Skip to content

Bump the javascript-dependencies group with 6 updates#53

Merged
shenanigansd merged 1 commit into
mainfrom
dependabot/npm_and_yarn/javascript-dependencies-5f790f10b3
May 1, 2026
Merged

Bump the javascript-dependencies group with 6 updates#53
shenanigansd merged 1 commit into
mainfrom
dependabot/npm_and_yarn/javascript-dependencies-5f790f10b3

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 1, 2026

Bumps the javascript-dependencies group with 6 updates:

Package From To
@astrojs/cloudflare 13.1.10 13.2.1
@astrojs/react 5.0.3 5.0.4
@auth0/auth0-spa-js 2.19.1 2.19.2
astro 6.1.6 6.1.9
wrangler 4.82.2 4.87.0
@biomejs/biome 2.4.11 2.4.13

Updates @astrojs/cloudflare from 13.1.10 to 13.2.1

Release notes

Sourced from @​astrojs/cloudflare's releases.

@​astrojs/cloudflare@​13.2.1

Patch Changes

  • #16458 8cb1f42 Thanks @​matthewp! - Fixes Cloudflare dev and build failures caused by @cloudflare/vite-plugin defaulting compatibility_date to today's date, which can exceed the maximum date supported by the bundled workerd binary

@​astrojs/cloudflare@​13.2.0

Minor Changes

  • #16435 c4d321b Thanks @​jamesopstad! - Add support for Preview deployments (currently in private beta)

    Non-inheritable bindings set internally by the Cloudflare adapter are now also set in the previews section of the config so that they are inherited by Preview deployments.

Patch Changes

  • Updated dependencies [99464ed, f3485c3]:
    • @​astrojs/internal-helpers@​0.9.0
    • @​astrojs/underscore-redirects@​1.0.3
Changelog

Sourced from @​astrojs/cloudflare's changelog.

13.2.1

Patch Changes

  • #16458 8cb1f42 Thanks @​matthewp! - Fixes Cloudflare dev and build failures caused by @cloudflare/vite-plugin defaulting compatibility_date to today's date, which can exceed the maximum date supported by the bundled workerd binary

13.2.0

Minor Changes

  • #16435 c4d321b Thanks @​jamesopstad! - Add support for Preview deployments (currently in private beta)

    Non-inheritable bindings set internally by the Cloudflare adapter are now also set in the previews section of the config so that they are inherited by Preview deployments.

Patch Changes

  • Updated dependencies [99464ed, f3485c3]:
    • @​astrojs/internal-helpers@​0.9.0
    • @​astrojs/underscore-redirects@​1.0.3
Commits

Updates @astrojs/react from 5.0.3 to 5.0.4

Release notes

Sourced from @​astrojs/react's releases.

@​astrojs/react@​5.0.4

Patch Changes

Changelog

Sourced from @​astrojs/react's changelog.

5.0.4

Patch Changes

Commits

Updates @auth0/auth0-spa-js from 2.19.1 to 2.19.2

Release notes

Sourced from @​auth0/auth0-spa-js's releases.

v2.19.2

Security

Changelog

Sourced from @​auth0/auth0-spa-js's changelog.

v2.19.2 (2026-04-15)

Full Changelog

Security

Commits

Updates astro from 6.1.6 to 6.1.9

Release notes

Sourced from astro's releases.

astro@6.1.9

Patch Changes

  • #16448 99464ed Thanks @​matthewp! - Updates vite, picomatch, and unstorage to latest patch versions

  • #16422 a3951d7 Thanks @​matthewp! - Hardens astro-island export resolution and hydration error handling for malformed component metadata

  • #16420 e21de1d Thanks @​matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

  • #16419 f3485c3 Thanks @​matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

  • #16022 a002540 Thanks @​mathieumaf! - Fixes an issue where i18n domains would return 404 when trailingSlash is set to never.

  • Updated dependencies [99464ed, f3485c3]:

    • @​astrojs/internal-helpers@​0.9.0
    • @​astrojs/markdown-remark@​7.1.1

astro@6.1.8

Patch Changes

  • #16367 a6866a7 Thanks @​ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

  • #16381 217c5b3 Thanks @​ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

  • #16348 7d26cd7 Thanks @​ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

  • #16317 d012bfe Thanks @​das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

  • #16379 5a84551 Thanks @​martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

  • #16317 d012bfe Thanks @​das-peter! - Adds tests to verify settings are properly propagated when using the development server.

  • #16282 5b0fdaa Thanks @​jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

  • Updated dependencies [e0b240e]:

    • @​astrojs/telemetry@​3.3.1

astro@6.1.7

Patch Changes

  • #16027 c62516b Thanks @​fkatsuhiro! - Fixes a bug where remote image dimensions were not validated during static builds on Netlify.

  • #16311 94048f2 Thanks @​Arecsu! - Fixes --port flag being ignored after a Vite-triggered server restart (e.g. when a .env file changes)

  • #16316 0fcd04c Thanks @​ematipico! - Fixes the /_image endpoint accepting an arbitrary f=svg query parameter and serving non-SVG content as image/svg+xml. The endpoint now validates that the source is actually SVG before honoring f=svg, matching the same guard already enforced on the <Image> component path.

Changelog

Sourced from astro's changelog.

6.1.9

Patch Changes

  • #16448 99464ed Thanks @​matthewp! - Updates vite, picomatch, and unstorage to latest patch versions

  • #16422 a3951d7 Thanks @​matthewp! - Hardens astro-island export resolution and hydration error handling for malformed component metadata

  • #16420 e21de1d Thanks @​matthewp! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

  • #16419 f3485c3 Thanks @​matthewp! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

  • #16022 a002540 Thanks @​mathieumaf! - Fixes an issue where i18n domains would return 404 when trailingSlash is set to never.

  • Updated dependencies [99464ed, f3485c3]:

    • @​astrojs/internal-helpers@​0.9.0
    • @​astrojs/markdown-remark@​7.1.1

6.1.8

Patch Changes

  • #16367 a6866a7 Thanks @​ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

  • #16381 217c5b3 Thanks @​ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

  • #16348 7d26cd7 Thanks @​ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

  • #16317 d012bfe Thanks @​das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

  • #16379 5a84551 Thanks @​martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

  • #16317 d012bfe Thanks @​das-peter! - Adds tests to verify settings are properly propagated when using the development server.

  • #16282 5b0fdaa Thanks @​jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

  • Updated dependencies [e0b240e]:

    • @​astrojs/telemetry@​3.3.1

6.1.7

Patch Changes

  • #16027 c62516b Thanks @​fkatsuhiro! - Fixes a bug where remote image dimensions were not validated during static builds on Netlify.

  • #16311 94048f2 Thanks @​Arecsu! - Fixes --port flag being ignored after a Vite-triggered server restart (e.g. when a .env file changes)

  • #16316 0fcd04c Thanks @​ematipico! - Fixes the /_image endpoint accepting an arbitrary f=svg query parameter and serving non-SVG content as image/svg+xml. The endpoint now validates that the source is actually SVG before honoring f=svg, matching the same guard already enforced on the <Image> component path.

Commits

Updates wrangler from 4.82.2 to 4.87.0

Release notes

Sourced from wrangler's releases.

wrangler@4.87.0

Minor Changes

  • #13726 b5ac54b Thanks @​penalosa! - Hard fail on Node.js < 22

    Wrangler no longer supports Node.js 20.x, as it reached end-of-life on 2026-04-30. The minimum supported Node.js version is now 22.0.0. See https://github.com/nodejs/release?tab=readme-ov-file#end-of-life-releases.

  • #13717 9a1f014 Thanks @​NuroDev! - Add an experimental experimental_generateTypes() programmatic API.

    Wrangler now exposes experimental_generateTypes() from the package root so you can generate Worker types in code using the same logic as wrangler types. The API supports the same core type-generation options (include env/runtime toggles) and returns structured output with separate env and runtime content alongside the combined formatted output.

Patch Changes

  • #13732 22e1a61 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260426.1 1.20260429.1

  • #13754 00523c8 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    workerd 1.20260429.1 1.20260430.1

  • #13711 1c4d850 Thanks @​dario-piotrowicz! - fix: skip auto-config and OpenNext delegation when --config is explicitly provided

    When --config is passed to wrangler deploy, the user is explicitly targeting a specific Worker configuration. Previously, wrangler would ignore --config and delegate to opennextjs-cloudflare deploy if it detected an OpenNext project in the working directory, silently deploying the wrong Worker. Now, both auto-config detection and OpenNext delegation are skipped when --config is provided, matching the existing behavior for --script and --assets.

  • #13735 6d28037 Thanks @​edmundhung! - Improve config-schema.json hover text in more editors

    Wrangler now emits markdownDescription in config-schema.json alongside the existing description field. Editors that support rich JSON Schema hovers can use that markdown directly instead of rendering escaped links and formatting.

  • #13722 0827815 Thanks @​MattieTK! - Improve safe telemetry categorisation for user-facing Wrangler errors.

  • #13116 e539008 Thanks @​dario-piotrowicz! - Allow getPlatformProxy and unstable_getMiniflareWorkerOptions to start when the assets directory does not exist yet

    Previously, getPlatformProxy would catch and swallow NonExistentAssetsDirError internally when the configured assets directory was absent on disk. This has been refactored so that the directory-existence check is skipped entirely for getPlatformProxy and unstable_getMiniflareWorkerOptions, since these APIs are typically used at dev time in frameworks where the assets directory is a build output that may not exist yet.

    wrangler dev, wrangler deploy, wrangler versions upload, and wrangler triggers deploy continue to require the assets directory to exist when specified.

  • Updated dependencies [22e1a61, 00523c8, b5ac54b, e653edf, e1eff94, e539008, 0bf64a7, b04eedf, 6457fb3, c07d0cb]:

    • miniflare@4.20260430.0
    • @​cloudflare/kv-asset-handler@​0.5.0

wrangler@4.86.0

... (truncated)

Commits
  • 47cf644 Version Packages (#13714)
  • e653edf fix(miniflare): expose send_email in platform proxy (#13723)
  • 0827815 [wrangler] Add safe telemetry labels for user errors (#13722)
  • 9a1f014 feat(wrangler): Add programmatic type generation API (#13717)
  • e539008 Allow users to run getPlatformProxy on static asset workers when the assets...
  • 00523c8 Bump the workerd-and-workers-types group with 2 updates (#13754)
  • 6d28037 fix(wrangler): emit markdownDescription in config schema (#13735)
  • 22e1a61 Bump the workerd-and-workers-types group with 2 updates (#13732)
  • b5ac54b Hard fail on Node.js < 22 (#13726)
  • 0bf64a7 fix(miniflare): Skip creating hyperdrive proxy server for local database (#13...
  • Additional commits viewable in compare view

Updates @biomejs/biome from 2.4.11 to 2.4.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.13

2.4.13

Patch Changes

  • #9969 c5eb92b Thanks @​officialasishkumar! - Added the nursery rule noUnnecessaryTemplateExpression, which disallows template literals that only contain string literal expressions. These can be replaced with a simpler string literal.

    For example, the following code triggers the rule:

    const a = `${"hello"}`; // can be 'hello'
const b = `${"prefix"}_suffix`; // can be 'prefix_suffix'
const c = `${"a"}${"b"}`; // can be 'ab'

  • #10037 f785e8c Thanks @​minseong0324! - Fixed #9810: noMisleadingReturnType no longer reports false positives on a getter with a matching setter in the same namespace.

    class Store {
  get status(): string {
    if (Math.random() > 0.5) return "loading";
    return "idle";
  }
  set status(v: string) {}
}

  • #10084 5e2f90c Thanks @​jiwon79! - Fixed #10034: noUselessEscapeInRegex no longer flags escapes of ClassSetReservedPunctuator characters (&, !, #, %, ,, :, ;, <, =, >, @, `, ~) inside v-flag character classes as useless. These characters are reserved as individual code points in v-mode, so the escape is required.

    The following pattern is now considered valid:

    /[a-z\&]/v;

  • #10063 c9ffa16 Thanks @​Netail! - Added extra rule sources from ESLint CSS. biome migrate eslint should do a bit better detecting rules in your eslint configurations.

  • #10035 946b50e Thanks @​Netail! - Fixed #10032: useIframeSandbox now flags if there's no initializer value.

  • #9865 68fb8d4 Thanks @​dyc3! - Added the new nursery rule useDomNodeTextContent, which prefers textContent over innerText for DOM node text access and destructuring.

    For example, the following snippet triggers the rule:

    const foo = node.innerText;

  • #10023 bd1e74f Thanks @​ematipico! - Added a new nursery rule noReactNativeDeepImports that disallows deep imports from the react-native package. Internal paths like react-native/Libraries/... are not part of the public API and may change between versions.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.13

Patch Changes

  • #9969 c5eb92b Thanks @​officialasishkumar! - Added the nursery rule noUnnecessaryTemplateExpression, which disallows template literals that only contain string literal expressions. These can be replaced with a simpler string literal.

    For example, the following code triggers the rule:

    const a = `${"hello"}`; // can be 'hello'
const b = `${"prefix"}_suffix`; // can be 'prefix_suffix'
const c = `${"a"}${"b"}`; // can be 'ab'

  • #10037 f785e8c Thanks @​minseong0324! - Fixed #9810: noMisleadingReturnType no longer reports false positives on a getter with a matching setter in the same namespace.

    class Store {
  get status(): string {
    if (Math.random() > 0.5) return "loading";
    return "idle";
  }
  set status(v: string) {}
}

  • #10084 5e2f90c Thanks @​jiwon79! - Fixed #10034: noUselessEscapeInRegex no longer flags escapes of ClassSetReservedPunctuator characters (&, !, #, %, ,, :, ;, <, =, >, @, `, ~) inside v-flag character classes as useless. These characters are reserved as individual code points in v-mode, so the escape is required.

    The following pattern is now considered valid:

    /[a-z\&]/v;

  • #10063 c9ffa16 Thanks @​Netail! - Added extra rule sources from ESLint CSS. biome migrate eslint should do a bit better detecting rules in your eslint configurations.

  • #10035 946b50e Thanks @​Netail! - Fixed #10032: useIframeSandbox now flags if there's no initializer value.

  • #9865 68fb8d4 Thanks @​dyc3! - Added the new nursery rule useDomNodeTextContent, which prefers textContent over innerText for DOM node text access and destructuring.

    For example, the following snippet triggers the rule:

    const foo = node.innerText;

  • #10023 bd1e74f Thanks @​ematipico! - Added a new nursery rule noReactNativeDeepImports that disallows deep imports from the react-native package. Internal paths like react-native/Libraries/... are not part of the public API and may change between versions.

    For example, the following code triggers the rule:

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the javascript-dependencies group with 6 updates
74b0bff 
Bumps the javascript-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/cloudflare](https://github.com/withastro/astro/tree/HEAD/packages/integrations/cloudflare) | `13.1.10` | `13.2.1` |
| [@astrojs/react](https://github.com/withastro/astro/tree/HEAD/packages/integrations/react) | `5.0.3` | `5.0.4` |
| [@auth0/auth0-spa-js](https://github.com/auth0/auth0-spa-js) | `2.19.1` | `2.19.2` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.1.6` | `6.1.9` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.82.2` | `4.87.0` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.11` | `2.4.13` |


Updates `@astrojs/cloudflare` from 13.1.10 to 13.2.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/cloudflare/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/cloudflare@13.2.1/packages/integrations/cloudflare)

Updates `@astrojs/react` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/react/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/react@5.0.4/packages/integrations/react)

Updates `@auth0/auth0-spa-js` from 2.19.1 to 2.19.2
- [Release notes](https://github.com/auth0/auth0-spa-js/releases)
- [Changelog](https://github.com/auth0/auth0-spa-js/blob/main/CHANGELOG.md)
- [Commits](auth0/auth0-spa-js@v2.19.1...v2.19.2)

Updates `astro` from 6.1.6 to 6.1.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@6.1.9/packages/astro)

Updates `wrangler` from 4.82.2 to 4.87.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.87.0/packages/wrangler)

Updates `@biomejs/biome` from 2.4.11 to 2.4.13
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.13/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@astrojs/cloudflare"
  dependency-version: 13.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: javascript-dependencies
- dependency-name: "@astrojs/react"
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: javascript-dependencies
- dependency-name: "@auth0/auth0-spa-js"
  dependency-version: 2.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: javascript-dependencies
- dependency-name: astro
  dependency-version: 6.1.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: javascript-dependencies
- dependency-name: wrangler
  dependency-version: 4.87.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: javascript-dependencies
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: javascript-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 1, 2026
@dependabot dependabot Bot requested a review from shenanigansd as a code owner May 1, 2026 00:51
@cloudflare-workers-and-pages
Copy link
Copy Markdown

cloudflare-workers-and-pages Bot commented May 1, 2026 •
edited
Loading

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs		 letsbuilda-dev 74b0bff Commit Preview URL

Branch Preview URL		 May 01 2026, 12:52 AM

@shenanigansd shenanigansd merged commit 2803c71 into main May 1, 2026
4 checks passed
@shenanigansd shenanigansd deleted the dependabot/npm_and_yarn/javascript-dependencies-5f790f10b3 branch May 1, 2026 00:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shenanigansd shenanigansd Awaiting requested review from shenanigansd shenanigansd is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shenanigansd