Skip to content

deps: update dependencies across the workspace - #1046

Merged
guybedford merged 6 commits into
mainfrom
gbedford/update-dependencies
Aug 18, 2026
Merged

deps: update dependencies across the workspace#1046
guybedford merged 6 commits into
mainfrom
gbedford/update-dependencies

Conversation

@guybedford

@guybedford guybedford commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

This updates workspace dependencies as far as currently practical, including a full lockfile refresh and major version bumps.

wasm-bindgen (and js-sys/web-sys/futures/test) is deliberately not touched — it is version-locked against the submodule and updated separately.

  • syn 2 → 3 across the workspace (worker-macros: ItemFn destructuring now uses ..; worker-codegen: syn::File gained frontmatter)
  • wit-parser 0.205 → 0.256 (worker-codegen updated for Function::result: Option<Type> replacing Results, and Vec<Param> params)
  • strum 0.28, prettyplease 0.3, convert_case 0.11, cargo_metadata 0.23, toml 1.1 (worker-build)
  • test-only: rand 0.10 (random_range moved to RngExt), getrandom 0.4, md5 0.8, tungstenite 0.30
  • examples: mail-builder 0.5, num-bigint 0.5
  • worker-build managed toolchain: wasm-opt 130 → 132, esbuild 0.28.1 → 0.28.2 (verified fresh download + release build)
  • JS: @cloudflare/workers-types 5, vitest 4, typescript 7, @types/node 26, miniflare 4.20260730 (the miniflare 5 line is alpha-only and skipped; new miniflare requires namespace_id on ratelimit configs — test fixed), changesets majors

Deliberate holds:

  • matchit stays at 0.7: matchit 0.8+ changed route param syntax from :param to {param}, which would silently break the Router public API for all users. Bumping it is a semver-major decision for workers-rs itself.
  • time stays at 0.3.48 (main's current version) in the lockfile: newer releases use edition-2024 let-chains (rustc 1.88+), and 0.3.48 cannot be re-resolved fresh since its exact-pinned time-macros 0.2.28 is yanked.
  • cargo-platform pinned to 0.3.1 in the lockfile (0.3.2+ declares rust-version above the repo's 1.87 CI toolchain).

The lockfile was resolved with a 1.87 toolchain (MSRV-aware fallback) to match CI. Verified locally: workspace check, both clippy configurations, rustfmt, worker-build wasm build of the test crate, and the full vitest suite (137 passed).

Updates wasm-bindgen to 0.2.127 (submodule + aligned crate pins),
js-sys/web-sys 0.3.104, and major bumps: syn 3, strum 0.28,
wit-parser 0.256, prettyplease 0.3, convert_case 0.11,
cargo_metadata 0.23, toml 1.1, rand 0.10, getrandom 0.4, md5 0.8,
tungstenite 0.30, mail-builder 0.5, num-bigint 0.5. JS deps:
workers-types 5, vitest 4, typescript 7, miniflare 4.20260730.

matchit is intentionally held at 0.7: matchit 0.8+ changed route
param syntax from ':param' to '{param}', which is a breaking change
to the worker Router public API.

cargo-platform is pinned to 0.3.1 and time to 0.3.48 in the
lockfile to preserve rustc 1.87 compatibility.
wasm-bindgen is version-locked against the submodule and updated
separately. miniflare now requires namespace_id on ratelimits.
binaryen 132 includes compact-imports in --all-features, but workerd
does not yet support the encoding (import kind 0x7f).
…ures

--all-features lets each new binaryen release emit encodings before
workerd supports them (binaryen 132 emitted compact imports, which
workerd rejects). Enable exactly the rustc wasm32 defaults plus
exception-handling for wasm-bindgen catch wrappers, so unsupported
proposals fail loudly at build time instead.
@guybedford
guybedford merged commit ff44868 into main Aug 18, 2026
19 of 20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant