[dependabot]

Bumps the packages group with 6 updates in the / directory:

Package	From	To
oxlint	1.89.0	1.90.0
tsdown	0.23.1	0.23.3
@types/chrome	0.3.6	0.3.7
@cloudflare/vitest-plugin	1.4.6	1.4.9
@cloudflare/workers-types	5.20261024.1	5.20261028.1
wrangler	4.151.3	4.154.0

Updates oxlint from 1.89.0 to 1.90.0

Release notes

Sourced from oxlint's releases.

oxlint v1.90.0

🚀 Features

• cf34678 oxlint: Export Oxlintrc type (#28132) (Sysix)
• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

🐛 Bug Fixes

• 7f3c908 linter/eslint/array-callback-return: Check callbacks passed with extra arguments (#28133) (sarankumar)
• 53be530 linter: Filter by type aware rules when looking up tsgolint rule severity (#28138) (NavpreetSSidhu)
• e0f8937 react-compiler: Compile a try whose catch is unreachable instead of panicking (#28066) (Dunqing)
• f5b625f linter/eslint/no-useless-concat: See through parenthesized expressions (#27984) (Rahul Kashyap)
• 4629bb2 linter/jest/no-conditional-expect: Check function expression callbacks (#28055) (camc314)
• 5c84098 semantic,linter: Report names with lone surrogates in enum and lint checks (#27991) (Dunqing)
• f3705a9 linter/eslint/prefer-const: Skip fixers if any declarator is reassigned (#28008) (Prince Jain)
• 4c0fa90 minifier,linter: Keep delete of constant members and later JSX keys (#27990) (Dunqing)
• 0298062 linter/arrow-body-style: Keep type assertions when adding a block body (#27978) (Yan Almeida)

Changelog

Sourced from oxlint's changelog.

[1.90.0] - 2026-10-27

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 831cdf1 feat(oxlint): require mininum oxlint-tsgolint version v7.0.2005 (#28118)
• d1b00f4 feat(linter/typescript): implement no-unsafe-enum-assignment rule (#28117)
• 165c91f feat(linter/typescript/await-thenable): support allowMixedPromiseArrays opt...
• See full diff in compare view

Updates tsdown from 0.23.1 to 0.23.3

Release notes

Sourced from tsdown's releases.

v0.23.3

   🐞 Bug Fixes

• Downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1107 (0344c)

    View changes on GitHub

v0.23.2

   🚀 Features

• Add JSON schema for config  -  by @​Sandbye and @​sxzz in rolldown/tsdown#1074 (2410e)

   🐞 Bug Fixes

• css: Respect Lightning CSS modules options  -  by @​sxzz in rolldown/tsdown#1103 (490ec)

    View changes on GitHub

Commits

• 53638e8 chore: release v0.23.3
• 0344c4f fix: downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support ...
• 3c0c854 chore: release v0.23.2
• 76fbfbf chore: upgrade deps
• 490ecd6 fix(css): respect Lightning CSS modules options (#1103)
• 2410ef3 feat: add JSON schema for config (#1074)
• c626e4a chore: upgrade deps
• 3b5f4ee chore(deps): update dependency void to v1 (#1102)
• b46c0d4 test: prune redundant utils tests and fold lookup tables (#1099)
• 3a51daa chore(deps): update pnpm to v12.11.2 (#1081)
• Additional commits viewable in compare view

Updates @types/chrome from 0.3.6 to 0.3.7

Commits

• See full diff in compare view

Updates @cloudflare/vitest-plugin from 1.4.6 to 1.4.9

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.4.9

Patch Changes

• Updated dependencies [0968b08, f3c13b3]:
  • miniflare@5.20261023.1-beta
  • wrangler@4.154.0

@​cloudflare/vitest-plugin@​1.4.8

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• #16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

  • miniflare@5.20261023.0-beta
  • wrangler@4.153.0

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.4.9

Patch Changes

• Updated dependencies [0968b08, f3c13b3]:
  • miniflare@5.20261023.1-beta
  • wrangler@4.154.0

1.4.8

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16476 8a30d8e Thanks @​tannerlinsley! - Update Undici to 7.30.1 to prevent a malformed HTTP response from crashing development tools

  The updated shared dependency rejects excessive content encodings without leaving an unhandled stream error when the server closes the connection early. This fixes GHSA-xjj6-f33q-929c and keeps the matching Undici types on the same version.

• #16490 bcd618d Thanks @​petebacondarwin! - Update Zod to 4.6.6 to address GHSA-mrhx-c7xc-m3w5

  The updated shared dependency fixes excessive memory consumption when validating oversized collections. This updates both the published Zod dependencies and the copies bundled into development tools and Workers.

• #16335 28cca4c Thanks @​robingenz! - Fix Worker tests failing when CommonJS dependencies require packages with separate import and require entries on Vite 8. The fix needs Vite 8.2.1 or later; Vite 8.0.x, 8.1.x and 8.2.0 stay affected.

• Updated dependencies [9e05ade, 5f82a56, e651d7c, 5f82a56, e651d7c, 8a30d8e, c0e915f, b7e762d, c709bff, 23ef63a, bcd618d]:

  • miniflare@5.20261023.0-beta
  • wrangler@4.153.0

1.4.7

Patch Changes

• Updated dependencies [80a9f96, 08f22d3, 2878645, a4eb57d, 182d6de]:
  • wrangler@4.152.0
  • miniflare@5.20261019.2-beta

Commits

• 71d0903 Version Packages (#16500)
• 1b3bde1 Version Packages (#16429)
• 28cca4c [vitest-plugin] Pass the import kind to Vite so require() picks the `requir...
• dfd962f Version Packages (#16377)
• See full diff in compare view

Updates @cloudflare/workers-types from 5.20261024.1 to 5.20261028.1

Commits

• See full diff in compare view

Updates wrangler from 4.151.3 to 4.154.0

Release notes

Sourced from wrangler's releases.

wrangler@4.154.0

Minor Changes

• #16494 0968b08 Thanks @​petebacondarwin! - Enable Miniflare's development registry by default and centralize path resolution

  In Miniflare v5 beta, resolve the registry from CLOUDFLARE_DEV_REGISTRY_PATH, then the unsafeDevRegistryPath constructor option, then <Cloudflare config directory>/dev-registry/v5. The default is independent of legacy Wrangler directories and is scoped to the Miniflare major version. The Vite v2 beta plugin follows this new default, while current Wrangler and getPlatformProxy() retain Wrangler's legacy default for compatibility with existing Wrangler sessions. Vite v2 and Wrangler therefore require the same CLOUDFLARE_DEV_REGISTRY_PATH to discover each other; set it for both processes when mixing these tools.

  Add enableDevRegistry: false to disable registration and discovery explicitly. Shared storage now uses the resolved default without requiring an explicit path. As before, shared storage requires an enabled registry to elect a storage owner, so combining unsafeEnableSharedStorage: true with enableDevRegistry: false is rejected. Miniflare no longer reads MINIFLARE_REGISTRY_PATH; use CLOUDFLARE_DEV_REGISTRY_PATH instead. Expose resolveDevRegistryPath() for integrations that also read registry files. Wrangler uses the effective path for its runtime configuration, initial bindings display, and Flagship active-session check, so the canonical override cannot bypass that check. An explicitly disabled Wrangler registry remains disabled.

Patch Changes

• #16499 f3c13b3 Thanks @​dinasaur404! - Preserve binding error codes and names in local development

  Errors from remote bindings and from Node.js binding proxies (getPlatformProxy() and Miniflare#getBindings()) now keep their machine-readable properties, such as Artifacts' code and numericCode. Previously these properties were dropped and the error name was folded into the message (for example "ArtifactsError: Repository not found"), so code could only branch on error text during local development.

  Node.js callers also keep custom error names such as ArtifactsError. Errors from remote bindings received inside a Worker keep their properties but are still named Error.

• Updated dependencies [0968b08, f3c13b3]:

  • miniflare@5.20261023.1-beta

wrangler@4.153.0

Minor Changes

• #14865 c0e915f Thanks @​TheSaiEaranti! - Add an --infer-origin-from-routes flag to wrangler dev

  When a config has routes, local dev infers the origin from the first route, so the Worker sees request.url, the Host header, and any Origin header rewritten to the route's host even though the client connected to localhost. That silently breaks Host/Origin-sensitive logic — for example a CORS check allowlisting http://localhost:* receives http://<route-host> instead and rejects the request only in local dev.

  The inference is intentional and remains the default. Passing --infer-origin-from-routes=false now opts out, preserving the real local origin without removing routes from the config. An explicitly configured --host, --local-upstream, or dev.host continues to take precedence either way. The flag only affects local development: in remote mode the route host still determines the preview session as before.

• #15955 23ef63a Thanks @​ericclemmons! - Expand dotenv variable references in --secrets-file input

  Dotenv files supplied through --secrets-file to deploy, versions upload, and preview now expand $VAR and ${VAR} references using process values and earlier file values. Process environment values override matching file keys, including explicitly empty values. Treat dotenv secrets files as trusted input: they can read and upload any process environment value, such as a CI credential referenced by X=${GITHUB_TOKEN}. In CI, use secrets files whose contents untrusted contributors cannot modify.

  This changes how existing dotenv secrets files are interpreted: an unset reference becomes an empty string, so PASSWORD=pa$word becomes pa when word is unset. Escape literal dollar signs with a backslash (PASSWORD=pa\$word), or use a JSON secrets file to preserve values exactly. JSON input and bulk-secret commands, including piped stdin, retain their existing literal parsing.

Patch Changes

• #16403 5f82a56 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-22

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16437 e651d7c Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-10-23

  Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

• #16403 5f82a56 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From | To |

... (truncated)

Commits

• 71d0903 Version Packages (#16500)
• 0968b08 [miniflare] Enable the dev registry by default and centralize path resolution...
• 1b3bde1 Version Packages (#16429)
• 23ef63a [wrangler] Expand dotenv values in secrets files (#15955)
• e0c034a [wrangler] Make inspector test resilient to message ordering (#16478)
• c0e915f [wrangler] Add --infer-origin-from-routes flag to opt out of route-based orig...
• c709bff [wrangler] Fix kv key list returning only the first 1000 keys in local mode (...
• dfd962f Version Packages (#16377)
• 2878645 [wrangler] Report the R2 location returned when creating a bucket (#16361)
• 182d6de [workers-utils,deploy-helpers,config,codemods,wrangler] Add a jurisdiction se...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions