares the isolate - keeps registering the hook.

`v1.20.2`

Patch Changes

#1312 38ea40b Thanks @james-elicx! - fix: handle encoded middleware and cache paths safely

Upgrade @opennextjs/aws to prevent encoded paths from bypassing middleware matching or selecting partially decoded cache entries.
#1313 766eee9 Thanks @james-elicx! - chore: bump the Next.js peer dependency to 15.5.21 / 16.2.11
#1306 97ef330 Thanks @james-elicx! - fix: normalize Windows paths when patching the Turbopack runtime

Ensure traced Turbopack chunks are included in the generated runtime loaders when builds run on Windows.

`v1.20.1`

Patch Changes

#1453 5d8c5bc Thanks @vicb! - chore: bump @opennextjs/aws to 4.1.11

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.1.11
- Add support for Next.js 16.4
- Bump Next.js dependencies following the Next.js security update on Oct 14
#1356 f993c8c Thanks @chargome! - fix(patches): include preview-props.json in loadManifest build-time inlining

`v1.20.0`

Minor Changes

#1290 46c50fc Thanks @james-elicx! - feature: add opt-in batch upload via rclone for fast R2 cache population.

Key Changes:
1. Optional rclone Upload: Install the optional rclone.js peer dependency and pass --rclone to opt in to rclone based batch uploads.
  - R2_ACCESS_KEY_ID
  - R2_SECRET_ACCESS_KEY
  - CF_ACCOUNT_ID
2. Explicit Opt-in: The existing worker-based population path remains the default. rclone is only loaded when --rclone is used for a remote cache.
3. Clear Errors: The CLI reports missing credentials or a missing rclone.js installation when the option is used.
Usage:

Install rclone.js, then add the secrets in a .env/.dev.vars file in your project root:
```
pnpm add rclone.js
pnpm approve-builds # select rclone.js
pnpm rebuild rclone.js
R2_ACCESS_KEY_ID=your_key
R2_SECRET_ACCESS_KEY=your_secret
CF_ACCOUNT_ID=your_account

opennextjs-cloudflare deploy --rclone
```
You can also set the environment variables for CI builds.

Notes:
- You can follow documentation https://developers.cloudflare.com/r2/api/tokens/ for creating API tokens with appropriate permissions for R2 access.
- rclone may not be supported on all platforms.

Patch Changes

#1289 eef243f Thanks @thatssoheil! - fix: spread SQLite bindings in BucketCachePurge alarm so tag purges run

BucketCachePurge.alarm() passed its tag bindings to SqlStorage.exec as a
single array. exec(query, ...bindings) is variadic over its bindings, so for a
multi-tag DELETE ... WHERE tag IN (?, ?, …) the binding count (1) disagreed
with the placeholder count (N) and exec threw "Wrong number of parameter
bindings" on every flush. On-demand revalidateTag purges therefore never
reached the Cloudflare cache, and with bypassTagCacheOnCacheHit enabled pages
served stale until the ISR TTL expired.

Spread the bindings, normalise the INSERT to the same variadic form, and
tighten the drain loop's guard from while (tags.length >= 0) (which never
exits via the condition) to while (tags.length > 0).
#1291 51439b1 Thanks @james-elicx! - fix: disable response compression when provisioning R2 cache buckets

Avoid truncated compressed Cloudflare API responses causing R2 cache bucket provisioning to fail.

`v1.19.11`

Patch Changes

#1270 802047e Thanks @alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mapping

Worker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing /_next/static/* requests to return 404 on past deployments. Versions are now filtered to those with workers/triggered_by in {upload, version_upload}.

Closes #1230

`v1.19.10`

Patch Changes

#1261 780dd4f Thanks @vicb! - Allow populating R2 when the domain is protected by Cloudflare Access

You need to:
- create a "Service Auth" policy for "open-next-cache-populate..workers.dev"
- add an "Include" rule for "Any Access Service Token" or for a given service token ("Service Token")
- populate the env variables CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET

`v1.19.9`

Patch Changes

#1259 3b35c6e Thanks @vicb! - chore: bump Next.js to 15.5.18 / 16.2.6 and @opennextjs/aws to 4.0.2

`v1.19.8`

Patch Changes

#1256 9696cd0 Thanks @vicb! - bump @opennextjs/aws to 4.0.1

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v4.0.1

`v1.19.7`

Patch Changes

#1252 29fe15d Thanks @vicb! - bump the number of retries for r2 cache uploads

Increase the retry count from 5 to 15 with a capped exponential backoff to improve resilience against transient R2 write failures during cache population.
#1255 364b7d9 Thanks @vicb! - Bump react and next

`v1.19.6`

Patch Changes

#1246 5d2014f Thanks @vicb! - fix: do not log expected expected D1 errors

The populateCache command adds columns to the D1 tag cache for SWR support.
This is required for older deployments made before those column were added.
SQLite errors when the columns exist and we should not log those errors.
#1244 01babce Thanks @tahmid-23! - fix: drop streaming wasm calls in Turbopack runtime

Turbopack replaces wasm imports using WebAssembly.compileStreaming and
WebAssembly.instantiateStreaming. These functions are not available in
the workerd runtime.

We add a helper loadWasmChunkFn. This is a generated switch statement
that contains an import for each wasm chunk. We use static strings for
all imports to ensure that all necessary wasm chunks will be detected
and bundled for the final build.

The Turbopack patcher replaces the invocations in loadWebAssembly and
loadWebAssemblyModule, using the synchronous WebAssembly.instantiate
and redirecting to loadWasmChunkFn.
#1243 1c815de Thanks @tahmid-23! - fix: detect object-valued conditions

The pre-existing build condition transform logic had subtle errors:
- failed to recognize object conditions
  (e.g. "workerd": { "import": ..., "require": ... })
- sibling pruning only applied to strings, not objects
Now, we fully support object conditions. Furthermore, we prune siblings,
unless its subtree also contains the build condition.

`v1.19.5`

Patch Changes

#1240 dd7de1d Thanks @vicb! - fix: add missing git ignored files for the migrate command

`v1.19.4`

Patch Changes

#1221 a2679bf Thanks @mushan0x0! - Stop bundling @vercel/og (and its ~1.4 MiB resvg.wasm) when the app does not use it.

Next.js's externalImport helper keeps a dynamic import("next/dist/compiled/@vercel/og/index.edge.js") in the emitted handler even for apps that never use ImageResponse / opengraph-image. Previously this module was marked as external when useOg was false, which left Wrangler to resolve and bundle it — pulling in ~800 KiB of JS plus resvg.wasm and pushing many Workers over the Cloudflare free-tier 3 MiB gzip limit.

When useOg is false, the edge entry is now aliased to the existing throw.js shim, so the unreachable dynamic import resolves to a tiny module and the real @vercel/og library is no longer pulled into the Worker bundle.
#1208 2c5b472 Thanks @edmundhung! - Use OPEN_NEXT_BUILD_ID instead of NEXT_BUILD_ID in the cache keys.

As of Next 16.2 NEXT_BUILD_ID is a fixed value when deploymentId is set explicitly.

See opennextjs/opennextjs-aws#1144
#1193 1e8d232 Thanks @conico974! - Fix tag cache stale logic

`v1.19.3`

Patch Changes

#1215 608893e Thanks @vicb! - Factor large repeated values in manifests

This reduce the size of the generated code.
#1218 f0d0226 Thanks @314systems! - remove process.version override

Remove process.version / process.versions.node overrides now that unjs/unenv#493 is merged and shipped in unenv@2.0.0-rc.16 (project uses 2.0.0-rc.24)
#1199 32594d6 Thanks @SdSadat! - fix(cli): fail fast in non-TTY environments instead of hanging on config-creation prompts

When open-next.config.ts (or wrangler.(toml|json|jsonc)) is missing, the CLI
prompts the user to auto-create it. In non-TTY environments (Cloudflare Workers
Builds, Docker, CI) the Enquirer prompt can't read stdin, so the build hangs or
fails with a truncated prompt and a cryptic exit code — the user sees
? Missing required open-next.config.ts file, do you want to create one? (Y/n)
and then ELIFECYCLE Command failed with exit code 13, with no hint at what
to do next.

Now, in non-interactive environments, both prompts throw an actionable error
with the exact template to paste (for open-next.config.ts) or point at the
existing --skipWranglerConfigCheck / SKIP_WRANGLER_CONFIG_CHECK escape
hatch (for the wrangler config). Interactive behavior is unchanged.

`v1.19.2`

Patch Changes

#1207 0958726 Thanks @edmundhung! - bump @opennextjs/aws to 3.10.2

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.10.2
#1139 79b01b8 Thanks @james-elicx! - Fix Turbopack external module resolution by dynamically discovering external imports at build time.

When packages are listed in serverExternalPackages, Turbopack externalizes them via externalImport() which uses dynamic await import(id). The bundler (ESBuild) can't statically analyze import(id) with a variable, so these modules aren't included in the worker bundle.

This patch:
- Discovers hashed Turbopack external module mappings from .next/node_modules/ symlinks (e.g. shiki-43d062b67f27bbdc → shiki)
- Scans traced chunk files for bare external imports (e.g. externalImport("shiki")) and subpath imports (e.g. shiki/engine/javascript)
- Generates explicit switch/case entries so the bundler can statically resolve and include these modules
#1203 6f02d12 Thanks @314systems! - fix: exclude unsupported Next.js 16 releases from peer dependencies.

The previous range allowed Next.js 16.0.0 through 16.2.2 without a peer dependency warning because >=16.2.3 was already covered by >=15.5.15.

The range now explicitly supports Next.js 15.5.15 and above in the 15.x line, and Next.js 16.2.3 and above in the 16.x line.
#1200 7820ad0 Thanks @NathanDrake2406! - fix: reuse sharded tag data when filling the regional cache.

The sharded tag cache miss path already reads tag data from the Durable Object before answering the request. Reuse that fetched data when populating the regional cache so a shard miss does not immediately trigger a second identical Durable Object read.
#1206 585795d Thanks @314systems! - fix: regression where getEnvFromPlatformProxy received wrong options type

This fixes a regression introduced in 32ba91a where getEnvFromPlatformProxy call sites passed OpenNextConfig even though the function expects Wrangler GetPlatformProxyOptions.

The fix restores the pre-32ba91a argument shape by passing { configPath, environment } from CLI arguments, so env resolution follows the selected Wrangler config/environment.

`v1.19.1`

Patch Changes

#1270 802047e Thanks @alex-all3dp! - fix: skip non-upload-triggered worker versions when building skew-protection deployment mapping

Worker versions created by metadata-only operations (e.g. Cloudflare API secret updates) do not include the static assets bundle. Previously, such versions could become the "latest" target in the skew-protection mapping, causing /_next/static/* requests to return 404 on past deployments. Versions are now filtered to those with workers/triggered_by in {upload, version_upload}.

Closes #1230

`v1.19.0`

Minor Changes

#1168 9a26846 Thanks @conico974! - Add support for SWR (stale-while-revalidate) in revalidateTag

See the AWS implementation for more details.

Patch Changes

#1184 c7d6425 Thanks @vicb! - fix for Next.js CVE-2026-23869

See the CVE-2026-23869 summary for details.

This CVE is fixed by bumping the minium Next.js release version to 15.5.15/16.2.3
#1177 e814a63 Thanks @conico974! - Fix use cache not working as expected in Next 16+

`v1.18.1`

Patch Changes

#1176 2232651 Thanks @conico974! - fix for OG with Next 16.2.2
#1166 f89fba1 Thanks @ash1day! - fix: sort .endsWith() checks by path length descending to prevent suffix collisions in dynamic requires

Routes whose paths are suffixes of other routes (e.g. /test/app vs /) were resolved incorrectly because the shorter path matched first in the generated .endsWith() chain. Sorting by path length descending ensures more specific (longer) paths are always checked first.

Fixes #1156.

`v1.18.0`

Minor Changes

#1159 75f5f0a Thanks @edmundhung! - Use remote dev for R2 cache population

Using remote dev is not subject to the Cloudflare API rate limit of 1,200 requests per 5 minutes that caused failures for large applications with thousands of prerendered pages.

`v1.17.3`

Patch Changes

#1160 161e726 Thanks @matthewvolk! - fix(patches): include prefetch-hints.json in loadManifest build-time inlining

Next.js 16.2.0 introduced prefetch-hints.json as a new server manifest loaded unconditionally
by NextNodeServer.getPrefetchHints(). The file exists in the build output but wasn't matched by
the glob pattern *-manifest.json, causing the patched loadManifest() to throw at runtime.

`v1.17.2`

Patch Changes

#1151 a143282 Thanks @nathanschram! - fix: handle known optional manifests gracefully in loadManifest/evalManifest patches

Next.js loads certain manifests with handleMissing: true (returning {} when the file doesn't
exist). The adapter's build-time glob scan doesn't find these files when they're conditionally
generated, so the patched function threw at runtime, crashing dynamic routes with 500.

Instead of a blanket catch-all, handle only the specific optional manifests from Next.js
route-module.ts:
- react-loadable-manifest (Turbopack per-route, not all routes have dynamic imports)
- subresource-integrity-manifest (only when experimental.sri configured)
- server-reference-manifest (App Router only)
- dynamic-css-manifest (Pages Router + Webpack only)
- fallback-build-manifest (only for /_error page)
- prefetch-hints (new in Next.js 16.2)
- _client-reference-manifest.js (optional for static metadata routes, evalManifest)
Manifest matching strips .json before comparison since some Next.js constants omit
the extension (SUBRESOURCE_INTEGRITY_MANIFEST, DYNAMIC_CSS_MANIFEST, etc.).

Unknown manifests still throw to surface genuine errors.

Fixes #1141.

`v1.17.1`

Patch Changes

#1147 f5bd138 Thanks @vicb! - make dev /cdn-cgi/image behaves like prod for consistency

`v1.17.0`

Minor Changes

#1133 25d5835 Thanks @dario-piotrowicz! - Update the migrate command to attempt to create an R2 bucket for caching, if that is not possible an application without caching enabled will be generated instead.

`v1.16.6`

Patch Changes

#1138 4487f1f Thanks @james-elicx! - Fix the CLI potentially setting a future compatibility date in the wrangler config when workerd has published a version matching a future date, by capping to the current date.

`v1.16.5`

Patch Changes

#1127 2b437f1 Thanks @dario-piotrowicz! - In the migrate command, add an initial step to create a Next.js config file (required by open-next) if it doesn't exist
#1126 8c3a36e Thanks @alex-all3dp! - fix: prevent Worker hang on HEAD requests to static assets

`v1.16.4`

Patch Changes

#1122 6c94a4a Thanks @dario-piotrowicz! - In migrate command, avoid adding unnecessary newlines when creating files
#1122 6c94a4a Thanks @dario-piotrowicz! - fix migrate command incorrectly erroring if the target application doesn't have a public directory
#1122 6c94a4a Thanks @dario-piotrowicz! - Bump @opennextjs/aws to 3.9.16
- Fix migrate command not updating Next.js config files
- Fixes #1062, #1115
See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.16
#1097 fea645f Thanks @dario-piotrowicz! - Add --help and --version to the opennextjs-cloudflare CLI

Improve the opennextjs-cloudflare CLI by:
- ensuring that unknown commands (e.g., opennextjs-cloudflare foo) display a clear and helpful error message
- adding a -h|--help flag to display the CLI's help message
- adding a -v|--version flag to display the package's version

`v1.16.3`

Patch Changes

#1113 09c41f1 Thanks @anonrig! - bump @opennextjs/aws to 3.9.15

See details at https://github.com/opennextjs/opennextjs-aws/releases/tag/v3.9.15

`v1.16.2`

Patch Changes

#1105 e6938a0 Thanks @vicb! - allow using a regional cache with KV

`v1.16.1`

Patch Changes

#1100 8676c78 Thanks @vicb! - Empty NextNodeServer#handleNextImageRequest to avoid pulling unneeded deps (in #1098)

`v1.16.0`

Minor Changes

#1083 b062597 Thanks @dario-piotrowicz! - feature: add migrate command to set up OpenNext for Cloudflare adapter

This command helps users migrate existing Next.js applications to the OpenNext Cloudflare adapter by automatically setting up all necessary configuration files, dependencies, and scripts.

To use the command simply run: npx opennextjs-cloudflare migrate

Patch Changes

#1092 [4279043](https://

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2025-07-04T16:24:07Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 013e83ef-d274-4f26-a29c-4f40d23af82f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

cloudflare-workers-and-pages · 2025-07-04T16:24:14Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	web4	`ca73b04`	Oct 15 2026, 11:55 AM

guardrails · 2025-07-04T16:24:25Z

⚠️ We detected 2 security issues in this pull request:

Vulnerable Libraries (2)

Severity	Details
High	pkg:npm/wrangler@4.22.0 (t) upgrade to: 3.114.17,4.59.1
High	pkg:npm/@opennextjs/cloudflare@1.3.1 upgrade to: > 1.3.1

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

openzeppelin-code · 2025-07-04T16:25:12Z

Update dependency @opennextjs/cloudflare to v1.19.7

Generated at commit: 6eaf84cd57a0a8d5182a83c013e3e0e8b234e8cc

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	0 0 0 0 0 0
Dependencies	Critical High Medium Low Note Total	0 0 0 0 0 0

For more details view the full report in OpenZeppelin Code Inspector

renovate · 2025-07-11T14:29:13Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: web4@undefined
npm error Found: next@15.4.5
npm error node_modules/next
npm error   next@"15.4.5" from the root project
npm error
npm error Could not resolve dependency:
npm error peer next@">=15.5.28 <16 || >=16.4.1" from @opennextjs/cloudflare@1.20.12
npm error node_modules/@opennextjs/cloudflare
npm error   @opennextjs/cloudflare@"1.20.12" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-15T11_55_32_847Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-15T11_55_32_847Z-debug-0.log

sonarqubecloud · 2025-08-05T01:10:27Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

Sign in to view

  },
  "dependencies": {
-    "@opennextjs/cloudflare": "1.3.1",
+    "@opennextjs/cloudflare": "1.15.1",


Sign in to view

  },
  "dependencies": {
-    "@opennextjs/cloudflare": "1.3.1",
+    "@opennextjs/cloudflare": "1.16.0",


sonarqubecloud · 2026-05-11T08:47:02Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-19T15:04:03Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-07-21T18:54:26Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-10-15T11:56:06Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code