chore(deps-dev): bump the development group across 1 directory with 8 updates

[dependabot]

Bumps the development group with 8 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.10	2.5.11
@vitejs/plugin-react	6.1.0	6.1.1
@cloudflare/vitest-plugin	1.1.0	1.1.2
@cloudflare/workers-types	5.20260826.1	5.20260830.1
wrangler	4.126.0	4.127.1
@types/node	26.3.0	26.4.0
tsx	4.23.12	4.23.13
@testing-library/react	16.3.2	16.3.3

Updates @biomejs/biome from 2.5.10 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.0 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• See full diff in compare view

Updates @cloudflare/vitest-plugin from 1.1.0 to 1.1.2

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.1.2

Patch Changes

• #15106 d5f3e56 Thanks @​thinkter! - Fix slowdowns and crashes in tests that repeatedly recreate Durable Objects

  Tests that construct the same Durable Object many times could get progressively slower and eventually fail with a stack overflow. Repeated constructions now behave the same as the first one.

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

  • miniflare@5.20260828.0-alpha
  • wrangler@4.127.1

@​cloudflare/vitest-plugin@​1.1.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.1.2

Patch Changes

• #15106 d5f3e56 Thanks @​thinkter! - Fix slowdowns and crashes in tests that repeatedly recreate Durable Objects

  Tests that construct the same Durable Object many times could get progressively slower and eventually fail with a stack overflow. Repeated constructions now behave the same as the first one.

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

  • miniflare@5.20260828.0-alpha
  • wrangler@4.127.1

1.1.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

Commits

• f808554 Version Packages (#15385)
• d5f3e56 [vitest-pool-workers] Install wrapper prototype proxy once (#15106)
• a831498 Version Packages (#15372)
• See full diff in compare view

Updates @cloudflare/workers-types from 5.20260826.1 to 5.20260830.1

Commits

• See full diff in compare view

Updates wrangler from 4.126.0 to 4.127.1

Release notes

Sourced from wrangler's releases.

wrangler@4.127.1

Patch Changes

• #15383 eb01850 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260826.1	^5.20260827.1
  workerd	1.20260826.1	1.20260827.1

• #15393 e1df91a Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260827.1	^5.20260828.1
  workerd	1.20260827.1	1.20260828.1

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

  • miniflare@5.20260828.0-alpha

wrangler@4.127.0

Minor Changes

• #15356 fe265f8 Thanks @​rubuy-74! - Add support for configuring a per-workflow max concurrency limit via workflows[].concurrency.limit in your Wrangler config.

  The limit is the maximum number of Workflow instances that can run concurrently. It is validated as a positive integer and persisted on deploy; the ceiling is enforced server-side. Concurrency is ignored in local development.

  {
    "workflows": [
      {
        "binding": "MY_WORKFLOW",
        "name": "my-workflow",
        "class_name": "MyWorkflow",
        "concurrency": { "limit": 10 }
      }
    ]
  }

Patch Changes

• #15367 412c79e Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

... (truncated)

Commits

• f808554 Version Packages (#15385)
• b903a09 Pin @netlify/build-info to 10.5.1 and update pnpm patch (#14808)
• 3650d29 Rename Worker target fields from workerName to worker (#15373)
• a831498 Version Packages (#15372)
• fe265f8 [wrangler] Add per-workflow concurrency limit config (#15356)
• 92874f6 WC-5857 [wrangler] Upload preview deployments as multipart form data (#15375)
• e9df120 Support multiple named Workers in the build output (#15371)
• See full diff in compare view

Updates @types/node from 26.3.0 to 26.4.0

Commits

• See full diff in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• See full diff in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 4, 2026, 2:43 PM ET / 18:43 UTC.

ClawSweeper review

What this changes

The PR updates eight direct development dependencies across six workspace manifests and refreshes the pnpm lockfile.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep open: the update is focused and project CI passed, but approval is still required for the new Wrangler/Workerd deployment toolchain because it performs production D1 migrations and Worker deploys with Cloudflare credentials.

Priority: P3
Reviewed head: a230ad655ae1c38a323d5012b5b7240788a27525
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and CI-backed, but confidence remains limited until the deployment owner accepts the updated credentialed toolchain.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored dependency update is exempt from the external-contributor real-behavior-proof gate; supplied CI covers build, lint, tests, typecheck, CodeQL, and workflow lint, while the remaining requirement is owner acceptance of the credentialed deployment executable.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored dependency update is exempt from the external-contributor real-behavior-proof gate; supplied CI covers build, lint, tests, typecheck, CodeQL, and workflow lint, while the remaining requirement is owner acceptance of the credentialed deployment executable.
Evidence reviewed	5 items	Introduced dependency change: The pinned PR delta updates the API workspace from Wrangler 4.126.0 to 4.127.1 and advances the Cloudflare test/runtime dependency chain, including Workerd 1.20260828.1 in the lockfile. Credentialed deployment boundary: The API scripts invoke Wrangler for remote D1 migrations and Worker deploys; the manual workflow runs those paths with Cloudflare API credentials. Deployment documentation: Operator documentation states that the manual workflow deploys from main using Cloudflare repository secrets and separates public and admin deployment paths.
Findings	None	None.
Security	Needs attention	Review the credentialed Wrangler update: The updated Wrangler and Workerd chain performs remote D1 migrations and Worker deployment in workflow steps that receive Cloudflare API credentials; accept its upstream release scope before use in production.

How this fits together

The API workspace supplies the Wrangler CLI used to develop, migrate, and deploy Krillswitch’s Cloudflare Worker and D1 database. The manual deployment workflow installs the locked workspace dependencies, then invokes those scripts with Cloudflare credentials.

flowchart LR
  A[Workspace manifests] --> B[Locked dependencies]
  B --> C[Wrangler toolchain]
  C --> D[Manual deployment workflow]
  D --> E[Cloudflare Worker]
  D --> F[D1 migrations]

Loading

Decision needed

Question	Recommendation
Should the deployment owner approve adopting Wrangler 4.127.1 and its updated Workerd chain for production migrations and Worker deploys that use Cloudflare credentials?	Approve the deployment toolchain update: Review the Wrangler and Workerd release scope, then accept the bounded dependency update for merge.

Why: This is a release-scope and credentialed-executable acceptance decision; source review and ordinary project CI cannot determine whether the organization accepts that upstream deployment-toolchain change.

Before merge

• Resolve security concern: Review the credentialed Wrangler update - The updated Wrangler and Workerd chain performs remote D1 migrations and Worker deployment in workflow steps that receive Cloudflare API credentials; accept its upstream release scope before use in production.
• Resolve merge risk (P1) - Wrangler 4.127.1 and its updated Workerd chain will run remote D1 migrations and Worker deploys with Cloudflare API credentials; passing repository CI does not independently establish that the upstream executable change is acceptable under that authority.
• Complete next step (P2) - Have the deployment owner review and approve the Wrangler 4.127.1 and Workerd 1.20260828.1 release scope before merge.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [medium] Review the credentialed Wrangler update — apps/api/package.json:34

Agent review details

Security

Needs attention: The diff changes a credentialed deployment executable, so upstream release-scope approval is required before merge.

Review metrics

Metric	Value	Why it matters
Direct dependency updates	8 updated across 6 manifests	The change is a focused workspace toolchain refresh rather than an application-code modification.
Deployment toolchain change	Wrangler 4.126.0 → 4.127.1; Workerd 1.20260825.1 → 1.20260828.1	These executables participate in remote migrations and Worker deployment.

Merge-risk options

Maintainer options:

1. Approve after release-scope review (recommended)
   Have the deployment owner review Wrangler 4.127.1 and Workerd 1.20260828.1 before accepting the compatibility and credentialed-execution risk.
2. Defer the update
   Keep this automated dependency PR open until that owner review is available rather than deploying the new toolchain by default.

Technical review

Best possible solution:

Keep the dependency update isolated and merge only after the deployment owner has reviewed and accepted the Wrangler 4.127.1 and Workerd release scope for the credentialed deployment path.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a development-dependency update, not a report of a product failure.

Is this the best way to solve the issue?

Yes. A focused owner review of the credentialed deployment toolchain is the narrowest safe path; no code repair would substitute for that acceptance decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 59f724c8d5aa.

Labels

Label justifications:

• P3: This is routine development-dependency maintenance with passing project checks.
• merge-risk: 🚨 compatibility: The update changes the Worker development, test, migration, and deployment toolchain used by existing repository workflows.
• merge-risk: 🚨 security-boundary: The updated Wrangler executable is used in steps that receive Cloudflare credentials for remote migrations and deploys.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored dependency update is exempt from the external-contributor real-behavior-proof gate; supplied CI covers build, lint, tests, typecheck, CodeQL, and workflow lint, while the remaining requirement is owner acceptance of the credentialed deployment executable.

Evidence

Security concerns:

• [medium] Review the credentialed Wrangler update — apps/api/package.json:34
  The updated Wrangler and Workerd chain performs remote D1 migrations and Worker deployment in workflow steps that receive Cloudflare API credentials; accept its upstream release scope before use in production.
  Confidence: 0.94

What I checked:

• Introduced dependency change: The pinned PR delta updates the API workspace from Wrangler 4.126.0 to 4.127.1 and advances the Cloudflare test/runtime dependency chain, including Workerd 1.20260828.1 in the lockfile. (apps/api/package.json:34, a230ad655ae1)
• Credentialed deployment boundary: The API scripts invoke Wrangler for remote D1 migrations and Worker deploys; the manual workflow runs those paths with Cloudflare API credentials. (apps/api/package.json:9, a230ad655ae1)
• Deployment documentation: Operator documentation states that the manual workflow deploys from main using Cloudflare repository secrets and separates public and admin deployment paths. (docs/deploy-cloudflare.md:167, a230ad655ae1)
• Current-main and CI status: The verified PR parent is current main at 59f724c, so the dependency versions are not yet on main; supplied GitHub context reports successful Build, Lint, Test, Typecheck, CodeQL, and workflow-lint checks for this exact head. (a230ad655ae1)
• Area history: Recent workspace dependency maintenance was authored by Peter Steinberger, while Vincent Koc has repeatedly maintained the Cloudflare deployment and Access workflow surface. (apps/api/package.json, f3e028867797)

Likely related people:

• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Have the deployment owner review and approve the Wrangler 4.127.1 and Workerd 1.20260828.1 release scope.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-09-01T18:47:48.100Z sha a230ad6 :: needs maintainer review before merge. :: none
• reviewed 2026-09-02T18:39:10.938Z sha a230ad6 :: needs maintainer review before merge. :: none
• reviewed 2026-09-03T18:41:31.527Z sha a230ad6 :: blocked before merge. :: none

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.