[dependabot]

Bumps the documentation-dependencies group in /web with 5 updates:

Package	From	To
sass	1.106.1	1.107.0
@biomejs/biome	2.6.3	2.6.4
@cloudflare/workers-types	5.20261026.1	5.20261029.1
@types/node	26.6.5	26.6.6
wrangler	4.153.0	4.155.0

Updates sass from 1.106.1 to 1.107.0

Release notes

Sourced from sass's releases.

Dart Sass 1.107.0

To install Sass 1.107.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Command-Line Interface

• The --fatal-deprecation flag can now exclude deprecations that would otherwise be included by passing a version number. To exclude a deprecation, add - before its name. For example, --fatal-deprecation=1.107.0,-import includes all deprecations that were present in Dart Sass 1.107.0 except for the @import deprecation.

• The --fatal-deprecation flag now takes the special value dart-sass-2, which treats as fatal all deprecations that will become fatal in Dart Sass 2.0.0.

JavaScript API

• Options.fatalDeprecations can now take a DeprecationSelectorDifference object of the form {include: ..., except: ...}, where the include field lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field takes precedence over include.

• Add a (non-enumerable) sass.deprecations.dartSass2 property which can be passed to Options.fatalDeprecations to mark as fatal exactly the deprecations that will become fatal in Dart Sass 2.0.0. This can be combined with other deprecations or used in a DeprecationSelectorDifference to modify exactly which deprecations it covers.

• Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass website for details.

Dart API

• Add a Deprecation.dartSass2 property which returns exactly the set of deprecations that will become fatal in Dart Sass 2.0.0.

• Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.

Embedded Protocol

• Add a CompileRequest.fatal_deprecation_except field which excludes deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.107.0

Command-Line Interface

• The --fatal-deprecation flag can now exclude deprecations that would otherwise be included by passing a version number. To exclude a deprecation, add - before its name. For example, --fatal-deprecation=1.107.0,-import includes all deprecations that were present in Dart Sass 1.107.0 except for the @import deprecation.

• The --fatal-deprecation flag now takes the special value dart-sass-2, which treats as fatal all deprecations that will become fatal in Dart Sass 2.0.0.

JavaScript API

• Options.fatalDeprecations can now take a DeprecationSelectorDifference object of the form {include: ..., except: ...}, where the include field lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field takes precedence over include.

• Add a (non-enumerable) sass.deprecations.dartSass2 property which can be passed to Options.fatalDeprecations to mark as fatal exactly the deprecations that will become fatal in Dart Sass 2.0.0. This can be combined with other deprecations or used in a DeprecationSelectorDifference to modify exactly which deprecations it covers.

• Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass website for details.

Dart API

• Add a Deprecation.dartSass2 property which returns exactly the set of deprecations that will become fatal in Dart Sass 2.0.0.

• Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.

Embedded Protocol

• Add a CompileRequest.fatal_deprecation_except field which excludes deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.

Commits

• 455cbc0 [Deprecations Except] Implement the change (#2895)
• 0cc2fa2 Bump postcss from 8.5.30 to 8.5.31 in /pkg/sass-parser (#2899)
• See full diff in compare view

Updates @biomejs/biome from 2.6.3 to 2.6.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.4

2.6.4

Patch Changes

• #12261 19fbfb2 Thanks @​dyc3! - Added the new nursery rule noConsoleSpaces, which reports a leading or trailing space in a console.log(), console.debug(), console.info(), console.warn(), or console.error() argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.

  console.log("abc ", "def");

• #12469 cd716d3 Thanks @​dyc3! - Added the new nursery rule noMagicArrayFlatDepth, which reports number literals other than 1 passed as the depth of Array.prototype.flat() unless a comment inside the parentheses explains them.

  const items = array.flat(2);

• #12470 92c9e81 Thanks @​dyc3! - Added the nursery rule noNull, which reports uses of the null literal and suggests undefined instead. Strict comparisons such as foo === null are allowed.

  let foo = null;

• #12483 9bd3527 Thanks @​dyc3! - Added the nursery rule noReturnArrayPush, which reports code that uses the return value of push() or unshift(). These methods return the new length of the array, not the added item or the array.

  function add(item) {
    return items.push(item);
  }

• #12477 a384892 Thanks @​dyc3! - Added the nursery rule noUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.

  const foo = (bar => (bar ? bar.baz : baz))(getBar());

• #12447 0a963e4 Thanks @​dyc3! - Added the nursery rule noUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.

  function findRoot(node) {
      if (node.parent) {
          return findRoot(node.parent);
      }
      return node;
  }

• #12554 2eddda9 Thanks @​dyc3! - Added the nursery rule noVueComputedPropertiesInData, which reports computed properties used inside the data function of a Vue component. Vue runs data before it sets up computed properties, so the value read there is undefined.

... (truncated)

Commits

• 5653874 ci: release (#12647)
• 824df15 feat(lint): add noVueDeprecatedDeleteSet (#12586)
• 861b288 feat(lint): add noVueUnusedRefs (#12603)
• 2eddda9 feat(lint): add noVueComputedPropertiesInData (#12554)
• 5d7553b feat(lint): add noVueMultipleSlotArgs (#12562)
• de1188f feat(lint): add noVueDeprecatedScopeAttribute (#12631)
• 2e520d8 feat(lint): add noVueMutatingProps (#12513)
• ade9845 feat(lint): add useVueDefineOptions (#12615)
• 6fc1a51 feat(lint): add noVueDeprecatedRouterLinkTagProp (#12648)
• a810209 feat(lint): add useVueValidDefineEmits (#12591)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20261026.1 to 5.20261029.1

Commits

• See full diff in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates wrangler from 4.153.0 to 4.155.0

Release notes

Sourced from wrangler's releases.

wrangler@4.155.0

Minor Changes

• #16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

  Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

  {
    "analytics_engine_datasets": [
      {
        "binding": "EVENTS",
        "dataset": "my-dataset",
        "remote": true
      }
    ]
  }

Patch Changes

• #16526 dba0e81 Thanks @​petebacondarwin! - Render terminal control characters as visible text in tail output

  Pretty tail and remote-preview output now escape control characters in log strings, exceptions and event metadata. Unicode, tabs and multiline logs remain readable, and JSON output keeps the original structured values.

• #16489 fc57bc0 Thanks @​akshitsinha! - Keep Flagship flag metadata when updating flags

  wrangler flagship flags commands that update an existing flag, such as enable, set, rollout, split, and rules, no longer clear the flag's metadata. wrangler flagship flags pull now copies metadata into the local flag store.

• #16521 ec6eddd Thanks @​petebacondarwin! - Validate .assetsignore encoding before building asset manifests

  Asset uploads and local development now stop with an actionable user error when .assetsignore is not valid UTF-8 or contains null characters, instead of silently losing its patterns. This also applies to standalone Miniflare and the Wrangler, Vite and Vitest development integrations. Save the file as UTF-8 to continue; UTF-8 files with a byte order mark and intentionally empty files remain supported.

• Updated dependencies [a95d647, c7a3373, c7a3373, c7a3373]:

  • miniflare@5.20261023.2-beta

wrangler@4.154.0

Minor Changes

• #16494 0968b08 Thanks @​petebacondarwin! - Enable Miniflare's development registry by default and centralize path resolution

  In Miniflare v5 beta, resolve the registry from CLOUDFLARE_DEV_REGISTRY_PATH, then the unsafeDevRegistryPath constructor option, then <Cloudflare config directory>/dev-registry/v5. The default is independent of legacy Wrangler directories and is scoped to the Miniflare major version. The Vite v2 beta plugin follows this new default, while current Wrangler and getPlatformProxy() retain Wrangler's legacy default for compatibility with existing Wrangler sessions. Vite v2 and Wrangler therefore require the same CLOUDFLARE_DEV_REGISTRY_PATH to discover each other; set it for both processes when mixing these tools.

  Add enableDevRegistry: false to disable registration and discovery explicitly. Shared storage now uses the resolved default without requiring an explicit path. As before, shared storage requires an enabled registry to elect a storage owner, so combining unsafeEnableSharedStorage: true with enableDevRegistry: false is rejected. Miniflare no longer reads MINIFLARE_REGISTRY_PATH; use CLOUDFLARE_DEV_REGISTRY_PATH instead. Expose resolveDevRegistryPath() for integrations that also read registry files. Wrangler uses the effective path for its runtime configuration, initial bindings display, and Flagship active-session check, so the canonical override cannot bypass that check. An explicitly disabled Wrangler registry remains disabled.

Patch Changes

• #16499 f3c13b3 Thanks @​dinasaur404! - Preserve binding error codes and names in local development

  Errors from remote bindings and from Node.js binding proxies (getPlatformProxy() and Miniflare#getBindings()) now keep their machine-readable properties, such as Artifacts' code and numericCode. Previously these properties were dropped and the error name was folded into the message (for example "ArtifactsError: Repository not found"), so code could only branch on error text during local development.

... (truncated)

Commits

• a09957a Version Packages (#16553)
• c7a3373 Revert "Version Packages" (#16554)
• a95d647 [wrangler] Support remote Analytics Engine bindings in local dev (#16536)
• 52315bd Version Packages (#16529)
• dba0e81 [wrangler] Escape terminal controls in tail output (#16526)
• fc57bc0 [miniflare] Enable local Flagship management without Worker bindings (#16489)
• ec6eddd [wrangler] Validate .assetsignore encoding before building asset manifests (#...
• 71d0903 Version Packages (#16500)
• 0968b08 [miniflare] Enable the dev registry by default and centralize path resolution...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.