chore(deps): Bump the npm-minor-and-patch group with 8 updates

[dependabot]

Bumps the npm-minor-and-patch group with 8 updates:

Package	From	To
@tightknitai/block-kitchen	0.9.9	0.10.1
@tightknitai/slack-block-kit-validator	0.1.10	0.1.11
hono	4.12.30	4.12.31
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8
@cloudflare/vite-plugin	1.45.0	1.47.0
@vitejs/plugin-react	6.0.3	6.0.4
wrangler	4.111.0	4.114.0

Updates @tightknitai/block-kitchen from 0.9.9 to 0.10.1

Release notes

Sourced from @​tightknitai/block-kitchen's releases.

block-kitchen: v0.10.1

0.10.1 (2026-07-22)

Features

• add "Done" button to close block editor context windows (2775c6b)
• add Done button to block editor popover (0f509f0)
• add undo/redo to the block builder (7878585)
• add undo/redo to the block builder (1847f38)

block-kitchen: v0.10.0

0.10.0 (2026-07-17)

⚠ BREAKING CHANGES

• editing={{ onUpdate }} is now onUpdate={...} (the EditingConfig wrapper is removed; load fields already moved to loading):
• EditingConfig.onLoadMessage, loadRecentMessages, and initialTarget are removed. Move them to the loading prop unchanged:

Features

• apply deep-review fixes — notification correctness, flatten onUpdate, doc/cleanup (20d8d18)
• decouple message loading from update-in-place — loading works in compose-only mode (e4ed168)
• drop the legacy editing load fields — editing is onUpdate-only (d49572e)

Bug Fixes

• preserve the draft on compose-only banner exit; scope docs (239bb3a)

block-kitchen: v0.9.10

0.9.10 (2026-07-17)

Features

• caller-customized send — compose-only mode, send-dialog extras, exported primitives (5c8b33e)
• send-dialog extras slot, compose-only primaryAction, exported send primitives (122c2d3)

Changelog

Sourced from @​tightknitai/block-kitchen's changelog.

0.10.1 (2026-07-22)

Features

• add "Done" button to close block editor context windows (2775c6b)
• add Done button to block editor popover (0f509f0)
• add undo/redo to the block builder (7878585)
• add undo/redo to the block builder (1847f38)

0.10.0 (2026-07-17)

⚠ BREAKING CHANGES

• editing={{ onUpdate }} is now onUpdate={...} (the EditingConfig wrapper is removed; load fields already moved to loading):
• EditingConfig.onLoadMessage, loadRecentMessages, and initialTarget are removed. Move them to the loading prop unchanged:

Features

• apply deep-review fixes — notification correctness, flatten onUpdate, doc/cleanup (20d8d18)
• decouple message loading from update-in-place — loading works in compose-only mode (e4ed168)
• drop the legacy editing load fields — editing is onUpdate-only (d49572e)

Bug Fixes

• preserve the draft on compose-only banner exit; scope docs (239bb3a)

0.9.10 (2026-07-17)

Features

• caller-customized send — compose-only mode, send-dialog extras, exported primitives (5c8b33e)
• send-dialog extras slot, compose-only primaryAction, exported send primitives (122c2d3)

Commits

• 8eef084 Merge pull request #161 from TightknitAI/release-please--branches--main--comp...
• 2ce933b chore(main): release block-kitchen 0.10.1
• 7878585 Merge pull request #160 from TightknitAI/claude/undo-redo-capabilities-9fwf9z
• 0d099e2 build(deps): refresh fast-uri to 3.1.4 to clear GHSA-v2hh-gcrm-f6hx
• b055232 build(deps): bump @​tightknitai/slack-block-kit-validator to 0.1.11
• c6201d6 Merge remote-tracking branch 'origin/main' into claude/undo-redo-capabilities...
• 95e1393 build(deps): bump @​tightknitai/slack-block-kit-validator to 0.1.10
• 9f7b8b9 Merge pull request #154 from TightknitAI/dependabot/npm_and_yarn/production-d...
• 0f509f0 Merge pull request #159 from TightknitAI/claude/editing-blocks-done-button-y2...
• 6860212 chore: cap undo history at 20 steps
• Additional commits viewable in compare view

Updates @tightknitai/slack-block-kit-validator from 0.1.10 to 0.1.11

Release notes

Sourced from @​tightknitai/slack-block-kit-validator's releases.

slack-block-kit-validator: v0.1.11

0.1.11 (2026-07-22)

Bug Fixes

• deps: pin fast-uri to patched ^3.1.4 to clear host-confusion advisories (#62) (7b32635)

Reverts

• add response-only metadata fields to image elements and blocks (#57) (#58) (52e7f86)

Changelog

Sourced from @​tightknitai/slack-block-kit-validator's changelog.

0.1.11 (2026-07-22)

Bug Fixes

• deps: pin fast-uri to patched ^3.1.4 to clear host-confusion advisories (#62) (7b32635)

Reverts

• add response-only metadata fields to image elements and blocks (#57) (#58) (52e7f86)

Commits

• 6ca0087 chore(main): release slack-block-kit-validator 0.1.11 (#61)
• 7b32635 fix(deps): pin fast-uri to patched ^3.1.4 to clear host-confusion advisories ...
• 29c1078 Add validation for single plan block per message (#60)
• 52e7f86 revert: add response-only metadata fields to image elements and blocks (#57) ...
• e8525f5 Add response-only metadata fields to image elements and blocks (#57)
• See full diff in compare view

Updates hono from 4.12.30 to 4.12.31

Release notes

Sourced from hono's releases.

v4.12.31

What's Changed

• test(context): assert case-insensitive header names in response helpers by @​yusukebe in honojs/hono#5116
• chore(benchmark): add app.fetch() overhead benchmark by @​yusukebe in honojs/hono#5117
• refactor(aws-lambada): remove FIXME in @ts-expect-error by @​yusukebe in honojs/hono#5130
• fix(utils/body): reuse cached formData in parseBody() by @​yusukebe in honojs/hono#5131
• fix(request): fix multipart boundary mismatch in cloneRawRequest by @​yusukebe in honojs/hono#5133
• fix(sse): emit retry feild when retry is 0 by @​yusukebe in honojs/hono#5135
• test(validator): fix misspelled identifier in transform type test by @​yusukebe in honojs/hono#5136

Full Changelog: honojs/hono@v4.12.30...v4.12.31

Commits

• cadff88 4.12.31
• 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
• aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
• d796450 fix(request): fix multipart boundary mismatch in cloneRawRequest (#5133)
• 80959d4 fix(utils/body): reuse cached formData in parseBody() (#5131)
• 21b44b6 refactor(aws-lambada): remove FIXME in @ts-expect-error (#5130)
• 5f73897 docs(combine): close quote in combine JSDoc example (#5126)
• c285f9a chore(benchmark): add app.fetch() overhead benchmark (#5117)
• fb9d7bf test(context): assert case-insensitive header names in response helpers (#5116)
• See full diff in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates @cloudflare/vite-plugin from 1.45.0 to 1.47.0

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.47.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

• Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

  • wrangler@4.114.0
  • miniflare@4.20260722.0

@​cloudflare/vite-plugin@​1.46.0

Minor Changes

• #14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

  Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

  // cloudflare.config.ts
  import { defineSettings, defineWorker } from "wrangler/experimental-config";
  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  export const settings = defineSettings({
  accountId: "<your-account-id>",
  });
  export default defineWorker({
  name: "my-worker",
  entrypoint,
  compatibilityDate: "2026-05-18",
  });

  This is only used behind the experimental new-config path (wrangler --experimental-new-config and the @cloudflare/vite-plugin experimental.newConfig option).

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.47.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14792 c4bacec Thanks @​matthewp! - Recover local development after the Workers runtime crashes

  Previously, an unexpected workerd crash left Miniflare running but unable to serve subsequent requests. Miniflare now restarts workerd after post-startup crashes, while continuing to surface startup crashes as fatal errors.

  The Cloudflare Vite plugin also restarts the Vite development server after workerd recovers so its environments, hot channels, and module runners are recreated.

• Updated dependencies [246ce92, c38a2c3, 8416b33, c079ba3, 4683ff8, 95b026e, 02232f3, c4bacec, f8a8c2c, 3203b5d]:

  • wrangler@4.114.0
  • miniflare@4.20260722.0

1.46.0

Minor Changes

• #14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

  Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

  // cloudflare.config.ts
  import { defineSettings, defineWorker } from "wrangler/experimental-config";
  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  export const settings = defineSettings({
  accountId: "<your-account-id>",
  });
  export default defineWorker({
  name: "my-worker",
  entrypoint,
  compatibilityDate: "2026-05-18",
  });

... (truncated)

Commits

• 16b3d5a Version Packages (#14799)
• 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
• c4bacec Recover from workerd crashes in Miniflare (#14792)
• 88f42e7 Version Packages (#14740)
• 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
• a50f73a Support settings export in new config (#14724)
• 6687a91 docs: React Router v7 -> v8 in vite plugin README (#14757)
• ec2600e Enable @typescript-eslint/no-deprecated linting rule for `vite-plugin-cloud...
• 82918ad Version Packages (#14699)
• cb30df3 Remove loopback for Router worker (#14418)
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.0.3 to 6.0.4

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.0.4

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Commits

• f4b5498 release: plugin-react@6.0.4
• 7a40659 fix(react): $RefreshSig$ is not defined with NODE_ENV=production vite dev ...
• 98b32d4 fix(deps): update react 19.2.8 (#1298)
• 8ae5449 fix: babel-plugin-react-compiler cannot be imported when used in a framework ...
• f09ea01 fix(deps): update all non-major dependencies (#1282)
• See full diff in compare view

Updates wrangler from 4.111.0 to 4.114.0

Release notes

Sourced from wrangler's releases.

wrangler@4.114.0

Minor Changes

• #14633 3203b5d Thanks @​nickpatt! - Add local-dev observability

  wrangler dev and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and console.* output, including requests that cross worker or Durable Object boundaries.

  You can explore this data two ways:

  • A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.
  • A read-only SQL endpoint at /cdn-cgi/explorer/api/local/observability/query, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same spans and logs tables.

  While this is in testing it's off by default; set X_LOCAL_OBSERVABILITY=true to turn it on. It will be on by default in the public release.

Patch Changes

• #14373 246ce92 Thanks @​Jacroney! - Improve the D1 database-limit error message

  When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to wrangler d1 create and to the D1 database that is created during resource provisioning on deploy.

• #14796 c38a2c3 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260721.1	^5.20260722.1
  workerd	1.20260721.1	1.20260722.1

• #14788 8416b33 Thanks @​chinesepowered! - Fix grammar in the container image-too-large error

  The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."

• #14809 4683ff8 Thanks @​jamesopstad! - Ignore the removed legacy_env field when reading a redirected configuration

  Older versions of tools such as the Vite plugin can generate a redirected configuration (.wrangler/deploy/config.json) that still includes the removed legacy_env field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips legacy_env from redirected configurations. User-authored configurations still report an error so that the field can be removed.

• #14593 02232f3 Thanks @​spk-ai! - Fix dev proxy silently hanging or returning a misleading 503 on network errors for non-root-path requests

  During wrangler dev, a transient network error on any request path other than / could be misclassified as the worker being reloaded, even when it wasn't: GET/HEAD requests would silently hang (with nothing logged) until the client timed out, and other methods would receive a misleading Your worker restarted mid-request 503. Such errors are now reported and surfaced immediately when the worker has not actually changed.

• #14797 f8a8c2c Thanks @​roerohan! - Explain how to provision Flagship bindings if app_id missing in remote development

  Wrangler now reports that a Flagship binding without an app_id must first be created with wrangler flagship apps create.

• Updated dependencies [c38a2c3, c079ba3, 95b026e, c4bacec, 3203b5d]:

  • miniflare@4.20260722.0

wrangler@4.113.0

Minor Changes

... (truncated)

Commits

• 16b3d5a Version Packages (#14799)
• 3203b5d [miniflare] Local dev observability: traces, spans & logs via a SQL query API...
• 246ce92 [wrangler] Improve d1 create database-limit error message (#14373)
• 02232f3 [wrangler] compare origins, not hrefs, when classifying dev proxy fetch error...
• 8416b33 [wrangler] Fix grammar in container image-too-large error (#14788)
• f8a8c2c [wrangler] Explain missing Flagship app ID (#14797)
• 88f42e7 Version Packages (#14740)
• 9e61971 unskip agent memory remote bindings test (#14786)
• 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
• 4815711 [miniflare] Report the Worker's error for HEAD requests (#14766)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions