Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 11 updates - #512

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-f213e1df60
Closed

chore(deps-dev): bump the dev-dependencies group across 1 directory with 11 updates#512
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-f213e1df60

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 11 updates in the / directory:

Package From To
@changesets/cli 3.0.0 3.0.1
@cloudflare/vitest-pool-workers 0.20.2 0.22.0
@cloudflare/workers-types 5.20260804.1 5.20260826.1
@fedify/fedify 2.3.4 2.3.6
@fedify/vocab 2.3.4 2.3.6
@types/node 26.2.0 26.3.0
@vitest/coverage-istanbul 4.1.10 4.1.11
eslint 10.8.1 10.9.1
typescript-eslint 8.67.0 8.68.0
vitest 4.1.10 4.1.11
wrangler 4.119.0 4.126.0

Updates @changesets/cli from 3.0.0 to 3.0.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.1

Patch Changes

Changelog

Sourced from @​changesets/cli's changelog.

3.0.1

Patch Changes

Commits

Updates @cloudflare/vitest-pool-workers from 0.20.2 to 0.22.0

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.22.0

Minor Changes

  • #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

    @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

    If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

    When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

  • #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

    inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

  • #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

  • #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

    When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

    The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

  • Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

@​cloudflare/vitest-pool-workers@​0.21.3

Patch Changes

@​cloudflare/vitest-pool-workers@​0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

  • #15148 0b82b15 Thanks @​jamesopstad! - Ignore a nodejs_compat compatibility flag that the compatibility date already enables

    workerd rejects a compatibility flag that its compatibility date enables by default, so a Worker configured with both a compatibility date of 2026-08-04 or later and nodejs_compat failed to start locally with "The compatibility flag nodejs_compat became the default as of 2026-08-04 so does not need to be specified anymore".

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.22.0

Minor Changes

  • #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

    @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

    If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

    When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

  • #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

    inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

  • #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

  • #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

    When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

    The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

  • Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

0.21.3

Patch Changes

0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

... (truncated)

Commits
  • 8ee43f6 Version Packages (#15175)
  • 3ddd3ce Fix module resolution for relative require() inside CJS deps when the proje...
  • 1f79ace Use a fixed default compatibility date derived from the pinned workerd (#15185)
  • 2cf3143 [vitest-pool-workers] Restore typed inject() keys (#15150)
  • 49d4e00 [vitest-pool-workers] Adopt @​msw/cloudflare and remove MSW workarounds (#13830)
  • c576a82 Version Packages (#15154)
  • e5d56e9 Version Packages (#15145)
  • d0c976c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
  • 90dd5e5 chore: bump capnp-es to 0.0.15 (#15131)
  • 15fc568 Version Packages (#15118)
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260804.1 to 5.20260826.1

Commits

Updates @fedify/fedify from 2.3.4 to 2.3.6

Release notes

Sourced from @​fedify/fedify's releases.

Fedify 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

@​fedify/vocab-runtime

Fedify 2.3.5

Released on August 22, 2026.

@​fedify/fedify

  • Fixed a remotely triggerable denial-of-service vulnerability where the outbound delivery circuit breaker, when configured with a custom failure policy without an explicit stateTtl, stored per-host state in the configured key–value store without any expiry. A remote attacker could accumulate unbounded permanent records—one per distinct inbox host:port—by advertising inbox URLs that fail delivery, gradually exhausting storage. Custom failure policies now derive a default stateTtl of recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values), and the automatic upgrade sweep on CAS-backed stores now stamps a TTL on circuit state that earlier 2.3 releases wrote without one, including state written by custom policies on 2.3.2–2.3.4. Set stateTtl explicitly if your custom policy needs its failure history retained for a different length of time. [CVE-2026-69132]
  • Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
  • Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@​fedify/elysia

  • Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@​fedify/vocab-runtime

  • Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
  • Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]
Changelog

Sourced from @​fedify/fedify's changelog.

Version 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

#998: fedify-dev/fedify#998 #1008: fedify-dev/fedify#1008

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

#989: fedify-dev/fedify#989 #997: fedify-dev/fedify#997

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

#974: fedify-dev/fedify#974

@​fedify/vocab-runtime

... (truncated)

Commits
  • beb1d3c Merge tag '2.2.11' into 2.3-maintenance
  • 9f9063a Test public relay Follow normalization
  • a15e609 Normalize public relay Follow targets
  • 0c11307 Version bump
  • 4509389 Merge tag '2.2.10' into 2.3-maintenance
  • 66457dc Version bump
  • 45cae44 Merge tag '2.1.21' into 2.2-maintenance
  • 9e3d5d4 Merge tag '2.0.25' into 2.1-maintenance
  • 6dd8988 Validate authenticated loader redirects
  • 315f4c6 Expire custom-policy circuit breaker state
  • Additional commits viewable in compare view

Updates @fedify/vocab from 2.3.4 to 2.3.6

Release notes

Sourced from @​fedify/vocab's releases.

Fedify 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

@​fedify/vocab-runtime

Fedify 2.3.5

Released on August 22, 2026.

@​fedify/fedify

  • Fixed a remotely triggerable denial-of-service vulnerability where the outbound delivery circuit breaker, when configured with a custom failure policy without an explicit stateTtl, stored per-host state in the configured key–value store without any expiry. A remote attacker could accumulate unbounded permanent records—one per distinct inbox host:port—by advertising inbox URLs that fail delivery, gradually exhausting storage. Custom failure policies now derive a default stateTtl of recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values), and the automatic upgrade sweep on CAS-backed stores now stamps a TTL on circuit state that earlier 2.3 releases wrote without one, including state written by custom policies on 2.3.2–2.3.4. Set stateTtl explicitly if your custom policy needs its failure history retained for a different length of time. [CVE-2026-69132]
  • Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
  • Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@​fedify/elysia

  • Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@​fedify/vocab-runtime

  • Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
  • Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]
Changelog

Sourced from @​fedify/vocab's changelog.

Version 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

#998: fedify-dev/fedify#998 #1008: fedify-dev/fedify#1008

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

#989: fedify-dev/fedify#989 #997: fedify-dev/fedify#997

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

#974: fedify-dev/fedify#974

@​fedify/vocab-runtime

... (truncated)

Commits

Updates @types/node from 26.2.0 to 26.3.0

Commits

Updates @vitest/coverage-istanbul from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-istanbul's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates eslint from 10.8.1 to 10.9.1

Release notes

Sourced from eslint's releases.

v10.9.1

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

v10.9.0

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

  • 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
  • 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
  • dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
  • f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
  • 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])
Commits

Updates typescript-eslint from 8.67.0 to 8.68.0

Release notes

Sourced from typescript-eslint's releases.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

  • eslint-plugin: [strict-void-return] add fix suggestions (#12086)
  • utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

  • eslint-plugin: [unified-signatures] deduplicate types in report (#12656)
  • eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
  • eslint-plugin: [unified-signatures] report identical signatures (#12678)
  • eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
  • eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
  • eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
  • website: playground crashes on extends configs (#12608)
  • website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

@dependabot
chore(deps-dev): bump the dev-dependencies group across 1 directory w…
7c70365 
…ith 11 updates

Bumps the dev-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli) | `3.0.0` | `3.0.1` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.20.2` | `0.22.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260804.1` | `5.20260826.1` |
| [@fedify/fedify](https://github.com/fedify-dev/fedify/tree/HEAD/packages/fedify) | `2.3.4` | `2.3.6` |
| [@fedify/vocab](https://github.com/fedify-dev/fedify/tree/HEAD/packages/vocab) | `2.3.4` | `2.3.6` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.3.0` |
| [@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul) | `4.1.10` | `4.1.11` |
| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.9.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.68.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.119.0` | `4.126.0` |



Updates `@changesets/cli` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@3.0.1/packages/cli)

Updates `@cloudflare/vitest-pool-workers` from 0.20.2 to 0.22.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers)

Updates `@cloudflare/workers-types` from 5.20260804.1 to 5.20260826.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@fedify/fedify` from 2.3.4 to 2.3.6
- [Release notes](https://github.com/fedify-dev/fedify/releases)
- [Changelog](https://github.com/fedify-dev/fedify/blob/main/CHANGES.md)
- [Commits](https://github.com/fedify-dev/fedify/commits/2.3.6/packages/fedify)

Updates `@fedify/vocab` from 2.3.4 to 2.3.6
- [Release notes](https://github.com/fedify-dev/fedify/releases)
- [Changelog](https://github.com/fedify-dev/fedify/blob/main/CHANGES.md)
- [Commits](https://github.com/fedify-dev/fedify/commits/2.3.6/packages/vocab)

Updates `@types/node` from 26.2.0 to 26.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-istanbul` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-istanbul)

Updates `eslint` from 10.8.1 to 10.9.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.1...v10.9.1)

Updates `typescript-eslint` from 8.67.0 to 8.68.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `wrangler` from 4.119.0 to 4.126.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.126.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@changesets/cli"
  dependency-version: 3.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260826.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@fedify/fedify"
  dependency-version: 2.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@fedify/vocab"
  dependency-version: 2.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@vitest/coverage-istanbul"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 10.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: wrangler
  dependency-version: 4.126.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 29, 2026
@dependabot
dependabot Bot requested a review from davidwkeith as a code owner August 29, 2026 23:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 29, 2026
@davidwkeith Claude

davidwkeith commented Aug 29, 2026

Copy link
Copy Markdown
Owner

Reviewed this Dependabot dev-dependencies bump against CONTRIBUTING.md.

Diff itself looks clean:

  • All 11 bumps are patch/minor version-string updates only (package.json × 5 + pnpm-lock.yaml) — no manual code, config, or workspace-dependency changes.
  • Exact-version pinning is preserved everywhere (no stray ^/~ introduced), matching the "dependencies are minimized and pinned to exact versions" rule.
  • No package touches a workspace:* internal dependency, so there's no cross-package coupling risk to review.

Conformance notes (informational, not blocking — both are artifacts of how Dependabot opens PRs, not something to hand-fix on this branch):

  1. PR body doesn't use .github/PULL_REQUEST_TEMPLATE.md's Summary / Packages affected / Checklist sections — Dependabot posts its own generated body and GitHub doesn't apply repo templates to API-created PRs. If this repo wants Dependabot PRs to carry the checklist, that has to be configured separately (there's no clean way to make Dependabot itself fill it in).
  2. Title scope is chore(deps-dev): … — deps-dev isn't a package name, whereas CONTRIBUTING.md defines scope as "the package name minus @dwk/, or omitted for a repo-wide change." This is Dependabot's own default commit-message format (no commit-message: override is set in .github/dependabot.yml); since this repo squash-merges, that title is what lands in git log. If literal conformance matters here, add a commit-message.prefix/include setting to the dev-dependencies/production-dependencies groups in dependabot.yml, or accept deps/deps-dev as an allowed repo-wide scope in the convention.

Before merging: release-gate, build-test, and integration were still in progress at review time — worth confirming they're green (this bump touches @cloudflare/vitest-pool-workers, @cloudflare/workers-types, vitest, and wrangler, which are exactly the packages most likely to surface a breaking change in the test/build toolchain) before merging.

Generated by Claude Code

@dependabot @github

dependabot Bot commented on behalf of github Sep 5, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 5, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/dev-dependencies-f213e1df60 branch September 5, 2026 23:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@davidwkeith davidwkeith Awaiting requested review from davidwkeith davidwkeith is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@davidwkeith