chore(deps): bump the minor group across 4 directories with 7 updates by dependabot[bot] · Pull Request #640 · dmno-dev/varlock

dependabot · 2026-04-22T06:52:59Z

Bumps the minor group with 7 updates in the / directory:

Package	From	To
gunshi	`0.28.2`	`0.29.4`
@modelcontextprotocol/sdk	`1.23.0`	`1.29.0`
agents	`0.2.35`	`0.11.6`
@astrojs/starlight	`0.37.7`	`0.38.4`
astro-og-canvas	`0.7.2`	`0.11.1`
canvaskit-wasm	`0.40.0`	`0.41.1`
starlight-llms-txt	`0.6.1`	`0.8.1`

Bumps the minor group with 1 update in the /packages/varlock directory: gunshi.
Bumps the minor group with 2 updates in the /packages/varlock-docs-mcp directory: @modelcontextprotocol/sdk and agents.
Bumps the minor group with 4 updates in the /packages/varlock-website directory: @astrojs/starlight, astro-og-canvas, canvaskit-wasm and starlight-llms-txt.

Updates gunshi from 0.28.2 to 0.29.4

Changelog

Sourced from gunshi's changelog.

v0.29.4 (2026-04-09T06:58:18Z)

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

fix(plugin-completion): wrong interface and example by @kazupon in kazupon/gunshi#506

Full Changelog: kazupon/gunshi@v0.29.3...v0.29.4

v0.29.3 (2026-03-11T08:53:31Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.2...v0.29.3

v0.29.2 (2026-02-21T14:05:58Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.1...v0.29.2

v0.29.1 (2026-02-21T14:00:47Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.0...v0.29.1

v0.29.0 (2026-02-21T13:53:41Z)

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

feat(gunshi): support parser combinators for argument schema (experimental) by @kazupon in kazupon/gunshi#496

... (truncated)

Commits

1009f72 release: v0.29.4
3d13fca update
c90a2a3 release: v0.29.3
3b4277b chore: bump deps
b4ea0b2 release: v0.29.2
f165be2 release: v0.29.1
9e3341b release: v0.29.0
a95db15 feat(gunshi): support parser combinators for argment schema (experimental) (#...
See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.23.0 to 1.29.0

Commits

e12cbd7 chore: bump version to 1.29.0 (#1820)
3913fd4 fix(stdio): always set windowsHide on Windows, not just in Electron (#1640)
5608e78 [v1.x backport] Allow servers / clients to advertise extensions in the capabi...
7213816 v1.x #1623 follow up -add missing types to package.json (#1773)
364f38c v1.x npm audit fix (#1780)
c95cc09 Add typings exports (#1623)
ddadaa6 [v1.x] fix: add missing size field to ResourceSchema (#1575)
2a15851 [v1.x] fix: disallow null (infinite) requested TTL (#1339)
13e30f1 fix: treat v1.x as primary branch for npm latest tag (backport #1577) (#1749)
a056569 chore: bump version to 1.28.0 (#1746)
Additional commits viewable in compare view

Updates agents from 0.2.35 to 0.11.6

Release notes

Sourced from agents's releases.

agents@0.11.6

Patch Changes

#1393 5aaf7c4 Thanks @threepointone! - Migrate facet (sub-agent) bootstrap to the documented Cloudflare facet API: pass id: parentNs.idFromName(name) to ctx.facets.get() so the facet has its own ctx.id.name. Drops the __ps_name storage write and setName() bootstrap from _cf_initAsFacet.

Why this matters. Facets spawned without an explicit id inherit the parent DO's ctx.id, so on a facet ctx.id.name was the parent's name and this.name silently misreported as the parent's name. Anything that read this.name from inside a sub-agent (including selfPath, parentPath, and any user code) was getting the wrong value. With the explicit id passed at facet creation time, the runtime gives the facet a real ctx.id.name === name and PartyServer's existing 0.5.x name getter resolves this.name correctly without any override mechanism, storage write, or cold-wake hydrate cost. Cold-wake recovery happens for free because idFromName is deterministic and the factory re-runs on resume.

This requires partyserver ≥ 0.5.3 (bumped in this release); 0.5.3 is byte-identical to 0.5.2 at runtime, only adds documentation and test coverage of the explicit-id facet pattern.

Other changes:

New error path. If subAgent() is called from a parent class that isn't bound as a Durable Object namespace, the framework now throws a descriptive error pointing at wrangler.jsonc. If this.constructor.name looks minified (e.g. _a), the message includes a bundler-config hint about preserving class names.

Defensive runtime check. _cf_initAsFacet now asserts this.name === name so any future bug in the parent's id construction surfaces immediately instead of silently mis-identifying the facet.

alarm() docstring clarified to reflect the new resolution path (this.name from ctx.id.name, not from a storage hydrate).

MCP test cleanup. Vestigial setName("default") + explicit onStart() call pairs in oauth2-mcp-client, wait-connections-e2e, and create-oauth-provider test files have been removed; they were originally needed for partyserver 0.4.x bootstrap but became actual ctx.id.name mismatches under partyserver 0.5.x.

Backward-compatible for all public APIs: subAgent(), parentAgent(), hasSubAgent(), listSubAgents(), deleteSubAgent(), and abortSubAgent() keep their signatures and semantics. The change is purely in the facet bootstrap internals; the user-facing effect is that this.name inside a sub-agent now correctly reports the sub-agent's own name (was previously the parent's name when run against partyserver 0.5.x).

See cloudflare/partykit#386 for the partyserver-side documentation companion.

#1395 63cfae6 Thanks @threepointone! - Share submit concurrency bookkeeping through agents/chat and use it from both chat agents.

This extracts the latest/merge/drop/debounce admission state machine into a SubmitConcurrencyController exported from agents/chat. AIChatAgent semantics (including merge persistence) are preserved. Think now picks up the same pending-enqueue protection, so an overlapping submit is still detected while an accepted request is between admission and turn queue registration.

Additional fixes:

Think now captures the turn generation immediately after admission and threads it into _turnQueue.enqueue, so a clear that lands between admission and queue registration cannot run a stale turn.

Pending-enqueue tracking is now bound to a release function tied to the controller's reset epoch, so a release from a pre-reset submit can no longer erase a post-reset submit's marker and let a third submit slip through as non-overlapping.

Debounce cancellation correctly resolves all in-flight waiters instead of overwriting a single timer slot.

#1396 fdf5a8a Thanks @threepointone! - Fix Think persisting a duplicate orphan assistant row when a user submits during a streaming tool turn (#1381).

When useAgentChat posts an in-flight assistant snapshot it minted optimistically (client-generated ID, state: "input-available"), Session's INSERT-OR-IGNORE-by-ID would store it as a separate row alongside the eventual server-owned assistant for the same toolCallId. The next turn's convertToModelMessages then produced a malformed Anthropic prompt and the provider rejected it.

reconcileMessages and resolveToolMergeId now live in agents/chat and Think runs them in _handleChatRequest before persistence. Stale input-available snapshots pick up the server's tool output via mergeServerToolOutputs, and any incoming assistant whose toolCallId already exists on a server row adopts the server's ID so persistence updates the existing row instead of inserting an orphan.

@cloudflare/ai-chat keeps its existing reconciler behavior; the only change is that it now imports reconcileMessages / resolveToolMergeId from agents/chat instead of a local file.

agents@0.11.5

Patch Changes

#1353 f834c81 Thanks @threepointone! - Align AIChatAgent generics and types with @cloudflare/think, plus a reference example for multi-session chat built on the sub-agent routing primitive.

New Props generic: AIChatAgent<Env, State, Props> extending Agent<Env, State, Props>. Subclasses now get properly typed this.ctx.props.

Shared lifecycle types: ChatResponseResult, ChatRecoveryContext, ChatRecoveryOptions, SaveMessagesResult, and MessageConcurrency now live in agents/chat and are re-exported by both @cloudflare/ai-chat and @cloudflare/think. No behavior change; one place to edit when shapes evolve.

ChatMessage stays the public message type: the package continues to export ChatMessage, and the public API/docs keep using that name.

messages stays a public field: messages: ChatMessage[].

The full stance (AIChatAgent is first-class, production-ready, and continuing to get features; shared infrastructure should land in agents/chat where both classes benefit) is captured in design/rfc-ai-chat-maintenance.md.

... (truncated)

Changelog

Sourced from agents's changelog.

0.11.6

Patch Changes

#1393 5aaf7c4 Thanks @threepointone! - Migrate facet (sub-agent) bootstrap to the documented Cloudflare facet API: pass id: parentNs.idFromName(name) to ctx.facets.get() so the facet has its own ctx.id.name. Drops the __ps_name storage write and setName() bootstrap from _cf_initAsFacet.

Why this matters. Facets spawned without an explicit id inherit the parent DO's ctx.id, so on a facet ctx.id.name was the parent's name and this.name silently misreported as the parent's name. Anything that read this.name from inside a sub-agent (including selfPath, parentPath, and any user code) was getting the wrong value. With the explicit id passed at facet creation time, the runtime gives the facet a real ctx.id.name === name and PartyServer's existing 0.5.x name getter resolves this.name correctly without any override mechanism, storage write, or cold-wake hydrate cost. Cold-wake recovery happens for free because idFromName is deterministic and the factory re-runs on resume.

This requires partyserver ≥ 0.5.3 (bumped in this release); 0.5.3 is byte-identical to 0.5.2 at runtime, only adds documentation and test coverage of the explicit-id facet pattern.

Other changes:

New error path. If subAgent() is called from a parent class that isn't bound as a Durable Object namespace, the framework now throws a descriptive error pointing at wrangler.jsonc. If this.constructor.name looks minified (e.g. _a), the message includes a bundler-config hint about preserving class names.

Defensive runtime check. _cf_initAsFacet now asserts this.name === name so any future bug in the parent's id construction surfaces immediately instead of silently mis-identifying the facet.

alarm() docstring clarified to reflect the new resolution path (this.name from ctx.id.name, not from a storage hydrate).

MCP test cleanup. Vestigial setName("default") + explicit onStart() call pairs in oauth2-mcp-client, wait-connections-e2e, and create-oauth-provider test files have been removed; they were originally needed for partyserver 0.4.x bootstrap but became actual ctx.id.name mismatches under partyserver 0.5.x.

Backward-compatible for all public APIs: subAgent(), parentAgent(), hasSubAgent(), listSubAgents(), deleteSubAgent(), and abortSubAgent() keep their signatures and semantics. The change is purely in the facet bootstrap internals; the user-facing effect is that this.name inside a sub-agent now correctly reports the sub-agent's own name (was previously the parent's name when run against partyserver 0.5.x).

See cloudflare/partykit#386 for the partyserver-side documentation companion.

#1395 63cfae6 Thanks @threepointone! - Share submit concurrency bookkeeping through agents/chat and use it from both chat agents.

This extracts the latest/merge/drop/debounce admission state machine into a SubmitConcurrencyController exported from agents/chat. AIChatAgent semantics (including merge persistence) are preserved. Think now picks up the same pending-enqueue protection, so an overlapping submit is still detected while an accepted request is between admission and turn queue registration.

Additional fixes:

Think now captures the turn generation immediately after admission and threads it into _turnQueue.enqueue, so a clear that lands between admission and queue registration cannot run a stale turn.

Pending-enqueue tracking is now bound to a release function tied to the controller's reset epoch, so a release from a pre-reset submit can no longer erase a post-reset submit's marker and let a third submit slip through as non-overlapping.

Debounce cancellation correctly resolves all in-flight waiters instead of overwriting a single timer slot.

#1396 fdf5a8a Thanks @threepointone! - Fix Think persisting a duplicate orphan assistant row when a user submits during a streaming tool turn (#1381).

When useAgentChat posts an in-flight assistant snapshot it minted optimistically (client-generated ID, state: "input-available"), Session's INSERT-OR-IGNORE-by-ID would store it as a separate row alongside the eventual server-owned assistant for the same toolCallId. The next turn's convertToModelMessages then produced a malformed Anthropic prompt and the provider rejected it.

reconcileMessages and resolveToolMergeId now live in agents/chat and Think runs them in _handleChatRequest before persistence. Stale input-available snapshots pick up the server's tool output via mergeServerToolOutputs, and any incoming assistant whose toolCallId already exists on a server row adopts the server's ID so persistence updates the existing row instead of inserting an orphan.

@cloudflare/ai-chat keeps its existing reconciler behavior; the only change is that it now imports reconcileMessages / resolveToolMergeId from agents/chat instead of a local file.

0.11.5

Patch Changes

#1353 f834c81 Thanks @threepointone! - Align AIChatAgent generics and types with @cloudflare/think, plus a reference example for multi-session chat built on the sub-agent routing primitive.

New Props generic: AIChatAgent<Env, State, Props> extending Agent<Env, State, Props>. Subclasses now get properly typed this.ctx.props.

Shared lifecycle types: ChatResponseResult, ChatRecoveryContext, ChatRecoveryOptions, SaveMessagesResult, and MessageConcurrency now live in agents/chat and are re-exported by both @cloudflare/ai-chat and @cloudflare/think. No behavior change; one place to edit when shapes evolve.

ChatMessage stays the public message type: the package continues to export ChatMessage, and the public API/docs keep using that name.

messages stays a public field: messages: ChatMessage[].

