deps-dev: bump the development group with 5 updates

[dependabot]

Bumps the development group with 5 updates:

Package	From	To
@biomejs/biome	2.5.10	2.5.12
@cloudflare/workers-types	5.20260821.1	5.20260904.1
browserslist	4.28.8	4.28.9
bun-types	1.4.0	1.4.1
wrangler	4.125.0	4.129.0

Updates @biomejs/biome from 2.5.10 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• 1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
• 6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
• f4e5ebb feat(lint): add useModernMathApis (#11581)
• 54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
• 1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
• 2d55931 feat(js_analyze): added a React naming convention rule (#11554)
• ee69e0e fix(schema): domains (#11565)
• f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20260821.1 to 5.20260904.1

Commits

• See full diff in compare view

Updates browserslist from 4.28.8 to 4.28.9

Release notes

Sourced from browserslist's releases.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

Changelog

Sourced from browserslist's changelog.

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

Commits

• 12ed525 Release 4.28.9 version
• b1d8cf9 Update dependencies
• 21517b6 Improve or parsing performance
• See full diff in compare view

Updates bun-types from 1.4.0 to 1.4.1

Release notes

Sourced from bun-types's releases.

Bun v1.4.1

To install Bun v1.4.1

curl -fsSL https://bun.sh/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.1:

bun upgrade

Read Bun v1.4.1's release notes on Bun's blog

Thanks to 7 contributors!

• @​alii
• @​dylan-conway
• @​jarred-sumner
• @​jvitormelo
• @​marshallofsound
• @​robobun
• @​sosukesuzuki

Commits

• 9c3683f bundler: make --min-chunk-size effective on React apps and cheap; fix the sta...
• 7c18e0d bundler: modulepreload the chunks a split browser import() depends on (#41143)
• d2b71fb bun-types: type with { type } imports on TypeScript 7.1 (#41076)
• 70736fd webview: stop close() and browser death from raising uncatchable unhandled re...
• e8eaae9 bundler: bind property accesses on re-exported namespaces directly (#41009)
• 41906a4 bun-types: keep generic process.removeListener and off signatures visible wit...
• 1ab272b bun-types: defer Event and EventTarget to lib.dom when it is loaded (#40576)
• c6f335f Bun.serve: HTTP/2 support via http2: true (#40137)
• 1a50bfa bundler: with --splitting --target bun, require() of an ES module is a chunk ...
• 52baef6 WebSocket client: pause()/resume(), working bufferedAmount, and a ServerWebSo...
• Additional commits viewable in compare view

Updates wrangler from 4.125.0 to 4.129.0

Release notes

Sourced from wrangler's releases.

wrangler@4.129.0

Minor Changes

• #15460 93d72a5 Thanks @​QnJ1c2kNCg! - Support gzip compression for JSON Pipelines sinks

  Pipelines is in open beta. wrangler pipelines sinks create and the interactive setup flow now pass the selected JSON compression to the Pipelines API. JSON sinks accept uncompressed or gzip, while Parquet retains its existing compression options and zstd default.

• #15358 d2d8eea Thanks @​pombosilva! - Add a --json flag to the wrangler workflows commands

  Every wrangler workflows command now accepts --json, which emits the raw API payload instead of the human-readable rendering. The formatted output remains the default, so existing usage is unaffected:

  wrangler workflows instances list my-workflow --json

  The JSON output carries raw values rather than a serialisation of the formatted view: ISO timestamps instead of locale-formatted dates, plain status strings instead of emojified labels, and no presentation-only derived fields.

Patch Changes

• #15469 d40a634 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260831.1	^5.20260902.1
  workerd	1.20260831.1	1.20260902.1

• #15481 7c1b2a6 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260902.1	^5.20260903.1
  workerd	1.20260902.1	1.20260903.1

• #15472 f6fb347 Thanks @​emily-shen! - Tolerate missing permissions during wrangler delete cleanup checks

  wrangler delete now warns and continues when it cannot inspect Worker dependencies or clean up legacy Workers Sites KV namespaces because of missing permissions. The Worker delete request itself still fails normally if the token cannot delete the Worker.

• #15472 f6fb347 Thanks @​emily-shen! - Tolerate missing resource permissions during resource provisioning

  When Wrangler cannot check whether a bound resource exists because the API returns a 403, it now skips automatic provisioning for that resource type and continues the deploy. The deploy may still fail later if the resource is missing.

• #15476 dc24057 Thanks @​christhorwarth! - Fix remote development with static assets for API tokens using granular Worker permissions

  Wrangler now creates Workers.dev preview sessions through the Worker-scoped endpoint and derives the preview hostname from the session response. This avoids requiring account-level Workers subdomain access.

• Updated dependencies [00a9f2f, 1dba24a, d40a634, 7c1b2a6]:

  • miniflare@5.20260903.0-alpha

... (truncated)

Commits

• be87ff0 Version Packages (#15461)
• f6fb347 tolerate missing permissions for pre-flight checks (#15472)
• dc24057 [wrangler] Use worker-scoped preview sessions (#15476)
• d2d8eea [wrangler] Add --json output to Workflows commands (#15358)
• 93d72a5 PIPE-635: Support gzip compression for JSON sinks (#15460)
• b7b4ff8 Version Packages (#15450)
• ea28cc3 [wrangler] Add observability query string redaction (#15379)
• 1809c5e [wrangler] Stop publishing build metafile (#15398)
• 10d6bfb Support partial manifests in build output (#15388)
• dbbb795 Move binding utilities into workers-utils (#15454)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions