Skip to content

build(deps): bump the dependencies group across 1 directory with 22 updates - #85

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dependencies-1d31ef9afc
Open

build(deps): bump the dependencies group across 1 directory with 22 updates#85
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dependencies-1d31ef9afc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 22 updates in the / directory:

Package From To
@types/bun 1.3.14 1.4.0
eslint 10.7.0 10.9.1
turbo 2.10.5 2.10.11
typescript 6.0.3 7.0.2
@cloudflare/nimbus-docs 0.6.1 0.11.0
astro 7.1.3 7.2.6
astro-icon 1.1.5 1.2.0
canvaskit-wasm 0.41.1 0.42.0
sanitize-html 2.17.6 2.17.7
@astrojs/check 0.9.9 0.9.10
wrangler 4.112.0 4.125.0
@astrojs/cloudflare 14.1.4 14.2.4
@astrojs/react 6.0.1 6.0.4
@base-ui/react 1.6.0 1.7.0
lucide-react 1.25.0 1.34.0
react 19.2.7 19.2.8
@types/react 19.2.17 19.2.18
react-dom 19.2.7 19.2.8
@types/react-dom 19.2.3 19.2.5
recharts 3.10.0 3.10.1
@types/react 19.2.17 19.2.18
@types/react-dom 19.2.3 19.2.5
@cloudflare/workers-types 5.20260721.1 5.20260825.1
@types/node 26.1.1 26.3.0

Updates @types/bun from 1.3.14 to 1.4.0

Commits

Updates eslint from 10.7.0 to 10.9.1

Release notes

Sourced from eslint's releases.

v10.9.1

Bug Fixes

  • 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

  • ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

v10.9.0

Features

  • 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
  • 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

  • 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
  • 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
  • 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

  • 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
  • 87f66f4 docs: Update README (GitHub Actions Bot)
  • 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
  • f3993b0 docs: Update README (GitHub Actions Bot)
  • ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
  • 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
  • 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
  • 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

  • 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
  • 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
  • dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
  • f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
  • 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])

v10.8.1

Bug Fixes

  • 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
  • 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
  • 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
  • 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
  • 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

  • 7d0cbf8 docs: Update README (GitHub Actions Bot)
  • 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
  • 678c90b docs: Update README (GitHub Actions Bot)
  • 8a10424 docs: Update README (GitHub Actions Bot)

... (truncated)

Commits

Updates turbo from 2.10.5 to 2.10.11

Release notes

Sourced from turbo's releases.

Turborepo v2.10.11

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.10...v2.10.11

Turborepo v2.10.11-canary.4

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.11-canary.3...v2.10.11-canary.4

Turborepo v2.10.11-canary.3

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.11-canary.2...v2.10.11-canary.3

Turborepo v2.10.11-canary.2

... (truncated)

Commits

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @cloudflare/nimbus-docs from 0.6.1 to 0.11.0

Release notes

Sourced from @​cloudflare/nimbus-docs's releases.

@​cloudflare/nimbus-docs@​0.10.0

Minor Changes

  • #71 e5d74f9 Thanks @​MohamedH1998! - Enable MDX optimization by default to reduce large-site build memory usage. Sites can opt out with mdx: { optimize: false }.

    Verified the generated starter with optimization on and with mdx: { optimize: false } forced; the rendered HTML is structurally equivalent for element names, attributes, and non-whitespace text. AC#3 is treated as semantic/structural render parity rather than byte identity: raw bytes differ due to serializer escaping and inter-block whitespace, but the rendered document is lossless.

    Spot-checked the starter components page, which includes JSX tags in prose, inline code with <...>, quoted code, and package names. The optimized and opt-out renders preserve those special-character text probes and match structurally.

    Constrain the supported Astro peer range to >=7.0.0 <7.1.0 || >=7.2.0 <8.0.0: the 7.1.x line is excluded while its static-build regression is open upstream, but 7.2.x is admitted (verified against a sub-path build). Generated templates and the dev pin stay on the verified 7.0.x line.

  • #76 acfac20 Thanks @​mvvmm! - Replace astro-icon with a built-in icon system. This is a breaking change for any project using astro-icon directly.

    Why: astro-icon stamped a generated lastModified timestamp into its virtual module on every build, invalidating thousands of cached pages in Astro's incremental build cache. The package is unmaintained so an upstream fix isn't coming.

    What's new: Nimbus now provides virtual:nimbus/icons (a Vite plugin) and @cloudflare/nimbus-docs/components/Icon.astro. The plugin auto-detects installed @iconify-json/* packages and loads local SVGs from src/icons/. The component API is compatible with astro-icon (name, size, width, height, is:inline, title, desc, and all <svg> attributes). SVG bodies are passed through replaceIDs so internal IDs (clipPath, mask, gradient defs) are unique per render — preventing collisions when the same icon appears more than once on a page.

    Breaking changes:

    • Remove astro-icon from your package.json and astro.config.ts
    • Replace import { Icon } from "astro-icon/components" with import Icon from "@cloudflare/nimbus-docs/components/Icon.astro"
    • SVG output structure changed: SVGs are always inlined; the previous <symbol>/<use> pattern produced duplicate DOM IDs when the same icon was used more than once on a page, so it has been removed. Any CSS or JS targeting symbol or use elements will need updating.

    Migration:

    - import { Icon } from "astro-icon/components";
+ import Icon from "@cloudflare/nimbus-docs/components/Icon.astro";

    Starter templates updated: removed astro-icon dependency and icon() integration from astro.config.ts; all component imports updated to the new path.

Patch Changes

  • #77 1c49268 Thanks @​MohamedH1998! - Fix NimbusHead emitting base-less SEO URLs on sub-path deployments (e.g. base: '/docs').

    new URL(path, Astro.site) resolves against the origin only and drops the configured base, so the rel=sitemap link, the LLM-index rel=alternate, og:image/twitter:image, the JSON-LD isPartOf.url, the versioned canonical, and the cross-version rel=alternate all pointed at the origin root and 404'd under a sub-path. Every internal path handed to new URL(..., Astro.site) is now base-prefixed via a withBase helper, matching the existing BASE_URL handling for the favicon and Shiki stylesheet.

    Root deployments (base: '/') are unaffected: the helper is a no-op when no base is configured, and already-based paths pass through unchanged (idempotent).

  • #80 ec71a7b Thanks @​MohamedH1998! - Fix syntax-highlighted code rendering uncoloured in dev on sites with a non-root base (e.g. base: "/docs"). The dev middleware that serves _nimbus/shiki.css compared the request path exactly against the based asset path, but Vite strips base from req.url at a non-root base, so the request 404'd and tokens fell back to their inherited colour. It now matches by suffix, serving the stylesheet regardless of how Vite presents base. Production was unaffected — the stylesheet is written statically at build time.

@​cloudflare/nimbus-docs@​0.9.0

Minor Changes

  • #64 e1e4e8d Thanks @​MohamedH1998! - Add nimbus-docs check — a build-free preflight that reports readiness honestly

    One command a human, CI, or agent runs to catch setup, structural, authoring, and type problems before a build. It runs four categories — environment (Node floor, config locatable, site not a placeholder, pagefind, wrangler), structure (config Zod, duplicate routes, MDX component resolution — the same validators the build gates on), authoring (the shipped lint rules), and types (a build-free type-check) — and normalizes every result into one envelope.

    The types category type-checks your TypeScript with your project's own tsc, build-free — no astro build, no astro sync, nothing spawned (your TypeScript is resolved from your project, never bundled into the CLI). Astro transpiles rather than type-checks, so a type error never fails the build on its own; catching it in the preflight is the point. Because tsc can't parse .astro SFCs, their internals and prop types are out of scope (that needs astro check); an injected ambient declare module "*.astro" keeps .ts files that import .astro components from being false-flagged.

... (truncated)

Changelog

Sourced from @​cloudflare/nimbus-docs's changelog.

0.11.0

Minor Changes

  • #86 b4b0dc3 Thanks @​MohamedH1998! - makeDisclosure now marks closed content inert so collapsed regions leave the tab order, keeping keyboard focus out of hidden disclosure panels. Add a manageInert option (default true) to opt out for consumers that manage their own focus.

  • #90 74702e0 Thanks @​mvvmm! - getDocsStaticPaths and getCollectionStaticPaths now include a cacheKey (derived from the entry's digest) on each returned path. This enables Astro's experimental incremental build cache to skip re-rendering unchanged pages. No-op when experimental.incrementalBuild is not enabled in astro.config.ts.

Patch Changes

0.10.0

Minor Changes

  • #71 e5d74f9 Thanks @​MohamedH1998! - Enable MDX optimization by default to reduce large-site build memory usage. Sites can opt out with mdx: { optimize: false }.

    Verified the generated starter with optimization on and with mdx: { optimize: false } forced; the rendered HTML is structurally equivalent for element names, attributes, and non-whitespace text. AC#3 is treated as semantic/structural render parity rather than byte identity: raw bytes differ due to serializer escaping and inter-block whitespace, but the rendered document is lossless.

    Spot-checked the starter components page, which includes JSX tags in prose, inline code with <...>, quoted code, and package names. The optimized and opt-out renders preserve those special-character text probes and match structurally.

    Constrain the supported Astro peer range to >=7.0.0 <7.1.0 || >=7.2.0 <8.0.0: the 7.1.x line is excluded while its static-build regression is open upstream, but 7.2.x is admitted (verified against a sub-path build). Generated templates and the dev pin stay on the verified 7.0.x line.

  • #76 acfac20 Thanks @​mvvmm! - Replace astro-icon with a built-in icon system. This is a breaking change for any project using astro-icon directly.

    Why: astro-icon stamped a generated lastModified timestamp into its virtual module on every build, invalidating thousands of cached pages in Astro's incremental build cache. The package is unmaintained so an upstream fix isn't coming.

    What's new: Nimbus now provides virtual:nimbus/icons (a Vite plugin) and @cloudflare/nimbus-docs/components/Icon.astro. The plugin auto-detects installed @iconify-json/* packages and loads local SVGs from src/icons/. The component API is compatible with astro-icon (name, size, width, height, is:inline, title, desc, and all <svg> attributes). SVG bodies are passed through replaceIDs so internal IDs (clipPath, mask, gradient defs) are unique per render — preventing collisions when the same icon appears more than once on a page.

    Breaking changes:

    • Remove astro-icon from your package.json and astro.config.ts
    • Replace import { Icon } from "astro-icon/components" with import Icon from "@cloudflare/nimbus-docs/components/Icon.astro"
    • SVG output structure changed: SVGs are always inlined; the previous <symbol>/<use> pattern produced duplicate DOM IDs when the same icon was used more than once on a page, so it has been removed. Any CSS or JS targeting symbol or use elements will need updating.

    Migration:

    - import { Icon } from "astro-icon/components";
+ import Icon from "@cloudflare/nimbus-docs/components/Icon.astro";

    Starter templates updated: removed astro-icon dependency and icon() integration from astro.config.ts; all component imports updated to the new path.

Patch Changes

  • #77 1c49268 Thanks @​MohamedH1998! - Fix NimbusHead emitting base-less SEO URLs on sub-path deployments (e.g. base: '/docs').

    new URL(path, Astro.site) resolves against the origin only and drops the configured base, so the rel=sitemap link, the LLM-index rel=alternate, og:image/twitter:image, the JSON-LD isPartOf.url, the versioned canonical, and the cross-version rel=alternate all pointed at the origin root and 404'd under a sub-path. Every internal path handed to new URL(..., Astro.site) is now base-prefixed via a withBase helper, matching the existing BASE_URL handling for the favicon and Shiki stylesheet.

... (truncated)

Commits

Updates astro from 7.1.3 to 7.2.6

Release notes

Sourced from astro's releases.

astro@7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

  • #17810 0fc5f65 Thanks @​florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved

  • #17781 aa33b44 Thanks @​matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session

  • #17787 6661fbe Thanks @​astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n

  • #17750 dd0e3ac Thanks @​dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.

  • #17774 fe1d16d Thanks @​astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation

  • #17799 8797754 Thanks @​astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route

  • #17741 99d3d3d Thanks @​ericswpark! - Bumps the Astro compiler to the latest version. Changelog.

  • #17782 3578d45 Thanks @​Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.

  • #17705 2043e4f Thanks @​astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit

  • #17754 3d50dfd Thanks @​astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

  • #17810 0fc5f65 Thanks @​florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved

  • #17781 aa33b44 Thanks @​matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session

  • #17787 6661fbe Thanks @​astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n

  • #17750 dd0e3ac Thanks @​dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.

  • #17774 fe1d16d Thanks @​astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation

  • #17799 8797754 Thanks @​astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route

  • #17741 99d3d3d Thanks @​ericswpark! - Bumps the Astro compiler to the latest version. Changelog.

  • #17782 3578d45 Thanks @​Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.

  • #17705 2043e4f Thanks @​astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit

... (truncated)

Commits
  • 22e439b [ci] release (#17814)
  • 29af6da Fix FetchState manifest resolution in development (#17812)
  • d38ed60 [ci] release (#17753)
  • 0fc5f65 fix: content image regression (#17810)
  • 493796b Skip URL normalization writes that would not change the path (#17416)
  • 8797754 Fix i18n fallback rewrite returning 500 instead of 404 for missing prerendere...
  • 99d3d3d fix: bump compiler (#17741)
  • 6661fbe fix(dev): break circular import in virtual:astro:routes by importing from ast...
  • 60b14ff Fix type error when using content collection images after apng support (#17783)
  • 3578d45 perf(cli): enable the Node.js compile cache (#17782)
  • Additional commits viewable in compare view

Updates astro-icon from 1.1.5 to 1.2.0

Release notes

Sourced from astro-icon's releases.

astro-icon@1.2.0

Minor Changes

  • #290 956817e Thanks @​stramel! - Bump @iconify/tools to v5 and @iconify/utils to v3, removing the transitive extract-zip dependency that was flagged for a symlink path-traversal vulnerability (GHSA-jmr9-qjv8-65gv).

    Requires Node ≥22.12 — @iconify/utils v3 uses node:util's styleText, which needs Node ≥20.12/21.7, but the toolchain now also builds against Astro 7 (which itself requires Node ≥22.12). Node 20 reached end-of-life in April 2026, so astro-icon's engines field is raised to the currently-supported floor rather than the bare minimum.

  • #285 2e83ca0 Thanks @​stramel! - title/desc props now accept { id, value } in addition to a plain string, so consumers can set id attributes on the generated <title>/<desc> elements for aria-labelledby referencing.

Patch Changes

  • #291 3db45a5 Thanks @​stramel! - Strip the lastModified timestamp from the generated local icon collection so its output is deterministic across builds, allowing Astro's incremental build cache to work as expected.

    ...

    Description has been truncated

    Summary by cubic

    Bumps 22 dependencies across the root, apps/docs, apps/web, and apps/worker, including TypeScript's jump from 6 to 7 and @cloudflare/nimbus-docs from 0.6.1 to 0.11.0.

    Migration

    • @cloudflare/nimbus-docs replaces astro-icon with a built-in icon system, so update any astro-icon imports in the docs app.
    • astro-icon now requires Node ≥22.12.
    • TypeScript 7 is a major release; confirm type-checking and linting still pass.
    • Disclosure panels now mark collapsed content as inert; opt out with manageInert: false if you manage focus yourself.

    Written for commit 0bb895d. Summary will update on new commits.

@dependabot
build(deps): bump the dependencies group across 1 directory with 22 u…
0bb895d 
…pdates

Bumps the dependencies group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.3.14` | `1.4.0` |
| [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.9.1` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.5` | `2.10.11` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@cloudflare/nimbus-docs](https://github.com/cloudflare/nimbus/tree/HEAD/packages/nimbus-docs) | `0.6.1` | `0.11.0` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.1.3` | `7.2.6` |
| [astro-icon](https://github.com/natemoo-re/astro-icon/tree/HEAD/packages/core) | `1.1.5` | `1.2.0` |
| [canvaskit-wasm](https://github.com/google/skia) | `0.41.1` | `0.42.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.6` | `2.17.7` |
| [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.112.0` | `4.125.0` |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `14.1.4` | `14.2.4` |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `6.0.1` | `6.0.4` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.7.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.34.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.7` | `19.2.8` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.7` | `19.2.8` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.5` |
| [recharts](https://github.com/recharts/recharts) | `3.10.0` | `3.10.1` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.5` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20260721.1` | `5.20260825.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.3.0` |



Updates `@types/bun` from 1.3.14 to 1.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `eslint` from 10.7.0 to 10.9.1
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.7.0...v10.9.1)

Updates `turbo` from 2.10.5 to 2.10.11
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.5...v2.10.11)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

Updates `@cloudflare/nimbus-docs` from 0.6.1 to 0.11.0
- [Release notes](https://github.com/cloudflare/nimbus/releases)
- [Changelog](https://github.com/cloudflare/nimbus/blob/main/packages/nimbus-docs/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/nimbus/commits/HEAD/packages/nimbus-docs)

Updates `astro` from 7.1.3 to 7.2.6
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.6/packages/astro)

Updates `astro-icon` from 1.1.5 to 1.2.0
- [Release notes](https://github.com/natemoo-re/astro-icon/releases)
- [Changelog](https://github.com/natemoo-re/astro-icon/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/natemoo-re/astro-icon/commits/astro-icon@1.2.0/packages/core)

Updates `canvaskit-wasm` from 0.41.1 to 0.42.0
- [Changelog](https://github.com/google/skia/blob/main/RELEASE_NOTES.md)
- [Commits](https://github.com/google/skia/commits/canvaskit/0.42.0)

Updates `sanitize-html` from 2.17.6 to 2.17.7
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html)

Updates `@astrojs/check` from 0.9.9 to 0.9.10
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.10/packages/language-tools/astro-check)

Updates `wrangler` from 4.112.0 to 4.125.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.125.0/packages/wrangler)

Updates `@astrojs/cloudflare` from 14.1.4 to 14.2.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@14.2.4/packages/integrations/cloudflare)

Updates `@astrojs/react` from 6.0.1 to 6.0.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@6.0.4/packages/integrations/react)

Updates `@base-ui/react` from 1.6.0 to 1.7.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.7.0/packages/react)

Updates `lucide-react` from 1.25.0 to 1.34.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.34.0/packages/lucide-react)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

Updates `@types/react-dom` from 19.2.3 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `recharts` from 3.10.0 to 3.10.1
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v3.10.0...v3.10.1)

Updates `@types/react` from 19.2.17 to 19.2.18
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.3 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@cloudflare/workers-types` from 5.20260721.1 to 5.20260825.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@types/node` from 26.1.1 to 26.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/bun"
  dependency-version: 1.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: turbo
  dependency-version: 2.10.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@cloudflare/nimbus-docs"
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: astro
  dependency-version: 7.2.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: astro-icon
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: canvaskit-wasm
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: sanitize-html
  dependency-version: 2.17.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: wrangler
  dependency-version: 4.125.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 14.2.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@astrojs/react"
  dependency-version: 6.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: lucide-react
  dependency-version: 1.34.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: recharts
  dependency-version: 3.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/react"
  dependency-version: 19.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260825.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 26.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
@greptile-apps

greptile-apps Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@codecov

codecov Bot commented Sep 1, 2026

Copy link
Copy Markdown

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

@socket-security

socket-security Bot commented Sep 1, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​types/​bun@​1.3.14 ⏵ 1.4.01001004890100
Updated@​base-ui/​react@​1.6.0 ⏵ 1.7.072 +110089 +193100
Updated@​types/​react-dom@​19.2.3 ⏵ 19.2.5100 +110075 +191 +3100
Updated@​types/​react@​19.2.17 ⏵ 19.2.18100 +110079 +190100
Updated@​astrojs/​check@​0.9.9 ⏵ 0.9.101001008088100
Updatedlucide-react@​1.25.0 ⏵ 1.34.0100 +110098 +196 +180
Added@​types/​node@​26.3.01001008196100
Updatedastro-icon@​1.1.5 ⏵ 1.2.010010010082 +2100
Updated@​astrojs/​react@​6.0.1 ⏵ 6.0.4991008295 -1100
Updatedreact@​19.2.7 ⏵ 19.2.81001008497100
Updated@​astrojs/​cloudflare@​14.1.4 ⏵ 14.2.4100 +110084 +198 +1100
Updatedturbo@​2.10.5 ⏵ 2.10.1110010085 +197100
Updated@​cloudflare/​nimbus-docs@​0.6.1 ⏵ 0.11.093 +1710088 +197 +5100
Updatedastro@​7.1.3 ⏵ 7.2.69710088 +198100
Updatedtypescript@​6.0.3 ⏵ 7.0.29910089 -1100100 +10
Updatedwrangler@​4.112.0 ⏵ 4.125.0981009296 +1100
Updatedreact-dom@​19.2.7 ⏵ 19.2.81001009298100
Updatedsanitize-html@​2.17.6 ⏵ 2.17.7100 +110010092100
Addedcanvaskit-wasm@​0.42.01001009992100
Updatedrecharts@​3.10.0 ⏵ 3.10.198 +19100100 +195 -2100
Updated@​cloudflare/​workers-types@​5.20260721.1 ⏵ 5.20260825.1100 +2610096 +199100
Updatedeslint@​10.7.0 ⏵ 10.9.197 +110010096 +1100

View full report

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Sep 1, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0bb895d257

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread package.json
"@types/bun": "^1.4.0",
"eslint": "^10.9.1",
"turbo": "^2.10.11",
"typescript": "^7.0"

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep TypeScript within the checking stack's supported range

The CI workflow runs both bun run lint and bun run typecheck, but the resolved @typescript-eslint/parser/typescript-estree packages declare TypeScript support only for >=4.8.4 <6.1.0, while @astrojs/check accepts only ^5 || ^6; resolving TypeScript 7 here—and independently in apps/docs/package.json—therefore makes every TypeScript lint run and both Astro checks use an unsupported compiler API. Pin both declarations to a supported 6.x release, or upgrade the checking stack to versions that explicitly support TypeScript 7.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants