[dependabot]

Bumps the server-dependencies group in /server with 6 updates:

Package	From	To
@biomejs/biome	2.6.3	2.6.4
tsdown	0.23.2	0.23.4
wrangler	4.153.0	4.155.0
@types/node	26.6.5	26.6.6
jose	6.2.13	6.2.14
@cloudflare/workers-types	5.20261026.1	5.20261029.1

Updates @biomejs/biome from 2.6.3 to 2.6.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.4

2.6.4

Patch Changes

• #12261 19fbfb2 Thanks @​dyc3! - Added the new nursery rule noConsoleSpaces, which reports a leading or trailing space in a console.log(), console.debug(), console.info(), console.warn(), or console.error() argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.

  console.log("abc ", "def");

• #12469 cd716d3 Thanks @​dyc3! - Added the new nursery rule noMagicArrayFlatDepth, which reports number literals other than 1 passed as the depth of Array.prototype.flat() unless a comment inside the parentheses explains them.

  const items = array.flat(2);

• #12470 92c9e81 Thanks @​dyc3! - Added the nursery rule noNull, which reports uses of the null literal and suggests undefined instead. Strict comparisons such as foo === null are allowed.

  let foo = null;

• #12483 9bd3527 Thanks @​dyc3! - Added the nursery rule noReturnArrayPush, which reports code that uses the return value of push() or unshift(). These methods return the new length of the array, not the added item or the array.

  function add(item) {
    return items.push(item);
  }

• #12477 a384892 Thanks @​dyc3! - Added the nursery rule noUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.

  const foo = (bar => (bar ? bar.baz : baz))(getBar());

• #12447 0a963e4 Thanks @​dyc3! - Added the nursery rule noUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.

  function findRoot(node) {
      if (node.parent) {
          return findRoot(node.parent);
      }
      return node;
  }

• #12554 2eddda9 Thanks @​dyc3! - Added the nursery rule noVueComputedPropertiesInData, which reports computed properties used inside the data function of a Vue component. Vue runs data before it sets up computed properties, so the value read there is undefined.

... (truncated)

Commits

• 5653874 ci: release (#12647)
• 824df15 feat(lint): add noVueDeprecatedDeleteSet (#12586)
• 861b288 feat(lint): add noVueUnusedRefs (#12603)
• 2eddda9 feat(lint): add noVueComputedPropertiesInData (#12554)
• 5d7553b feat(lint): add noVueMultipleSlotArgs (#12562)
• de1188f feat(lint): add noVueDeprecatedScopeAttribute (#12631)
• 2e520d8 feat(lint): add noVueMutatingProps (#12513)
• ade9845 feat(lint): add useVueDefineOptions (#12615)
• 6fc1a51 feat(lint): add noVueDeprecatedRouterLinkTagProp (#12648)
• a810209 feat(lint): add useVueValidDefineEmits (#12591)
• Additional commits viewable in compare view

Updates tsdown from 0.23.2 to 0.23.4

Release notes

Sourced from tsdown's releases.

v0.23.4

   🚀 Features

• cjs: Warn when platform is ignored for the CJS format  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1111 (58003)
• config: Support multiple env files  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1110 (5d558)

   🐞 Bug Fixes

• attw: Apply profiles to file-based problems  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1108 (a853d)
• config: Ignore empty env file paths and scope env deps per watcher  -  by @​sxzzbot (17bd0)
• css: Inline ?inline CSS imported from dependencies  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1109 (75a78)

   🏎 Performance

• Use tinyps in hooks  -  by @​43081j in rolldown/tsdown#1112 (f925e)

    View changes on GitHub

v0.23.3

   🐞 Bug Fixes

• Downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1107 (0344c)

    View changes on GitHub

Commits

• 83b6fb5 chore: release v0.23.4
• 8e22a34 chore: upgrade deps, hoist regex patterns
• f925e52 perf: use tinyps in hooks (#1112)
• 17bd0fc fix(config): ignore empty env file paths and scope env deps per watcher
• 5800398 feat(cjs): warn when platform is ignored for the CJS format (#1111)
• 5d55836 feat(config): support multiple env files (#1110)
• 75a78ce fix(css): inline ?inline CSS imported from dependencies (#1109)
• a853d19 fix(attw): apply profiles to file-based problems (#1108)
• 53638e8 chore: release v0.23.3
• 0344c4f fix: downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support ...
• See full diff in compare view

Updates wrangler from 4.153.0 to 4.155.0

Release notes

Sourced from wrangler's releases.

wrangler@4.155.0

Minor Changes

• #16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

  Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

  {
    "analytics_engine_datasets": [
      {
        "binding": "EVENTS",
        "dataset": "my-dataset",
        "remote": true
      }
    ]
  }

Patch Changes

• #16526 dba0e81 Thanks @​petebacondarwin! - Render terminal control characters as visible text in tail output

  Pretty tail and remote-preview output now escape control characters in log strings, exceptions and event metadata. Unicode, tabs and multiline logs remain readable, and JSON output keeps the original structured values.

• #16489 fc57bc0 Thanks @​akshitsinha! - Keep Flagship flag metadata when updating flags

  wrangler flagship flags commands that update an existing flag, such as enable, set, rollout, split, and rules, no longer clear the flag's metadata. wrangler flagship flags pull now copies metadata into the local flag store.

• #16521 ec6eddd Thanks @​petebacondarwin! - Validate .assetsignore encoding before building asset manifests

  Asset uploads and local development now stop with an actionable user error when .assetsignore is not valid UTF-8 or contains null characters, instead of silently losing its patterns. This also applies to standalone Miniflare and the Wrangler, Vite and Vitest development integrations. Save the file as UTF-8 to continue; UTF-8 files with a byte order mark and intentionally empty files remain supported.

• Updated dependencies [a95d647, c7a3373, c7a3373, c7a3373]:

  • miniflare@5.20261023.2-beta

wrangler@4.154.0

Minor Changes

• #16494 0968b08 Thanks @​petebacondarwin! - Enable Miniflare's development registry by default and centralize path resolution

  In Miniflare v5 beta, resolve the registry from CLOUDFLARE_DEV_REGISTRY_PATH, then the unsafeDevRegistryPath constructor option, then <Cloudflare config directory>/dev-registry/v5. The default is independent of legacy Wrangler directories and is scoped to the Miniflare major version. The Vite v2 beta plugin follows this new default, while current Wrangler and getPlatformProxy() retain Wrangler's legacy default for compatibility with existing Wrangler sessions. Vite v2 and Wrangler therefore require the same CLOUDFLARE_DEV_REGISTRY_PATH to discover each other; set it for both processes when mixing these tools.

  Add enableDevRegistry: false to disable registration and discovery explicitly. Shared storage now uses the resolved default without requiring an explicit path. As before, shared storage requires an enabled registry to elect a storage owner, so combining unsafeEnableSharedStorage: true with enableDevRegistry: false is rejected. Miniflare no longer reads MINIFLARE_REGISTRY_PATH; use CLOUDFLARE_DEV_REGISTRY_PATH instead. Expose resolveDevRegistryPath() for integrations that also read registry files. Wrangler uses the effective path for its runtime configuration, initial bindings display, and Flagship active-session check, so the canonical override cannot bypass that check. An explicitly disabled Wrangler registry remains disabled.

Patch Changes

• #16499 f3c13b3 Thanks @​dinasaur404! - Preserve binding error codes and names in local development

  Errors from remote bindings and from Node.js binding proxies (getPlatformProxy() and Miniflare#getBindings()) now keep their machine-readable properties, such as Artifacts' code and numericCode. Previously these properties were dropped and the error name was folded into the message (for example "ArtifactsError: Repository not found"), so code could only branch on error text during local development.

... (truncated)

Commits

• a09957a Version Packages (#16553)
• c7a3373 Revert "Version Packages" (#16554)
• a95d647 [wrangler] Support remote Analytics Engine bindings in local dev (#16536)
• 52315bd Version Packages (#16529)
• dba0e81 [wrangler] Escape terminal controls in tail output (#16526)
• fc57bc0 [miniflare] Enable local Flagship management without Worker bindings (#16489)
• ec6eddd [wrangler] Validate .assetsignore encoding before building asset manifests (#...
• 71d0903 Version Packages (#16500)
• 0968b08 [miniflare] Enable the dev registry by default and centralize path resolution...
• See full diff in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates jose from 6.2.13 to 6.2.14

Release notes

Sourced from jose's releases.

v6.2.14

Fixes

• types: preserve contextual JWT payload inference (0dbf7a0), closes #911

Changelog

Sourced from jose's changelog.

6.2.14 (2026-10-29)

Fixes

• types: preserve contextual JWT payload inference (0dbf7a0), closes #911

Commits

• 5a6a5b6 chore(release): 6.2.14
• b04c907 test: handle JWKS rotation and algorithm migration
• 4e3292e chore: bump packages
• 0dbf7a0 fix(types): preserve contextual JWT payload inference
• 4080772 test: simplify runtime support checks
• 2cddc59 chore: cleanup after release
• See full diff in compare view

Updates @cloudflare/workers-types from 5.20261026.1 to 5.20261029.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.