Skip to content

build(deps): bump the dependencies group across 1 directory with 23 updates - #104

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dependencies-2a24eed594
Open

build(deps): bump the dependencies group across 1 directory with 23 updates#104
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dependencies-2a24eed594

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026 •
edited by cubic-dev-ai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 23 updates in the / directory:

Package From To
@pleaseai/eslint-config 0.0.4 0.1.0
@types/bun 1.3.14 1.4.3
eslint 10.7.0 10.12.0
turbo 2.10.5 2.11.8
typescript 6.0.3 7.0.2
@cloudflare/nimbus-docs 0.6.1 0.18.1
astro-icon 1.1.5 1.2.0
astro-og-canvas 0.13.0 0.13.2
canvaskit-wasm 0.41.1 0.42.0
sanitize-html 2.17.6 2.18.1
@types/sanitize-html 2.16.1 2.16.2
tailwind-merge 3.6.0 3.7.0
@astrojs/check 0.9.9 0.9.10
@types/sanitize-html 2.16.1 2.16.2
wrangler 4.112.0 4.151.3
workerd 1.20260714.1 1.20261019.1
@base-ui/react 1.6.0 1.9.0
lucide-react 1.25.0 1.57.0
recharts 3.10.0 3.10.1
@types/node 26.1.1 26.6.5
yaml 2.9.0 2.9.1
zod 4.6.5 4.6.7
vite 8.1.3 8.3.4
vitest 4.1.12 5.0.4

Updates @pleaseai/eslint-config from 0.0.4 to 0.1.0

Release notes

Sourced from @​pleaseai/eslint-config's releases.

ast-grep-config: v0.1.0

0.1.0 (2026-10-13)

⚠ BREAKING CHANGES

  • deps: @​pleaseai/eslint-config now requires eslint ^10.4.0. ESLint 9 is no longer supported.

Features

  • add @​pleaseai/ast-grep-config rules and please-style check path checker (#36) (8aadb75)

Bug Fixes

  • cli: close Yarn Plug'n'Play and Kotlin Multiplatform gaps in please-style (#48) (2ef3049)
  • cli: tighten please-style check heuristics deferred from #36 (#42) (42a5f65), closes #37

Miscellaneous Chores

  • deps: update dependencies within semver ranges across workspaces (#41) (1858fcd)

code-style: v0.1.0

0.1.0 (2026-10-13)

⚠ BREAKING CHANGES

  • deps: @​pleaseai/eslint-config now requires eslint ^10.4.0. ESLint 9 is no longer supported.

Features

  • add @​pleaseai/ast-grep-config rules and please-style check path checker (#36) (8aadb75)

Bug Fixes

  • cli: close Yarn Plug'n'Play and Kotlin Multiplatform gaps in please-style (#48) (2ef3049)
  • cli: tighten please-style check heuristics deferred from #36 (#42) (42a5f65), closes #37

Miscellaneous Chores

  • deps: update dependencies within semver ranges across workspaces (#41) (1858fcd)

eslint-config: v0.1.0

0.1.0 (2026-10-13)

... (truncated)

Changelog

Sourced from @​pleaseai/eslint-config's changelog.

0.1.0 (2026-10-13)

⚠ BREAKING CHANGES

  • deps: @​pleaseai/eslint-config now requires eslint ^10.4.0. ESLint 9 is no longer supported.

Miscellaneous Chores

  • deps: update dependencies within semver ranges across workspaces (#41) (1858fcd)
Commits
  • 38ca3fd chore: release main (#38)
  • 1858fcd chore(deps)!: update dependencies within semver ranges across workspaces (#41)
  • a011ad4 chore: apply PassionFactory standards setup (toolchain, Claude Code, OSS) (#40)
  • 509ec9c chore(deps-dev): bump tsdown (#17)
  • 79cc35b chore(deps): bump the production-dependencies group across 1 directory with 2...
  • 3ec62e2 chore: add repository field for npm provenance
  • See full diff in compare view

Updates @types/bun from 1.3.14 to 1.4.3

Commits

Updates eslint from 10.7.0 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

  • 4618052 feat: handle astral letters in new-cap (#21357) (sary)
  • 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
  • efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
  • 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
  • 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
  • b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
  • 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
  • 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

  • 67eb586 docs: Update README (GitHub Actions Bot)
  • 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
  • 8816c1d docs: Update README (GitHub Actions Bot)
  • 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

  • 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
  • bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
  • d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
  • 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
  • 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
  • 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
  • f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
  • b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
  • 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

v10.11.0

Features

  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
  • 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
  • d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
  • b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
  • 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
  • 6c789ff docs: Update README (GitHub Actions Bot)
  • 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

... (truncated)

Commits
  • a438ec3 10.12.0
  • 32a73f1 Build: changelog update for 10.12.0
  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
  • 152067f chore: update ecosystem plugins (#21362)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
  • 67eb586 docs: Update README
  • bfaea12 perf: cache normalized config globals per languageOptions (#21364)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
  • d166567 chore: update dependency prettier to v3.9.9 (#21371)
  • Additional commits viewable in compare view

Updates turbo from 2.10.5 to 2.11.8

Release notes

Sourced from turbo's releases.

Turborepo v2.11.8

What's Changed

Changelog

... (truncated)

Commits
  • 7663d6b publish 2.11.8 to registry
  • ad820cb fix: Disable agent guidance by default (#14490)
  • 6e9c65b fix: Prevent Git index refresh during dirty hash collection (#14489)
  • b5fe180 feat: Validate sealed native setup baselines (#14482)
  • cb615c3 chore: Add copyable Factory snapshot command (#14481)
  • 71d0766 fix: Upgrade turbo-gen Handlebars to 4.7.10 (#14471)
  • 2935202 docs: Explain declaring Cargo sources read from outside the crate (#14480)
  • 215637c fix: Report inferred framework env vars for deferred tasks in dry runs (#14478)
  • d6d63bd fix: Carry uv tool configuration into pruned workspaces (#14449)
  • 768d5ba fix: Hash Clippy configuration for Cargo lint tasks (#14448)
  • Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @cloudflare/nimbus-docs from 0.6.1 to 0.18.1

Release notes

Sourced from @​cloudflare/nimbus-docs's releases.

@​cloudflare/nimbus-docs@​0.18.1

Patch Changes

  • #247 b98bd3f Thanks @​MohamedH1998! - - Generated _headers rules leave out any header the site's own _headers already sets for that path, site-wide rules included, so hosts no longer send doubled values such as Access-Control-Allow-Origin: *, *.

  • #250 d664242 Thanks @​sansynx! - Keep application warnings visible during concurrent OpenAPI specification publication.

  • #257 e9a4360 Thanks @​MohamedH1998! - - New Cloudflare projects, and nimbus-docs add adapter-cloudflare when wrangler.jsonc has no valid date, get a compatibility_date the installed Workers runtime supports instead of today's date, so local dev starts.

@​cloudflare/nimbus-docs@​0.17.0

Minor Changes

  • #204 a8e0d02 Thanks @​MohamedH1998! - - Agent files follow the rendering policy: a page's index.md/index.mdx renders in its collection's mode, a section's llms.txt in the mode of the collection it lists, llms.txt/llms-full.txt in rendering.default, and homepage Markdown in the root collection's mode. Mounted collections get their own agent routes, copied starter routes keep working unchanged, and static sites don't change.

  • #201 855091c Thanks @​MohamedH1998! - Add samples.generate to choose which languages Nimbus generates code samples in, and fix generated samples and examples that sent different values from the page.

    • samples.generate: set samples: { generate: ["curl"] } on an api entry to generate only a cURL request, instead of cURL, TypeScript, and Python, on every operation. [] generates none, so operations show only their authored x-codeSamples. The default is unchanged: all three. samples.keepGenerated still picks the generated languages shown next to authored samples; each of its languages must now also be in generate.
    • Python and TypeScript bodies: in Python, a string containing a newline, carriage return, or tab no longer breaks the sample with a SyntaxError, and object keys with quotes or backslashes stay valid. In both languages, a backslash is no longer read as an escape (C:\\temp\\new was sent with a tab and a newline), including in text bodies such as text/plain. A JSON body of false, 0, or "" is now sent instead of dropped.
    • cURL bodies: a body containing ' was passed through an unquoted heredoc, so the shell collapsed backslashes and ran $NAME and backticks in the example when the sample was pasted. The heredoc is now quoted.
    • Form bodies: application/x-www-form-urlencoded bodies were dropped from every sample and are now sent in all three languages. A property with an encoding entry follows OpenAPI: style, explode, or allowReserved select query-style serialization, and an entry without them sends the value as its contentType, so an object is sent as JSON. A property without an entry nests objects in brackets (metadata[plan]=pro), repeats the name for each item of a scalar array (tags=a&tags=b), and indexes arrays of objects (items[0][price]=p_1). A string example is read as an encoded form; a form example with no fields sends no body. multipart/form-data bodies are still omitted.
    • Form encoding: explicit JSON content types serialize scalar values as JSON before form encoding. allowReserved: true preserves valid percent-encoded triples and safe reserved characters without double encoding; form delimiters and unsafe characters remain encoded.
    • cURL text bodies: a body starting with @ is sent as text instead of uploading the file it names.
    • Joined form values: a ,, |, or space inside an array item no longer reads as a separator with explode: false, unless allowReserved: true leaves a , unencoded.
    • Empty form field names: cURL now sends =value like the other languages.
    • Request example: an operation without code samples, such as with samples.generate: [], shows its request example on the page.
    • Swagger 2.0: a Swagger 2.0 document now fails the build with Swagger 2.0 isn't supported. Convert it to OpenAPI 3.x first. and the document's path, instead of building pages with no server URL, unknown parameter types, and missing response schemas. The API reference docs show how to convert one before each build.

    If the installed httpsnippet writes a body differently from the layout Nimbus corrects, that language's sample is left out rather than shown with an unescaped body. Authored x-codeSamples are unchanged. New sites scaffolded by create-nimbus-docs use this release.

  • #207 d77ff08 Thanks @​MohamedH1998! - - A request-rendered API family can set versionMode: "query": one URL per operation, the version in ?api-version= (absent means the default, unknown is 404, hidden versions reachable by query only). Generated same-version links carry the query; discovery covers the default version at version-free URLs; non-default pages are noindex with the default counterpart as canonical. Path mode stays the default and is unchanged.

    • API version ids may contain dots, and must start and end with a letter or digit. An id like -v1 or v1- now fails validation; rename it.

  • #198 86b573a Thanks @​MohamedH1998! - - Skills in skills/<name>/SKILL.md folders are published at /.well-known/agent-skills/ with a discovery index, archives for multi-file skills, and digests.

  • #199 b8a8dbd Thanks @​MohamedH1998! - - Sites with API collections publish every spec, including hidden versions, as one self-contained openapi.json at its mount path, and list each visible API in an RFC 9727 catalog at /.well-known/api-catalog. Set publishSpec: false to keep a spec private.

  • #195 b685092 Thanks @​MohamedH1998! - - Add discovery files, homepage Markdown, and Link headers to all sites.

    • Add editable Content Signals to the starter's robots.txt.

  • #205 7b76521 Thanks @​MohamedH1998! - - Sidebar groups are native details/summary with one class per row type, a CSS caret, and no animation; a group's landing page lists as an "Overview" child row. Each page renders one sidebar tree, shared by the desktop rail and the mobile drawer, and a large sidebar's page HTML drops by roughly 80%. The state scripts drive the old copied markup too.

  • #203 62d7956 Thanks @​MohamedH1998! - - Only collections made with Nimbus's helpers (docsCollection(), componentsCollection(), withNimbusMarkdown()) become pages; every other collection is plain Astro data with no naming rule, and the _ prefix convention is removed. If rendering is set, a site's own page collection with a catch-all route now needs an entry in rendering.collections.

  • #196 2e200ce Thanks @​MohamedH1998! - - The starter registers a search_documentation WebMCP tool, backed by the site's Pagefind index.

  • #200 c17a945 Thanks @​MohamedH1998! - - On server output, a request-rendered page returns its Markdown when the request prefers text/markdown; the URL stays canonical and both forms send Vary: Accept.

    • The starter homepage renders on request when a collection already does under server output, so it negotiates too. All-build homepages remain prerendered in production.
    • Preserve owner static-header rules while adding discovery fields, and support prose request rendering and published Markdown negotiation through Astro adapters and standard HTTP on non-Cloudflare deployments.
    • Recreate the isolated browser-agent Pagefind instance after observable search failures and give accurate connection/reload guidance. Pagefind's swallowed index-chunk failures remain a documented upstream limitation.
    • Include a release-matched agent-interface guide in the framework package and point generated project instructions to it.

... (truncated)

Changelog

Sourced from @​cloudflare/nimbus-docs's changelog.

0.18.1

Patch Changes

  • #247 b98bd3f Thanks @​MohamedH1998! - - Generated _headers rules leave out any header the site's own _headers already sets for that path, site-wide rules included, so hosts no longer send doubled values such as Access-Control-Allow-Origin: *, *.

  • #250 d664242 Thanks @​sansynx! - Keep application warnings visible during concurrent OpenAPI specification publication.

  • #257 e9a4360 Thanks @​MohamedH1998! - - New Cloudflare projects, and nimbus-docs add adapter-cloudflare when wrangler.jsonc has no valid date, get a compatibility_date the installed Workers runtime supports instead of today's date, so local dev starts.

0.18.0

Minor Changes

  • #229 a04304c Thanks @​MohamedH1998! - - A page or reusable snippet with only frontmatter builds, and its Markdown version is just its title and source.

    • A snippet included inside a list item or quote keeps that structure in the page's Markdown version.
    • llms.txt names each section for its index page's title, such as "Guides" instead of guides.
    • Documentation search results link to the page itself instead of a URL ending in #, and excerpts no longer include the page actions.
    • The Markdown version of an API page names each field as the page does, with its full coordinate beside it for citing.

  • #232 d655e86 Thanks @​MohamedH1998! - - API pages link to the previous and next page in sidebar order, even when a group is collapsed.

    • Error responses start collapsed; a link to one, or to a field inside it, opens it.
    • A sidebar link to an API or docs-version mount, such as /api, no longer warns.
    • Operations that fall back to a coordinate route print one summary line, so other warnings stay visible.
    • Samples and the endpoint card keep a server URL's query after the path.
    • Response toggles meet 4.5:1 contrast in light mode, field anchors work on touch screens, and "Authorisation" reads "Authorization".

  • #211 4a841cb Thanks @​MohamedH1998! - - Add bundle: false to an api entry to serve a very large or many-version API from static assets instead of the server bundle. Unchanged pages are shared across versions, and unchanged versions aren't prepared again on rebuild. Needs src/live.config.ts registering apiPagesLoader from @cloudflare/nimbus-docs/live; the build shows the snippet. The build suggests the option when an API's bundled page data passes 16 MiB.

    • Add getVersionSwitchUrl and getApiVersionHead for version pickers and heads in every rendering mode; the starter's picker and API layout use them.

  • #212 94ebe52 Thanks @​MohamedH1998! - API pages show the sidebar filter. With sidebar: "on-demand" it also finds pages the sidebar hasn't loaded.

  • #222 e15eea7 Thanks @​MohamedH1998! - New api[].extensions option: list the x-* fields to keep, and their values are copied onto API pages as page.extensions and field.extensions for your components to render.

  • #214 825ffcf Thanks @​MohamedH1998! - API reference pages show the version picker for versioned APIs, in the sidebar and the mobile navigation.

  • #211 02f53a1 Thanks @​MohamedH1998! - versionMode is now versionUrl: versionUrl: { in: "query" } selects the version with ?version= instead of ?api-version=, and old links redirect. Set param to use another name (review entry api-version-url).

  • #240 381b37a Thanks @​MohamedH1998! - - og:image:width and og:image:height describe the image: generated cards stay 1200 × 630, a socialImage file in public/ is measured at build time, and any other image gets no size tags. NimbusHead takes socialImageSize to set them for an image Nimbus can't measure.

    • The sitemap has <lastmod> on every documentation page, from frontmatter lastUpdated or the page's last commit, and /sitemap.xml is a copy of sitemap-index.xml unless the site serves its own.
    • The starter's BaseLayout passes socialImageSize through to NimbusHead, and the 404 page recipe writes the new title and noindex.
    • On a shallow clone, pages get no git dates instead of the wrong one, and the build says how to fetch the history.
    • The 404 page's title is Page not found | <site> and the page is noindex.

  • #233 1f2ce43 Thanks @​MohamedH1998! - - New sites open content images at full size on click. On an existing site, run nimbus-docs add image-zoom and render <ImageZoom /> in src/layouts/DocsLayout.astro.

  • #238 315ab66 Thanks @​MohamedH1998! - - A resource-action-v2 route convention publishes tag pages at lowercase URLs, such as /api/tags/user-management, with the same operation URLs as resource-action-v1. Existing conventions, and sites without routes, are unchanged.

    • The API reference recipe sets resource-action-v2 on new sites and resolves the route collisions the build reports.

  • #224 79b05ef Thanks @​MohamedH1998! - - New markdown.features option turns on Sätteri syntax, such as { headingAttributes: true } for ## Install {#install} or { math: true }. Pages, generated Markdown, reusable snippets and lint all follow it. New sites start with heading ids on.

... (truncated)

Commits
  • 482054f chore: bump package versions
  • a27cf79 Revert "feat: build one collection or a set with NIMBUS_BUILD_ONLY"
  • 9279e8d Revert "fix: upgrade safety: add --overwrite without a terminal, sharp on pnp...
  • e9a4360 fix: write a compatibility date the local workers runtime supports
  • 27fa6b1 Merge pull request #242 from cloudflare/fix/upgrade-safety
  • d664242 Preserve warnings during concurrent spec publication
  • d2a08f2 fix: slice search results resolve from the site root, and the root llms.txt n...
  • 23291af test: compare the root sitemap url exactly
  • 88b3265 fix: keep a site's own .well-known files in a slice
  • 3c484e0 test: accept the date every route truth carries
  • Additional commits viewable in compare view

Updates astro-icon from 1.1.5 to 1.2.0

Release notes

Sourced from astro-icon's releases.

astro-icon@1.2.0

Minor Changes

  • #290 956817e Thanks @​stramel! - Bump @iconify/tools to v5 and @iconify/utils to v3, removing the transitive extract-zip dependency that was flagged for a symlink path-traversal vulnerability (GHSA-jmr9-qjv8-65gv).

    Requires Node ≥22.12 — @iconify/utils v3 uses node:util's styleText, which needs Node ≥20.12/21.7, but the toolchain now also builds against Astro 7 (which itself requires Node ≥22.12). Node 20 reached end-of-life in April 2026, so astro-icon's engines field is raised to the currently-supported floor rather than the bare minimum.

  • #285 2e83ca0 Thanks @​stramel! - title/desc props now accept { id, value } in addition to a plain string, so consumers can set id attributes on the generated <title>/<desc> elements for aria-labelledby referencing.

Patch Changes

  • #291 3db45a5 Thanks @​stramel! - Strip the lastModified timestamp from the generated local icon collection so its output is deterministic across builds, allowing Astro's incremental build cache to work as expected.

  • #288 adb18cf Thanks @​stramel! - Log a warning instead of silently swallowing errors when the local icon collection fails to load, so failures during dev/build are visible instead of hidden.

  • #287 fd5d522 Thanks @​strame...

    Description has been truncated

    Summary by cubic

    Bumps 23 dependencies across the monorepo, mostly patch and minor releases. Notable changes to review: typescript jumps 6.0.3 → 7.0.2, vitest jumps 4.1.12 → 5.0.4, and @pleaseai/eslint-config 0.0.4 → 0.1.0 now requires ESLint ≥10.4.0, dropping ESLint 9 support.

    Migration

    • Verify TypeScript 7 and vitest 5 don't break build, lint, and test workflows.
    • @cloudflare/nimbus-docs jumps 0.6.1 → 0.18.1, which includes API and sidebar rendering changes.

    Written for commit 08c111cd0e51877552cbf9bd8741ed2f9c7d9616. Summary will update on new commits.

    Turn on auto-fix

@dependabot
build(deps): bump the dependencies group across 1 directory with 23 u…
08c111c 
…pdates

Bumps the dependencies group with 23 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@pleaseai/eslint-config](https://github.com/pleaseai/code-style/tree/HEAD/packages/eslint-config) | `0.0.4` | `0.1.0` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.3.14` | `1.4.3` |
| [eslint](https://github.com/eslint/eslint) | `10.7.0` | `10.12.0` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.5` | `2.11.8` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@cloudflare/nimbus-docs](https://github.com/cloudflare/nimbus/tree/HEAD/packages/nimbus-docs) | `0.6.1` | `0.18.1` |
| [astro-icon](https://github.com/natemoo-re/astro-icon/tree/HEAD/packages/core) | `1.1.5` | `1.2.0` |
| [astro-og-canvas](https://github.com/delucis/astro-og-canvas/tree/HEAD/packages/astro-og-canvas) | `0.13.0` | `0.13.2` |
| [canvaskit-wasm](https://github.com/google/skia) | `0.41.1` | `0.42.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.6` | `2.18.1` |
| [@types/sanitize-html](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html) | `2.16.1` | `2.16.2` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.6.0` | `3.7.0` |
| [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.9` | `0.9.10` |
| [@types/sanitize-html](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html) | `2.16.1` | `2.16.2` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.112.0` | `4.151.3` |
| [workerd](https://github.com/cloudflare/workerd) | `1.20260714.1` | `1.20261019.1` |
| [@base-ui/react](https://github.com/mui/base-ui/tree/HEAD/packages/react) | `1.6.0` | `1.9.0` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.25.0` | `1.57.0` |
| [recharts](https://github.com/recharts/recharts) | `3.10.0` | `3.10.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.6.5` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |
| [zod](https://github.com/colinhacks/zod) | `4.6.5` | `4.6.7` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.3` | `8.3.4` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.12` | `5.0.4` |



Updates `@pleaseai/eslint-config` from 0.0.4 to 0.1.0
- [Release notes](https://github.com/pleaseai/code-style/releases)
- [Changelog](https://github.com/pleaseai/code-style/blob/main/packages/eslint-config/CHANGELOG.md)
- [Commits](https://github.com/pleaseai/code-style/commits/code-style-v0.1.0/packages/eslint-config)

Updates `@types/bun` from 1.3.14 to 1.4.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `eslint` from 10.7.0 to 10.12.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.7.0...v10.12.0)

Updates `turbo` from 2.10.5 to 2.11.8
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.5...v2.11.8)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

Updates `@cloudflare/nimbus-docs` from 0.6.1 to 0.18.1
- [Release notes](https://github.com/cloudflare/nimbus/releases)
- [Changelog](https://github.com/cloudflare/nimbus/blob/main/packages/nimbus-docs/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/nimbus/commits/@cloudflare/nimbus-docs@0.18.1/packages/nimbus-docs)

Updates `astro-icon` from 1.1.5 to 1.2.0
- [Release notes](https://github.com/natemoo-re/astro-icon/releases)
- [Changelog](https://github.com/natemoo-re/astro-icon/blob/main/packages/core/CHANGELOG.md)
- [Commits](https://github.com/natemoo-re/astro-icon/commits/astro-icon@1.2.0/packages/core)

Updates `astro-og-canvas` from 0.13.0 to 0.13.2
- [Release notes](https://github.com/delucis/astro-og-canvas/releases)
- [Changelog](https://github.com/delucis/astro-og-canvas/blob/latest/packages/astro-og-canvas/CHANGELOG.md)
- [Commits](https://github.com/delucis/astro-og-canvas/commits/astro-og-canvas@0.13.2/packages/astro-og-canvas)

Updates `canvaskit-wasm` from 0.41.1 to 0.42.0
- [Changelog](https://github.com/google/skia/blob/main/RELEASE_NOTES.md)
- [Commits](https://github.com/google/skia/commits/canvaskit/0.42.0)

Updates `sanitize-html` from 2.17.6 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `@types/sanitize-html` from 2.16.1 to 2.16.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html)

Updates `tailwind-merge` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge)

Updates `@astrojs/check` from 0.9.9 to 0.9.10
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.10/packages/language-tools/astro-check)

Updates `@types/sanitize-html` from 2.16.1 to 2.16.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html)

Updates `wrangler` from 4.112.0 to 4.151.3
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.151.3/packages/wrangler)

Updates `workerd` from 1.20260714.1 to 1.20261019.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](cloudflare/workerd@v1.20260714.1...v1.20261019.1)

Updates `@base-ui/react` from 1.6.0 to 1.9.0
- [Release notes](https://github.com/mui/base-ui/releases)
- [Changelog](https://github.com/mui/base-ui/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mui/base-ui/commits/v1.9.0/packages/react)

Updates `lucide-react` from 1.25.0 to 1.57.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.57.0/packages/lucide-react)

Updates `recharts` from 3.10.0 to 3.10.1
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v3.10.0...v3.10.1)

Updates `@types/node` from 26.1.1 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

Updates `zod` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.5...v4.6.7)

Updates `vite` from 8.1.3 to 8.3.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite)

Updates `vitest` from 4.1.12 to 5.0.4
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.4/packages/vitest)

---
updated-dependencies:
- dependency-name: "@pleaseai/eslint-config"
  dependency-version: 0.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/bun"
  dependency-version: 1.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: eslint
  dependency-version: 10.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: turbo
  dependency-version: 2.11.8
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@cloudflare/nimbus-docs"
  dependency-version: 0.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: astro-icon
  dependency-version: 1.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: astro-og-canvas
  dependency-version: 0.13.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: canvaskit-wasm
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/sanitize-html"
  dependency-version: 2.16.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: tailwind-merge
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/sanitize-html"
  dependency-version: 2.16.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: wrangler
  dependency-version: 4.151.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: workerd
  dependency-version: 1.20261019.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@base-ui/react"
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: lucide-react
  dependency-version: 1.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: recharts
  dependency-version: 3.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: vitest
  dependency-version: 5.0.4
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 22, 2026
@greptile-apps

greptile-apps Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

PR author is in the excluded authors list.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-22T14:10:56.410245Z 08c111c PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@socket-security

socket-security Bot commented Oct 22, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updated@​types/​bun@​1.3.14 ⏵ 1.4.31001004893 +2100
Updated@​types/​sanitize-html@​2.16.1 ⏵ 2.16.21001006987 +7100
Updated@​pleaseai/​eslint-config@​0.0.4 ⏵ 0.1.070 +41009787 -1100
Addedvitest@​5.0.4981007998100
Updated@​astrojs/​check@​0.9.9 ⏵ 0.9.101001008092 +6100
Updatedlucide-react@​1.25.0 ⏵ 1.57.010010098 +196 +180
Updatedastro-icon@​1.1.5 ⏵ 1.2.010010010082 +2100
Updatedturbo@​2.10.5 ⏵ 2.11.8100 +110085 +197100
Updatedcanvaskit-wasm@​0.41.1 ⏵ 0.42.0100 +110099 +187 -3100
Updatedastro-og-canvas@​0.13.0 ⏵ 0.13.2100 +71009988 -3100
Addedtypescript@​7.0.29910089100100
Updated@​cloudflare/​nimbus-docs@​0.6.1 ⏵ 0.18.197 +2110092 +598 +7100
Updatedrecharts@​3.10.0 ⏵ 3.10.198 +19100100 +196100
Updatedeslint@​10.7.0 ⏵ 10.12.097 +110010097100

View full report

@codecov

codecov Bot commented Oct 22, 2026

Copy link
Copy Markdown

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 22, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 08c111cd0e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread apps/docs/package.json
},
"dependencies": {
"@cloudflare/nimbus-docs": "^0.6.1",
"@cloudflare/nimbus-docs": "^0.18.1",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Upgrade Astro alongside Nimbus

Nimbus 0.18.1 declares astro >=7.2.6 <8.0.0, while the committed frozen lockfile still resolves astro@7.1.3 (bun.lock:317 and bun.lock:1173); its bundled @astrojs/mdx 8 also expects a newer Astro generation. Consequently CI installs an unsupported mixture for the docs build and typecheck. Upgrade Astro to a compatible release and regenerate the lockfile together with this Nimbus bump.

Useful? React with 👍 / 👎.

Comment thread package.json
"@types/bun": "^1.4.3",
"eslint": "^10.12.0",
"turbo": "^2.11.8",
"typescript": "^7.0"

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep TypeScript on a supported major

The frozen graph resolves TypeScript 7, but the updated lint/typecheck stack does not support it: @astrojs/check accepts only TypeScript 5 or 6 (bun.lock:151), and the locked @typescript-eslint parser/tooling requires <6.1.0 (bun.lock:1021-1037). Since the quality workflow runs both ESLint and astro check, this makes those required checks operate outside their declared compatibility ranges; retain TypeScript 6 until both toolchains support 7, including the separate docs declaration.

Useful? React with 👍 / 👎.

Comment thread packages/emdash-plugin/package.json
"emdash": "^1.3.1",
"vite": "^8",
"vitest": "^4.1.0"
"vitest": "^5.0.4"

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the host-test runner compatible with plugin-test

The host-test config combines emdashPluginTest() from @emdash-cms/plugin-test with the workspace Vitest runner, but plugin-test 0.2.10 declares only vitest ^4.1.0 (bun.lock:385). With this bump, the lockfile installs Vitest 5 for vitest run and a separate Vitest 4.1.12 beneath plugin-test (bun.lock:2423 and bun.lock:2601), so the CI host-test step crosses unsupported runner/plugin APIs and separate Vitest instances. Keep Vitest 4 here until plugin-test publishes Vitest 5 support.

Useful? React with 👍 / 👎.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants