chore: bump dev-dependencies group, hold back workers-types/wrangler

[davidwkeith]

Summary

Supersedes #491, whose CI (build-test, image, integration) failed
on the same single root cause: @cloudflare/workers-types >=5.20260807.2
adds a global declare const Buffer: any (nodejs_compat ambient global).
In any package that lists both "node" and "@cloudflare/workers-types"
in its tsconfig.json types array (@dwk/cf-shims, @dwk/server,
@dwk/conformance-target), this collides with @types/node's own
Buffer typing, and every buf.toString(encoding) call in scope
(hex/base64/etc.) resolves to the zero-arg Object.prototype.toString
instead of Node's overload — a hard tsc error, not just a lint nit.

Verified with a minimal repro and by bisecting each of the 7 originally
bumped packages individually (installing each old/new combination and
re-running pnpm typecheck). The bug is present in every
@cloudflare/workers-types release up through 5.20260822.1 (checked
against npm), so it isn't a transient regression that will resolve
itself on the next patch release.

This PR takes the same dependency bump as #491 but holds back the
correlated Cloudflare trio:

• @cloudflare/workers-types (5.20260804.1, unchanged) — carries the bug
• wrangler (4.119.0, unchanged) — 4.120.0+ peer-depends on
  @cloudflare/workers-types@^5.20260811.1, which is inside the broken
  range
• @cloudflare/vitest-pool-workers (0.20.2, unchanged) — pulls in the
  newer wrangler as a nested dependency

eslint, typescript-eslint, @types/node, and esbuild keep their
bumps from the original PR. @dwk/conformance-target's package.json
ends up unchanged net of both commits (its workers-types bump is held
back too), so it no longer appears in the diff.

Full local CI gate (pnpm lint && pnpm format:check && pnpm typecheck && pnpm build && pnpm test) and node scripts/release-gate.mjs pass
cleanly against this combination. All five CI checks (build-test,
image, integration, release-gate, CodeQL) are green.

Packages affected

Root package.json, @dwk/cf-shims, @dwk/deno-host, @dwk/server
(devDependency version pins only — no source changes)

Checklist

• Read the relevant spec(s) under spec/packages/ and updated them if
  behaviour changed — not applicable, dependency version pins only
• Added/updated colocated tests (src/*.test.ts) — not applicable, no behaviour change
• Ran the local CI gate: pnpm lint && pnpm format:check && pnpm typecheck && pnpm build && pnpm test
• Added a changeset (pnpm changeset) if this touches a publishable
  package — not applicable; @dwk/cf-shims and @dwk/deno-host are
  publishable, but a devDependency-only bump doesn't change their
  published artifact or warrant a version bump
• Updated catalog.json / conformance/status.json if this adds a new
  mountable worker or changes conformance status — not applicable

[davidwkeith]

Reviewed against CONTRIBUTING.md. The dependency-bump logic and root-cause writeup for holding back @cloudflare/workers-types/wrangler/@cloudflare/vitest-pool-workers look sound. Two conformance issues worth fixing before merge (GitHub won't let me self-request-changes on this PR, so flagging as a comment instead):

1. PR title scope (inline comment on package.json): chore(deps-dev): … uses a scope that isn't a package name. Per CONTRIBUTING.md §6, this repo-wide change should drop the scope entirely: chore: bump dev-dependencies group, hold back workers-types/wrangler. Since this repo squash-merges PRs, the title is what lands in git log — worth getting right.

2. "Packages affected" section is inaccurate. It lists "Root package.json, @dwk/conformance-target, @dwk/server", but the diff doesn't touch packages/conformance-target/package.json at all, and it omits @dwk/cf-shims and @dwk/deno-host, both of which do have @types/node bumped in this PR. Please correct the list to: root package.json, @dwk/cf-shims, @dwk/deno-host, @dwk/server.

Minor: the changeset checkbox reason ("not applicable … no publishable package affected") is slightly misleading — @dwk/cf-shims and @dwk/deno-host are publishable packages; the real reason a changeset isn't needed is that dev-dependency bumps don't affect the published artifact/version. Worth tightening the wording so it doesn't read as a factual claim that's contradicted by the diff.

CI was still in progress (build-test, image, integration) at review time — please confirm all five local-gate equivalents are green before merging, per the checklist.

---

Generated by Claude Code

[davidwkeith]

Addressed both review points:

1. Title scope — fixed, now chore: bump dev-dependencies group, hold back workers-types/wrangler (replied inline and resolved that thread).
2. "Packages affected" accuracy — corrected to root package.json, @dwk/cf-shims, @dwk/deno-host, @dwk/server; also tightened the changeset checkbox reason to note cf-shims/deno-host are publishable but a devDependency-only bump doesn't warrant a version bump.

All five CI checks are green (build-test, image, integration, release-gate, CodeQL), confirming the local gate result already noted in the PR description.

---

Generated by Claude Code