... (truncated)

Commits

1ad4cde Version Packages (#1373)
fdf5a8a think: reconcile incoming messages to fix duplicate orphan assistant rows (#1...
63cfae6 chat: share submit concurrency controller in agents/chat (#1395)
5aaf7c4 Migrate facet bootstrap to explicit FacetStartupOptions.id (#1393)
f07411b Version Packages (#1347)
d901804 fix(mcp): capture tool title in MCP client (#1362)
f834c81 ai-chat: align with Think + multi-ai-chat example on the sub-agent routing pr...
df2023f sub-agent routing: RFC + implementation (phases 1–3) (#1355)
0693a5f Bump dev deps and update lockfile (#1348)
ca87e99 Upgrade Kimi model to k2.6
Additional commits viewable in compare view

Updates @astrojs/starlight from 0.37.7 to 0.38.4

Changelog

Sourced from @astrojs/starlight's changelog.

0.38.4

Patch Changes

#3828 342038b Thanks @MangelMaxime! - Fixes aside styling when used without any content

#3853 563e11b Thanks @delucis! - Fixes a type-checking issue for users on newer versions of TypeScript

0.38.3

Patch Changes

#3799 313611b Thanks @JosefJezek! - Improves Czech UI translations

#3770 6e7bed1 Thanks @gameroman! - Adds examples to the inline documentation for title in the Starlight configuration object

#3801 fedd48b Thanks @delucis! - Fixes missing draft content warning in dev on pages using the hero layout

0.38.2

Patch Changes

#3759 f24ce99 Thanks @MilesChou! - Fixes an issue where monolingual sites using a region-specific locale (e.g., zh-TW) as the default would incorrectly display base language translations (e.g., zh Simplified Chinese) instead of the region-specific ones (e.g., zh-TW Traditional Chinese).

#3768 a4c6c20 Thanks @delucis! - Improves performance of sidebar generation for sites with very large sidebars

0.38.1

Patch Changes

#3751 fb955ff Thanks @pyxelr! - Fixes a regression causing global tableOfContents config to be ignored

0.38.0

Minor Changes
#3644 0d2e7ed Thanks @HiDeoo! - Adds support for Astro v6, drops support for Astro v5.

Upgrade Astro and dependencies

⚠️ BREAKING CHANGE: Astro v5 is no longer supported. Make sure you update Astro and any other official integrations at the same time as updating Starlight:
npx @astrojs/upgrade
Community Starlight plugins and Astro integrations may also need to be manually updated to work with Astro v6. If you encounter any issues, please reach out to the plugin or integration author to see if it is a known issue or if an updated version is being worked on.

Update your collections

... (truncated)

Commits

d986558 [ci] release (#3844)
563e11b Ignore type error in i18n util with newer TypeScript versions (#3853)
04fcec0 [ci] format
342038b fix: empty aside alignment (#3828)
7a59b9a [ci] release (#3773)
313611b Update Czech translations for consistency (#3799)
fedd48b Include draft content notice on pages with hero component (#3801)
d940845 [ci] format
6e7bed1 docs: update jsdoc for UserConfigSchema.title with example (#3770)
d871021 [ci] release (#3766)
Additional commits viewable in compare view

Updates astro-og-canvas from 0.7.2 to 0.11.1

Release notes

Sourced from astro-og-canvas's releases.

astro-og-canvas@0.11.1

Patch Changes

#163 390fdea Thanks @renovate! - Updates dependency canvaskit-wasm to ^0.41.1

astro-og-canvas@0.11.0

Minor Changes

#157 91ac061 Thanks @renovate! - Updates dependency entities to v8

⚠️ Potentially breaking change: The minimum supported Node version is now 20.19.0

Patch Changes

#155 1066126 Thanks @renovate! - Updates dependency canvaskit-wasm to ^0.41.0

astro-og-canvas@0.10.1

Patch Changes

#128 dd829f9 Thanks @renovate! - Updates dependency entities to ^7.0.1

astro-og-canvas@0.10.0

Minor Changes
#119 151edd2 Thanks @delucis! - Makes OGImageRoute() asynchronous.

⚠️ BREAKING CHANGE: You must now await the result of OGImageRoute():
import { OGImageRoute } from 'astro-og-canvas';

export const { getStaticPaths, GET } = OGImageRoute({


export const { getStaticPaths, GET } = await OGImageRoute({
Patch Changes

#119 151edd2 Thanks @delucis! - Fixes using the built-in getSlug() for OG images with format: "JPEG" or format: "WEBP"

astro-og-canvas@0.9.0

Minor Changes
#117 b94a123 Thanks @delucis! - Adds type safety to OGImageRoute. The page parameter in getSlug() and getImageOptions() is now correctly inferred from the value passed to pages instead of being typed as any.
OGImageRoute({
  pages: {
    example: {
      title: 'Example Page',
      description: 'Description of this page shown in smaller text',

... (truncated)

Changelog

Sourced from astro-og-canvas's changelog.

0.11.1

Patch Changes

#163 390fdea Thanks @renovate! - Updates dependency canvaskit-wasm to ^0.41.1

0.11.0

Minor Changes

#157 91ac061 Thanks @renovate! - Updates dependency entities to v8

⚠️ Potentially breaking change: The minimum supported Node version is now 20.19.0

Patch Changes

#155 1066126 Thanks @renovate! - Updates dependency canvaskit-wasm to ^0.41.0

0.10.1

Patch Changes

#128 dd829f9 Thanks @renovate! - Updates dependency entities to ^7.0.1

0.10.0

Minor Changes
#119 151edd2 Thanks @delucis! - Makes OGImageRoute() asynchronous.

⚠️ BREAKING CHANGE: You must now await the result of OGImageRoute():
import { OGImageRoute } from 'astro-og-canvas';

export const { getStaticPaths, GET } = OGImageRoute({


export const { getStaticPaths, GET } = await OGImageRoute({
Patch Changes

#119 151edd2 Thanks @delucis! - Fixes using the built-in getSlug() for OG images with format: "JPEG" or format: "WEBP"

0.9.0

Minor Changes
#117 b94a123 Thanks @delucis! - Adds type safety to OGImageRoute. The page parameter in getSlug() and getImageOptions() is now correctly inferred from the value passed to pages instead of being typed as any.

... (truncated)

Commits

574c03c Version Packages (#165)
867ea9d Update dependency typescript to v6 (#158)
390fdea Update dependency canvaskit-wasm to ^0.41.1 (#163)
705ec9b Update dependency astro to ^6.1.5 (#162)
d9c7beb Version Packages (#160)
91ac061 Update dependency entities to v8 (#157)
1066126 Update dependency canvaskit-wasm to ^0.41.0 (#155)
f1ea3a0 Update astro (#153)
6fbab24 Update dependency astro to ^6.0.4 (#152)
0b30f26 Update dependency astro to ^6.0.3 (#151)
Additional commits viewable in compare view

Updates canvaskit-wasm from 0.40.0 to 0.41.1

Commits

See full diff in compare view

Updates starlight-llms-txt from 0.6.1 to 0.8.1

Changelog

Sourced from starlight-llms-txt's changelog.

0.8.1

Patch Changes

29e5efb Thanks @mvanhorn! - Strips HTML comments from llms.txt files.  style comments in .md files are no longer emitted in the generated files.

0.8.0

Minor Changes

#80 dea7b22 Thanks @nonoakij! - Adds support for Astro v6 and Starlight v0.38, drops support for lower versions.

0.7.0

Minor Changes

#43 1db4591 Thanks @sanscontext! - Enforces llms.txt files to be prerendered at build time. Previously, sites using Astro’s output: server configuration would generate llms.txt files on-demand, which can be slow, and additionally was incompatible with the custom sets feature. This change means that llms.txt files are statically generated even for sites using output: server.

⚠️ Potentially breaking change: If you were relying on on-demand rendered llms.txt files, for example by using middleware to gate access, this may be a breaking change. Please share your use case to let us know if you need this.

Commits

5b7d9e0 [ci] release (#98)
29e5efb fix: strip HTML comments from llms.txt output (#97)
a66510e fix(deps): update astro (#95)
6409751 fix(deps): update astro (#92)
897ff05 fix(deps): update dependency astro to ^6.0.4 (#89)
c0eb642 fix(deps): update dependency @astrojs/starlight to ^0.38.1 (#88)
9b81974 fix(deps): update dependency astro to ^6.0.3 (#86)
b70667a fix(deps): update dependency astro to ^6.0.2 (#82)
9aee078 [ci] release (#81)
dea7b22 feat: add Astro v6 support (#80)
Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.23.0 to 1.29.0

Commits

e12cbd7 chore: bump version to 1.29.0 (#1820)
3913fd4 fix(stdio): always set windowsHide on Windows, not just in Electron (#1640)
5608e78 [v1.x backport] Allow servers / clients to advertise extensions in the capabi...
7213816 v1.x #1623 follow up -add missing types to package.json (#1773)
364f38c v1.x npm audit fix (#1780)
c95cc09 Add typings exports (#1623)
ddadaa6 [v1.x] fix: add missing size field to ResourceSchema (#1575)
2a15851 [v1.x] fix: disallow null (infinite) requested TTL (#1339)
13e30f1 fix: treat v1.x as primary branch for npm latest tag (backport #1577) (#1749)
a056569 chore: bump version to 1.28.0 (#1746)
Additional commits viewable in compare view

Updates gunshi from 0.28.2 to 0.29.4

Changelog

Sourced from gunshi's changelog.

v0.29.4 (2026-04-09T06:58:18Z)

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

fix(plugin-completion): wrong interface and example by @kazupon in kazupon/gunshi#506

Full Changelog: kazupon/gunshi@v0.29.3...v0.29.4

v0.29.3 (2026-03-11T08:53:31Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.2...v0.29.3

v0.29.2 (2026-02-21T14:05:58Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.1...v0.29.2

v0.29.1 (2026-02-21T14:00:47Z)

This changelog is generated by GitHub Releases

Full Changelog: kazupon/gunshi@v0.29.0...v0.29.1

v0.29.0 (2026-02-21T13:53:41Z)

This changelog is generated by GitHub Releases

What's Changed

🌟 Features

feat(gunshi): support parser combinators for argument schema (experimental) by @kazupon in kazupon/gunshi#496

... (truncated)

Commits

1009f72 release: v0.29.4
3d13fca update
c90a2a3 release: v0.29.3
3b4277b chore: bump deps
b4ea0b2 release: v0.29.2
f165be2 release: v0.29.1
9e3341b release: v0.29.0
a95db15 feat(gunshi): support parser combinators for argment schema (experimental) (#...
See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.23.0 to 1.29.0

Commits

e12cbd7 chore: bump version to 1.29.0 (#1820)
3913fd4 fix(stdio): always set windowsHide on Windows, not just in Electron (#1640)
5608e78 [v1.x backport] Allow servers / clients to advertise extensions in the capabi...
7213816 v1.x #1623 follow up -add missing types to package.json (#1773)
364f38c v1.x npm audit fix (#1780)
c95cc09 Add typings exports (#1623)
ddadaa6 [v1.x] fix: add missing size field to ResourceSchema (#1575)
2a15851 [v1.x] fix: disallow null (infinite) requested TTL (#1339)
13e30f1 fix: treat v1.x as primary branch for npm latest tag (backport #1577) (#1749)
a056569 chore: bump version to 1.28.0 (#1746)
Additional commits viewable in compare view

Updates agents from 0.2.35 to 0.11.6

Release notes

Sourced from agents's releases.

agents@0.11.6

Patch Changes

#1393 5aaf7c4 Thanks @threepointone! - Migrate facet (sub-agent) bootstrap to the documented Cloudflare facet API: pass id: parentNs.idFromName(name) to ctx.facets.get() so the facet has its own ctx.id.name. Drops the __ps_name storage write and setName() bootstrap from _cf_initAsFacet.

Why this matters. Facets spawned without an explicit id inherit the parent DO's ctx.id, so on a facet ctx.id.name was the parent's name and this.name silently misreported as the parent's name. Anything that read this.name from inside a sub-agent (including selfPath, parentPath, and any user code) was getting the wrong value. With the explicit id passed at facet creation time, the runtime gives the facet a real ctx.id.name === name and PartyServer's existing 0.5.x name getter resolves this.name correctly without any override mechanism, storage write, or cold-wake hydrate cost. Cold-wake recovery happens for free because idFromName is deterministic and the factory re-runs on resume.

This requires partyserver ≥ 0.5.3 (bumped in this release); 0.5.3 is byte-identical to 0.5.2 at runtime, only adds documentation and test coverage of the explicit-id facet pattern.

Other changes:

Description has been truncated

cloudflare-workers-and-pages · 2026-04-22T06:53:05Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
🔵 In progress View logs	varlock-docs-mcp	`6c51fa6`	Apr 22 2026, 06:53 AM

cloudflare-workers-and-pages · 2026-04-22T06:53:05Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
🔵 In progress View logs	varlock-website	`b7f4f25`	Apr 27 2026, 04:46 PM

changeset-bot · 2026-04-22T06:53:06Z

⚠️ No Changeset found

Latest commit: 6c51fa6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

socket-security · 2026-04-22T06:54:06Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
starlight-llms-txt@0.6.1 ⏵ 0.8.1	⁺¹		⁺¹	^-1
gunshi@0.28.2 ⏵ 0.29.4	⁺¹		⁺¹
@astrojs/starlight@0.37.7 ⏵ 0.38.3	⁺¹		⁺¹	⁺¹
astro-og-canvas@0.7.2 ⏵ 0.11.1	^-2			⁺⁴
canvaskit-wasm@0.40.0 ⏵ 0.41.1	⁺¹			⁺⁶
@modelcontextprotocol/sdk@1.23.0 ⏵ 1.29.0		⁺³¹
agents@0.2.35 ⏵ 0.11.4		⁺⁴	⁺¹	⁺¹

View full report

pkg-pr-new · 2026-04-22T06:54:29Z

Open in StackBlitz

npm i https://pkg.pr.new/varlock@640

npm i https://pkg.pr.new/@varlock/cloudflare-integration@640

commit: 6c51fa6

Bumps the minor group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [gunshi](https://github.com/kazupon/gunshi/tree/HEAD/packages/gunshi) | `0.28.2` | `0.29.4` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.23.0` | `1.29.0` | | [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents) | `0.2.35` | `0.11.6` | | [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.37.7` | `0.38.4` | | [astro-og-canvas](https://github.com/delucis/astro-og-canvas/tree/HEAD/packages/astro-og-canvas) | `0.7.2` | `0.11.1` | | [canvaskit-wasm](https://github.com/google/skia) | `0.40.0` | `0.41.1` | | [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt) | `0.6.1` | `0.8.1` | Bumps the minor group with 1 update in the /packages/varlock directory: [gunshi](https://github.com/kazupon/gunshi/tree/HEAD/packages/gunshi). Bumps the minor group with 2 updates in the /packages/varlock-docs-mcp directory: [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) and [agents](https://github.com/cloudflare/agents/tree/HEAD/packages/agents). Bumps the minor group with 4 updates in the /packages/varlock-website directory: [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight), [astro-og-canvas](https://github.com/delucis/astro-og-canvas/tree/HEAD/packages/astro-og-canvas), [canvaskit-wasm](https://github.com/google/skia) and [starlight-llms-txt](https://github.com/delucis/starlight-llms-txt/tree/HEAD/packages/starlight-llms-txt). Updates `gunshi` from 0.28.2 to 0.29.4 - [Changelog](https://github.com/kazupon/gunshi/blob/main/CHANGELOG.md) - [Commits](https://github.com/kazupon/gunshi/commits/v0.29.4/packages/gunshi) Updates `@modelcontextprotocol/sdk` from 1.23.0 to 1.29.0 - [Commits](modelcontextprotocol/typescript-sdk@1.23.0...v1.29.0) Updates `agents` from 0.2.35 to 0.11.6 - [Release notes](https://github.com/cloudflare/agents/releases) - [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md) - [Commits](https://github.com/cloudflare/agents/commits/agents@0.11.6/packages/agents) Updates `@astrojs/starlight` from 0.37.7 to 0.38.4 - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.38.4/packages/starlight) Updates `astro-og-canvas` from 0.7.2 to 0.11.1 - [Release notes](https://github.com/delucis/astro-og-canvas/releases) - [Changelog](https://github.com/delucis/astro-og-canvas/blob/latest/packages/astro-og-canvas/CHANGELOG.md) - [Commits](https://github.com/delucis/astro-og-canvas/commits/astro-og-canvas@0.11.1/packages/astro-og-canvas) Updates `canvaskit-wasm` from 0.40.0 to 0.41.1 - [Changelog](https://github.com/google/skia/blob/main/RELEASE_NOTES.md) - [Commits](https://github.com/google/skia/commits) Updates `starlight-llms-txt` from 0.6.1 to 0.8.1 - [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md) - [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.8.1/packages/starlight-llms-txt) Updates `@modelcontextprotocol/sdk` from 1.23.0 to 1.29.0 - [Commits](modelcontextprotocol/typescript-sdk@1.23.0...v1.29.0) Updates `gunshi` from 0.28.2 to 0.29.4 - [Changelog](https://github.com/kazupon/gunshi/blob/main/CHANGELOG.md) - [Commits](https://github.com/kazupon/gunshi/commits/v0.29.4/packages/gunshi) Updates `@modelcontextprotocol/sdk` from 1.23.0 to 1.29.0 - [Commits](modelcontextprotocol/typescript-sdk@1.23.0...v1.29.0) Updates `agents` from 0.2.35 to 0.11.6 - [Release notes](https://github.com/cloudflare/agents/releases) - [Changelog](https://github.com/cloudflare/agents/blob/main/packages/agents/CHANGELOG.md) - [Commits](https://github.com/cloudflare/agents/commits/agents@0.11.6/packages/agents) Updates `@modelcontextprotocol/sdk` from 1.23.0 to 1.29.0 - [Commits](modelcontextprotocol/typescript-sdk@1.23.0...v1.29.0) Updates `@astrojs/starlight` from 0.37.7 to 0.38.4 - [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md) - [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.38.4/packages/starlight) Updates `astro-og-canvas` from 0.7.2 to 0.11.1 - [Release notes](https://github.com/delucis/astro-og-canvas/releases) - [Changelog](https://github.com/delucis/astro-og-canvas/blob/latest/packages/astro-og-canvas/CHANGELOG.md) - [Commits](https://github.com/delucis/astro-og-canvas/commits/astro-og-canvas@0.11.1/packages/astro-og-canvas) Updates `canvaskit-wasm` from 0.40.0 to 0.41.1 - [Changelog](https://github.com/google/skia/blob/main/RELEASE_NOTES.md) - [Commits](https://github.com/google/skia/commits) Updates `starlight-llms-txt` from 0.6.1 to 0.8.1 - [Changelog](https://github.com/delucis/starlight-llms-txt/blob/main/packages/starlight-llms-txt/CHANGELOG.md) - [Commits](https://github.com/delucis/starlight-llms-txt/commits/starlight-llms-txt@0.8.1/packages/starlight-llms-txt) --- updated-dependencies: - dependency-name: "@astrojs/starlight" dependency-version: 0.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: "@astrojs/starlight" dependency-version: 0.38.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: agents dependency-version: 0.11.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: agents dependency-version: 0.11.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: astro-og-canvas dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: astro-og-canvas dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: canvaskit-wasm dependency-version: 0.41.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: canvaskit-wasm dependency-version: 0.41.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: gunshi dependency-version: 0.29.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor - dependency-name: gunshi dependency-version: 0.29.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor - dependency-name: starlight-llms-txt dependency-version: 0.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor - dependency-name: starlight-llms-txt dependency-version: 0.8.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-27T16:47:47Z

Superseded by #661.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 22, 2026

github-actions Bot added community core:website core:varlock core:docs-mcp labels Apr 22, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-c82cbddd63 branch from 6c51fa6 to f49d230 Compare April 22, 2026 07:16

dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-c82cbddd63 branch from f49d230 to b7f4f25 Compare April 27, 2026 16:46

dependabot Bot closed this Apr 27, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/minor-c82cbddd63 branch April 27, 2026 16:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the minor group across 4 directories with 7 updates#640

chore(deps): bump the minor group across 4 directories with 7 updates#640
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/minor-c82cbddd63

dependabot Bot commented on behalf of github Apr 22, 2026 •

edited

Loading

Upgrade Astro and dependencies

Update your collections

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 22, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Apr 22, 2026

Uh oh!

socket-security Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Apr 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Apr 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.29.4 (2026-04-09T06:58:18Z)

What's Changed

🐛 Bug Fixes

v0.29.3 (2026-03-11T08:53:31Z)

v0.29.2 (2026-02-21T14:05:58Z)

v0.29.1 (2026-02-21T14:00:47Z)

v0.29.0 (2026-02-21T13:53:41Z)

What's Changed

🌟 Features

agents@0.11.6

Patch Changes

agents@0.11.5

Patch Changes

0.11.6

Patch Changes

0.11.5

Patch Changes

0.38.4

Patch Changes

0.38.3

Patch Changes

0.38.2

Patch Changes

0.38.1

Patch Changes

0.38.0

Minor Changes

Upgrade Astro and dependencies

Update your collections

astro-og-canvas@0.11.1

Patch Changes

astro-og-canvas@0.11.0

Minor Changes

Patch Changes

astro-og-canvas@0.10.1

Patch Changes

astro-og-canvas@0.10.0

Minor Changes

Patch Changes

astro-og-canvas@0.9.0

Minor Changes

0.11.1

Patch Changes

0.11.0

Minor Changes

Patch Changes

0.10.1

Patch Changes

0.10.0

Minor Changes

Patch Changes

0.9.0

Minor Changes

0.8.1

Patch Changes

0.8.0

Minor Changes

0.7.0

Minor Changes

v0.29.4 (2026-04-09T06:58:18Z)

What's Changed

🐛 Bug Fixes

v0.29.3 (2026-03-11T08:53:31Z)

v0.29.2 (2026-02-21T14:05:58Z)

v0.29.1 (2026-02-21T14:00:47Z)

v0.29.0 (2026-02-21T13:53:41Z)

What's Changed

🌟 Features

agents@0.11.6

Patch Changes

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 22, 2026

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

dependabot Bot commented on behalf of github Apr 22, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Apr 22, 2026 •

edited

Loading

socket-security Bot commented Apr 22, 2026 •

edited

Loading