[pull] main from oomol-lab:main - #16
Merged
Merged
Conversation
## Summary The public documentation did not clearly distinguish the hosted OAuth flow from self-hosted credential setup, and Korean readers did not have a localized README. The contributor sections were also inconsistent across the available README translations. This PR clarifies that `connect.oomol.com` provides the hosted OAuth path while self-hosted deployments use their own provider credentials. It adds a full Korean README, updates the language navigation and corresponding localized wording, and adds consistent contributor-wall sections to the English, French, Japanese, Korean, Russian, Simplified Chinese, and Traditional Chinese READMEs. These changes make the supported authentication paths easier to understand, extend the project documentation to Korean-speaking users, and keep contributor recognition consistent across translations. ## Validation - `npm run lint` - `npm run fix-check`
Adds an `excalidraw_mcp` provider that connects to Excalidraw's MCP server and exposes two actions: - `read_me` for the Excalidraw element-format reference - `create_view` for rendering a diagram from Excalidraw elements Details: - Optional custom MCP endpoint configuration, defaulting to the public `https://mcp.excalidraw.com` - Credential validation that verifies the endpoint exposes the expected MCP tools - Catalog regeneration and provider wiring - Unit coverage for endpoint normalization and provider behavior Verified live end-to-end against the public Excalidraw MCP endpoint: - `read_me` - `create_view` - `export_to_excalidraw` --------- Co-authored-by: Kevin Cui <bh@bugs.cc>
## Summary - In-place reconnect via `store.set()` now rotates the connection `id`. - A stale OAuth refresh holding the previous id fails optimistic concurrency and cannot overwrite newly stored credentials. - Applies to both SQLite and D1 connection stores; memory test doubles updated to match. ## Problem `updateCredential` uses `id` for OCC, but `set()` preserved `id` on upsert. A refresh started before reconnect could finish after an in-place credential replace and overwrite the new tokens. ## Test plan - [x] `npm test -- src/connection-service.test.ts -t "OAuth refresh|in place"` - [x] `npm test -- src/server/storage/sqlite-runtime-store.test.ts -t "rotates connection"` - [x] `npm test -- src/server/storage/d1-runtime-store.test.ts -t "rotates connection"` --------- Co-authored-by: l1shen <648952316@qq.com>
Fork PRs often need small maintainer fixes — a rebase, a lint tweak, a follow-up commit — and each one stalls on a review round-trip when the author hasn't enabled "Allow edits by maintainers". This adds a workflow that checks the setting on fork PRs and, when it's off, leaves a comment asking the author to enable it, linking the GitHub docs page ([Allowing changes to a pull request branch created from a fork](https://docs.github.com/en/pull-requests/how-tos/work-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork)) that shows where the checkbox is. The check is non-blocking — the job never fails the PR. The main review point is the trigger: it runs on `pull_request_target` because on fork PRs the `pull_request` event's `GITHUB_TOKEN` is read-only and can't comment — exactly the PRs this targets. That's safe here since the workflow never checks out or executes PR code; it only reads PR metadata and writes an issue comment, with permissions scoped to `pull-requests: write`. A hidden HTML marker keeps it to a single comment per PR, updated in place when the state changes — including flipping to a short "enabled, thanks" note once the author turns it on (the checkbox emits no webhook event, so that refresh happens on the next push or a manual re-run). Same-repo branches are skipped because maintainers already have push access, and organization-owned forks are skipped because GitHub doesn't offer the setting there at all. Signed-off-by: Kevin Cui <bh@bugs.cc>
Adds narayann7/star-history-action on a daily schedule (plus `workflow_dispatch`) to render the repo's star-growth chart as light/dark SVGs into `assets/star-history/` and keep the new marker block at the bottom of `README.md` up to date. The action only commits when star data actually changed, and its commit message carries `[skip ci]`, so refreshes neither spam history nor trigger the CI workflow. Two deliberate deviations from the upstream example: the action is pinned to an immutable SHA instead of the mutable `v1` tag, since a third-party action holding `contents: write` that pushes to this repo shouldn't be silently updatable; and the per-star `watch` trigger is left out to avoid a commit for every star event — daily is enough. The first chart appears after a manual `workflow_dispatch` run once this lands on main; until then the marker block renders as empty. Localized READMEs under `docs/` are untouched for now — they can reference the same generated SVGs once the first run produces them. Signed-off-by: Kevin Cui <bh@bugs.cc>
## Summary OpenConnector's README did not have a dedicated, restrained prompt for readers who want to support the project with a GitHub star. Adding the prompt too early in the document would interrupt the developer-focused product and setup flow, while leaving it implicit inside the Community section would make its purpose unclear. This change adds a standalone support section near the end of the README, between Community and Contributors. The placement keeps the main developer journey uninterrupted while giving the star guidance a clear semantic home. ## Changes - add an optimized animated GIF that demonstrates where to star the repository - add a concise `Support OpenConnector` section to the English README - localize the section heading, explanatory copy, image path, and accessible alt text across Simplified Chinese, Traditional Chinese, Japanese, Korean, Russian, and French - keep the GIF as a non-clickable repository asset because the README is already rendered on the repository page ## Validation - `npm run fix-check` - `git diff --check` - verified the provider registries remain up to date - verified the GIF appears once in each README between the Community and Contributors sections
Bumps `fast-xml-parser` from ^5.9.3 to ^5.10.1. The lockfile also picks up its internal dependency updates (`@nodable/entities` 2→3, `is-unsafe` 1→2, `xml-naming` 0.1→0.3); no API changes on our side. Signed-off-by: Kevin Cui <bh@bugs.cc>
## Summary OpenConnector's README files previously described Wanta mainly as a hosted product entry point for trying SaaS connections. Since Wanta is now available as an open-source desktop Agent project, that framing no longer explained the relationship between the two repositories or the ways open-source users can run, adapt, and contribute to Wanta. This change presents OpenConnector and Wanta as two projects in the same OOMOL open-source ecosystem. It explains that OpenConnector connects Agents to external services, while Wanta provides a complete desktop Agent application powered by OpenCode and uses OpenConnector for connected SaaS services. The revised section gives readers three concrete paths: - run Wanta locally with an OpenAI-compatible model and no Wanta account; - fork and customize Wanta to build a desktop Agent; - optionally use hosted models, OAuth connections, and team workspaces. It also links Wanta's GitHub repository directly and invites issues and pull requests. The wording is synchronized across the English, Simplified Chinese, Traditional Chinese, French, Japanese, Korean, and Russian README files. ## User impact Readers can now understand what each project does, how the projects relate technically, and which parts can be used locally or customized. The section remains compact while providing enough context to avoid presenting Wanta only as a commercial or hosted path. ## Validation - `npm run lint` - `npm run fix-check` - `git diff --check`
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/fastify/fast-uri/releases">fast-uri's releases</a>.</em></p> <blockquote> <h2>v3.1.4</h2> <h2>⚠️ Security Release</h2> <p>Fix for <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx">https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx</a></p> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4">https://github.com/fastify/fast-uri/compare/v3.1.3...v3.1.4</a></p> <h2>v3.1.3</h2> <h2>⚠️ Security Release</h2> <ul> <li>Fixes: <a href="https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6">https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3">https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/fastify/fast-uri/commit/6aeece669e4166b2446a89f17c07a3b15dfb7ed4"><code>6aeece6</code></a> Bumped v3.1.4</li> <li><a href="https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353"><code>2d50fba</code></a> fix: reject literal backslash in URI authority</li> <li><a href="https://github.com/fastify/fast-uri/commit/0549fe35b0d482233f3be2816439f3ec803603fa"><code>0549fe3</code></a> Bumped v3.1.3</li> <li><a href="https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05"><code>2a6d357</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/oomol-lab/open-connector/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.16 to 8.5.23. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.19</h2> <ul> <li>Fixed cleaning <code>before</code> for new nodes inserted to <code>Root</code> (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.18</h2> <ul> <li>Restricted loading previous source maps file to the <code>opts.from</code> folder for security reasons (use <code>unsafeMap: true</code> to disable the check).</li> </ul> <h2>8.5.17</h2> <ul> <li>Fixed <code>Maximum call stack size exceeded</code> error.</li> <li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li> <li>Fixed <code>Input#origin()</code> for unmapped end position (by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.5.23</h2> <ul> <li>Do not load source map without <code>opts.from</code> for security reasons.</li> </ul> <h2>8.5.22</h2> <ul> <li>Fixed custom property losing semicolon before a comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> </ul> <h2>8.5.21</h2> <ul> <li>Fixed childless at-rule losing semicolon before comment (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/isker"><code>@isker</code></a>).</li> </ul> <h2>8.5.20</h2> <ul> <li>Fixed missing space if <code>AtRule#params</code> is set after (by <a href="https://github.com/sarathfrancis90"><code>@sarathfrancis90</code></a>).</li> <li>Fixed mixing AST error on warnings (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.19</h2> <ul> <li>Fixed cleaning <code>before</code> for new nodes inserted to <code>Root</code> (by <a href="https://github.com/MahinAnowar"><code>@MahinAnowar</code></a>).</li> </ul> <h2>8.5.18</h2> <ul> <li>Restricted loading previous source maps file to the <code>opts.from</code> folder for security reasons (use <code>unsafeMap: true</code> to disable the check).</li> </ul> <h2>8.5.17</h2> <ul> <li>Fixed <code>Maximum call stack size exceeded</code> error.</li> <li>Fixed Prototype hijacking for <code>postcss.fromJSON()</code>.</li> <li>Fixed <code>Input#origin()</code> for unmapped end position (by <a href="https://github.com/chatman-media"><code>@chatman-media</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/eb9e1fe793740bb3280bdf5bf98147f857f011bd"><code>eb9e1fe</code></a> Release 8.5.23 version</li> <li><a href="https://github.com/postcss/postcss/commit/9d19c78ac91108b3f7d7130e55c6fa806c0efb84"><code>9d19c78</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"><code>7beca13</code></a> Does no load source map file without opts.from</li> <li><a href="https://github.com/postcss/postcss/commit/decea51421682341401575b3740709fda0e12930"><code>decea51</code></a> Typo</li> <li><a href="https://github.com/postcss/postcss/commit/c18e30d126395d42a0726aa00e03a8f1088985ae"><code>c18e30d</code></a> Update EM banner</li> <li><a href="https://github.com/postcss/postcss/commit/98a39ad73d163a90be924d5126c771262110f1fc"><code>98a39ad</code></a> Update EM banner</li> <li><a href="https://github.com/postcss/postcss/commit/a3e48c492ddec0e4879d513b8b995fee887af352"><code>a3e48c4</code></a> Release 8.5.22 version</li> <li><a href="https://github.com/postcss/postcss/commit/f49d6911795f53b2cfe023bb686bf1144ec30618"><code>f49d691</code></a> Fix custom property losing its semicolon before a comment (<a href="https://redirect.github.com/postcss/postcss/issues/2117">#2117</a>)</li> <li><a href="https://github.com/postcss/postcss/commit/28e0daf8f2fe5ba9e19ea3f8c27c8fe176f9419e"><code>28e0daf</code></a> Release 8.5.21 version</li> <li><a href="https://github.com/postcss/postcss/commit/3d2b4e43e38274f233b5609d09687cadad8215d9"><code>3d2b4e4</code></a> Update dependencies</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.5.16...8.5.23">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/oomol-lab/open-connector/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [sharp](https://github.com/lovell/sharp) to 0.35.2 and updates ancestor dependency [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler). These dependencies need to be updated together. Updates `sharp` from 0.34.5 to 0.35.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lovell/sharp/releases">sharp's releases</a>.</em></p> <blockquote> <h2>v0.35.2</h2> <ul> <li> <p>TypeScript: Add <code>mediaType</code> to metadata response. <a href="https://redirect.github.com/lovell/sharp/issues/4492">#4492</a></p> </li> <li> <p>Improve WebAssembly fallback detection. <a href="https://redirect.github.com/lovell/sharp/issues/4513">#4513</a></p> </li> <li> <p>Improve code bundler support with stub binaries. <a href="https://redirect.github.com/lovell/sharp/issues/4543">#4543</a></p> </li> <li> <p>Verify GIF <code>effort</code> option is an integer. <a href="https://redirect.github.com/lovell/sharp/pull/4544">#4544</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Verify <code>recomb</code> matrix entries are numbers. <a href="https://redirect.github.com/lovell/sharp/pull/4545">#4545</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>TypeScript: Replace namespace with named exports for ESM. <a href="https://redirect.github.com/lovell/sharp/issues/4546">#4546</a></p> </li> <li> <p>Bound dilate and erode width to avoid mask-size overflow. <a href="https://redirect.github.com/lovell/sharp/pull/4548">#4548</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Verify <code>convolve</code> kernel values are numbers. <a href="https://redirect.github.com/lovell/sharp/pull/4549">#4549</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> </ul> <h2>v0.35.2-rc.2</h2> <ul> <li> <p>TypeScript: Add <code>mediaType</code> to metadata response. <a href="https://redirect.github.com/lovell/sharp/issues/4492">#4492</a></p> </li> <li> <p>Improve WebAssembly fallback detection. <a href="https://redirect.github.com/lovell/sharp/issues/4513">#4513</a></p> </li> <li> <p>Improve code bundler support with stub binaries. <a href="https://redirect.github.com/lovell/sharp/issues/4543">#4543</a></p> </li> <li> <p>Verify GIF <code>effort</code> option is an integer. <a href="https://redirect.github.com/lovell/sharp/pull/4544">#4544</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>Verify <code>recomb</code> matrix entries are numbers. <a href="https://redirect.github.com/lovell/sharp/pull/4545">#4545</a> <a href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p> </li> <li> <p>TypeScript: Replace namespace with named exports for ESM. <a href="https://redirect.github.com/lovell/sharp/issues/4546">#4546</a></p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lovell/sharp/commit/c9622a38edfc6fc709764152ea34332ba01619cf"><code>c9622a3</code></a> Release v0.35.2</li> <li><a href="https://github.com/lovell/sharp/commit/cd4568fd41e576345be3c5f774d22e441ac563ac"><code>cd4568f</code></a> Upgrade to sharp-libvips v1.3.1</li> <li><a href="https://github.com/lovell/sharp/commit/78390cf3d22a79c799727564eb1d0ff92d0e759b"><code>78390cf</code></a> Tests: Add font file to prevent font discovery flakiness (<a href="https://redirect.github.com/lovell/sharp/issues/4550">#4550</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/61210b4d0a6972e83fa5a8cef47e04445114c1e1"><code>61210b4</code></a> Verify convolve kernel values are numbers (<a href="https://redirect.github.com/lovell/sharp/issues/4549">#4549</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/1cb27dcca43d2bb3b43fad485d9d54ece0ee1f3e"><code>1cb27dc</code></a> Prerelease v0.35.2-rc.2</li> <li><a href="https://github.com/lovell/sharp/commit/c7606c3ca7d8364d36984f44bb81a45c4b7733fb"><code>c7606c3</code></a> Upgrade to sharp-libvips v1.3.1-rc.0</li> <li><a href="https://github.com/lovell/sharp/commit/29d1e9e4d318775590e332f95088cf7f741c8dca"><code>29d1e9e</code></a> Prerelease v0.35.2-rc.1</li> <li><a href="https://github.com/lovell/sharp/commit/bbba0a16bab7a6cc2b6f3023f3dc0337336b39bd"><code>bbba0a1</code></a> Improve code bundler support with stub binaries</li> <li><a href="https://github.com/lovell/sharp/commit/ab528662ea949f60421dc527640d3188894fb57f"><code>ab52866</code></a> Bound dilate and erode width to avoid mask-size overflow (<a href="https://redirect.github.com/lovell/sharp/issues/4548">#4548</a>)</li> <li><a href="https://github.com/lovell/sharp/commit/0f594dde40ed08c391810da38d994e923fcdfc24"><code>0f594dd</code></a> Prerelease v0.35.2-rc.0</li> <li>Additional commits viewable in <a href="https://github.com/lovell/sharp/compare/v0.34.5...v0.35.2">compare view</a></li> </ul> </details> <br /> Updates `wrangler` from 4.107.0 to 4.114.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/cloudflare/workers-sdk/releases">wrangler's releases</a>.</em></p> <blockquote> <h2>wrangler@4.114.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14633">#14633</a> <a href="https://github.com/cloudflare/workers-sdk/commit/3203b5d34488b2b14d6066db705acef267d1229a"><code>3203b5d</code></a> Thanks <a href="https://github.com/nickpatt"><code>@nickpatt</code></a>! - Add local-dev observability</p> <p><code>wrangler dev</code> and the Vite plugin now capture a trace for every local Worker invocation - spans, logs, and <code>console.