Skip to content

chore(deps)(deps-dev): bump the dev-dependencies group with 7 updates - #259

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-0f58a33da5
Open

chore(deps)(deps-dev): bump the dev-dependencies group with 7 updates#259
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-0f58a33da5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 7 updates:

Package From To
@next/bundle-analyzer 16.3.5 16.3.6
@next/mdx 16.3.5 16.3.6
@typescript-eslint/parser 8.70.0 8.70.1
@typescript-eslint/types 8.70.0 8.70.1
cspell 10.3.3 10.3.4
tsx 4.23.13 4.23.15
wrangler 4.134.0 4.140.0

Updates @next/bundle-analyzer from 16.3.5 to 16.3.6

Release notes

Sourced from @​next/bundle-analyzer's releases.

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

Commits

Updates @next/mdx from 16.3.5 to 16.3.6

Release notes

Sourced from @​next/mdx's releases.

v16.3.6

This release contains a security fix for GHSA-vcvr-r3jv-pc5j: Remote Code Execution in next/og ImageResponse

Commits

Updates @typescript-eslint/parser from 8.70.0 to 8.70.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

  • ast-spec: narrow import attribute keys to identifiers and strings (#12879)
  • eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
  • eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
  • eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
  • eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
  • eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
  • eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
  • eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
  • eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
  • eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
  • eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
  • eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
  • eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
  • rule-tester: test the final autofix output instead of the first pass (#12867)
  • scope-manager: merge implicit global definitions (#12809)
  • type-utils: match package specifiers on whole path components (#12838)
  • typescript-estree: resolve symlinked paths when matching files to projects (#12725)
  • typescript-estree: add missing < token opening type arguments (#12821)
  • typescript-estree: require string literal import attribute values (#12894)
  • website: prevent playground from breaking down after opening link with the .js file type (#12777)

❤️ Thank You

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates @typescript-eslint/types from 8.70.0 to 8.70.1

Release notes

Sourced from @​typescript-eslint/types's releases.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

  • ast-spec: narrow import attribute keys to identifiers and strings (#12879)
  • eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
  • eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
  • eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
  • eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
  • eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
  • eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
  • eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
  • eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
  • eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
  • eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
  • eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
  • eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
  • rule-tester: test the final autofix output instead of the first pass (#12867)
  • scope-manager: merge implicit global definitions (#12809)
  • type-utils: match package specifiers on whole path components (#12838)
  • typescript-estree: resolve symlinked paths when matching files to projects (#12725)
  • typescript-estree: add missing < token opening type arguments (#12821)
  • typescript-estree: require string literal import attribute values (#12894)
  • website: prevent playground from breaking down after opening link with the .js file type (#12777)

❤️ Thank You

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from @​typescript-eslint/types's changelog.

8.70.1 (2026-09-21)

This was a version bump only for types to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates cspell from 10.3.3 to 10.3.4

Release notes

Sourced from cspell's releases.

v10.3.4

Fixes

fix: Report errors (#9267)

This pull request introduces improvements to error handling and debugging information in the spell-checking workflow. The main changes focus on providing more informative error messages and ensuring that errors encountered during document processing are surfaced promptly.

Error handling improvements:

  • In processFile (packages/cspell/src/lint/processFile.ts), the function now throws the first error from r.errors if any are present, ensuring that errors encountered during spell checking are not silently ignored.

Debugging and diagnostics:

  • In resolveParser (packages/cspell-lib/src/lib/Settings/CSpellSettingsServer.ts), the assertion message has been enhanced to include a list of available parsers when a requested parser is not found, making it easier to diagnose configuration issues.

fix: ParsedTag can only be boolean values for now. (#9268)

This pull request updates the ParsedTag type throughout the codebase to remove the possibility of a string value, restricting it to only boolean or undefined. This change is applied consistently across type definitions and source files.

Note: The is possible because it has only been an experimental feature and isn't used.

Type definition changes:

  • Updated the ParsedTag type in packages/cspell-types/api/Parser/index.d.mts to only allow boolean or undefined, removing support for string.
  • Updated the ParsedTag type in packages/cspell-types/api/index.d.mts to only allow boolean or undefined, removing support for string.
  • Updated the ParsedTag type in packages/cspell-types/src/Parser/parser.ts to only allow boolean or undefined, removing support for string.

fix: Fix Sponsor cards on npmjs (#9260)

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.3.4 (2026-09-24)

Fixes

fix: Report errors (#9267)

This pull request introduces improvements to error handling and debugging information in the spell-checking workflow. The main changes focus on providing more informative error messages and ensuring that errors encountered during document processing are surfaced promptly.

Error handling improvements:

  • In processFile (packages/cspell/src/lint/processFile.ts), the function now throws the first error from r.errors if any are present, ensuring that errors encountered during spell checking are not silently ignored.

Debugging and diagnostics:

  • In resolveParser (packages/cspell-lib/src/lib/Settings/CSpellSettingsServer.ts), the assertion message has been enhanced to include a list of available parsers when a requested parser is not found, making it easier to diagnose configuration issues.

fix: ParsedTag can only be boolean values for now. (#9268)

This pull request updates the ParsedTag type throughout the codebase to remove the possibility of a string value, restricting it to only boolean or undefined. This change is applied consistently across type definitions and source files.

Note: The is possible because it has only been an experimental feature and isn't used.

Type definition changes:

  • Updated the ParsedTag type in packages/cspell-types/api/Parser/index.d.mts to only allow boolean or undefined, removing support for string.
  • Updated the ParsedTag type in packages/cspell-types/api/index.d.mts to only allow boolean or undefined, removing support for string.
  • Updated the ParsedTag type in packages/cspell-types/src/Parser/parser.ts to only allow boolean or undefined, removing support for string.

fix: Fix Sponsor cards on npmjs (#9260)

... (truncated)

Commits

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

  • exclude bare builtins from namespace inheritance (38e1588)
  • expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
  • make namespaced register() overloads portable for declaration emit (562c434)

This release is also available on:

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

  • restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

This release is also available on:

Commits
  • ca66105 test: fix drive-less file URLs in ESM resolver fixtures
  • 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
  • 38e1588 fix: exclude bare builtins from namespace inheritance
  • 562c434 fix: make namespaced register() overloads portable for declaration emit
  • edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
  • 70e7828 test: upgrade tinyspy for disposable API
  • 9ed2022 ci: avoid duplicate release notifications
  • 872e77f refactor: use disposables for cleanup
  • 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
  • See full diff in compare view

Updates wrangler from 4.134.0 to 4.140.0

Release notes

Sourced from wrangler's releases.

wrangler@4.140.0

Minor Changes

Patch Changes

wrangler@4.139.0

Minor Changes

  • #15792 479e1e8 Thanks @​flakey5! - Configure SSH for experimental Durable Object-managed Containers

    Set containers[].ssh and containers[].authorized_keys when using scheduling_policy: "durable_object". These are application-wide settings that follow the same rules as the existing Durable Object-managed Container settings: normal deployments create missing applications and update explicitly configured values, while omitted settings preserve the existing application configuration.

    // wrangler.jsonc
{
  "containers": [
    {
      "name": "sandbox",
      "class_name": "Sandbox",
      "scheduling_policy": "durable_object",
      "ssh": { "enabled": true },
      "authorized_keys": [
        { "name": "laptop", "public_key": "ssh-ed25519 AAAA..." }
      ]
    }
  ]
}

  • #15648 52c0e9f Thanks @​tpmmorris! - Expose configured Cron Triggers to local development consumers

    Wrangler now passes the active environment's exact Cron Trigger expressions to Miniflare so Local Explorer can display them. Headless agent sessions also advertise the Local Explorer scheduled invocation API.

  • #15786 bdda4c3 Thanks @​ThomasRubini! - Support UDP connect handlers in local development

    The experimental connect configuration now accepts protocol: "udp", with optional idle_timeout_ms and max_pending_bytes settings. UDP datagrams are delivered to the Worker's connect() handler using workerd's value-mode socket streams, and can be tested with Miniflare#dispatchConnect({ protocol: "udp" }).

  • #15779 fc3cbaa Thanks @​Naapperas! - Support workflow entries in the exports configuration map

    A Worker can now declare the Workflows it defines in exports, keyed by the WorkflowEntrypoint class name:

    {
  "exports": {
    "MyWorkflow": {

... (truncated)

Commits
  • 84c819f Version Packages (#15857)
  • 8f7916c [deploy-helpers] Containers support for Worker Preview deployments in the Bui...
  • c59dae6 Version Packages (#15828)
  • 15799d4 [wrangler] Update smol-toml to 1.9.0 (#15838)
  • 479e1e8 Allow ssh config for DO containers (#15792)
  • 52c0e9f Add backend support for cron triggers in local explorer (#15648)
  • fc3cbaa [workers-utils,miniflare,wrangler] Accept workflow entries in the exports con...
  • cd60c9c [wrangler] chore: Show --jurisdiction flag in KV Create Namespace help (#15803)
  • bdda4c3 [wrangler] Support UDP connect handlers for local development (#15786)
  • 8d7e380 Version Packages (#15813)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps-dev): bump the dev-dependencies group with 7 updates
772620c 
Bumps the dev-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@next/bundle-analyzer](https://github.com/vercel/next.js/tree/HEAD/packages/next-bundle-analyzer) | `16.3.5` | `16.3.6` |
| [@next/mdx](https://github.com/vercel/next.js/tree/HEAD/packages/next-mdx) | `16.3.5` | `16.3.6` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.70.0` | `8.70.1` |
| [@typescript-eslint/types](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/types) | `8.70.0` | `8.70.1` |
| [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) | `10.3.3` | `10.3.4` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.13` | `4.23.15` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.134.0` | `4.140.0` |


Updates `@next/bundle-analyzer` from 16.3.5 to 16.3.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.6/packages/next-bundle-analyzer)

Updates `@next/mdx` from 16.3.5 to 16.3.6
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.3.6/packages/next-mdx)

Updates `@typescript-eslint/parser` from 8.70.0 to 8.70.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/parser)

Updates `@typescript-eslint/types` from 8.70.0 to 8.70.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/types/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/types)

Updates `cspell` from 10.3.3 to 10.3.4
- [Release notes](https://github.com/streetsidesoftware/cspell/releases)
- [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md)
- [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.3.4/packages/cspell)

Updates `tsx` from 4.23.13 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.13...v4.23.15)

Updates `wrangler` from 4.134.0 to 4.140.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.140.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@next/bundle-analyzer"
  dependency-version: 16.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@next/mdx"
  dependency-version: 16.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.70.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@typescript-eslint/types"
  dependency-version: 8.70.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: cspell
  dependency-version: 10.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: wrangler
  dependency-version: 4.140.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner September 28, 2026 06:12

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants