[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@cloudflare/workers-types	^5.20261016.1 → ^5.20261018.1
execa	^10.1.1 → ^10.2.0
rollup (source)	^4.64.7 → ^4.64.9

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

sindresorhus/execa (execa)

v10.2.0

Compare Source

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

• Exceeding maxBuffer now terminates the subprocess with killSignal, instead of leaving it running and the promise pending f6de9be
• maxBuffer: 0 now limits the output of synchronous methods, like asynchronous methods 224dd20
• Options of $ set to undefined now use $'s defaults, such as inheriting stdin f61a6e9

Fixes

• Fix invalid file descriptor objects, such as closed file handles, crashing the current process instead of throwing d0a5968
• Fix synchronous transforms: errors being hidden, filtered output being returned on failure, mixed text and byte chunks being reordered, and final() being skipped without input 0ba2b6e ed80079 9c54833
• Fix result.all changing objects when only stdout or stderr is buffered 8629132
• Fix writing objects to a web WritableStream 5ea2900
• Fix an invalid subprocess.duplex() option making later stream conversions hang 5e4345b
• Fix execaNode() not running its file when the current process uses --print e747872

Types

• Fix result and subprocess types when the options are a union, including IPC f5772f3 355d917 cb8aaf6
• Fix result types when options bound with execa(options) are overridden or reset with undefined 708fed7
• Fix subprocess.stdin types with the input and inputFile options 236c831
• Fix chunk types of subprocess.iterable() with object-mode transforms a2912e5
• Fix fd-specific option types, and execaNode() types with node: undefined 80b01e9 523cf9b

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 1am and before 5am"
• Automerge
  • "after 2am and before 5am"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nitro.build	Ready	Preview	Oct 21, 2026 7:46am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 387d5fe1-801b-4fa9-a2aa-6aa5c1e1dcec

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4875

commit: 5c3efdd

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	execa@​10.1.1 ⏵ 10.2.0			+1

View full report