chore(deps-dev): bump the development group across 1 directory with 8 updates

[dependabot]

Bumps the development group with 8 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.10	2.5.12
@vitejs/plugin-react	6.1.0	6.1.1
@cloudflare/vitest-plugin	1.1.0	1.1.6
@cloudflare/workers-types	5.20260826.1	5.20260908.1
wrangler	4.126.0	4.130.0
@types/node	26.3.0	26.5.1
tsx	4.23.12	4.23.13
@testing-library/react	16.3.2	16.3.3

Updates @biomejs/biome from 2.5.10 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• 1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
• 6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
• f4e5ebb feat(lint): add useModernMathApis (#11581)
• 54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
• 1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
• 2d55931 feat(js_analyze): added a React naming convention rule (#11554)
• ee69e0e fix(schema): domains (#11565)
• f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.1.0 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• See full diff in compare view

Updates @cloudflare/vitest-plugin from 1.1.0 to 1.1.6

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.1.6

Patch Changes

• Updated dependencies [edb3631, dbf6aad, bcebf08, e20df20, e20df20, 63c7ff1, a4e41df]:
  • miniflare@5.20260908.0-alpha
  • wrangler@4.130.0

@​cloudflare/vitest-plugin@​1.1.5

Patch Changes

• Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:
  • miniflare@5.20260907.0-alpha
  • wrangler@4.129.1

@​cloudflare/vitest-plugin@​1.1.4

Patch Changes

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6, 93d72a5, f6fb347, f6fb347, dc24057, d2d8eea]:
  • miniflare@5.20260903.0-alpha
  • wrangler@4.129.0

@​cloudflare/vitest-plugin@​1.1.3

Patch Changes

• Updated dependencies [dbbb795, 200780f, b3f2628, 87a7acf, 1809c5e, ea28cc3, b3fb2bf, 707cb6f]:
  • wrangler@4.128.0
  • miniflare@5.20260831.0-alpha

@​cloudflare/vitest-plugin@​1.1.2

Patch Changes

• #15106 d5f3e56 Thanks @​thinkter! - Fix slowdowns and crashes in tests that repeatedly recreate Durable Objects

  Tests that construct the same Durable Object many times could get progressively slower and eventually fail with a stack overflow. Repeated constructions now behave the same as the first one.

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

  • miniflare@5.20260828.0-alpha
  • wrangler@4.127.1

@​cloudflare/vitest-plugin@​1.1.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha
  • wrangler@4.127.0

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.1.6

Patch Changes

• Updated dependencies [edb3631, dbf6aad, bcebf08, e20df20, e20df20, 63c7ff1, a4e41df]:
  • miniflare@5.20260908.0-alpha
  • wrangler@4.130.0

1.1.5

Patch Changes

• Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:
  • miniflare@5.20260907.0-alpha
  • wrangler@4.129.1

1.1.4

Patch Changes

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6, 93d72a5, f6fb347, f6fb347, dc24057, d2d8eea]:
  • miniflare@5.20260903.0-alpha
  • wrangler@4.129.0

1.1.3

Patch Changes

• Updated dependencies [dbbb795, 200780f, b3f2628, 87a7acf, 1809c5e, ea28cc3, b3fb2bf, 707cb6f]:
  • wrangler@4.128.0
  • miniflare@5.20260831.0-alpha

1.1.2

Patch Changes

• #15106 d5f3e56 Thanks @​thinkter! - Fix slowdowns and crashes in tests that repeatedly recreate Durable Objects

  Tests that construct the same Durable Object many times could get progressively slower and eventually fail with a stack overflow. Repeated constructions now behave the same as the first one.

• Updated dependencies [eb01850, e1df91a, b23de74, 015550a, 015550a, 015550a, 3650d29, b23de74]:

  • miniflare@5.20260828.0-alpha
  • wrangler@4.127.1

1.1.1

Patch Changes

• Updated dependencies [412c79e, 92874f6, fe265f8]:
  • miniflare@5.20260826.0-alpha

... (truncated)

Commits

• 5705262 Version Packages (#15555)
• 87fd28c Revert "graduate miniflare v5" (#15551)
• 7f14caa Version Packages (#15510)
• be87ff0 Version Packages (#15461)
• b7b4ff8 Version Packages (#15450)
• f808554 Version Packages (#15385)
• d5f3e56 [vitest-pool-workers] Install wrapper prototype proxy once (#15106)
• a831498 Version Packages (#15372)
• See full diff in compare view

Updates @cloudflare/workers-types from 5.20260826.1 to 5.20260908.1

Commits

• See full diff in compare view

Updates wrangler from 4.126.0 to 4.130.0

Release notes

Sourced from wrangler's releases.

wrangler@4.130.0

Minor Changes

• #14372 dbf6aad Thanks @​ichernetsky-cf! - Add containers[].observability support to wrangler deploy

  Wrangler now accepts container-specific observability settings via containers[].observability, including application-level targeting fields for Containers. Root observability continues to work as a fallback when a container does not define its own observability settings.

  wrangler deploy now preserves legacy configuration.observability for existing container apps that still use rollout-based observability, while using top-level application observability for new or already-migrated apps.

  Existing application diffs are now normalized even when stored resource limits cannot be mapped to a named instance type. API-only metadata and equivalent managed-registry image names no longer appear as edits or affect whether deployment changes require a rollout.

• #15004 e20df20 Thanks @​MattieTK! - Delegate agent Pages project creation with a production branch to Workers

  When run by an AI agent, wrangler pages project create --production-branch <name> is now eligible for delegation to a Workers static-assets deploy. The production branch names the target that a Workers deploy would publish to, so it does not need to disqualify a brand-new project from delegation.

  wrangler pages deploy --branch <name> remains on Pages because an interactive new-project flow separately prompts for its production branch. The deployment branch may therefore represent a preview and cannot safely be converted into a production Workers deployment.

• #15004 e20df20 Thanks @​MattieTK! - Widen agent Pages-to-Workers delegation to new projects on accounts that already use Pages

  When run by an AI agent, wrangler pages deploy and wrangler pages project create now delegate a brand-new static Pages project to a Workers static-assets deploy even when the account already has other Pages projects. The gate is now per-project rather than per-account: a command targeting a project that already exists stays on Pages, but a new project is delegated regardless of the account's other Pages projects.

  A project name restored from the Pages configuration cache is only used when the cache belongs to the currently authenticated account. An account-matching cached name remains on Pages even when the project is missing remotely, preserving the user's recorded Pages intent. After switching accounts, an otherwise unnamed deploy stays on Pages rather than treating a stale cached project name as a new project on the selected account.

Patch Changes

• #15560 edb3631 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260907.1	^5.20260908.1
  workerd	1.20260907.1	1.20260908.1

• #15557 63c7ff1 Thanks @​tomekancu! - Fix wrangler d1 execute --local being extremely slow with large SQL files or commands

  The local SQL splitter consumed quoted strings and comments character-by-character, re-checking the full accumulated string each time. This made splitting a large quoted value or comment quadratic, so seed files could take tens of seconds to run. The splitter now only inspects a bounded trailing window on each step, making splitting effectively linear. The remote path is unaffected as it imports the file server-side.

• #15542 a4e41df Thanks @​NAVEENKUMARKR777! - Fix wrangler dev running the custom build command twice on startup and on every config change

  Wrangler already runs the custom build.command once before starting wrangler dev, to resolve the Worker's entry point. When dev.watch wasn't explicitly disabled, BundlerController then unconditionally ran the same build command again the moment it started watching for changes, and repeated this on every subsequent config reload too.

  For fast build commands this just meant duplicate log output (e.g. a vite build visibly running twice at startup). For slower or stateful build commands, running two builds concurrently against the same output files could corrupt the result or fail outright (for example, non-deterministic wasm-opt failures have been reported for Rust builds).

  The initial watcher setup now only bundles the output the build command already produced, instead of re-running the command. Real file changes detected by the watcher still re-run the build command as before.

• Updated dependencies [edb3631, bcebf08]:

  • miniflare@5.20260908.0-alpha

wrangler@4.129.1

... (truncated)

Commits

• 5705262 Version Packages (#15555)
• dbf6aad Add containers[].observability support to wrangler deploy (#14372)
• e20df20 [wrangler] Widen agent Pages-to-Workers delegation for new projects (#15004)
• 63c7ff1 Fix wrangler d1 execute performance for local (#15557)
• 9c60d14 Enable referencing Worker configs directly in cross-Worker bindings (#15511)
• a849e0d [workers-utils] Share named tunnel resolution (#15470)
• a4e41df [wrangler] Fix wrangler dev running the custom build command twice (#15542)
• 87fd28c Revert "graduate miniflare v5" (#15551)
• 7f14caa Version Packages (#15510)
• 411dbc4 Revert "fix(wrangler): tolerate missing KV access when deleting Workers" (#15...
• Additional commits viewable in compare view

Updates @types/node from 26.3.0 to 26.5.1

Commits

• See full diff in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• See full diff in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 11, 2026, 2:39 PM ET / 18:39 UTC.

ClawSweeper review

What this changes

Updates eight development dependencies and their lockfile resolutions across the Worker, dashboard, demo, CLI, and React SDK.

Merge readiness

✅ Ready for maintainer review

Keep open: these updates are not on main, and the overlapping dependency refresh uses older versions for several packages. No actionable defect was found; the current head’s build, lint, typecheck, test, and security checks pass.

Priority: P3
Reviewed head: f27f30cbd5a9a34743512bf97cb07bdc94a5738a

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency update with consistent resolutions, passing checks, and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored toolchain update is exempt from contributor runtime proof, and no material authority change triggers additional proof; passing CI remains validation rather than live application evidence.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored toolchain update is exempt from contributor runtime proof, and no material authority change triggers additional proof; passing CI remains validation rather than live application evidence.
Evidence reviewed	7 items	Verified change scope: The pinned main-to-head delta contains six package manifests and the lockfile: 177 additions and 188 deletions. Direct changes are development dependency versions; scripts, public exports, application source, migrations, and workflows are unchanged. Cloudflare dependency boundary: The API test configuration directly imports cloudflareTest and readD1Migrations from the updated plugin. The lockfile aligns that plugin with Wrangler 4.130.0, Miniflare 5.20260908.0-alpha, and workerd 1.20260908.1; the existing Vitest 4.1.11 satisfies its peer requirements. Deployment scripts use Wrangler, while the Worker configuration and compatibility date remain unchanged. Complete captured body inspected: Retrieved and inspected the complete 54,130-unit body, including upstream release notes. Its SHA-256 matches the supplied snapshot: fd015902cc4d676379505c790ea4e84f5088c6adfc5ad93beb466a748726c447. The release notes and dependency-only scope do not establish a changed application authorization boundary.
Findings	None	None.
Security	None	None.

How this fits together

The workspace toolchain builds the dashboard and SDKs, tests the Cloudflare Worker, and runs deployment commands. Package manifests and the shared lockfile select the tools used by local development and CI.

flowchart TD
  A[Package manifests] --> C[Resolved development tools]
  B[Shared lockfile] --> C
  C --> D[Dashboard and SDK builds]
  C --> E[Worker tests]
  C --> F[Worker deployment commands]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency update scope	8 direct development dependencies; 6 manifests and 1 lockfile	The update spans the shared build and Worker testing toolchain without adding application source.

Technical review

Best possible solution:

Keep one consistent, tested dependency graph while preserving the existing runtime support, SDK contracts, and deployment configuration.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance, and inspection found no concrete introduced failure to reproduce.

Is this the best way to solve the issue?

Yes: updating the existing manifests and generated lockfile is the narrow maintenance path; the related open refresh only partially overlaps these versions.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 59f724c8d5aa.

Labels

Label changes:

• add P3: Routine compatible development dependency maintenance has no demonstrated urgent user-facing failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored toolchain update is exempt from contributor runtime proof, and no material authority change triggers additional proof; passing CI remains validation rather than live application evidence.

Label justifications:

• P3: Routine compatible development dependency maintenance has no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored toolchain update is exempt from contributor runtime proof, and no material authority change triggers additional proof; passing CI remains validation rather than live application evidence.

Evidence

What I checked:

• Verified change scope: The pinned main-to-head delta contains six package manifests and the lockfile: 177 additions and 188 deletions. Direct changes are development dependency versions; scripts, public exports, application source, migrations, and workflows are unchanged. (apps/api/package.json:29, f27f30cbd5a9)
• Cloudflare dependency boundary: The API test configuration directly imports cloudflareTest and readD1Migrations from the updated plugin. The lockfile aligns that plugin with Wrangler 4.130.0, Miniflare 5.20260908.0-alpha, and workerd 1.20260908.1; the existing Vitest 4.1.11 satisfies its peer requirements. Deployment scripts use Wrangler, while the Worker configuration and compatibility date remain unchanged. (apps/api/vitest.config.ts:2, f27f30cbd5a9)
• Complete captured body inspected: Retrieved and inspected the complete 54,130-unit body, including upstream release notes. Its SHA-256 matches the supplied snapshot: fd015902cc4d676379505c790ea4e84f5088c6adfc5ad93beb466a748726c447. The release notes and dependency-only scope do not establish a changed application authorization boundary. (f27f30cbd5a9)
• Current main and prior refresh: GitHub confirms main remains at 59f724c. The merged refresh chore(deps): refresh workspace and GitHub Actions dependencies #85 supplies the older versions this PR updates, so it does not implement this request. (apps/api/package.json:29, 59f724c8d5aa)
• Partial overlap with an open refresh: build(deps): refresh compatible dependencies and patch Undici #87 includes the same React plugin and testing-library versions, but older Biome, Cloudflare, and Node type updates, plus separate production dependency changes. Its local Worker proof is useful for that branch but does not validate this PR’s newer versions or make this PR wholly redundant. (0a0649f4ed4e)
• Current-head validation: GitHub reports successful Build, Lint, Typecheck, Test, workflow lint, JavaScript/TypeScript analysis, and CodeQL checks. No local builds or tests were executed under the read-only review contract; diff checking passed and the checkout remained clean. (.github/workflows/ci.yml, f27f30cbd5a9)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps-dev): bump the development group across 1 directory with 8 updates This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.