Skip to content

build(deps): bump the dependencies group across 1 directory with 24 updates - #88

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dependencies-1076f3ae26
Open

build(deps): bump the dependencies group across 1 directory with 24 updates#88
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dependencies-1076f3ae26

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 15, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 23 updates in the / directory:

Package From To
@types/bun 1.3.14 1.4.2
eslint 10.7.0 10.10.0
turbo 2.10.5 2.10.12
typescript 6.0.3 7.0.2
@cloudflare/nimbus-docs 0.6.1 0.13.1
astro 7.1.3 7.3.1
astro-icon 1.1.5 1.2.0
astro-og-canvas 0.13.0 0.13.1
canvaskit-wasm 0.41.1 0.42.0
sanitize-html 2.17.6 2.17.7
@astrojs/check 0.9.9 0.9.10
wrangler 4.112.0 4.129.1
@astrojs/cloudflare 14.1.4 14.3.0
@astrojs/react 6.0.1 6.0.5
@base-ui/react 1.6.0 1.8.0
lucide-react 1.25.0 1.43.0
react 19.2.7 19.2.8
@types/react 19.2.17 19.2.18
react-dom 19.2.7 19.2.8
@types/react-dom 19.2.3 19.2.7
recharts 3.10.0 3.10.1
@types/react 19.2.17 19.2.18
@types/react-dom 19.2.3 19.2.7
@cloudflare/workers-types 5.20260721.1 5.20260908.1
@types/node 26.1.1 26.5.0

Updates @types/bun from 1.3.14 to 1.4.2

Commits

Updates eslint from 10.7.0 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

  • 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
  • c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
  • 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

  • bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
  • 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
  • 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
  • 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
  • 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
  • 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

  • 2417cad docs: Update README (GitHub Actions Bot)
  • 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
  • 8724829 docs: update compat table links (#21263) (fnx)
  • 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

  • b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
  • 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
  • 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
  • 3c753f1 chore: update eslint (#21289) (renovate[bot])
  • 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
  • 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
  • 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
  • 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
  • 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

v10.9.0

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

... (truncated)

Commits

Updates turbo from 2.10.5 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

... (truncated)

Commits

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @cloudflare/nimbus-docs from 0.6.1 to 0.13.1

Release notes

Sourced from @​cloudflare/nimbus-docs's releases.

@​cloudflare/nimbus-docs@​0.12.0

Minor Changes

  • #93 43c161a Thanks @​MohamedH1998! - Add first-party OpenAPI reference support to Nimbus.

    • Configure local or inline OpenAPI specs as routed, version-aware collections with operations, schemas, tags, webhooks, generated samples, and every declared request-body media type.
    • Install an editable api-layout UI that shares Nimbus's docs shell, navigation, breadcrumbs, banners, mobile behavior, and deep-linkable field and code-sample controls. The copied ApiFieldList field iterator is explicitly typed so the scaffolded UI type-checks cleanly under a consumer's strict TypeScript.
    • Publish per-page Markdown, agent indexes, corpus entries, coordinate manifests, and api.ref: citations across local and cross-site documentation.
    • Harden generated-consumer delivery with exact registry dependencies, working pnpm installs from scaffold roots, and base-aware canonical, Markdown, sitemap, and agent URLs through the new public withBase helper.
    • Control how operation pages are addressed, and stay resilient to messy specs. By default, operations that lack a usable operationId no longer abort the build — they warn and fall back to a path-derived coordinate, so real-world specs (e.g. Cloudflare's brand-protection operations) build; set api[].requireOperationId: true on specs you own to keep that fatal, while route-hostile paths and coordinate collisions stay fatal regardless. For readable, path-derived URLs, opt into the resource-action-v1 route convention: set api[].routes: { convention: "resource-action-v1" } (per version in a family) to derive slugs like charges/list from an operation's method and path, decoupled from operationId so route-hostile identifiers no longer poison URLs. Trim shared bases with stripPathPrefixes (e.g. ["/v1"]), pin individual pages with an operations (operationId → slug) map, and inspect how each slug resolved (override / derived / fallback) via the new getApiRouteProvenance export. Derivation collisions, reserved-route segments, unused overrides, cross-version slug drift, and unknown config keys (e.g. a stripPrefixes typo for stripPathPrefixes) are reported with pointed messages; the default (no routes) keeps the legacy operationId slugs unchanged.

  • #104 79d6430 Thanks @​MohamedH1998! - Add server-output support and the @cloudflare/nimbus-docs/adapters export.

    Nimbus can now target on-request (server) output in addition to static. A new @cloudflare/nimbus-docs/adapters public export ships the adapter recipes plus the shared astro.config and wrangler.jsonc emitters, and two new CLI verbs opt an existing site in: nimbus-docs add server-output --adapter <vercel|node|netlify|cloudflare> (alias nimbus-docs add adapter-<id>). The installer rewrites astro.config at the // nimbus:adapter marker and, for Cloudflare, creates a server wrangler.jsonc or replaces an exact Nimbus static config. Cloudflare installs add request rendering when the active Nimbus config has no explicit rendering policy; explicit or ambiguous policies are preserved and receive an agent-ready handoff. Adapter dependencies are saved at their exact resolved versions so subsequent runs accept the installed declaration. Custom and alternate Wrangler configs are preserved with manual adaptation instructions.

    Withdraw the gated config option because it did not hold as a confidentiality boundary. Existing gated config now fails with a migration error; to keep a page out of the build, move the page out of a routed content collection.

    Fix env preflight precedence and parsing to match Vite, including empty shell overrides, last-wins .env* files, and inline dotenv comments. Adapter dependency validation now resolves pnpm catalog declarations, and compatibility warnings reflect the versions installed by the command.

    Fix NimbusHead URLs for sub-path deployments by applying Astro's configured base to sitemap, LLM index, social image, JSON-LD, canonical, and version-alternate URLs. Root deployments and already-based paths are unchanged.

    Keep registry component render counters compatible with adapter-defined Astro.locals types, including Cloudflare server output.

  • #104 862df4a Thanks @​MohamedH1998! - Add Cloudflare request rendering for canonical content collections.

    Nimbus now supports collection-level build and request rendering policies with validated defaults and per-collection overrides. Request-rendered prose and API routes use response-aware page helpers, prepared API models, request-safe partial headings, 404 responses, and build-derived syntax-highlighting assets without shipping source OpenAPI specs to Workers. Cloudflare server scaffolds enable request rendering by default, and generated pnpm configuration installs Satteri's WASI fallback alongside the current architecture.

    Preserve sitemap, Pagefind, Markdown, and agent-index discovery for request-rendered routes. Pin the tested sitemap integration, clean up synthetic Pagefind staging files transactionally, and generate cross-collection Open Graph images in new starters.

Patch Changes

  • #99 2965d9f Thanks @​MohamedH1998! - - Honor noindex: true on machine discovery surfaces. noindex pages now drop out of /llms.txt, per-section llms.txt, and the /llms-full.txt corpus (matching on-site search, which already excluded them) while staying directly addressable and navigable. A single exported isDiscoverable predicate defines the contract for custom index/corpus routes.
    • Pin @vercel/detect-agent to 1.2.3, the last release published with npm provenance. Versions 1.2.4/1.2.5 dropped provenance, tripping pnpm's ERR_PNPM_TRUST_DOWNGRADE and blocking lockfile updates. Pinning holds at the attested artifact until upstream restores provenance.
    • Fix navigation for pages under CJK (percent-encoded) paths. Route matching now decodes percent-encoded request paths (toRouteKey), so active sidebar state, breadcrumbs, and prev/next resolve correctly instead of falling back to a URL-encoded trail; the breadcrumb URL fallback also decodes segment labels.

@​cloudflare/nimbus-docs@​0.10.0

Minor Changes

  • #71 e5d74f9 Thanks @​MohamedH1998! - Enable MDX optimization by default to reduce large-site build memory usage. Sites can opt out with mdx: { optimize: false }.

    Verified the generated starter with optimization on and with mdx: { optimize: false } forced; the rendered HTML is structurally equivalent for element names, attributes, and non-whitespace text. AC#3 is treated as semantic/structural render parity rather than byte identity: raw bytes differ due to serializer escaping and inter-block whitespace, but the rendered document is lossless.

    Spot-checked the starter components page, which includes JSX tags in prose, inline code with <...>, quoted code, and package names. The optimized and opt-out renders preserve those special-character text probes and match structurally.

    Constrain the supported Astro peer range to >=7.0.0 <7.1.0 || >=7.2.0 <8.0.0: the 7.1.x line is excluded while its static-build regression is open upstream, but 7.2.x is admitted (verified against a sub-path build). Generated templates and the dev pin stay on the verified 7.0.x line.

  • #76 acfac20 Thanks @​mvvmm! - Replace astro-icon with a built-in icon system. This is a breaking change for any project using astro-icon directly.

    Why: astro-icon stamped a generated lastModified timestamp into its virtual module on every build, invalidating thousands of cached pages in Astro's incremental build cache. The package is unmaintained so an upstream fix isn't coming.

... (truncated)

Changelog

Sourced from @​cloudflare/nimbus-docs's changelog.

0.13.1

Patch Changes

  • #110 e6fb2b1 Thanks @​sansynx! - Reject registry install paths that resolve outside src through symbolic links.

  • #109 f4d0d78 Thanks @​sansynx! - Preserve casing in static page routes during duplicate-route checks.

  • #119 bd179bb Thanks @​MohamedH1998! - Index API response coordinates for direct citations, and keep scaffold progress readable in non-interactive terminals. Emit canonical trailing slashes for API navigation links.

0.13.0

Minor Changes

  • #114 3c0d794 Thanks @​MohamedH1998! - Generate deterministic Markdown versions for every public page, prepared MDX source versions for authored pages, llms.txt indexes, llms-full.txt, and merged partial headings at build time. Request-rendered pages now consume compact prepared heading data, and custom component transforms and partial resolvers are configured through markdown.componentMap and markdown.partialResolver. Worker bundles no longer include partial-expansion parsers. Calls to renderEntryAsMarkdown or getEntryMarkdown that still pass <Render> partials now fail instead of attempting runtime expansion; migrate custom Markdown routes to the prepared helpers exported by @cloudflare/nimbus-docs/build.

    Rename prepared publication APIs without compatibility aliases: TwinSurface becomes PreparedMarkdownSurface, PreparedTwin* becomes PreparedMarkdown*, PreparedCorpus* becomes PreparedLlms*, getPreparedTwin* becomes getPreparedMarkdown*, getPreparedCorpus* becomes getPreparedLlms*, and renderCorpusMarkdown becomes renderLlmsFullMarkdown. Move integration customization from twins.componentMap and twins.partialResolver to markdown.componentMap and markdown.partialResolver.

    Keep framework assets, metadata, starter navigation, and generated API links inside Astro's configured deployment base path. Replace the removed withBaseRoute runtime export with withBase; site-relative inputs to withBase must be logical, unbased paths.

    Keep generated .nimbus build data out of source control, deduplicate sitemap roots on subpath deployments, and advertise prepared MDX source responses as text/mdx consistently across static and request rendering.

0.12.0

Minor Changes

  • #93 43c161a Thanks @​MohamedH1998! - Add first-party OpenAPI reference support to Nimbus.

    • Configure local or inline OpenAPI specs as routed, version-aware collections with operations, schemas, tags, webhooks, generated samples, and every declared request-body media type.
    • Install an editable api-layout UI that shares Nimbus's docs shell, navigation, breadcrumbs, banners, mobile behavior, and deep-linkable field and code-sample controls. The copied ApiFieldList field iterator is explicitly typed so the scaffolded UI type-checks cleanly under a consumer's strict TypeScript.
    • Publish per-page Markdown, agent indexes, corpus entries, coordinate manifests, and api.ref: citations across local and cross-site documentation.
    • Harden generated-consumer delivery with exact registry dependencies, working pnpm installs from scaffold roots, and base-aware canonical, Markdown, sitemap, and agent URLs through the new public withBase helper.
    • Control how operation pages are addressed, and stay resilient to messy specs. By default, operations that lack a usable operationId no longer abort the build — they warn and fall back to a path-derived coordinate, so real-world specs (e.g. Cloudflare's brand-protection operations) build; set api[].requireOperationId: true on specs you own to keep that fatal, while route-hostile paths and coordinate collisions stay fatal regardless. For readable, path-derived URLs, opt into the resource-action-v1 route convention: set api[].routes: { convention: "resource-action-v1" } (per version in a family) to derive slugs like charges/list from an operation's method and path, decoupled from operationId so route-hostile identifiers no longer poison URLs. Trim shared bases with stripPathPrefixes (e.g. ["/v1"]), pin individual pages with an operations (operationId → slug) map, and inspect how each slug resolved (override / derived / fallback) via the new getApiRouteProvenance export. Derivation collisions, reserved-route segments, unused overrides, cross-version slug drift, and unknown config keys (e.g. a stripPrefixes typo for stripPathPrefixes) are reported with pointed messages; the default (no routes) keeps the legacy operationId slugs unchanged.

  • #104 79d6430 Thanks @​MohamedH1998! - Add server-output support and the @cloudflare/nimbus-docs/adapters export.

    Nimbus can now target on-request (server) output in addition to static. A new @cloudflare/nimbus-docs/adapters public export ships the adapter recipes plus the shared astro.config and wrangler.jsonc emitters, and two new CLI verbs opt an existing site in: nimbus-docs add server-output --adapter <vercel|node|netlify|cloudflare> (alias nimbus-docs add adapter-<id>). The installer rewrites astro.config at the // nimbus:adapter marker and, for Cloudflare, creates a server wrangler.jsonc or replaces an exact Nimbus static config. Cloudflare installs add request rendering when the active Nimbus config has no explicit rendering policy; explicit or ambiguous policies are preserved and receive an agent-ready handoff. Adapter dependencies are saved at their exact resolved versions so subsequent runs accept the installed declaration. Custom and alternate Wrangler configs are preserved with manual adaptation instructions.

    Withdraw the gated config option because it did not hold as a confidentiality boundary. Existing gated config now fails with a migration error; to keep a page out of the build, move the page out of a routed content collection.

    Fix env preflight precedence and parsing to match Vite, including empty shell overrides, last-wins .env* files, and inline dotenv comments. Adapter dependency validation now resolves pnpm catalog declarations, and compatibility warnings reflect the versions installed by the command.

    Fix NimbusHead URLs for sub-path deployments by applying Astro's configured base to sitemap, LLM index, social image, JSON-LD, canonical, and version-alternate URLs. Root deployments and already-based paths are unchanged.

    Keep registry component render counters compatible with adapter-defined Astro.locals types, including Cloudflare server output.

  • #104 862df4a Thanks @​MohamedH1998! - Add Cloudflare request rendering for canonical content collections.

    Nimbus now supports collection-level build and request rendering policies with validated defaults and per-collection overrides. Request-rendered prose and API routes use response-aware page helpers, prepared API models, request-safe partial headings, 404 responses, and build-derived syntax-highlighting assets without shipping source OpenAPI specs to Workers. Cloudflare server scaffolds enable request rendering by default, and generated pnpm configuration installs Satteri's WASI fallback alongside the current architecture.

... (truncated)

Commits

Updates astro from 7.1.3 to 7.3.1

Release notes

Sourced from astro's releases.

astro@7.3.1

Patch Changes

astro@7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible

... (truncated)

Changelog

Sourced from astro's changelog.

7.3.1

Patch Changes

7.3.0

Minor Changes

  • #17767 ce7c91f Thanks @​astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds a logger parameter to image services hooks

    Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { LocalImageService } from 'astro';
const service: LocalImageService = {
// ...
async transform(inputBuffer, transform, imageConfig, logger) {
logger.warn(Could not optimize &quot;${transform.src}&quot;. Passing it through unchanged.);
return { data: inputBuffer, format: 'png' };
},
};

    Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.

  • #17818 c0b6581 Thanks @​florian-lefebvre! - Adds logger to the context object passed to cache providers

    Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:

    import type { CacheProvider } from 'astro';
const provider: CacheProvider = {
name: 'my-cache',
async onRequest({ request, url, logger }, next) {
logger.warn(Skipping cache for ${url.pathname} because the response sets a cookie.);
return next();
},
// ...
};

    Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

... (truncated)

Commits

Updates astro-icon from 1.1.5 to 1.2.0

Release notes

Sourced from astro-icon's releases.

astro-icon@1.2.0

Minor Changes

  • #290 956817e Thanks @​stramel! - Bump @iconify/tools to v5 and @iconify/utils to v3, removing the transitive extract-zip dependency that was flagged for a symlink path-traversal vulnerability (GHSA-jmr9-qjv8-65gv).

    Requires Node ≥22.12 — @iconify/utils v3 uses node:util's styleText, which needs Node ≥20.12/21.7, but the toolchain now also builds against Astro 7 (which itself requires Node ≥22.12). Node 20 reached end-of-life in April 2026, so astro-icon's engines field is raised to the currently-supported floor rather than the bare minimum.

  • #285 2e83ca0 Thanks @​stramel! - title/desc props now accept { id, value } in addition to a plain string, so consumers can set id attributes on the generated <title>/<desc> elements for aria-labelledby referencing.

Patch Changes

  • #291 3db45a5 Thanks @​stramel! - Strip the lastModified timestamp from the generated local icon collection so its output is deterministic across builds, allowing Astro's incremental build cache to work as expected.

  • #288 adb18cf Thanks @​stramel! - Log a warning instead of silently swallowing errors when the local icon collection fails to load, so failures during dev/build are visible instead of hidden.

  • #287 fd5d522 Thanks @​stramel! - Fix icon dir watcher so newly added local icons (including files inside subfolders) are picked up without restarting the dev server

  • #282 8904693 Thanks @​stramel! - Update @iconify/tools and @iconify/utils to resolve axios and undici vulnerabilities pulled in transitively.

  • #286 6af6fcf Thanks @​stramel! - Fix viewBox being inconsistently present on <svg> elements across repeated...

    Description has been truncated

    Summary by cubic

    Bumps 24 dependencies across the workspace. Most are routine patch and minor updates, but typescript, @cloudflare/nimbus-docs, and astro-icon include breaking changes.

    Migration

    • typescript moves from 6 to 7, the new native compiler.
    • @cloudflare/nimbus-docs moves from 0.6.1 to 0.13.1: withBaseRoute is replaced by withBase, prepared Markdown/LLM exports are renamed, the gated config is removed, and MDX optimization is enabled by default.
    • astro-icon now requires Node ≥22.12 and drops the vulnerable transitive extract-zip dependency.

    Written for commit 6543f9d. Summary will update on new commits.

@dependabot
build(deps): bump the dependencies group across 1 directory with 24 u…
6543f9d 
…pdates

Bumps the dependencies group with 23 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.3.14` | `1.4.2` |
| [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.10.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.5` | `2.10.12` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@cloudflare/nimbus-docs](https://github.com/cloudflare/nimbus/tree/HEAD/packages/nimbus-docs) | `0.6.1` | `0.13.1` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.3.1` |
| [astro-icon](https://github.com/natemoo-re/astro-icon/tree/HEAD/packages/core) | `1.1.5` | `1.2.0` |
| [astro-og-canvas](https://github.com/delucis/astro-og-canvas/tree/HEAD/packages/astro-og-canvas) | `0.13.0` | `0.13.1` |
| [canvaskit-wasm](https://github.com/google/skia) | `0.41.1` | `0.42.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.6` | `2.17.7` |
| [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.112.0` | `4.129.1` |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.4` | `14.3.0` |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.1` | `6.0.5` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.8.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.43.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.7` |
| [recharts](https://github.com/recharts/recharts) | `3.10.0` | `3.10.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.7` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260721.1` | `5.20260908.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.5.0` |



Updates `@types/bun` from 1.3.14 to 1.4.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `eslint` from 10.7.0 to 10.10.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.7.0...v10.10.0)

Updates `turbo` from 2.10.5 to 2.10.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.5...v2.10.12)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

Updates `@cloudflare/nimbus-docs` from 0.6.1 to 0.13.1
- [Release notes](https://github.com/cloudflare/nimbus/releases)
- [Changelog](https://github.com/cloudflare/nimbus/blob/main/packages/nimbus-docs/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/nimbus/commits/HEAD/packages/nimbus-docs)

Updates `astro` from 7.1.3 to 7.3.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.3.1/packages/astro)

Updates `astro-icon` from 1.1.5 to 1.2.0
- [Release notes](https://github.com/natemoo-re/astro-icon/releases)
- [Changelog](https://github.com/natemoo-re/astro-icon/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/natemoo-re/astro-icon/commits/astro-icon@1.2.0/packages/core)

Updates `astro-og-canvas` from 0.13.0 to 0.13.1
- [Release notes](https://github.com/delucis/astro-og-canvas/releases)
- [Changelog](https://github.com/delucis/astro-og-canvas/blob/latest/packages/astro-og-canvas/CHANGELOG.md)
- [Commits](https://github.com/delucis/astro-og-canvas/commits/astro-og-canvas@0.13.1/packages/astro-og-canvas)

Updates `canvaskit-wasm` from 0.41.1 to 0.42.0
- [Changelog](https://github.com/google/skia/blob/main/RELEASE_NOTES.md)
- [Commits](https://github.com/google/skia/commits/canvaskit/0.42.0)

Updates `sanitize-html` from 2.17.6 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.17.7/packages/sanitize-html)

Updates `@astrojs/check` from 0.9.9 to 0.9.10
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.10/packages/language-tools/astro-check)

Updates `wrangler` from 4.112.0 to 4.129.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.129.1/packages/wrangler)

Updates `@astrojs/cloudflare` from 14.1.4 to 14.3.0
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.3.0/packages/integrations/cloudflare)

Updates `@astrojs/react` from 6.0.1 to 6.0.5
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.5/packages/integrations/react)

Updates `@base-ui/react` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.8.0/packages/react)

Updates `lucide-react` from 1.25.0 to 1.43.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.43.0/packages/lucide-react)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@types/react-dom` from 19.2.3 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `recharts` from 3.10.0 to 3.10.1
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v3.10.0...v3.10.1)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@cloudflare/workers-types` from 5.20260721.1 to 5.20260908.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@types/node` from 26.1.1 to 26.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `zod` from 4.4.3 to 4.6.5
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.5)

---
updated-dependencies:
- dependency-name: "@types/bun"
  dependency-version: 1.4.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: turbo
  dependency-version: 2.10.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@cloudflare/nimbus-docs"
  dependency-version: 0.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: astro
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: astro-icon
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: astro-og-canvas
  dependency-version: 0.13.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: canvaskit-wasm
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: wrangler
  dependency-version: 4.129.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@astrojs/react"
  dependency-version: 6.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: lucide-react
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: recharts
  dependency-version: 3.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260908.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 26.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: zod
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 15, 2026
@greptile-apps

greptile-apps Bot commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@socket-security

socket-security Bot commented Sep 15, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​types/​bun@​1.3.14 ⏵ 1.4.21001004893100
Updated@​base-ui/​react@​1.6.0 ⏵ 1.8.07210089 +194 +2100
Updated@​types/​react-dom@​19.2.3 ⏵ 19.2.7100 +110075 +193100
Updated@​types/​react@​19.2.17 ⏵ 19.2.18100 +110079 +194100
Updated@​astrojs/​check@​0.9.9 ⏵ 0.9.101001008088100
Updatedlucide-react@​1.25.0 ⏵ 1.43.010010098 +196 +180
Added@​types/​node@​26.5.01001008196100
Updatedastro-icon@​1.1.5 ⏵ 1.2.010010010082 +2100
Updated@​astrojs/​react@​6.0.1 ⏵ 6.0.5991008296 +1100
Updatedreact@​19.2.7 ⏵ 19.2.81001008497100
Updated@​astrojs/​cloudflare@​14.1.4 ⏵ 14.3.0100 +110084 +198 +1100
Updatedturbo@​2.10.5 ⏵ 2.10.12100 +110085 +197100
Updatedastro@​7.1.3 ⏵ 7.3.198 +1100 +7588 +198 +1100
Updatedtypescript@​6.0.3 ⏵ 7.0.29910089 -1100100 +10
Updatedastro-og-canvas@​0.13.0 ⏵ 0.13.1100 +71009990 -1100
Updatedsanitize-html@​2.17.6 ⏵ 2.17.7100 +1100 +210091 -1100
Updatedwrangler@​4.108.0 ⏵ 4.129.1981009296100
Updatedwrangler@​4.108.0 ⏵ 4.131.2981009296 +1100
Updated@​cloudflare/​nimbus-docs@​0.6.1 ⏵ 0.13.194 +1810092 +597 +5100
Updatedreact-dom@​19.2.7 ⏵ 19.2.81001009298100
Updatedcanvaskit-wasm@​0.41.1 ⏵ 0.42.0100 +110099 +192 +2100
Updatedeslint@​10.7.0 ⏵ 10.10.097 +110010096100
Updated@​cloudflare/​workers-types@​5.20260721.1 ⏵ 5.20260908.1100 +2610096 +199100
Addedzod@​4.6.510010010096100
Updatedrecharts@​3.10.0 ⏵ 3.10.198 +19100100 +197 +1100

View full report

@codecov

codecov Bot commented Sep 15, 2026

Copy link
Copy Markdown

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Sep 15, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6543f9dda9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread apps/docs/package.json
},
"dependencies": {
"@cloudflare/nimbus-docs": "^0.6.1",
"@cloudflare/nimbus-docs": "^0.13.1",

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Migrate the removed Nimbus corpus helper before upgrading

This upgrade crosses Nimbus 0.13, which removed renderCorpusMarkdown without a compatibility alias, but apps/docs/src/pages/llms-full.txt.ts:4 still imports that symbol from this package. Consequently, every docs build—including the root CI build and the docs deployment workflow—fails while loading that route; migrate it to the replacement prepared/renderLlmsFullMarkdown API as part of the version bump.

Useful? React with 👍 / 👎.

Comment thread package.json
"@types/bun": "^1.4.2",
"eslint": "^10.10.0",
"turbo": "^2.10.12",
"typescript": "^7.0"

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep TypeScript within the toolchain's supported ranges

With this bump, Bun resolves TypeScript 7 for the workspace, but the committed lockfile shows @astrojs/check@0.9.10 accepts only TypeScript 5 or 6 and the installed @typescript-eslint parser/plugin accept versions below 6.1. The repository's CI runs both astro check and ESLint, so this leaves the quality gate using an explicitly unsupported compiler/API major; retain TypeScript 6 until compatible Astro and typescript-eslint releases are selected.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants