Skip to content

chore(deps): bump the bun group across 4 directories with 15 updates - #3807

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/bun-8a6523a93c
Closed

chore(deps): bump the bun group across 4 directories with 15 updates#3807
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/bun-8a6523a93c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the bun group with 14 updates in the / directory:

Package From To
@babel/parser 8.0.4 8.0.5
@biomejs/biome 2.5.12 2.5.13
@types/bun 1.4.1 1.4.2
@types/node 26.4.1 26.5.1
wrangler 4.129.0 4.131.1
yaml 2.9.0 2.9.1
@zod/mini 4.5.4 4.6.4
zod 4.5.4 4.6.4
pako 3.0.1 3.0.2
vite 8.2.2 8.3.0
mediabunny 1.54.0 1.56.2
react 19.2.8 19.3.0
@types/react 19.2.18 19.3.0
open 11.0.2 11.0.3

Bumps the bun group with 2 updates in the /demo/pub directory: wrangler and @cloudflare/workers-types.
Bumps the bun group with 2 updates in the /infra/apt directory: wrangler and @cloudflare/workers-types.
Bumps the bun group with 2 updates in the /infra/rpm directory: wrangler and @cloudflare/workers-types.

Updates @babel/parser from 8.0.4 to 8.0.5

Release notes

Sourced from @​babel/parser's releases.

v8.0.5 (2026-09-10)

Thanks @​drubetti, @​jibin7jose, @​joelle-a-dev, @​journey-ad, @​Kjubikstronk, @​MatteoGabriele, and @​zhangli091011 for your first PRs!

👓 Spec Compliance

  • babel-parser

🐛 Bug Fix

📝 Documentation

🏠 Internal

  • babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env
  • babel-node
  • babel-types

... (truncated)

Changelog

Sourced from @​babel/parser's changelog.

v8.0.5 (2026-09-10)

👓 Spec Compliance

  • babel-parser

🐛 Bug Fix

📝 Documentation

🏠 Internal

  • babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env
  • babel-node
  • babel-types

🏃‍♀️ Performance

  • babel-parser

... (truncated)

Commits

Updates @biomejs/biome from 2.5.12 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

  • #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

    /* Invalid */
@import 'foo.css';
.my-style {
color: red;
}
/* Valid */
@​import 'foo.css' layer(base);
@​layer base {
.my-style {
color: red;
}
}

  • #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

    element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");

  • #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

  • #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

  • #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

  • #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

  • #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

  • #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

    const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

... (truncated)

Commits

Updates @types/bun from 1.4.1 to 1.4.2

Commits

Updates @types/node from 26.4.1 to 26.5.1

Commits

Updates wrangler from 4.129.0 to 4.131.1

Release notes

Sourced from wrangler's releases.

wrangler@4.131.1

Patch Changes

  • #15592 945aaa3 Thanks @​WillTaylorDev! - Add a provisioning delay note when custom domain Preview URLs change

    Wrangler now explains that DNS and TLS certificate provisioning may continue after a deploy adds a custom domain or enables its Preview URLs. Stable redeploys don't repeat the note.

    This assumes that a request which matches the stored custom domain state doesn't restart provisioning. The client infers this from the API changeset and current domain record because this repository can't verify the backend behavior.

  • #15592 945aaa3 Thanks @​WillTaylorDev! - Clarify production status labels for custom domain routes

    Wrangler now prefixes explicit custom domain production states with production: so they match Preview labels. The updated labels appear in deployed trigger output and WRANGLER_OUTPUT_FILE_PATH.

  • #15602 47d906f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20260910.1 ^5.20260911.1
    workerd 1.20260910.1 1.20260911.1

  • #15592 945aaa3 Thanks @​WillTaylorDev! - Avoid replacement prompts for custom domains already on the Worker

    Wrangler now updates Preview settings without asking to replace a custom domain when that domain already belongs to the deployed Worker. It still asks before replacing domains attached to another Worker.

  • #15592 945aaa3 Thanks @​WillTaylorDev! - Explain how to enable Preview URLs when a Preview deployment has none

    wrangler preview now shows URL shapes and configuration snippets for Workers.dev and custom domains. The custom domain snippet preserves every configured route, and the guidance distinguishes missing settings from disabled ones.

    This changes a private beta feature. The warning also makes clear that wrangler deploy publishes code from the current checkout.

  • Updated dependencies [47d906f, c2699bf]:

wrangler@4.131.0

Minor Changes

  • #15480 36aed7f Thanks @​skepticfx! - Add Durable Object-managed Containers to top-level container configuration

    Wrangler now accepts scheduling_policy: "durable_object" in the top-level containers array and creates its namespace-backed application after the Worker upload resolves the Durable Object namespace ID. The namespace ID is also the application ID, so repeated deploys idempotently ensure the same application without name-based lookup, modification, or a Containers rollout.

    Durable Object-managed entries accept class_name, scheduling_policy, an optional name, and an optional named images map. Scheduler-only fields are rejected. Each image provides either a local dockerfile or a digest-pinned managed-registry image. Wrangler builds or resolves each image, waits while Cloudflare prepares it for the Containers runtime, and uploads the resulting references with the Worker version for access through ctx.container.images and env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Local development support for these entries is deferred to a follow-up.

    Existing scheduler-backed entries and Durable Object migrations continue to work unchanged.

    With --containers-rollout=none, existing Workers retain their deployed Container metadata and image binding even when local containers is omitted or empty; local scheduler edits are also ignored. The upload stops if the deployed versions cannot be recovered. Existing Workers for Platforms dispatch scripts reject this flag before upload because their API does not expose enough metadata to preserve Container associations safely. First deployments can still skip Container preparation and rollout. Without this flag, removing managed Containers, including by omitting containers entirely, clears the experimental image binding even with keep_vars.

    versions deploy validates the selected versions before changing traffic and creates their Durable Object-managed applications only after deployment succeeds. Both deploy and versions deploy report partial completion if application creation fails afterward, with instructions to retry the same command.

... (truncated)

Commits

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

  • Limit recursive merge aliases (#685, #713)
  • Simplify line unfolding during quoted string parsing (#714)
Commits

Updates @zod/mini from 4.5.4 to 4.6.4

Release notes

Sourced from @​zod/mini's releases.

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

  • .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
  • z.instanceof().properties() — validates properties of an instance
  • fromJSONSchema() — enforces six validation keywords it used to ignore
  • z.iban() — electronic-format IBAN plus mod-97 checksum
  • z.withParser() — installs a parser generated elsewhere, for environments without new Function
  • Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
  • Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
  • @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

... (truncated)

Commits

Updates zod from 4.5.4 to 4.6.4

Release notes

Sourced from zod's releases.

v4.6.4

A patch on top of 4.6.3.

  • d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
  • ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
  • 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

  • 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
  • 75d63ee1 docs: show only the .properties() method form in the 4.6 post
  • 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

  • .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
  • z.instanceof().properties() — validates properties of an instance
  • fromJSONSchema() — enforces six validation keywords it used to ignore
  • z.iban() — electronic-format IBAN plus mod-97 checksum
  • z.withParser() — installs a parser generated elsewhere, for environments without new Function
  • Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
  • Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
  • @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

... (truncated)

Commits
  • 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
  • 743aedb 4.6.4
  • f6e1701 chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)
  • d6bc1e3 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by...
  • ad32d75 perf: reduce validation and schema allocation overhead (#6588)
  • 12e6272 4.6.3
  • 413cce9 fix(v4): make z.properties() a check again (#6594)
  • 75d63ee docs: show only the .properties() method form in the 4.6 post
  • 46da957 docs: match the error-message examples to what the parsers emit
  • e359f73 4.6.2
  • Additional commits viewable in compare view

Updates pako from 3.0.1 to 3.0.2

Changelog

Sourced from pako's changelog.

3.0.2 - 2026-09-12

Fixed

  • Port missed upstream zlib fix for block type selection with Z_FIXED, avoiding fixed blocks when stored blocks would be smaller, #316.
  • Read gzip header time as an unsigned 32-bit value, fixing negative timestamps from 2038 onward, #311.
Commits

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

  • build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

  • handle CRLF line endings in code frame positions (#23219) (9913672)
  • only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

  • proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

Bug Fixes

@dependabot
chore(deps): bump the bun group across 4 directories with 15 updates
e373355 
Bumps the bun group with 14 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@babel/parser](https://github.com/babel/babel/tree/HEAD/packages/babel-parser) | `8.0.4` | `8.0.5` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.12` | `2.5.13` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.1` | `1.4.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.5.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.129.0` | `4.131.1` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |
| [@zod/mini](https://github.com/colinhacks/zod/tree/HEAD/packages/mini) | `4.5.4` | `4.6.4` |
| [zod](https://github.com/colinhacks/zod) | `4.5.4` | `4.6.4` |
| [pako](https://github.com/nodeca/pako) | `3.0.1` | `3.0.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.0` |
| [mediabunny](https://github.com/Vanilagy/mediabunny) | `1.54.0` | `1.56.2` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [open](https://github.com/sindresorhus/open) | `11.0.2` | `11.0.3` |

Bumps the bun group with 2 updates in the /demo/pub directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) and [@cloudflare/workers-types](https://github.com/cloudflare/workerd).
Bumps the bun group with 2 updates in the /infra/apt directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) and [@cloudflare/workers-types](https://github.com/cloudflare/workerd).
Bumps the bun group with 2 updates in the /infra/rpm directory: [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) and [@cloudflare/workers-types](https://github.com/cloudflare/workerd).


Updates `@babel/parser` from 8.0.4 to 8.0.5
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.5/packages/babel-parser)

Updates `@biomejs/biome` from 2.5.12 to 2.5.13
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.13/packages/@biomejs/biome)

Updates `@types/bun` from 1.4.1 to 1.4.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `@types/node` from 26.4.1 to 26.5.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `wrangler` from 4.129.0 to 4.131.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.131.1/packages/wrangler)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

Updates `@zod/mini` from 4.5.4 to 4.6.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](https://github.com/colinhacks/zod/commits/v4.6.4/packages/mini)

Updates `zod` from 4.5.4 to 4.6.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.5.4...v4.6.4)

Updates `pako` from 3.0.1 to 3.0.2
- [Changelog](https://github.com/nodeca/pako/blob/master/CHANGELOG.md)
- [Commits](nodeca/pako@3.0.1...3.0.2)

Updates `vite` from 8.2.2 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

Updates `mediabunny` from 1.54.0 to 1.56.2
- [Release notes](https://github.com/Vanilagy/mediabunny/releases)
- [Commits](Vanilagy/mediabunny@v1.54.0...v1.56.2)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `open` from 11.0.2 to 11.0.3
- [Release notes](https://github.com/sindresorhus/open/releases)
- [Commits](sindresorhus/open@v11.0.2...v11.0.3)

Updates `wrangler` from 4.129.0 to 4.131.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.131.1/packages/wrangler)

Updates `@cloudflare/workers-types` from 5.20260906.1 to 5.20260911.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `wrangler` from 4.129.0 to 4.131.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.131.1/packages/wrangler)

Updates `@cloudflare/workers-types` from 5.20260906.1 to 5.20260911.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `wrangler` from 4.129.0 to 4.131.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.131.1/packages/wrangler)

Updates `@cloudflare/workers-types` from 5.20260906.1 to 5.20260911.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

---
updated-dependencies:
- dependency-name: "@babel/parser"
  dependency-version: 8.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun
- dependency-name: "@types/bun"
  dependency-version: 1.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun
- dependency-name: "@types/node"
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: wrangler
  dependency-version: 4.131.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun
- dependency-name: "@zod/mini"
  dependency-version: 4.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: zod
  dependency-version: 4.6.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: pako
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bun
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: mediabunny
  dependency-version: 1.56.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: open
  dependency-version: 11.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bun
- dependency-name: wrangler
  dependency-version: 4.131.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260911.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: wrangler
  dependency-version: 4.131.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260911.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: wrangler
  dependency-version: 4.131.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260911.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bun
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 20, 2026
@moq-bot
moq-bot Bot enabled auto-merge (squash) September 20, 2026 14:16
@kixelated

kixelated commented Sep 20, 2026

Copy link
Copy Markdown
Collaborator

MERGE (once Check / Smoke / WASM are green)

Positive improvement?

Yes. Routine Dependabot bun-group refresh across root, demo/pub, infra/apt, and infra/rpm. Diff is package.json pins plus lockfiles only — no application code. Patch updates (yaml recursive-merge limit, pako zlib/gzip fixes, Biome lint fixes, @babel/parser) are clearly worth taking. Keeping the workspace on current minors reduces drift and security lag.

Worth the complexity?

Yes — complexity is low. Grouped bumps are the right default here; splitting every package would add review noise without changing the merge gate (CI).

Different approach?

Only if CI fails on a specific package: then split that one out (especially zod/@zod/mini, react, or mediabunny) rather than holding the whole group. No reason to do that preemptively.

Watch after merge / on red CI

Package Bump Why it matters
zod / @zod/mini 4.5.4 → 4.6.4 Production schema stack; 4.6 had a short-lived z.properties() shape change (reverted in 4.6.3) plus parse/memory fixes
react / @types/react 19.2.x → 19.3.0 Core UI minor in js/signals and demos
mediabunny 1.54.0 → 1.56.2 Production media path; two minors
wrangler 4.129.0 → 4.131.1 Tooling (incl. Durable Object–managed containers); mainly doc/infra/demo
vite 8.2.2 → 8.3.0 Build/devtools minor

CI was still running when this review was written — merge on green, investigate the table above if anything fails.

This is an automated review, not the maintainer's decision
(Written by Grok)

@kixelated kixelated closed this Sep 20, 2026
auto-merge was automatically disabled September 20, 2026 20:26

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/bun/bun-8a6523a93c branch September 20, 2026 20:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kixelated