Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates - #520

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-d195841abf
Open

chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates#520
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-d195841abf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 12 updates in the / directory:

Package From To
@changesets/cli 3.0.0 3.0.1
@cloudflare/vitest-pool-workers 0.20.2 0.22.0
@cloudflare/workers-types 5.20260804.1 5.20260902.1
@fedify/fedify 2.3.4 2.3.6
@fedify/vocab 2.3.4 2.3.6
@types/node 26.2.0 26.4.1
@vitest/coverage-istanbul 4.1.10 4.1.11
eslint 10.8.1 10.9.1
typescript-eslint 8.67.0 8.69.0
vitest 4.1.10 4.1.11
wrangler 4.119.0 4.128.0
@libsql/client 0.17.4 0.18.0

Updates @changesets/cli from 3.0.0 to 3.0.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.1

Patch Changes

Changelog

Sourced from @​changesets/cli's changelog.

3.0.1

Patch Changes

Commits

Updates @cloudflare/vitest-pool-workers from 0.20.2 to 0.22.0

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.22.0

Minor Changes

  • #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

    @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

    If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

    When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

  • #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

    inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

  • #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

  • #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

    When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

    The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

  • Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

@​cloudflare/vitest-pool-workers@​0.21.3

Patch Changes

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.22.0

Minor Changes

  • #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

    @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

    If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

    When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

  • #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

    inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

  • #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

  • #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

    When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

    The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

  • Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

0.21.3

Patch Changes

0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

... (truncated)

Commits
  • 8ee43f6 Version Packages (#15175)
  • 3ddd3ce Fix module resolution for relative require() inside CJS deps when the proje...
  • 1f79ace Use a fixed default compatibility date derived from the pinned workerd (#15185)
  • 2cf3143 [vitest-pool-workers] Restore typed inject() keys (#15150)
  • 49d4e00 [vitest-pool-workers] Adopt @​msw/cloudflare and remove MSW workarounds (#13830)
  • c576a82 Version Packages (#15154)
  • e5d56e9 Version Packages (#15145)
  • d0c976c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
  • 90dd5e5 chore: bump capnp-es to 0.0.15 (#15131)
  • 15fc568 Version Packages (#15118)
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260804.1 to 5.20260902.1

Commits

Updates @fedify/fedify from 2.3.4 to 2.3.6

Release notes

Sourced from @​fedify/fedify's releases.

Fedify 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

@​fedify/vocab-runtime

Fedify 2.3.5

Released on August 22, 2026.

@​fedify/fedify

  • Fixed a remotely triggerable denial-of-service vulnerability where the outbound delivery circuit breaker, when configured with a custom failure policy without an explicit stateTtl, stored per-host state in the configured key–value store without any expiry. A remote attacker could accumulate unbounded permanent records—one per distinct inbox host:port—by advertising inbox URLs that fail delivery, gradually exhausting storage. Custom failure policies now derive a default stateTtl of recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values), and the automatic upgrade sweep on CAS-backed stores now stamps a TTL on circuit state that earlier 2.3 releases wrote without one, including state written by custom policies on 2.3.2–2.3.4. Set stateTtl explicitly if your custom policy needs its failure history retained for a different length of time. [CVE-2026-69132]
  • Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
  • Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@​fedify/elysia

  • Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@​fedify/vocab-runtime

  • Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
  • Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]
Changelog

Sourced from @​fedify/fedify's changelog.

Version 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

#998: fedify-dev/fedify#998 #1008: fedify-dev/fedify#1008

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

#989: fedify-dev/fedify#989 #997: fedify-dev/fedify#997

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

#974: fedify-dev/fedify#974

@​fedify/vocab-runtime

... (truncated)

Commits
  • beb1d3c Merge tag '2.2.11' into 2.3-maintenance
  • 9f9063a Test public relay Follow normalization
  • a15e609 Normalize public relay Follow targets
  • 0c11307 Version bump
  • 4509389 Merge tag '2.2.10' into 2.3-maintenance
  • 66457dc Version bump
  • 45cae44 Merge tag '2.1.21' into 2.2-maintenance
  • 9e3d5d4 Merge tag '2.0.25' into 2.1-maintenance
  • 6dd8988 Validate authenticated loader redirects
  • 315f4c6 Expire custom-policy circuit breaker state
  • Additional commits viewable in compare view

Updates @fedify/vocab from 2.3.4 to 2.3.6

Release notes

Sourced from @​fedify/vocab's releases.

Fedify 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

@​fedify/vocab-runtime

Fedify 2.3.5

Released on August 22, 2026.

@​fedify/fedify

  • Fixed a remotely triggerable denial-of-service vulnerability where the outbound delivery circuit breaker, when configured with a custom failure policy without an explicit stateTtl, stored per-host state in the configured key–value store without any expiry. A remote attacker could accumulate unbounded permanent records—one per distinct inbox host:port—by advertising inbox URLs that fail delivery, gradually exhausting storage. Custom failure policies now derive a default stateTtl of recoveryDelay plus heldActivityTtl (7 days 30 minutes with the default values), and the automatic upgrade sweep on CAS-backed stores now stamps a TTL on circuit state that earlier 2.3 releases wrote without one, including state written by custom policies on 2.3.2–2.3.4. Set stateTtl explicitly if your custom policy needs its failure history retained for a different length of time. [CVE-2026-69132]
  • Fixed a server-side request forgery (SSRF) vulnerability in authenticated document loaders, where an otherwise public document URL could redirect a signed request to a loopback, link-local, or private address. Redirect targets are now validated before they are fetched, while the explicit allowPrivateAddress option continues to permit private addresses. [CVE-2026-77632 by Jace]
  • Standalone key documents whose id differs from the requested key URL are now rejected instead of being cached under the wrong URL. [#963, #980 by Junseok Oh]

@​fedify/elysia

  • Fixed duplicate response headers on Elysia 1.4.18 and earlier, which append both set.headers and the returned Response's own headers without deduplication. The fedify() plugin no longer sets the headers in both places. [#970, #972 by Kyujin Lim]

@​fedify/vocab-runtime

  • Added the FEP-ef61 context to preloaded JSON-LD contexts. The https://w3id.org/fep/ef61 URL redirects to a Codeberg Pages host which suffers recurring outages; during one, JSON-LD expansion of any document referencing this URL fails before application handlers can run. [#982, #928]
  • Changed miscellany context to match public version 1.0.1, which fixes a bug with re-compacting Mastodon and similar content using boolean flags (manuallyApprovesFollowers, sensitive). [#1002, #1003 by Evan Prodromou]
Changelog

Sourced from @​fedify/vocab's changelog.

Version 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

#998: fedify-dev/fedify#998 #1008: fedify-dev/fedify#1008

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

#989: fedify-dev/fedify#989 #997: fedify-dev/fedify#997

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

#974: fedify-dev/fedify#974

@​fedify/vocab-runtime

... (truncated)

Commits

Updates @types/node from 26.2.0 to 26.4.1

Commits

Updates @vitest/coverage-istanbul from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-istanbul's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates eslint from 10.8.1 to 10.9.1

Release notes

Sourced from eslint's releases.

v10.9.1

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

v10.9.0

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

  • 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
  • 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
  • dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
  • f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
  • 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])
Commits

Updates typescript-eslint from 8.67.0 to 8.69.0

Release notes

Sourced from typescript-eslint's releases.

v8.69.0

8.69.0 (2026-08-31)

🚀 Features

  • eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

  • eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)
  • eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
  • eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
  • website: respect allowJs playground config (#12744)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

  • eslint-plugin: [strict-void-return] add fix suggestions (#12086)
  • utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

  • eslint-plugin: [unified-signatures] deduplicate types in report (#12656)
  • eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
  • eslint-plugin: [unified-signatures] report identical signatures (#12678)
  • eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
  • eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
  • eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
  • website: playground crashes on extends configs (#12608)
  • website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.69.0 (2026-08-31)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

@dependabot
chore(deps-dev): bump the dev-dependencies group across 1 directory w…
cf8708f 
…ith 12 updates

Bumps the dev-dependencies group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli) | `3.0.0` | `3.0.1` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.20.2` | `0.22.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260804.1` | `5.20260902.1` |
| [@fedify/fedify](https://github.com/fedify-dev/fedify/tree/HEAD/packages/fedify) | `2.3.4` | `2.3.6` |
| [@fedify/vocab](https://github.com/fedify-dev/fedify/tree/HEAD/packages/vocab) | `2.3.4` | `2.3.6` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.4.1` |
| [@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul) | `4.1.10` | `4.1.11` |
| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.9.1` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.67.0` | `8.69.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.119.0` | `4.128.0` |
| [@libsql/client](https://github.com/tursodatabase/libsql-client-ts/tree/HEAD/packages/libsql-client) | `0.17.4` | `0.18.0` |



Updates `@changesets/cli` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@3.0.1/packages/cli)

Updates `@cloudflare/vitest-pool-workers` from 0.20.2 to 0.22.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.22.0/packages/vitest-pool-workers)

Updates `@cloudflare/workers-types` from 5.20260804.1 to 5.20260902.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@fedify/fedify` from 2.3.4 to 2.3.6
- [Release notes](https://github.com/fedify-dev/fedify/releases)
- [Changelog](https://github.com/fedify-dev/fedify/blob/main/CHANGES.md)
- [Commits](https://github.com/fedify-dev/fedify/commits/2.3.6/packages/fedify)

Updates `@fedify/vocab` from 2.3.4 to 2.3.6
- [Release notes](https://github.com/fedify-dev/fedify/releases)
- [Changelog](https://github.com/fedify-dev/fedify/blob/main/CHANGES.md)
- [Commits](https://github.com/fedify-dev/fedify/commits/2.3.6/packages/vocab)

Updates `@types/node` from 26.2.0 to 26.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-istanbul` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-istanbul)

Updates `eslint` from 10.8.1 to 10.9.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.1...v10.9.1)

Updates `typescript-eslint` from 8.67.0 to 8.69.0
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.69.0/packages/typescript-eslint)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

Updates `wrangler` from 4.119.0 to 4.128.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.128.0/packages/wrangler)

Updates `@libsql/client` from 0.17.4 to 0.18.0
- [Release notes](https://github.com/tursodatabase/libsql-client-ts/releases)
- [Changelog](https://github.com/tursodatabase/libsql-client-ts/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tursodatabase/libsql-client-ts/commits/v0.18.0/packages/libsql-client)

---
updated-dependencies:
- dependency-name: "@changesets/cli"
  dependency-version: 3.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.22.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260902.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@fedify/fedify"
  dependency-version: 2.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@fedify/vocab"
  dependency-version: 2.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@vitest/coverage-istanbul"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: eslint
  dependency-version: 10.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript-eslint
  dependency-version: 8.69.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: wrangler
  dependency-version: 4.128.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@libsql/client"
  dependency-version: 0.18.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026
@dependabot
dependabot Bot requested a review from davidwkeith as a code owner September 5, 2026 23:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 5, 2026
davidwkeith
davidwkeith requested changes Sep 5, 2026
View reviewed changes

@davidwkeith davidwkeith left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated review of this Dependabot dev-dependencies bump.

Blocking: CI is red — build-test, integration, and image all fail with the same root cause: the @types/node bump (26.2.0 → 26.4.1, applied across the root, cf-shims, deno-host, and server packages) introduces a tsc overload-resolution regression in packages/cf-shims/src/durable-object.ts:497 (see inline comment). release-gate passed (it doesn't run tsc), but the standard lint → format:check → typecheck → build → test gate that CONTRIBUTING.md requires does not — "all five must pass" before merge.

Everything else about this PR looks fine and consistent with how this repo's Dependabot dev-dependency PRs are normally handled:

  • Title (chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates) matches the established pattern from prior merged bumps (#486, #493, #495) — no package-name scope is expected for these grouped bot PRs.
  • All 12 version bumps are patch/minor releases; nothing in the linked release notes indicates an intentional breaking change.
  • pnpm-lock.yaml and every consuming package's package.json (cf-shims, conformance-target, deno-host, server) were updated consistently for the shared devDependencies (@types/node, @cloudflare/workers-types).
  • No changeset is needed — these are devDependency-only changes with no user-visible effect on published package behavior.

Please resolve the @dwk/cf-shims typecheck failure (or pin @types/node back) before this merges.

Generated by Claude Code

Comment thread package.json
"eslint": "10.8.1",
"@fedify/fedify": "2.3.6",
"@fedify/vocab": "2.3.6",
"@types/node": "26.4.1",

@davidwkeith davidwkeith Sep 5, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This bump (@types/node 26.2.0 → 26.4.1) breaks the build: packages/cf-shims/src/durable-object.ts(497,61): error TS2554: Expected 0 arguments, but got 1.

newUniqueId(): ShimDurableObjectId {
  return new ShimDurableObjectId(randomBytes(32).toString("hex"));
}

TypeScript is resolving .toString(...) on the Buffer returned by randomBytes to the zero-arg Uint8Array/Array.prototype.toString() overload instead of Buffer.prototype.toString(encoding) — the new @types/node patch appears to have changed how Buffer's toString override is declared relative to the Uint8Array<ArrayBufferLike> base. This fails pnpm build/pnpm typecheck for @dwk/cf-shims, which cascades into the build-test, integration, and image (Docker bundle) CI jobs — all three are currently red on this PR.

Per CONTRIBUTING.md, "the CI gate ... all five [lint, format:check, typecheck, build, test] must pass" — this shouldn't merge until that's resolved. Options: pin @types/node back to 26.2.0/a version before the regression, or adjust packages/cf-shims/src/durable-object.ts (e.g. an explicit Buffer.from(...)/type assertion) to route through the correct overload.

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@davidwkeith davidwkeith davidwkeith requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@davidwkeith