build(deps): bump the weekly-dependencies group with 4 updates

[dependabot]

Bumps the weekly-dependencies group with 4 updates: @supabase/supabase-js, @cloudflare/vite-plugin, @types/node and wrangler.

Updates @supabase/supabase-js from 2.115.0 to 2.116.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

• auth: add MFA recovery codes API (#2676)
• storage: add bucket lifecycle configuration (#2659)
• storage: topk 10k support (#2667)
• storage: add versionId support to create URL methods (#2678)

🩹 Fixes

• auth: silence commit-guard-discarded refresh in initial session (#2668)
• storage: drop legacy prefix from lifecycles (#2674)
• supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

• fadymak
• Ferhat Elmas
• Katerina Skroumpelou @​mandarini
• Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

• auth: add MFA recovery codes API (#2676)
• storage: add versionId support to create URL methods (#2678)

❤️ Thank You

• fadymak
• Katerina Skroumpelou
• Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

• storage: topk 10k support (#2667)

🩹 Fixes

• storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.116.0 (2026-09-07)

🚀 Features

• auth: add MFA recovery codes API (#2676)

🩹 Fixes

• supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

• fadymak
• Katerina Skroumpelou @​mandarini

Commits

• 5aedaab feat(auth): add MFA recovery codes API (#2676)
• e4f675a fix(supabase): warn when schema is passed outside db options (#2663)
• dbe7679 chore(release): version 2.115.0 changelogs (#2664)
• See full diff in compare view

Updates @cloudflare/vite-plugin from 1.54.4 to 1.54.5

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.54.5

Patch Changes

• #15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

  When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

• Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

  • miniflare@5.20260907.0-alpha
  • wrangler@4.129.1

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.54.5

Patch Changes

• #15519 e004845 Thanks @​devaniketh! - Preserve HTTP/2 :authority header and non-default port in dev server requests

  When Vite runs over HTTPS with HTTP/2 enabled, browsers send authority via the :authority pseudo-header rather than Host. Previously, pseudo-headers were omitted when creating Fetch requests, causing non-default ports to be dropped from request.url and X-Forwarded-Host. Authority and scheme are now preserved from HTTP/2 pseudo-headers and request properties.

• Updated dependencies [8bbcb9f, 2b42d6f, ea5634e, c0c6504, ffc7efd, 682cd44]:

  • miniflare@5.20260907.0-alpha
  • wrangler@4.129.1

Commits

• 87fd28c Revert "graduate miniflare v5" (#15551)
• 7f14caa Version Packages (#15510)
• e004845 [vite-plugin-cloudflare] fix: preserve :authority and port in HTTP/2 requests...
• See full diff in compare view

Updates @types/node from 26.4.1 to 26.5.0

Commits

• See full diff in compare view

Updates wrangler from 4.129.0 to 4.129.1

Release notes

Sourced from wrangler's releases.

wrangler@4.129.1

Patch Changes

• #15502 8bbcb9f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260903.1	^5.20260904.1
  workerd	1.20260903.1	1.20260904.1

• #15543 2b42d6f Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260904.1	^5.20260907.1
  workerd	1.20260904.1	1.20260907.1

• #15323 ea5634e Thanks @​Sakshamm-Goyal! - Prevent Wrangler from exiting when a process capturing its output closes the pipe.

  Wrangler now ignores broken-pipe errors from stdout and stderr while preserving the existing failure behavior for other output errors.

• #14001 c0c6504 Thanks @​for-the-kidz! - Update bundle size warning thresholds to use uncompressed size instead of gzip size

  The compressed script size limits (3 MiB free / 10 MiB paid) have been removed server-side in favor of a single 64 MiB uncompressed limit. The bundle size reporter now compares the uncompressed bundle size against this 64 MiB limit for its color-coded warnings, instead of comparing gzip size against the old 3 MiB compressed limit.

• #15499 ffc7efd Thanks @​WillTaylorDev! - Honor Workers Builds name overrides in wrangler preview

  Preview commands now target the Worker name supplied by Workers Builds instead of the name in local Wrangler configuration. This prevents preview builds from failing when the two names differ.

• #15252 682cd44 Thanks @​GregoryCollett! - wrangler dev no longer exits when a request to your Worker fails transiently

  Previously, a transient network failure on a single request — most commonly a request arriving just as an idle internal connection was closed, after roughly five seconds without traffic — could take down the whole dev server with an empty ✘ [ERROR], leaving the port unbound until restarted. In CI test suites, one such failure caused every remaining test to fail with connection errors.

  wrangler dev now automatically retries the affected request if it is safe to repeat (GET and HEAD requests). If a request still fails, it fails individually — the error is logged with the request method and URL — and the dev server keeps serving.

• Updated dependencies [8bbcb9f, 2b42d6f]:

  • miniflare@5.20260907.0-alpha

Commits

• 87fd28c Revert "graduate miniflare v5" (#15551)
• 7f14caa Version Packages (#15510)
• 411dbc4 Revert "fix(wrangler): tolerate missing KV access when deleting Workers" (#15...
• 682cd44 fix(wrangler): keep wrangler dev alive when a proxied request to the UserWo...
• de88857 fix(wrangler): tolerate missing KV access when deleting Workers (#15443)
• ea5634e [wrangler] Ignore EPIPE from closed output consumers (#15323)
• ffc7efd WC-5936 Honor Workers Builds worker name overrides in wrangler preview (#15499)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[opencode-agent]

User dependabot[bot] does not have write permissions

github run

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9e9f2da6-1b34-4f4e-a134-9bc13b137322

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml