chore(deps-dev): bump the development group with 7 updates

[dependabot]

Bumps the development group with 7 updates:

Package	From	To
@biomejs/biome	2.5.10	2.5.11
@vitejs/plugin-react	6.1.0	6.1.1
@cloudflare/vitest-plugin	1.1.0	1.1.2
@cloudflare/workers-types	5.20260826.1	5.20260829.1
wrangler	4.126.0	4.127.1
@types/node	26.3.0	26.4.0
@testing-library/react	16.3.2	16.3.3

Updates @biomejs/biome from 2.5.10 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.0 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• See full diff in compare view

Updates @cloudflare/vitest-plugin from 1.1.0 to 1.1.2

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.1.2

Patch Changes

• #15106 d5f3e56 Thanks @​thinkter! - Fix slowdowns and crashes in tests that repeatedly recreate Durable Objects

  Tests that construct the same Durable Object many times could get progressively slower and eventually fail with a stack overflow. Repeated constructions now behave the same as the first one.

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

  • miniflare@5.20260828.0-alpha
  • wrangler@4.127.1

@​cloudflare/vitest-plugin@​1.1.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.1.2

Patch Changes

• #15106 d5f3e56 Thanks @​thinkter! - Fix slowdowns and crashes in tests that repeatedly recreate Durable Objects

  Tests that construct the same Durable Object many times could get progressively slower and eventually fail with a stack overflow. Repeated constructions now behave the same as the first one.

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

  • miniflare@5.20260828.0-alpha
  • wrangler@4.127.1

1.1.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

Commits

• f808554 Version Packages (#15385)
• d5f3e56 [vitest-pool-workers] Install wrapper prototype proxy once (#15106)
• a831498 Version Packages (#15372)
• See full diff in compare view

Updates @cloudflare/workers-types from 5.20260826.1 to 5.20260829.1

Commits

• See full diff in compare view

Updates wrangler from 4.126.0 to 4.127.1

Release notes

Sourced from wrangler's releases.

wrangler@4.127.1

Patch Changes

• #15383 eb01850 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260826.1	^5.20260827.1
  workerd	1.20260826.1	1.20260827.1

• #15393 e1df91a Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260827.1	^5.20260828.1
  workerd	1.20260827.1	1.20260828.1

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

  • miniflare@5.20260828.0-alpha

wrangler@4.127.0

Minor Changes

• #15356 fe265f8 Thanks @​rubuy-74! - Add support for configuring a per-workflow max concurrency limit via workflows[].concurrency.limit in your Wrangler config.

  The limit is the maximum number of Workflow instances that can run concurrently. It is validated as a positive integer and persisted on deploy; the ceiling is enforced server-side. Concurrency is ignored in local development.

  {
    "workflows": [
      {
        "binding": "MY_WORKFLOW",
        "name": "my-workflow",
        "class_name": "MyWorkflow",
        "concurrency": { "limit": 10 }
      }
    ]
  }

Patch Changes

• #15367 412c79e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

... (truncated)

Commits

• f808554 Version Packages (#15385)
• b903a09 Pin @netlify/build-info to 10.5.1 and update pnpm patch (#14808)
• 3650d29 Rename Worker target fields from workerName to worker (#15373)
• a831498 Version Packages (#15372)
• fe265f8 [wrangler] Add per-workflow concurrency limit config (#15356)
• 92874f6 WC-5857 [wrangler] Upload preview deployments as multipart form data (#15375)
• e9df120 Support multiple named Workers in the build output (#15371)
• See full diff in compare view

Updates @types/node from 26.3.0 to 26.4.0

Commits

• See full diff in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 1, 2026, 5:01 AM ET / 09:01 UTC.

ClawSweeper review

What this changes

Updates seven development dependencies across workspace manifests and synchronizes their pnpm lockfile resolutions.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open: this is a focused, current development-toolchain update whose exact head passed the full CI matrix; normal maintainer merge review is the remaining action.

Priority: P3
Reviewed head: 90c35540d88ceff7ba093d87875397c481174ca0

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused and correctly synchronized dependency-refresh patch with complete exact-head CI coverage.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored development-toolchain refresh changes no directly user-visible product behavior; the exact head's successful Worker-aware test, typecheck, build, lint, and analysis checks provide the relevant validation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored development-toolchain refresh changes no directly user-visible product behavior; the exact head's successful Worker-aware test, typecheck, build, lint, and analysis checks provide the relevant validation.
Evidence reviewed	4 items	Introduced scope: The pinned PR delta changes only six package manifests and pnpm-lock.yaml, updating seven declared development dependencies; it adds no application source, migration, workflow, or package-script changes. Cloudflare test-stack dependency signal: The API test configuration imports the Cloudflare Vitest plugin and supplies the Wrangler configuration to its Worker/D1 test environment, so the upgraded Cloudflare development stack is exercised by the repository test path. Exact-head CI coverage: The supplied PR checks for this head report success for Lint, Typecheck, Test, Build, workflow linting, CodeQL, and JavaScript/TypeScript analysis. The CI workflow runs those four workspace commands after a frozen lockfile install.
Findings	None	None.
Security	None	None.

How this fits together

Workspace manifests and the pnpm lockfile select the tools used to build the admin/demo apps and test the Cloudflare Worker. Those tools feed CI and local developer workflows without changing flag-evaluation or API runtime code.

flowchart LR
  A[Developers and CI] --> B[Workspace manifests]
  B --> C[pnpm lockfile]
  C --> D[Development tools]
  D --> E[Worker and dashboard checks]
  E --> F[Build test and deployment workflows]

Loading

Before merge

• Complete next step (P2) - No repair lane is appropriate because the complete dependency-refresh implementation is already present and needs only normal maintainer merge review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	7 files affected; 0 production source files	All 165 additions and 165 deletions are manifest or lockfile resolution updates, keeping the change narrowly scoped to development tooling.

Technical review

Best possible solution:

Land the synchronized patch-level development dependency refresh after normal maintainer review.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates development tooling rather than reporting a user-facing defect; the relevant compatibility signal is the successful exact-head CI matrix.

Is this the best way to solve the issue?

Yes: synchronized manifest and lockfile updates are the narrow maintainable path for this package-manager-managed development dependency refresh.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 59f724c8d5aa.

Labels

Label justifications:

• P3: This is a routine patch-level development dependency refresh with the full CI matrix passing on the exact PR head.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored development-toolchain refresh changes no directly user-visible product behavior; the exact head's successful Worker-aware test, typecheck, build, lint, and analysis checks provide the relevant validation.

Evidence

What I checked:

• Introduced scope: The pinned PR delta changes only six package manifests and pnpm-lock.yaml, updating seven declared development dependencies; it adds no application source, migration, workflow, or package-script changes. (apps/api/package.json:29, 90c35540d88c)
• Cloudflare test-stack dependency signal: The API test configuration imports the Cloudflare Vitest plugin and supplies the Wrangler configuration to its Worker/D1 test environment, so the upgraded Cloudflare development stack is exercised by the repository test path. (apps/api/vitest.config.ts:2, 90c35540d88c)
• Exact-head CI coverage: The supplied PR checks for this head report success for Lint, Typecheck, Test, Build, workflow linting, CodeQL, and JavaScript/TypeScript analysis. The CI workflow runs those four workspace commands after a frozen lockfile install. (.github/workflows/ci.yml:36, 90c35540d88c)
• Prior dependency ownership: Current-main history shows Peter Steinberger's immediately preceding workspace/CI dependency refresh on the same manifest surface; this is routing context, not attribution for this bot-authored change. (apps/api/package.json:29, 59f724c8d5aa)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-31T18:42:52.858Z sha 90c3554 :: needs maintainer review before merge. :: none

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.