Skip to content

chore: bump dev-dependencies group, hold back workers-types/wrangler - #526

Merged
davidwkeith merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-c3bbf18a00
Oct 21, 2026
Merged

chore: bump dev-dependencies group, hold back workers-types/wrangler#526
davidwkeith merged 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-c3bbf18a00

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 11 updates in the / directory:

Package From To
@changesets/cli 3.0.0 3.0.3
@cloudflare/vitest-pool-workers 0.20.2 0.22.0
@cloudflare/workers-types 5.20260804.1 5.20260928.1
@fedify/fedify 2.3.4 2.3.8
@fedify/vocab 2.3.4 2.3.8
@types/node 26.2.0 26.6.3
eslint 10.8.1 10.11.0
prettier 3.9.6 3.9.9
typescript-eslint 8.67.0 8.70.1
wrangler 4.119.0 4.142.0
@libsql/client 0.17.4 0.18.0

Updates @changesets/cli from 3.0.0 to 3.0.3

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.3

Patch Changes

  • #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

  • #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

  • Updated dependencies [3f163da, bfe9050, e522996]:

    • @​changesets/apply-release-plan@​8.1.1
    • @​changesets/config@​4.0.1

@​changesets/cli@​3.0.2

Patch Changes

@​changesets/cli@​3.0.1

Patch Changes

Changelog

Sourced from @​changesets/cli's changelog.

3.0.3

Patch Changes

  • #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

  • #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

  • Updated dependencies [3f163da, bfe9050, e522996]:

    • @​changesets/apply-release-plan@​8.1.1
    • @​changesets/config@​4.0.1

3.0.2

Patch Changes

3.0.1

Patch Changes

Commits

Updates @cloudflare/vitest-pool-workers from 0.20.2 to 0.22.0

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/config@​0.22.0

Minor Changes

  • #15685 b9f1cdc Thanks @​Ankcorn! - Add native support for the Analytics SQL binding

    Declare the zero-configuration binding in wrangler.json with "analytics": { "binding": "ANALYTICS" }. Wrangler uploads the analytics binding type and proxies it to the remote service during local development, so wrangler dev can call the binding without unsafe.bindings.

  • #15948 a0712e5 Thanks @​akoval-cf! - Add beta K2 producer bindings for existing streams

    Configure a stream created through Wrangler, the Dashboard, or the API in wrangler.json:

    {
  "k2": [
    {
      "binding": "ORDERS",
      "stream": "0123456789abcdef0123456789abcdef"
    }
  ]
}

    The binding supports env.ORDERS.send([{ content: new TextEncoder().encode("order"), headers: { event: "order.created" } }]). Batches use either all ArrayBuffer or all Uint8Array content. Check the returned success value, handle rejected RPC promises, and retry only when the returned error explicitly allows it. Generated environment types describe this producer contract without requiring a separate application dependency.

    K2 requires an enabled account. Deployment credentials need Worker deployment and K2 configuration-read access. Default Wrangler logins now request the K2 OAuth scopes; existing OAuth users should run wrangler login again to grant the new permissions. Development always uses a real K2 stream and may incur usage charges; no local simulator is provided. The remote setting can be omitted, remote: true suppresses the usage warning, and remote: false is rejected. Consumption is not part of this Worker binding.

Patch Changes

  • #15916 27bc20d Thanks @​jamesopstad! - Fix environment types for Worker configurations inferred as unions

    InferEnv and generated Worker Env types now include every binding and runtime type that the configuration can produce. Bindings that are not always present are optional.

@​cloudflare/containers-shared@​0.21.1

Patch Changes

  • Updated dependencies [b9f1cdc, a0712e5, 27bc20d]:
    • @​cloudflare/config@​0.22.0
    • @​cloudflare/workers-utils@​0.45.0
    • @​cloudflare/build-output-utils@​0.8.4
    • @​cloudflare/cli-shared-helpers@​0.2.1

@​cloudflare/config@​0.21.0

Minor Changes

  • #15951 2a15ae2 Thanks @​flakey5! - Support SSH settings for Durable Object-managed Containers in the configuration API

    defineContainer now accepts ssh and authorizedKeys with schedulingPolicy: "durable-object", matching the ssh and authorized_keys fields that Wrangler already supports for these Containers. Previously the schema rejected them, so they could not be set from cloudflare.config.ts.

    defineContainer({

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.22.0

Minor Changes

  • #13830 49d4e00 Thanks @​penalosa! - Mocking requests with MSW in Worker tests now requires MSW >= 2.14

    @cloudflare/vitest-pool-workers previously shipped internal shims to make MSW work inside the workerd runtime. MSW 2.14 added that support natively, so those shims have been removed.

    If you mock requests with MSW in your Worker tests, make sure you're on MSW >= 2.14; older versions will no longer intercept requests. You can keep using setupServer() from msw/node, or adopt the official @msw/cloudflare integration via setupNetwork(). See the updated request-mocking example fixture for the recommended pattern.

Patch Changes

  • #15211 bc5726b Thanks @​nithin42! - Honor access.dev when running Workers with @cloudflare/vitest-pool-workers, so ctx.access.getIdentity() returns the configured identity just as it does with wrangler dev.

  • #15156 3ddd3ce Thanks @​dario-piotrowicz! - Fix module resolution for relative require() inside CJS deps when the project path contains spaces

    When a project lives under a directory with a space in its name, externalized CommonJS dependencies that use relative require() calls (e.g. require("./lib/impl.js")) would fail with "No such module" because workerd preserves URL encoding in the module name. Encoded module paths are now handled deterministically before CommonJS resolution without altering literal percent sequences.

  • #15150 2cf3143 Thanks @​kkkhs! - Restore typed inject() keys in cloudflareTest() pool options

    inject() inside cloudflareTest() options again infers the value type from the keys you declare in your Vitest ProvidedContext, and reports misspelled keys. For keys that are only provided at runtime, pass an explicit type argument, e.g. inject<number>("myPort").

  • #15232 8777180 Thanks @​vicb! - Bump capnp-es to 0.0.16.

  • #15185 1f79ace Thanks @​jamesopstad! - Use a fixed default compatibility date rather than the current date

    When no compatibility date was set, Wrangler, C3 and the Vitest pool all defaulted to the current date. workerd only accepts a compatibility date up to 7 days beyond its own release, so whenever a workerd release was delayed the default could get ahead of the runtime that had been installed, and local development would fail to start.

    The default is now fixed at the release date of the workerd version that ships with each release, which leaves a week of headroom and updates as workerd is upgraded. @cloudflare/vite-plugin previously inlined the date at which it was built. It now shares the same default.

  • Updated dependencies [bc5726b, 1277a72, ba54f0d, 6529f0c, b7422b0, 186339c, 4f922dc, 4d74b8d, 2e0c962, 1f79ace, 49f73de, 7cee278, 8777180, 265256a, 1f79ace, f431166, 8fb2b87, 75cf407]:

0.21.3

Patch Changes

0.21.2

Patch Changes

  • #15123 d0c976c Thanks @​dependabot! - Widen WorkerPoolOptionsContext.inject type to avoid ProvidedContext mismatch

    Previously, calling inject() inside cloudflareTest() pool options could fail with a type error when your project's ProvidedContext augmentation wasn't visible to the pool plugin. The inject parameter now accepts any string key and is generic (inject<T>(key)), defaulting to unknown when no type argument is provided. This lets you opt in to concrete types (e.g. inject<number>("port")) while avoiding the cross-copy ProvidedContext mismatch that occurred when pnpm resolved separate virtual-store instances of vitest.

... (truncated)

Commits
  • 8ee43f6 Version Packages (#15175)
  • 3ddd3ce Fix module resolution for relative require() inside CJS deps when the proje...
  • 1f79ace Use a fixed default compatibility date derived from the pinned workerd (#15185)
  • 2cf3143 [vitest-pool-workers] Restore typed inject() keys (#15150)
  • 49d4e00 [vitest-pool-workers] Adopt @​msw/cloudflare and remove MSW workarounds (#13830)
  • c576a82 Version Packages (#15154)
  • e5d56e9 Version Packages (#15145)
  • d0c976c Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
  • 90dd5e5 chore: bump capnp-es to 0.0.15 (#15131)
  • 15fc568 Version Packages (#15118)
  • Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260804.1 to 5.20260928.1

Commits

Updates @fedify/fedify from 2.3.4 to 2.3.8

Release notes

Sourced from @​fedify/fedify's releases.

Fedify 2.3.8

Released on September 22, 2026.

@​fedify/fedify

  • Fixed the inbox accepting activities from any actor at all. Fedify verified the signature on an incoming delivery, but took the signing key's own word for whom it belonged to: the owner of a CryptographicKey and the controller of a Multikey were believed as served, even though the key document and the claim inside it come from the same host. Anyone with an ordinary HTTP server could therefore have an activity accepted as coming from any actor in the world, whether or not that actor existed. All three inbound authentication paths were affected—HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs—and the latter two require no HTTP signature on the request at all. A key's claimed owner is now resolved and has to link back to the key before the key is usable, and a key that names no owner of its own is attributed to the actor whose document carried it. [GHSA-q9f8-5hc7-898f]
  • Fixed getKeyOwner(), and therefore Context.getSignedKeyOwner(), accepting a key document dressed up as another origin's actor document. A host that served a key could describe itself as any actor and list the key as that actor's own, which let an attacker pass an authorized fetch under a borrowed identity and read whatever access control had reserved for it. Only the origin that serves an actor id can now speak for it. [GHSA-q9f8-5hc7-898f]
  • Public keys cached before this release are no longer read back, since the owner recorded in them was never verified. Applications using the built-in key cache need no action; those passing a custom KeyCache implementation to verifyRequest(), verifyJsonLd(), or verifyObject() should discard its contents once on upgrade. [GHSA-q9f8-5hc7-898f]
  • Fixed an SSRF vulnerability in outbound activity delivery that allowed inbox URLs and redirects to target private network addresses. Delivery now checks each destination unless allowPrivateAddress is explicitly enabled for local testing. [GHSA-f59r-8gcj-68f2]
  • Fixed unbounded reads of authenticated documents, NodeInfo responses, and inbox bodies that could exhaust memory. JSON bodies are now limited to 16 MiB. Oversized inbox requests receive 413 Content Too Large. [GHSA-mc44-6cfg-2v6w]

@​fedify/redis

  • Fixed RedisKvStore.set() failing when the ttl option was not a whole number of seconds. The duration was handed to Redis SETEX unchanged, and SETEX takes only whole seconds, so the write was rejected with ERR value is not an integer or out of range instead of being stored with a rounded expiry. The TTL is now rounded up to the next whole second. A zero or negative duration, which SETEX also rejects, now stores the value for one second, the shortest expiry that command can express. The one-second granularity is SETEX's rather than Redis's; SET with PX supports millisecond expiries. [#1028, #1034 by Heewon Chae]

@​fedify/vocab-runtime

  • Fixed unbounded reads of remote JSON-LD and HTML documents that could exhaust memory. JSON responses are now limited to 16 MiB after decompression; HTML discovery is limited to 1 MiB. [GHSA-mc44-6cfg-2v6w]

@​fedify/webfinger

  • Fixed unbounded reads of WebFinger descriptors that could exhaust memory. Responses are now limited to 16 MiB after decompression; oversized responses return null. [GHSA-mc44-6cfg-2v6w]

Fedify 2.3.7

Released on September 15, 2026.

@​fedify/postgres

  • Fixed PostgresKvStore storing values as JSONB strings rather than JSONB objects when it was constructed with the initialized: true option. The option skipped the driver's JSON serialization probe along with the table's schema DDL, so every value was serialized twice and every later read of the row returned a string, including reads from a store that never passed the option. The option now skips only the DDL. [#1031, #1033 by Heewon Chae]
  • Fixed PostgresMessageQueue storing messages as JSONB strings rather than JSONB objects when it was constructed with the initialized: true option. The option skipped the driver's JSON serialization probe along with the table's schema DDL, so every message was serialized twice and a listener received a string with no recognizable task type, silently dropping the queued work. The option now skips only the DDL. [#1014, #1032 by Heewon Chae]

Fedify 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

... (truncated)

Changelog

Sourced from @​fedify/fedify's changelog.

Version 2.3.8

Released on September 22, 2026.

@​fedify/fedify

  • Fixed the inbox accepting activities from any actor at all. Fedify verified the signature on an incoming delivery, but took the signing key's own word for whom it belonged to: the owner of a CryptographicKey and the controller of a Multikey were believed as served, even though the key document and the claim inside it come from the same host. Anyone with an ordinary HTTP server could therefore have an activity accepted as coming from any actor in the world, whether or not that actor existed. All three inbound authentication paths were affected—HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs—and the latter two require no HTTP signature on the request at all. A key's claimed owner is now resolved and has to link back to the key before the key is usable, and a key that names no owner of its own is attributed to the actor whose document carried it. [GHSA-q9f8-5hc7-898f]
  • Fixed getKeyOwner(), and therefore Context.getSignedKeyOwner(), accepting a key document dressed up as another origin's actor document. A host that served a key could describe itself as any actor and list the key as that actor's own, which let an attacker pass an authorized fetch under a borrowed identity and read whatever access control had reserved for it. Only the origin that serves an actor id can now speak for it. [GHSA-q9f8-5hc7-898f]
  • Public keys cached before this release are no longer read back, since the owner recorded in them was never verified. Applications using the built-in key cache need no action; those passing a custom KeyCache implementation to verifyRequest(), verifyJsonLd(), or verifyObject() should discard its contents once on upgrade. [GHSA-q9f8-5hc7-898f]
  • Fixed an SSRF vulnerability in outbound activity delivery that allowed inbox URLs and redirects to target private network addresses. Delivery now checks each destination unless allowPrivateAddress is explicitly enabled for local testing. [GHSA-f59r-8gcj-68f2]
  • Fixed unbounded reads of authenticated documents, NodeInfo responses, and inbox bodies that could exhaust memory. JSON bodies are now limited to 16 MiB. Oversized inbox requests receive 413 Content Too Large. [GHSA-mc44-6cfg-2v6w]

@​fedify/redis

  • Fixed RedisKvStore.set() failing when the ttl option was not a whole number of seconds. The duration was handed to Redis SETEX unchanged, and SETEX takes only whole seconds, so the write was rejected with

... (truncated)

Commits
  • d52c887 Merge tag '2.2.13' into 2.3-maintenance
  • c865e13 Merge tag '2.1.24' into 2.2-maintenance
  • 5e58258 Merge tag '2.0.28' into 2.1-maintenance
  • b230a91 Stop trusting a key's own word about its owner
  • a2847fe Bound federation bodies before parsing JSON
  • 68ec7b4 Validate outbound activity delivery destinations
  • a9eb37c Version bump
  • 062935e Version bump
  • 72b4cd7 Version bump
  • d863a12 Version bump
  • Additional commits viewable in compare view

Updates @fedify/vocab from 2.3.4 to 2.3.8

Release notes

Sourced from @​fedify/vocab's releases.

Fedify 2.3.8

Released on September 22, 2026.

@​fedify/fedify

  • Fixed the inbox accepting activities from any actor at all. Fedify verified the signature on an incoming delivery, but took the signing key's own word for whom it belonged to: the owner of a CryptographicKey and the controller of a Multikey were believed as served, even though the key document and the claim inside it come from the same host. Anyone with an ordinary HTTP server could therefore have an activity accepted as coming from any actor in the world, whether or not that actor existed. All three inbound authentication paths were affected—HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs—and the latter two require no HTTP signature on the request at all. A key's claimed owner is now resolved and has to link back to the key before the key is usable, and a key that names no owner of its own is attributed to the actor whose document carried it. [GHSA-q9f8-5hc7-898f]
  • Fixed getKeyOwner(), and therefore Context.getSignedKeyOwner(), accepting a key document dressed up as another origin's actor document. A host that served a key could describe itself as any actor and list the key as that actor's own, which let an attacker pass an authorized fetch under a borrowed identity and read whatever access control had reserved for it. Only the origin that serves an actor id can now speak for it. [GHSA-q9f8-5hc7-898f]
  • Public keys cached before this release are no longer read back, since the owner recorded in them was never verified. Applications using the built-in key cache need no action; those passing a custom KeyCache implementation to verifyRequest(), verifyJsonLd(), or verifyObject() should discard its contents once on upgrade. [GHSA-q9f8-5hc7-898f]
  • Fixed an SSRF vulnerability in outbound activity delivery that allowed inbox URLs and redirects to target private network addresses. Delivery now checks each destination unless allowPrivateAddress is explicitly enabled for local testing. [GHSA-f59r-8gcj-68f2]
  • Fixed unbounded reads of authenticated documents, NodeInfo responses, and inbox bodies that could exhaust memory. JSON bodies are now limited to 16 MiB. Oversized inbox requests receive 413 Content Too Large. [GHSA-mc44-6cfg-2v6w]

@​fedify/redis

  • Fixed RedisKvStore.set() failing when the ttl option was not a whole number of seconds. The duration was handed to Redis SETEX unchanged, and SETEX takes only whole seconds, so the write was rejected with ERR value is not an integer or out of range instead of being stored with a rounded expiry. The TTL is now rounded up to the next whole second. A zero or negative duration, which SETEX also rejects, now stores the value for one second, the shortest expiry that command can express. The one-second granularity is SETEX's rather than Redis's; SET with PX supports millisecond expiries. [#1028, #1034 by Heewon Chae]

@​fedify/vocab-runtime

  • Fixed unbounded reads of remote JSON-LD and HTML documents that could exhaust memory. JSON responses are now limited to 16 MiB after decompression; HTML discovery is limited to 1 MiB. [GHSA-mc44-6cfg-2v6w]

@​fedify/webfinger

  • Fixed unbounded reads of WebFinger descriptors that could exhaust memory. Responses are now limited to 16 MiB after decompression; oversized responses return null. [GHSA-mc44-6cfg-2v6w]

Fedify 2.3.7

Released on September 15, 2026.

@​fedify/postgres

  • Fixed PostgresKvStore storing values as JSONB strings rather than JSONB objects when it was constructed with the initialized: true option. The option skipped the driver's JSON serialization probe along with the table's schema DDL, so every value was serialized twice and every later read of the row returned a string, including reads from a store that never passed the option. The option now skips only the DDL. [#1031, #1033 by Heewon Chae]
  • Fixed PostgresMessageQueue storing messages as JSONB strings rather than JSONB objects when it was constructed with the initialized: true option. The option skipped the driver's JSON serialization probe along with the table's schema DDL, so every message was serialized twice and a listener received a string with no recognizable task type, silently dropping the queued work. The option now skips only the DDL. [#1014, #1032 by Heewon Chae]

Fedify 2.3.6

Released on August 23, 2026.

@​fedify/fedify

  • Fixed some public relay subscription requests being rejected by implementations that compare Follow.object as a plain URL without JSON-LD expansion. The Public collection in relay Follow activities is now serialized as its full ActivityStreams URI instead of a compact IRI. [#998, #1008 by Jiwon Kwon]

@​fedify/cli

  • Added a permanent removal warning to the fedify init command for Linux and other Unix-like system users before deleting existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/init

  • Added permanent removal warning for Linux or other UNIX-like system users before delete the existing content in the project directory. [#989, #997 by Jungmin Yoon]

@​fedify/lint

  • Fixed @fedify/lint actor property requirement rules reporting false positives when an actor dispatcher returns null for an actor that was not found. Non-null actor returns are still checked for the configured properties. [#974]

... (truncated)

Changelog

Sourced from @​fedify/vocab's changelog.

Version 2.3.8

Released on September 22, 2026.

@​fedify/fedify

  • Fixed the inbox accepting activities from any actor at all. Fedify verified the signature on an incoming delivery, but took the signing key's own word for whom it belonged to: the owner of a CryptographicKey and the controller of a Multikey were believed as served, even though the key document and the claim inside it come from the same host. Anyone with an ordinary HTTP server could therefore have an activity accepted as coming from any actor in the world, whether or not that actor existed. All three inbound authentication paths were affected—HTTP Signatures, Linked Data Signatures, and Object Integrity Proofs—and the latter two require no HTTP signature on the request at all. A key's claimed owner is now resolved and has to link back to the key before the key is usable, and a key that names no owner of its own is attributed to the actor whose document carried it. [GHSA-q9f8-5hc7-898f]
  • Fixed getKeyOwner(), and therefore Context.getSignedKeyOwner(), accepting a key document dressed up as another origin's actor document. A host that served a key could describe itself as any actor and list the key as that actor's own, which let an attacker pass an authorized fetch under a borrowed identity and read whatever access control had reserved for it. Only the origin that serves an actor id can now speak for it. [GHSA-q9f8-5hc7-898f]
  • Public keys cached before this release are no longer read back, since the owner recorded in them was never verified. Applications using the built-in key cache need no action; those passing a custom KeyCache implementation to verifyRequest(), verifyJsonLd(), or verifyObject() should discard its contents once on upgrade. [GHSA-q9f8-5hc7-898f]
  • Fixed an SSRF vulnerability in outbound activity delivery that allowed inbox URLs and redirects to target private network addresses. Delivery now checks each destination unless allowPrivateAddress is explicitly enabled for local testing. [GHSA-f59r-8gcj-68f2]
  • Fixed unbounded reads of authenticated documents, NodeInfo responses, and inbox bodies that could exhaust memory. JSON bodies are now limited to 16 MiB. Oversized inbox requests receive 413 Content Too Large. [GHSA-mc44-6cfg-2v6w]

@​fedify/redis

  • Fixed RedisKvStore.set() failing when the ttl option was not a whole number of seconds. The duration was handed to Redis SETEX unchanged, and SETEX takes only whole seconds, so the write was rejected with

... (truncated)

Commits

Updates @types/node from 26.2.0 to 26.6.3

Commits

Updates eslint from 10.8.1 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
  • 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
  • d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
  • b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
  • 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
  • 6c789ff docs: Update README (GitHub Actions Bot)
  • 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

  • 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
  • 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
  • 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
  • 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
  • 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
  • ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
  • c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
  • f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
  • fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

  • 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
  • c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
  • 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

  • bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
  • 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
  • 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
  • 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
  • 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
  • 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

  • 2417cad docs: Update README (GitHub Actions Bot)
  • 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
  • 8724829 docs: update compat table links (#21263) (fnx)
  • 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

  • b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
  • 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits...

Description has been truncated

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 19, 2026
@dependabot
dependabot Bot requested a review from davidwkeith as a code owner September 19, 2026 23:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 19, 2026
davidwkeith
davidwkeith reviewed Sep 19, 2026
View reviewed changes

@davidwkeith davidwkeith left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated review

CI is red, and it's not a flake. build-test, integration, and image all fail with the same root cause:

packages/cf-shims/src/durable-object.ts(497,61): error TS2554: Expected 0 arguments, but got 1.

That's randomBytes(32).toString("hex") inside DurableObjectNamespace.newUniqueId(). It typechecks fine on main (@types/[email protected]), but breaks under this PR's bump to @types/[email protected] — Buffer#toString appears to resolve to a 0-arg overload after the update. pnpm --filter @dwk/cf-shims typecheck reproduces it locally. This needs a source-level fix (or holding back @types/node in this group) before merge — per spec/conformance-and-testing.md / the CI gate, lint → format → typecheck → build → test must all pass, and right now typecheck doesn't.

PR title, minor: chore(deps-dev): bump the dev-dependencies group across 1 directory with 11 updates uses deps-dev as scope. CONTRIBUTING.md's Conventional Commits section says scope is a package name, or omitted entirely for a repo-wide change (chore: …) — this repo squash-merges, so the PR title becomes the permanent commit message. History is mixed here (#493/#486 kept deps-dev as-is, #507 was retitled to drop the scope before merge), so this is a judgment call for whoever merges, not a hard blocker.

Changeset: correctly omitted. This only touches devDependencies workspace-wide, not a publishable package's runtime surface, so no changeset is required.

Version consistency: the bumped versions line up across the root package.json and packages/cf-shims, packages/conformance-target, packages/deno-host, packages/server, and pnpm-lock.yaml — no mismatched pins.

Recommendation: hold this PR until the @dwk/cf-shims typecheck failure is fixed; everything else here is clean, routine dependency-bump content.

Generated by Claude Code

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-c3bbf18a00 branch from 980e0fb to bd3f4ef Compare October 1, 2026 02:36
@davidwkeith davidwkeith changed the title chore(deps-dev): bump the dev-dependencies group across 1 directory with 11 updates chore: bump dev-dependencies group, hold back workers-types/wrangler Oct 21, 2026
@davidwkeith @claude
fix(deps): hold back @cloudflare/workers-types, vitest-pool-workers, …
291cf11 
…wrangler

@cloudflare/workers-types still ships the global `declare const Buffer:
any` (nodejs_compat ambient global) through 5.20260928.1, verified with a
minimal repro and by bisecting the group's updates individually. Merged
into a package's `types` array alongside @types/node (cf-shims, server,
conformance-target), it breaks resolution of Node's own Buffer
overloads: any `buf.toString(encoding)` call resolves to the zero-arg
`Object.prototype.toString` instead, which previously broke cf-shims's
typecheck and would also drop ExecutionContext's new `abort` member on
@dwk/server. Same root cause as #507.

wrangler peer-depends on a matching workers-types range, and
vitest-pool-workers pulls in that wrangler, so all three are held back
together. eslint, prettier, typescript-eslint, @types/node,
@changesets/cli, @libsql/client, and @fedify/fedify+vocab keep their
bumps. Rebased onto main after #519 and #533 merged ahead of this PR.
Frozen install, lint, format, typecheck, build, and the full test suite
all pass.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
@davidwkeith
davidwkeith force-pushed the dependabot/npm_and_yarn/dev-dependencies-c3bbf18a00 branch from 0e74f0d to 291cf11 Compare October 21, 2026 02:05
@davidwkeith
davidwkeith merged commit 0f1118c into main Oct 21, 2026
9 checks passed
@davidwkeith
davidwkeith deleted the dependabot/npm_and_yarn/dev-dependencies-c3bbf18a00 branch October 21, 2026 02:09
davidwkeith added a commit that referenced this pull request Oct 21, 2026
@davidwkeith @claude
chore(deps): bump ws and @types/ws
5886d86 
Bumps ws to 8.22.0 and @types/ws to 8.18.2 in packages/server.

Rebased onto main after #519, #522, #526, #532, and #533 merged ahead
of this PR; no content changes beyond the ws bump itself.

Signed-off-by: dependabot[bot] <[email protected]>
Co-Authored-By: Claude Sonnet 5 <[email protected]>
davidwkeith added a commit that referenced this pull request Oct 21, 2026
@dependabot @davidwkeith @claude
chore(deps): bump ws and @types/ws (#531)
bfc365c 
Bumps ws to 8.22.0 and @types/ws to 8.18.2 in packages/server.

Rebased onto main after #519, #522, #526, #532, and #533 merged ahead
of this PR; no content changes beyond the ws bump itself.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: David W. Keith <[email protected]>
Co-authored-by: Claude Sonnet 5 <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@davidwkeith davidwkeith davidwkeith left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@davidwkeith