Skip to content

chore(deps-dev): bump the development group across 1 directory with 11 updates - #72

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-c853e21f60
Open

chore(deps-dev): bump the development group across 1 directory with 11 updates#72
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-c853e21f60

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development group with 11 updates in the / directory:

Package From To
@biomejs/biome 2.5.5 2.5.7
@types/react 19.2.17 19.2.18
@types/react-dom 19.2.3 19.2.4
@vitejs/plugin-react 6.0.4 6.0.5
vite 8.1.5 8.2.1
@cloudflare/vitest-pool-workers 0.18.8 0.20.3
@cloudflare/workers-types 5.20260724.1 5.20260809.1
wrangler 4.114.0 4.120.0
@types/node 26.1.1 26.2.0
esbuild 0.28.1 0.28.2
tsx 4.23.1 4.23.11

Updates @biomejs/biome from 2.5.5 to 2.5.7

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes

  • #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

  • #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

  • #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

  • #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

  • #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

    ├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js

    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

    Now, the nested configuration is correctly picked up and applied.

    In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

  • #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

    declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";

    The following code is also now invalid, because map(() => 42) returns 42:

    

    • 






... (truncated)





Changelog

Sourced from @​biomejs/biome's changelog.




2.5.7


Patch Changes


    

  • 

    #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.
    

    • 

  • 

    #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.
    

    • 

  • 

    #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.
    

    • 

  • 

    #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
    

    • 

  • 

    #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in
stdin mode didn't work correctly when handling files in projects with nested
configurations. For example, with the following structure,
--stdin-file-path=subdirectory/... would not use the nested configuration in
subdirectory/biome.json:
    

    ├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js

    

    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
    

    Now, the nested configuration is correctly picked up and applied.
    

    In addition, Biome now shows a warning if --stdin-file-path is provided but
that path is ignored and therefore not formatted or fixed.
    

    • 

  • 

    #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.
    

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
    

    declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
    

    The following code is also now invalid, because map(() => 42) returns 42:
    

    type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;
    

    • 






... (truncated)





Commits






Updates @types/react from 19.2.17 to 19.2.18



Commits






Updates @types/react-dom from 19.2.3 to 19.2.4



Commits






Updates @vitejs/plugin-react from 6.0.4 to 6.0.5



Release notes

Sourced from @​vitejs/plugin-react's releases.




plugin-react@6.0.5


Fixed the react compiler preset filter to be linear (#1353)


The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.







Changelog

Sourced from @​vitejs/plugin-react's changelog.




6.0.5 (2026-07-30)


Fixed the react compiler preset filter to be linear (#1353)


The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.







Commits






Updates vite from 8.1.5 to 8.2.1



Release notes

Sourced from vite's releases.




plugin-legacy@8.2.1


Please refer to CHANGELOG.md for details.


v8.2.1


Please refer to CHANGELOG.md for details.


create-vite@8.2.0


Please refer to CHANGELOG.md for details.


plugin-legacy@8.2.0


Please refer to CHANGELOG.md for details.


v8.2.0


Please refer to CHANGELOG.md for details.


v8.2.0-beta.0


Please refer to CHANGELOG.md for details.







Changelog

Sourced from vite's changelog.




8.2.1 (2026-08-06)


Bug Fixes


    

  • build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
    • 

  • bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
    • 

  • css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
    • 

  • deps: update all non-major dependencies (#23136) (14454fd)
    • 

  • deps: update rolldown-related dependencies (#23070) (7ac6f7f)
    • 

  • don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
    • 

  • handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
    • 

  • server: use a random port when port is 0 (#23158) (fddf4ea)
    • 



Performance Improvements



Documentation


    

  • build: fix incomplete @default for build.minify (#23177) (ef02435)
    • 



Miscellaneous Chores


    

  • deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
    • 

  • deps: update dependency strip-literal to v4 (#23140) (9db65ce)
    • 



Code Refactoring


    

  • bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
    • 

  • bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)
    • 



Tests



8.2.0 (2026-07-30)


Features


    

  • add input to server.fs.allow (#23035) (95a3cda)
    • 

  • bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
    • 

  • bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
    • 

  • config: include column in config incompatibility location (#23064) (8a24572)
    • 

  • dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)
    • 



Bug Fixes


    

  • bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
    • 

  • deps: update all non-major dependencies (#23069) (4c07b74)
    • 

  • hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
    • 

  • importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)
    • 






... (truncated)





Commits

    

  • 4216158 release: v8.2.1
    • 

  • fddf4ea fix(server): use a random port when port is 0 (#23158)
    • 

  • de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
    • 

  • 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
    • 

  • c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
    • 

  • ef02435 docs(build): fix incomplete @default for build.minify (#23177)
    • 

  • eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
    • 

  • 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
    • 

  • e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
    • 

  • 14454fd fix(deps): update all non-major dependencies (#23136)
    • 

  • Additional commits viewable in compare view
    • 







Updates @cloudflare/vitest-pool-workers from 0.18.8 to 0.20.3



Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.




@​cloudflare/vitest-pool-workers@​0.20.3


Patch Changes



@​cloudflare/vitest-pool-workers@​0.20.2


Patch Changes



@​cloudflare/vitest-pool-workers@​0.20.1


Patch Changes



@​cloudflare/vitest-pool-workers@​0.20.0


Minor Changes


    

  • 

    #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options
    

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:
    

      

    • wrappedBindings
      • 

    • cacheWarnUsage
      • 

    • fetchMock: you should use outboundService instead
      • 

    • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.
      • 

    

    Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.
    

    • 



Patch Changes






... (truncated)





Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.




0.20.3


Patch Changes



0.20.2


Patch Changes



0.20.1


Patch Changes



0.20.0


Minor Changes


    

  • 

    #14586 5a56dda Thanks @​emily-shen! - Breaking change: Remove several options from the miniflare override options
    

    The following options have been removed from the miniflare override options, as they were not intended to be exposed, were not functional, or have been superseded by other options:
    

      

    • wrappedBindings
      • 

    • cacheWarnUsage
      • 

    • fetchMock: you should use outboundService instead
      • 

    • containerEngine: containers were not supported in vitest-pool-workers. Consider using createTestHarness() instead if you want to test against actual containers.
      • 

    

    Additionally, cache has been deprecated and renamed to cacheAPI, but cache remains functional.
    

    • 



Patch Changes


    

  • 

    #14586 5a56dda Thanks @​emily-shen! - Preserve the deprecated Miniflare cache option
    

    Vitest configurations using cache continue to work after the internal Miniflare v5 upgrade. The option is translated to cacheAPI; new configurations should use cacheAPI directly.
    

    • 

  • 

    #14586 5a56dda Thanks @​emily-shen! - Stop enabling Miniflare's removed unsafeStickyBlobs option
    

    The pool no longer sets the unsafeStickyBlobs Miniflare option, which has been removed. This option was only needed for the Durable Object isolated storage feature that was dropped in 0.13.0, so there is no change in behaviour.
    

    • 






... (truncated)





Commits






Updates @cloudflare/workers-types from 5.20260724.1 to 5.20260809.1



Commits






Updates wrangler from 4.114.0 to 4.120.0



Release notes

Sourced from wrangler's releases.




wrangler@4.120.0


Minor Changes


    

  • 

    #15008 35c87e9 Thanks @​skepticfx! - Adds the ability to find container instances by exact ID or name
    

    wrangler containers instances <application_id> --search <instance_id_or_name> now searches every page and returns exact matches in human-readable or JSON output. JSON returns a top-level array, including an empty array when there is no match, while human-readable output prints a no-match message. If multiple instances have the same exact name, every matching instance is returned.
    

    • 

  • 

    #15008 35c87e9 Thanks @​skepticfx! - Add explicit pagination to container instance JSON output
    

    Use wrangler containers instances <application_id> --json --per-page <size> to return one page with machine-readable result_info, then pass its next_page_token to --page-token to retrieve the next page. Plain --json remains backward-compatible: it requests the complete list and returns the existing top-level array.
    

    • 



Patch Changes


    

  • 

    #15013 8cf78c8 Thanks @​dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0
    

    • 

  • 

    #15015 a60ff4d Thanks @​nickpatt! - Cut the per-request cost of local observability capture
    

    Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.
    

    Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.
    

    The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.
    

    • 

  • 

    Updated dependencies [b4f0c97, 8cf78c8, a60ff4d, 99eb50c]:
    


    • 



wrangler@4.119.0


Minor Changes


    

  • 

    #14952 20470fa Thanks @​nelsonjsduarte! - Add --parse-type flag to wrangler ai-search create
    

    wrangler ai-search create now accepts --parse-type to control how a website data source discovers URLs. sitemap (the default) reads XML sitemaps; discover follows links recursively.
    

    Previously the parse type could only be chosen through the interactive wizard, which was skipped whenever --source was supplied — so it was impossible to create a discover instance from a script.
    

    wrangler ai-search create my-instance \
  --type web-crawler \
  --source https://example.com \
  --parse-type discover
    

    The interactive wizard now offers Discover alongside Sitemap. --parse-type is only valid with --type web-crawler; passing it with --type builtin or --type r2 is rejected, since the API stores the value for those source types but never reads it. When the flag is omitted in non-interactive mode the field is left unset and the API default (sitemap) applies.
    

    • 

  • 

    #14941 266172b Thanks @​nickpatt! - Improve the Local Explorer's Observability views
    

    console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).
    

    • 

  • 

    #14064 a9e5abb Thanks @​petebacondarwin! - Add support for OAuth 2.0 Device Authorization Grant to wrangler login
    

    • 






... (truncated)





Commits






Updates @types/node from 26.1.1 to 26.2.0



Commits






Updates esbuild from 0.28.1 to 0.28.2



Release notes

Sourced from esbuild's releases.




v0.28.2


    

  • 

    Fix tree shaking bug due to TypeScript import alias (#4507)
    

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
    

    import Base from './dep.js';
import Alias = Base.SomeType;
    

    • 

  • 

    Fix CSS minification bug involving & (#4497)
    

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
    

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
    

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.
    

    • 

  • 

    Avoid overwriting input files without --allow-overwrite (#4484)
    

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.
    

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.
    

    • 

  • 

    Fix incorrect code generated when using top-level await (#4498)
    

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
    

    • 

  • 

    Fix a minification bug with lowered logical assignment operators (#4508)
    

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
    

    // Original code
function foo() {
  let x
  bar(x ||= {})
    

    • 






... (truncated)





Changelog

Sourced from esbuild's changelog.




0.28.2


    

  • 

    Fix tree shaking bug due to TypeScript import alias (#4507)
    

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
    

    import Base from './dep.js';
import Alias = Base.SomeType;
    

    • 

  • 

    Fix CSS minification bug involving & (#4497)
    

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
    

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
    

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.
    

    • 

  • 

    Avoid overwriting input files without --allow-overwrite (#4484)
    

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.
    

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.
    

    • 

  • 

    Fix incorrect code generated when using top-level await (#4498)
    

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
    

    • 

  • 

    Fix a minification bug with lowered logical assignment operators (#4508)
    

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
    

    // Original code
function foo() {
  let x
    

    • 






... (truncated)





Commits


    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          chore(deps-dev): bump the development group across 1 directory with 1…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          43af53c
        
      

    

  

    

      
…1 updates

Bumps the development group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.5` | `2.5.7` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.4` | `6.0.5` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.1` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.18.8` | `0.20.3` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260724.1` | `5.20260809.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.114.0` | `4.120.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.2.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.11` |



Updates `@biomejs/biome` from 2.5.5 to 2.5.7
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.7/packages/@biomejs/biome)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.4
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.4 to 6.0.5
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react)

Updates `vite` from 8.1.5 to 8.2.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.1/packages/vite)

Updates `@cloudflare/vitest-pool-workers` from 0.18.8 to 0.20.3
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.20.3/packages/vitest-pool-workers)

Updates `@cloudflare/workers-types` from 5.20260724.1 to 5.20260809.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `wrangler` from 4.114.0 to 4.120.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.120.0/packages/wrangler)

Updates `@types/node` from 26.1.1 to 26.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `tsx` from 4.23.1 to 4.23.11
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.11)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: vite
  dependency-version: 8.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.20.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260809.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: wrangler
  dependency-version: 4.120.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@types/node"
  dependency-version: 26.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: tsx
  dependency-version: 4.23.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Aug 11, 2026

    

  



  

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

              requested a review
  from a team
    as a code owner


        August 11, 2026 18:56        
        
      

    





    

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency file

      

  javascript

  Pull requests that update javascript code

  labels


      Aug 11, 2026

    

  








      

  
      



  

  @clawsweeper






  



    

      

  

    

      
          
      

      
            clawsweeper
    Bot

      

      

      commented


        Aug 11, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          

🦞👀

ClawSweeper picked this up.


Pull request received. I will update this pull request when review starts.


      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
            

    

      
    

    


      


          @clawsweeper
clawsweeper
Bot



            added
      

  merge-risk: 🚨 compatibility

  🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades.

      

  merge-risk: 🚨 security-boundary

  🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data.

      

  P2

  Normal priority bug or improvement with limited blast radius.

      

  rating: 🦐 gold shrimp

  Decent PR readiness signal, but merge confidence is limited.

      

  status: ⏳ waiting on author

  ClawSweeper has contributor-facing work open and is waiting for author action.

  labels


      Aug 11, 2026

    

  








      

  
      



  

  @clawsweeper






  



    

      

  

    

      
          
      

      
            clawsweeper
    Bot

      

      

      commented


        Aug 11, 2026



      
  •

  

    
      

        
          edited
          
        
        
      

    
    
      
  
        
      Loading


  
    
  



    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

            
  
      
              Copy Markdown

  

        
      

    


    

        



        

    

  





      


        



  
    

      
          
Codex review: found issues before merge. Reviewed August 12, 2026, 4:12 PM ET / 20:12 UTC.


ClawSweeper review


What this changes


This PR updates eleven development dependencies across six workspace manifests and refreshes the shared pnpm lockfile.


Merge readiness


⛔ Blocked by patch quality or review findings - 8 items remain


Keep open: the unchanged P2 finding still blocks merge because this PR moves the install-executed esbuild binary to a version outside the repository’s explicit early-admission exception. Likely related people: Vincent Koc — introduced the current dependency-admission policy (high confidence).


Priority: P2

Reviewed head: 43af53cc0b2dac55c63f92edeb5f36d53e9f143b

Owner decision: Required. See Decision needed.


Review scores






Measure
Result
What it means






Overall readiness
🧂 unranked krab (1/6)
PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.




Proof confidence
🌊 off-meta tidepool
Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.




Patch quality
🧂 unranked krab (1/6)
Security review found an item that needs attention.






Verification






Check
Result
Evidence






Real behavior
Not applicable
Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.




Evidence reviewed
7 items
Release-age policy: Current main requires a 2,880-minute minimum release age for new dependencies.
Executable dependency exception: The policy permits esbuild to execute during installation but grants early admission only to esbuild@0.28.1, not 0.28.2.
Proposed esbuild update: The PR changes the CLI build dependency from esbuild 0.28.1 to 0.28.2.		




Findings
1 actionable finding
[P2] Keep esbuild inside the release-age admission policy




Security
Needs attention
Unadmitted install-time binary update: esbuild is allowed to execute during installation, but the proposed 0.28.2 version is not listed in the release-age exclusions that currently permit only 0.28.1.






How this fits together


Workspace manifests select development tooling for the admin UI, API worker, CLI, and React package, while pnpm resolves it into one shared lockfile. The package manager’s release-age policy controls which newly published packages can enter fresh installs and CI builds.



  

    

      
flowchart LR
  A[Workspace manifests] --> B[pnpm release-age policy]
  B --> C[Exception check]
  C --> D[Shared lockfile]
  D --> E[Install lifecycle]
  E --> F[Build test and deploy tools]


    

  

  
    
      Loading

  




Decision needed






Question
Recommendation






Should esbuild@0.28.2 wait for normal 2,880-minute admission, or receive a reviewed early-admission exception?
Wait for normal admission: Retain the existing esbuild version until the configured age window permits 0.28.2.






Why: The repository deliberately allows esbuild to execute during installation while restricting newly published versions, so accepting an exception is a maintainer-owned supply-chain decision.


Before merge


    

  •  Keep esbuild inside the release-age admission policy (P2) - The workspace requires a 2,880-minute release age and explicitly admits only esbuild@0.28.1 early, while allowing esbuild to run during installation. This unchanged line upgrades to 0.28.2 before that policy has admitted it; retain 0.28.1 until admission or obtain a reviewed narrow exception.
    • 

  •  Resolve security concern: Unadmitted install-time binary update - esbuild is allowed to execute during installation, but the proposed 0.28.2 version is not listed in the release-age exclusions that currently permit only 0.28.1.
    • 

  •  Resolve merge risk (P1) - Merging before normal admission would add an install-executed esbuild binary outside the repository’s stated 48-hour release-age policy.
    • 

  •  Resolve merge risk (P1) - Only CI results are supplied; there is no after-fix install/build evidence from a real setup.
    • 

  •  Complete next step (P2) - A maintainer must choose between normal timed admission and an explicit security-boundary exception; this is not a mechanical repair lane.
    • 

  •  Improve patch quality - Resolve the security review concern or explain why the changed path is safe.
    • 

  •  Improve patch quality - Address the highest-priority review finding and re-run the changed-surface validation.
    • 



Findings


    

  • [P2] Keep esbuild inside the release-age admission policy — packages/cli/package.json:31
    • 

  • [medium] Unadmitted install-time binary update — packages/cli/package.json:31
    • 




Agent review details

Security


Needs attention: The PR changes an install-executed binary to a version not covered by the repository’s early-admission exception.


Review metrics






Metric
Value
Why it matters






Dependency surface
11 direct development updates across 6 manifests and 1 lockfile; lockfile +692/-472
The shared lockfile changes transitive resolutions for all workspace development environments.






Merge-risk options


Maintainer options:


    

  1. Wait for age-gated admission (recommended)
    
Keep the existing esbuild resolution until version 0.28.2 is eligible under the configured release-age window.
    2. 

  2. Accept a reviewed exception
    
A maintainer may explicitly accept the install-time binary update after documenting why early admission is appropriate.
    3. 



Technical review


Best possible solution:


Keep esbuild at 0.28.1 until 0.28.2 passes normal admission, or record a narrowly reviewed exception before accepting the lockfile update.


Do we have a high-confidence way to reproduce the issue?


Not applicable: this is a dependency-maintenance PR, not a reported runtime defect. The merge blocker is directly verifiable from the current package policy and proposed version.


Is this the best way to solve the issue?


No: landing the new executable dependency before normal admission is not the narrowest safe path; wait for the gate or obtain an explicit exception.


Full review comments:


    

  • [P2] Keep esbuild inside the release-age admission policy — packages/cli/package.json:31
    
The workspace requires a 2,880-minute release age and explicitly admits only esbuild@0.28.1 early, while allowing esbuild to run during installation. This unchanged line upgrades to 0.28.2 before that policy has admitted it; retain 0.28.1 until admission or obtain a reviewed narrow exception.
    
Confidence: 0.98
    • 



Overall correctness: patch is incorrect

Overall confidence: 0.98


AGENTS.md: not found in the target repository.


Codex review notes: model internal, reasoning high; reviewed against 0cc3d3ef7f4a.


Labels


Label justifications:


    

  • P2: The dependency policy violation is a normal-priority merge blocker with developer and CI impact.
    • 

  • merge-risk: 🚨 compatibility: The update changes the CLI bundler and shared Vite-based tooling resolutions used by existing development workflows.
    • 

  • merge-risk: 🚨 security-boundary: esbuild is explicitly allowed to execute during installation, so bypassing its normal release-age admission affects the supply-chain boundary.
    • 

  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
    • 

  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
    • 



Evidence


Security concerns:


    

  • [medium] Unadmitted install-time binary update — packages/cli/package.json:31
    
esbuild is allowed to execute during installation, but the proposed 0.28.2 version is not listed in the release-age exclusions that currently permit only 0.28.1.
    
Confidence: 0.98
    • 



What I checked:


    

  • Release-age policy: Current main requires a 2,880-minute minimum release age for new dependencies. (pnpm-workspace.yaml:6, 0cc3d3ef7f4a)
    • 

  • Executable dependency exception: The policy permits esbuild to execute during installation but grants early admission only to esbuild@0.28.1, not 0.28.2. (pnpm-workspace.yaml:19, 0cc3d3ef7f4a)
    • 

  • Proposed esbuild update: The PR changes the CLI build dependency from esbuild 0.28.1 to 0.28.2. (packages/cli/package.json:31, 43af53cc0b2d)
    • 

  • Policy provenance: Git blame and the introducing release commit tie the current release-age rule, build allowlist, and exception list to the v0.5.0 release preparation. (pnpm-workspace.yaml:6, 0cc3d3ef7f4a)
    • 

  • Prior finding remains unchanged: The prior P2 finding targets the same head; the relevant manifest and lockfile have not changed since that review. (packages/cli/package.json:31, 43af53cc0b2d)
    • 

  • Supplemental CI validation: The supplied PR context records successful build, lint, test, typecheck, CodeQL, and JavaScript analysis runs, but those do not replace the required admission and real-behavior evidence. (43af53cc0b2d)
    • 



Likely related people:


    

  • Vincent Koc: The available current-main history shows Vincent Koc introduced the release-age gate, build allowlist, early-admission list, and current CLI manifest in the v0.5.0 release commit. (role: introduced dependency-admission policy and recent area contributor; confidence: high; commits: 0cc3d3ef7f4a; files: pnpm-workspace.yaml, packages/cli/package.json)
    • 



Rating scale






Score
Internal tier
Crab rank
Meaning






6/6
S
🦀 challenger crab
Exceptional readiness




5/6
A
🦞 diamond lobster
Very strong readiness




4/6
B
🐚 platinum hermit
Good normal PR; ordinary maintainer review




3/6
C
🦐 gold shrimp
Useful, but confidence is limited




2/6
D
🦪 silver shellfish
Proof or implementation needs work




1/6
F
🧂 unranked krab
Not merge-ready




N/A
NA
🌊 off-meta tidepool
Rating does not apply






Overall follows the weaker of proof and patch quality.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.


Workflow


    

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
    • 

  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
    • 

  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
    • 

  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
    • 

  • Maintainers can also comment @clawsweeper review to request a fresh review only.
    • 

  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
    • 

  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
    • 

  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
    • 



History



Review history (3 earlier review cycles)


    

  • reviewed 2026-08-11T19:02:01.932Z sha 43af53c :: found issues before merge. :: [P2] Preserve the dependency release-age gate
    • 

  • reviewed 2026-08-12T18:37:40.070Z sha 43af53c :: found issues before merge. :: [P2] Preserve the dependency release-age gate
    • 

  • reviewed 2026-08-12T18:42:54.327Z sha 43af53c :: found issues before merge. :: [P2] Preserve the dependency release-age gate
    • 











      		
    

  





        

            

            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
            

    

      
    

    


      


          @clawsweeper
clawsweeper
Bot



            added
      

  rating: 🧂 unranked krab

  Not merge-ready due to missing proof or serious correctness/safety concerns.

    and removed
      

  rating: 🦐 gold shrimp

  Decent PR readiness signal, but merge confidence is limited.

  labels


      Aug 12, 2026

    

  












  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews







    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file
  

    javascript

  Pull requests that update javascript code
  

    merge-risk: 🚨 compatibility

  🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades.
  

    merge-risk: 🚨 security-boundary

  🚨 Merging this PR could weaken sandboxing, authorization, credentials, or sensitive data.
  

    P2

  Normal priority bug or improvement with limited blast radius.
  

    rating: 🧂 unranked krab

  Not merge-ready due to missing proof or serious correctness/safety concerns.
  

    status: ⏳ waiting on author

  ClawSweeper has contributor-facing work open and is waiting for author action.








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants