Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates - #491

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-367acab72b
Closed

chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates#491
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-367acab72b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 7 updates in the / directory:

Package From To
@cloudflare/vitest-pool-workers 0.20.2 0.21.3
@cloudflare/workers-types 5.20260804.1 5.20260816.1
eslint 10.8.0 10.8.1
typescript-eslint 8.66.0 8.67.0
wrangler 4.119.0 4.123.0
@types/node 26.1.2 26.2.0
esbuild 0.28.1 0.28.2

Updates @cloudflare/vitest-pool-workers from 0.20.2 to 0.21.3

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.21.3

Patch Changes

@​cloudflare/vitest-pool-workers@​0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

  • #15148 0b82b15 Thanks @​jamesopstad! - Ignore a nodejs_compat compatibility flag that the compatibility date already enables

    workerd rejects a compatibility flag that its compatibility date enables by default, so a Worker configured with both a compatibility date of 2026-08-04 or later and nodejs_compat failed to start locally with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore".

    The redundant nodejs_compat and nodejs_compat_v2 flags are now dropped when starting the runtime, which has no effect on the resulting Worker because the compatibility date enables both anyway. no_nodejs_compat and no_nodejs_compat_v2 still switch Node.js compatibility off, and a flag specified alongside its own opt-out is left alone so that workerd still reports those as contradictory.

  • #15123 d0c976c Thanks @​dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

    As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

    To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

    @cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

    wrangler types also no longer attributes its @types/node suggestion to "the nodejs_compat flag", which it can now make for Workers that do not set the flag at all.

  • #15131 90dd5e5 Thanks @​vicb! - Bump capnp-es to 0.0.15.

    Also re-generate the types for the latest .capnp files

  • Updated dependencies [d0c976c, d0c976c, 0b82b15, d0c976c, d0c976c, 90dd5e5, 3b02915]:

@​cloudflare/vitest-pool-workers@​0.21.1

Patch Changes

  • #14882 ab9132d Thanks @​petebacondarwin! - Report built-in modules that a Worker's compatibility settings don't provide as module errors, instead of crashing workerd

    Previously, a Worker whose module graph statically reached a compatibility-gated built-in that wasn't enabled — for example import "node:child_process" without nodejs_compat — took down the runtime with *** Received signal [#11](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/11): Segmentation fault before any test ran. Vitest reported only Worker exited unexpectedly, naming neither the module nor the file that imported it, which made the cause very hard to find. The import didn't even have to be called; being reachable from the entrypoint was enough.

    The module fallback service answered these specifiers with a redirect to the modules root, but workerd already resolves node:/cloudflare:/workerd: specifiers there, so the redirect pointed back at the module workerd was in the middle of resolving and it recursed until the stack overflowed. Such a specifier only reaches the fallback service when workerd's own registry has already missed, so it's now reported as not found: workerd raises No such module "node:child_process", matching what wrangler dev does for the same Worker. The accompanying pool error names the module and points at compatibility flags rather than suggesting you bundle it, which can't help for a module built into the runtime.

  • Updated dependencies [15cad03, 026e058, 731b33a, e1b5b4b, 5b1b930, 6e7d37d, d669088, 15cad03, c7aede7, 0aa8fa5]:

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.21.3

Patch Changes

0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

  • #15148 0b82b15 Thanks @​jamesopstad! - Ignore a nodejs_compat compatibility flag that the compatibility date already enables

    workerd rejects a compatibility flag that its compatibility date enables by default, so a Worker configured with both a compatibility date of 2026-08-04 or later and nodejs_compat failed to start locally with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore".

    The redundant nodejs_compat and nodejs_compat_v2 flags are now dropped when starting the runtime, which has no effect on the resulting Worker because the compatibility date enables both anyway. no_nodejs_compat and no_nodejs_compat_v2 still switch Node.js compatibility off, and a flag specified alongside its own opt-out is left alone so that workerd still reports those as contradictory.

  • #15123 d0c976c Thanks @​dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

    As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

    To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

    @cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

    wrangler types also no longer attributes its @types/node suggestion to "the nodejs_compat flag", which it can now make for Workers that do not set the flag at all.

  • #15131 90dd5e5 Thanks @​vicb! - Bump capnp-es to 0.0.15.

    Also re-generate the types for the latest .capnp files

  • Updated dependencies [d0c976c, d0c976c, 0b82b15, d0c976c, d0c976c, 90dd5e5, 3b02915]:

0.21.1

Patch Changes

  • #14882 ab9132d Thanks @​petebacondarwin! - Report built-in modules that a Worker's compatibility settings don't provide as module errors, instead of crashing workerd

    Previously, a Worker whose module graph statically reached a compatibility-gated built-in that wasn't enabled — for example import "node:child_process" without nodejs_compat — took down the runtime with *** Received signal [#11](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers/issues/11): Segmentation fault before any test ran. Vitest reported only Worker exited unexpectedly, naming neither the module nor the file that imported it, which made the cause very hard to find. The import didn't even have to be called; being reachable from the entrypoint was enough.

    The module fallback service answered these specifiers with a redirect to the modules root, but workerd already resolves node:/cloudflare:/workerd: specifiers there, so the redirect pointed back at the module workerd was in the middle of resolving and it recursed until the stack overflowed. Such a specifier only reaches the fallback service when workerd's own registry has already missed, so it's now reported as not found: workerd raises No such module "node:child_process", matching what wrangler dev does for the same Worker. The accompanying pool error names the module and points at compatibility flags rather than suggesting you bundle it, which can't help for a module built into the runtime.

... (truncated)

Commits

Updates @cloudflare/workers-types from 5.20260804.1 to 5.20260816.1

Commits

Updates eslint from 10.8.0 to 10.8.1

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)
  • 69bb948 docs: Update README (GitHub Actions Bot)

Chores

  • 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
  • 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
  • 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
  • ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
  • f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
  • 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
  • d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
  • 65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
  • 22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
  • 55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
  • 7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
  • eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
  • 60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
  • f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
  • d086293 test: add error locations to no-undef (#21147) (JIYEON)
  • cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
  • 688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
  • 7c1e175 test: add error locations to require-await (#21145) (Grit)
  • 588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
  • 059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
  • 5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)
Commits

Updates typescript-eslint from 8.66.0 to 8.67.0

Release notes

Sourced from typescript-eslint's releases.

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

  • typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.67.0 (2026-08-10)

🚀 Features

  • typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates wrangler from 4.119.0 to 4.123.0

Release notes

Sourced from wrangler's releases.

wrangler@4.123.0

Minor Changes

  • #15113 b8fd112 Thanks @​BSFishy! - Add local dev simulation for Cloudflare Access ctx.access.getIdentity()

    You can now configure a mock Cloudflare Access identity in wrangler.json so that ctx.access.getIdentity() returns it during local development.

    // wrangler.json
{
  "access": {
    "dev": {
      "aud": "my-app-aud-tag",
      "identity": {
        "email": "user@example.com",
        "name": "Test User"
      }
    }
  }
}

  • #15152 f0f2054 Thanks @​GregBrimble! - [private beta]: Updates the --ignore-defaults flag to --ignore-base-config on wrangler preview commands.

    --ignore-base-config now only takes effect on Preview creation, rather than on each deployment, since Preview base configuration is now copy-on-create rather than inherit-on-deploy.

  • #14872 339509d Thanks @​dario-piotrowicz! - Add automatic update prompts for out-of-date Cloudflare agent skills

    When Cloudflare skills were previously installed by Wrangler and the upstream cloudflare/skills repository has newer content, Wrangler now offers to update them after eligible commands complete.

    To reduce prompt fatigue, the update check only runs once a month (30 days since the last install or update). Declining suppresses the prompt until the next upstream change.

    When declining an update, Wrangler offers the option to permanently disable future update prompts. This preference is stored globally in ~/.wrangler/agents-skills-install.jsonc. The WRANGLER_NO_SKILLS_UPDATE_PROMPTS=true environment variable can also be used to suppress prompts. The --install-skills flag remains available regardless of these settings.

Patch Changes

wrangler@4.122.0

Minor Changes

  • #15123 d0c976c Thanks @​dependabot! - Detect Node.js compatibility from the compatibility date, now that nodejs_compat is enabled by default

    As of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default. Previously these tools only treated Node.js compatibility as enabled when one of those flags was listed explicitly, so a Worker on a compatibility date of 2026-08-04 or later without the flag would get Node.js APIs from the runtime but no Node.js polyfills from the bundler, and process.env could be substituted with an empty object at build time. They now resolve these flags the same way workerd does, and honour no_nodejs_compat to opt out.

    To keep Node.js compatibility switched off on a newer compatibility date, specify both no_nodejs_compat and no_nodejs_compat_v2, since each flag has its own default.

    @cloudflare/vitest-pool-workers needs nodejs_compat_v2 for its own test runner, so it continues to override a project that opts out of it. On a compatibility date that enables the flag anyway, it now drops the opt-out rather than adding the flag back, which workerd would reject — previously this stopped such a project from running any tests at all.

... (truncated)

Commits

Updates @types/node from 26.1.2 to 26.2.0

Commits

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 15, 2026
@dependabot
dependabot Bot requested a review from davidwkeith as a code owner August 15, 2026 23:54
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 15, 2026
@davidwkeith Claude

davidwkeith commented Aug 15, 2026

Copy link
Copy Markdown
Owner

Code review: this PR conforms to CONTRIBUTING.md (Conventional Commits title, no changeset needed since these are devDependency-only bumps to unpublished/dev tooling), but CI is currently red and shouldn't be merged as-is.

build-test and integration both fail with the same root cause:

packages/cf-shims typecheck: src/durable-object.ts(497,61): error TS2554: Expected 0 arguments, but got 1.

at packages/cf-shims/src/durable-object.ts:497:

newUniqueId(): ShimDurableObjectId {
  return new ShimDurableObjectId(randomBytes(32).toString("hex"));
}

This bump includes @types/node 26.1.2 → 26.2.0. That's the likely culprit — the error shape (toString() suddenly taking 0 args instead of an encoding) is consistent with randomBytes()'s return type narrowing to a plain Uint8Array-like type rather than Buffer under the new @types/node, since Uint8Array#toString() takes no arguments while Buffer#toString(encoding) does. image fails as a downstream consequence of the same build failure.

Worth confirming against the @types/node 26.2.0 changelog before merging, and fixing cf-shims (e.g. Buffer.from(randomBytes(32)).toString("hex") or an explicit Buffer cast) if that's the cause — otherwise this bump will break main.

Generated by Claude Code

davidwkeith
davidwkeith requested changes Aug 16, 2026
View reviewed changes

@davidwkeith davidwkeith left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI is red — this bump breaks the build

build-test, integration, and image all fail with the same root cause:

packages/cf-shims/src/durable-object.ts(497,61): error TS2554: Expected 0 arguments, but got 1.

That's randomBytes(32).toString("hex") in newUniqueId() — a plain Node Buffer call, unrelated to this diff's content. I bisected it locally in an isolated worktree by reinstalling with each of the two @types/* bumps reverted individually:

  • Reverting @cloudflare/workers-types alone (5.20260804.1, keeping @types/node@26.2.0) → typecheck passes.
  • Keeping @cloudflare/workers-types@5.20260812.1 → typecheck fails.

So @cloudflare/workers-types@5.20260812.1 is the breaking dependency — something in that release changes global type resolution enough that Buffer#toString resolves to a zero-arg overload in packages/cf-shims (which sets "types": ["node", "@cloudflare/workers-types"]). This isn't a false-positive/flaky failure; it reproduces deterministically.

Note the two bumps aren't independently revertible as a quick fix: wrangler@4.122.0 (also bumped here) declares a peer dependency on @cloudflare/workers-types@^5.20260811.1, so simply pinning workers-types back conflicts with the wrangler bump in the same group. This needs an actual fix in @dwk/cf-shims (or an upstream issue against @cloudflare/workers-types) before this group can land — please don't merge as-is per CONTRIBUTING.md's CI gate ("All five must pass").

Minor — PR title convention

CONTRIBUTING.md asks for Conventional Commits titles where the scope is a package name, omitted entirely for repo-wide changes (chore: …), since this repo squash-merges and the PR title becomes the permanent log entry. deps-dev isn't a package scope — worth retitling before merge, e.g. chore: bump dev dependencies, since dependabot.yml has no commit-message override to produce a compliant title automatically.

Generated by Claude Code

@dependabot dependabot Bot changed the title chore(deps-dev): bump the dev-dependencies group with 7 updates chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates Aug 18, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-367acab72b branch from e60f6b6 to afba552 Compare August 18, 2026 23:18
@dependabot
chore(deps-dev): bump the dev-dependencies group across 1 directory w…
5421a9c 
…ith 7 updates

Bumps the dev-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.20.2` | `0.21.3` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260804.1` | `5.20260816.1` |
| [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.8.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.66.0` | `8.67.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.119.0` | `4.123.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |



Updates `@cloudflare/vitest-pool-workers` from 0.20.2 to 0.21.3
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.21.3/packages/vitest-pool-workers)

Updates `@cloudflare/workers-types` from 5.20260804.1 to 5.20260816.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `eslint` from 10.8.0 to 10.8.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.0...v10.8.1)

Updates `typescript-eslint` from 8.66.0 to 8.67.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.67.0/packages/typescript-eslint)

Updates `wrangler` from 4.119.0 to 4.123.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.123.0/packages/wrangler)

Updates `@types/node` from 26.1.2 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

---
updated-dependencies:
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.21.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260812.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 10.8.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.67.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: wrangler
  dependency-version: 4.122.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-367acab72b branch from afba552 to 5421a9c Compare August 19, 2026 03:05
@davidwkeith davidwkeith mentioned this pull request Aug 22, 2026
Merged
5 tasks
@davidwkeith

davidwkeith commented Aug 22, 2026

Copy link
Copy Markdown
Owner

Superseded by #507, which carries the same dependency bump but holds back @cloudflare/workers-types (and the two packages coupled to it via peer deps, wrangler and @cloudflare/vitest-pool-workers) — that bump broke CI here because workers-types >=5.20260807.2 adds a global declare const Buffer: any that collides with @types/node's own Buffer typing wherever a package's tsconfig loads both. See #507 for the full root-cause writeup.

@dependabot @github

dependabot Bot commented on behalf of github Aug 22, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-367acab72b branch August 22, 2026 18:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@davidwkeith davidwkeith davidwkeith requested changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@davidwkeith