*</code> output, including requests that cross worker or Durable Object boundaries.</p> <p>You can explore this data two ways:</p> <ul> <li>A new Observability tab in the Local Explorer, with a Traces view (recent invocations, an inline timeline waterfall, and filters) and an Events view.</li> <li>A read-only SQL endpoint at <code>/cdn-cgi/explorer/api/local/observability/query</code>, discoverable via the Local Explorer's OpenAPI document, so coding agents and tools can query the same <code>spans</code> and <code>logs</code> tables.</li> </ul> <p>While this is in testing it's off by default; set <code>X_LOCAL_OBSERVABILITY=true</code> to turn it on. It will be on by default in the public release.</p> </li> </ul> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14373">#14373</a> <a href="https://github.com/cloudflare/workers-sdk/commit/246ce92d1d24974678eb23a03290f9391fe9b272"><code>246ce92</code></a> Thanks <a href="https://github.com/Jacroney"><code>@Jacroney</code></a>! - Improve the D1 database-limit error message</p> <p>When creating a D1 database fails because the account has hit its database limit, the error now points to the relevant next steps — upgrading on the Workers Free plan or requesting a higher limit on a paid plan — alongside the existing commands to list and delete databases. Previously it only suggested deleting unused databases. This applies both to <code>wrangler d1 create</code> and to the D1 database that is created during resource provisioning on deploy.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14796">#14796</a> <a href="https://github.com/cloudflare/workers-sdk/commit/c38a2c358ef5c8628ce26fa8c62f002dda0dcb3d"><code>c38a2c3</code></a> Thanks <a href="https://github.com/apps/dependabot"><code>@dependabot</code></a>! - Update dependencies of "miniflare", "wrangler"</p> <p>The following dependency versions have been updated:</p> <table> <thead> <tr> <th>Dependency</th> <th>From</th> <th>To</th> </tr> </thead> <tbody> <tr> <td><code>@cloudflare/workers-types</code></td> <td>^5.20260721.1</td> <td>^5.20260722.1</td> </tr> <tr> <td>workerd</td> <td>1.20260721.1</td> <td>1.20260722.1</td> </tr> </tbody> </table> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14788">#14788</a> <a href="https://github.com/cloudflare/workers-sdk/commit/8416b33d9ba0109195ce8fd5a0c185366c41af5a"><code>8416b33</code></a> Thanks <a href="https://github.com/chinesepowered"><code>@chinesepowered</code></a>! - Fix grammar in the container image-too-large error</p> <p>The error thrown when a container image exceeds the available disk size ended with "Your need more disk for this image." It now reads "You need more disk for this image."</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14809">#14809</a> <a href="https://github.com/cloudflare/workers-sdk/commit/4683ff8aa72e1ba559108f7074d8f6aa5d73eaaa"><code>4683ff8</code></a> Thanks <a href="https://github.com/jamesopstad"><code>@jamesopstad</code></a>! - Ignore the removed <code>legacy_env</code> field when reading a redirected configuration</p> <p>Older versions of tools such as the Vite plugin can generate a redirected configuration (<code>.wrangler/deploy/config.json</code>) that still includes the removed <code>legacy_env</code> field. Since these files are tool-generated, users could not easily remove the field themselves, and Wrangler would error out. Wrangler now silently strips <code>legacy_env</code> from redirected configurations. User-authored configurations still report an error so that the field can be removed.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14593">#14593</a> <a href="https://github.com/cloudflare/workers-sdk/commit/02232f348002d8dc002c108ac7095119d34d1b35"><code>02232f3</code></a> Thanks <a href="https://github.com/spk-ai"><code>@spk-ai</code></a>! - Fix dev proxy silently hanging or returning a misleading 503 on network errors for non-root-path requests</p> <p>During <code>wrangler dev</code>, a transient network error on any request path other than <code>/</code> could be misclassified as the worker being reloaded, even when it wasn't: <code>GET</code>/<code>HEAD</code> requests would silently hang (with nothing logged) until the client timed out, and other methods would receive a misleading <code>Your worker restarted mid-request</code> 503. Such errors are now reported and surfaced immediately when the worker has not actually changed.</p> </li> <li> <p><a href="https://redirect.github.com/cloudflare/workers-sdk/pull/14797">#14797</a> <a href="https://github.com/cloudflare/workers-sdk/commit/f8a8c2c0001c669a731b947755bb68208d7e6f43"><code>f8a8c2c</code></a> Thanks <a href="https://github.com/roerohan"><code>@roerohan</code></a>! - Explain how to provision Flagship bindings if <code>app_id</code> missing in remote development</p> <p>Wrangler now reports that a Flagship binding without an <code>app_id</code> must first be created with <code>wrangler flagship apps create</code>.</p> </li> <li> <p>Updated dependencies [<a href="https://github.com/cloudflare/workers-sdk/commit/c38a2c358ef5c8628ce26fa8c62f002dda0dcb3d"><code>c38a2c3</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/c079ba33f1df98e38f7cebc82a64886a7e495879"><code>c079ba3</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/95b026edfdf0c6b6e40994cd8fa06a350bc868f2"><code>95b026e</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/c4bacec349f2d6e1bf4115f22a4b4eaca62cd0fc"><code>c4bacec</code></a>, <a href="https://github.com/cloudflare/workers-sdk/commit/3203b5d34488b2b14d6066db705acef267d1229a"><code>3203b5d</code></a>]:</p> <ul> <li>miniflare@4.20260722.0</li> </ul> </li> </ul> <h2>wrangler@4.113.0</h2> <h3>Minor Changes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/cloudflare/workers-sdk/commit/16b3d5a48005c7d92112470119ba96019071e59e"><code>16b3d5a</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14799">#14799</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/3203b5d34488b2b14d6066db705acef267d1229a"><code>3203b5d</code></a> [miniflare] Local dev observability: traces, spans & logs via a SQL query API...</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/246ce92d1d24974678eb23a03290f9391fe9b272"><code>246ce92</code></a> [wrangler] Improve d1 create database-limit error message (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14373">#14373</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/02232f348002d8dc002c108ac7095119d34d1b35"><code>02232f3</code></a> [wrangler] compare origins, not hrefs, when classifying dev proxy fetch error...</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/8416b33d9ba0109195ce8fd5a0c185366c41af5a"><code>8416b33</code></a> [wrangler] Fix grammar in container image-too-large error (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14788">#14788</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/f8a8c2c0001c669a731b947755bb68208d7e6f43"><code>f8a8c2c</code></a> [wrangler] Explain missing Flagship app ID (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14797">#14797</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/88f42e784365819e283ecca654ede661c952ec27"><code>88f42e7</code></a> Version Packages (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14740">#14740</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/9e619714b036507380334ba17e2fb44bfed74c16"><code>9e61971</code></a> unskip agent memory remote bindings test (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14786">#14786</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/0df3d432353f39b6a90c340c268c83a7ac0b7d5c"><code>0df3d43</code></a> [wrangler] Extract remote bindings into a package (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14720">#14720</a>)</li> <li><a href="https://github.com/cloudflare/workers-sdk/commit/4815711fb5f896a5aa9221b6bddb9ef78c3f288d"><code>4815711</code></a> [miniflare] Report the Worker's error for HEAD requests (<a href="https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler/issues/14766">#14766</a>)</li> <li>Additional commits viewable in <a href="https://github.com/cloudflare/workers-sdk/commits/wrangler@4.114.0/packages/wrangler">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/oomol-lab/open-connector/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@hono/node-server](https://github.com/honojs/node-server) from 2.0.6 to 2.0.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/honojs/node-server/releases">@hono/node-server's releases</a>.</em></p> <blockquote> <h2>v2.0.10</h2> <h2>Security fixes</h2> <p>This release includes a fix for the following security issue:</p> <h3>Unauthenticated memory-leak DoS via aborted WebSocket handshake</h3> <p>Affects: <code>upgradeWebSocket</code>. A WebSocket upgrade request with a missing or malformed <code>Sec-WebSocket-Key</code> header leaked the request's <code>IncomingMessage</code> and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. <a href="https://github.com/honojs/node-server/security/advisories/GHSA-9mqv-5hh9-4cgg">GHSA-9mqv-5hh9-4cgg</a></p> <hr /> <p>Users of <code>upgradeWebSocket</code> are encouraged to upgrade to this version.</p> <h2>v2.0.9</h2> <h2>What's Changed</h2> <ul> <li>fix(websocket): polyfill missing ErrorEvent global by <a href="https://github.com/otnc"><code>@otnc</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/371">honojs/node-server#371</a></li> <li>fix(serve-static): correct Range header parsing edge cases by <a href="https://github.com/otnc"><code>@otnc</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/372">honojs/node-server#372</a></li> <li>fix: recover complete request bodies after client disconnect by <a href="https://github.com/usualoma"><code>@usualoma</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/375">honojs/node-server#375</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/otnc"><code>@otnc</code></a> made their first contribution in <a href="https://redirect.github.com/honojs/node-server/pull/371">honojs/node-server#371</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9">https://github.com/honojs/node-server/compare/v2.0.8...v2.0.9</a></p> <h2>v2.0.8</h2> <h2>What's Changed</h2> <ul> <li>ci(release): add <code>--no-git-checks</code> option for <code>pnpm stage publish</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/369">honojs/node-server#369</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8">https://github.com/honojs/node-server/compare/v2.0.7...v2.0.8</a></p> <h2>v2.0.7</h2> <h2>What's Changed</h2> <ul> <li>chore: migrate to pnpm by <a href="https://github.com/BlankParticle"><code>@BlankParticle</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/367">honojs/node-server#367</a></li> <li>fix(serve-static): serve precompressed files for application/octet-stream by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/366">honojs/node-server#366</a></li> <li>chore: bump <code>supertest</code> by <a href="https://github.com/yusukebe"><code>@yusukebe</code></a> in <a href="https://redirect.github.com/honojs/node-server/pull/368">honojs/node-server#368</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7">https://github.com/honojs/node-server/compare/v2.0.6...v2.0.7</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/honojs/node-server/commit/7c1457ed5536c02fdd2f001129fae67bcbca54a1"><code>7c1457e</code></a> 2.0.10</li> <li><a href="https://github.com/honojs/node-server/commit/3a21938c418340e980cb7ffa88e78369f78392d1"><code>3a21938</code></a> Merge commit from fork</li> <li><a href="https://github.com/honojs/node-server/commit/98420217e53a17a238ef1aa1a6bef0b2b70136c5"><code>9842021</code></a> 2.0.9</li> <li><a href="https://github.com/honojs/node-server/commit/51f3bf56f56d9691ec0f7e1562a96f0b485a7dd9"><code>51f3bf5</code></a> fix: recover complete request bodies after client disconnect (<a href="https://redirect.github.com/honojs/node-server/issues/375">#375</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/fdb87badbe313cfbfe6bb2355e9893dc0698d2bd"><code>fdb87ba</code></a> fix(serve-static): correct Range header parsing edge cases (<a href="https://redirect.github.com/honojs/node-server/issues/372">#372</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/912e3fd80c4311756f724bd566de1433c8d772d9"><code>912e3fd</code></a> fix(websocket): polyfill missing ErrorEvent global (<a href="https://redirect.github.com/honojs/node-server/issues/371">#371</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/114c15efb38dabaf81af774ddb764409e3d156d8"><code>114c15e</code></a> 2.0.8</li> <li><a href="https://github.com/honojs/node-server/commit/5db2d5df662cd69ff5c4cc23b8ecb3a6f63e4e38"><code>5db2d5d</code></a> ci(release): add <code>--no-git-checks</code> option for <code>pnpm stage publish</code> (<a href="https://redirect.github.com/honojs/node-server/issues/369">#369</a>)</li> <li><a href="https://github.com/honojs/node-server/commit/a528a77ed2c28dc12775c849abc6b6df6d4cb44c"><code>a528a77</code></a> 2.0.7</li> <li><a href="https://github.com/honojs/node-server/commit/b2d610c1e37a96639fbb2eae662e858800aa8906"><code>b2d610c</code></a> chore: bump <code>supertest</code> (<a href="https://redirect.github.com/honojs/node-server/issues/368">#368</a>)</li> <li>Additional commits viewable in <a href="https://github.com/honojs/node-server/compare/v2.0.6...v2.0.10">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/oomol-lab/open-connector/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )