[dependabot]

Bumps the npm group with 3 updates in the / directory: @cloudflare/workers-types, knip and wrangler.

Updates @cloudflare/workers-types from 5.20261023.1 to 5.20261030.1

Commits

• See full diff in compare view

Updates knip from 6.42.1 to 6.44.0

Release notes

Sourced from knip's releases.

Release 6.44.0

• Clarify that custom entry still adds entry files from package.json (#2206) (4099ddeef28406ed8c9b798cf5ce525241818642) - thanks @​MannXo!
• Resolve expanded package scripts against the directory of their manifest (#2209) (9d8464dd7335b9898a17a0db59c3c33a7ae460f4) - thanks @​fixfon!
• Track exports through namespace member chains of any depth (#2210) (75697027e89e176c16e3d567cff3d6e016d0e9f0) - thanks @​fixfon!
• Do not treat Windows drive letters as package names (#2217) (d412c5be3a5c2d69583ce54b32e033813c1d2972) - thanks @​Cherry!
• Generate built-in compilers list from source (#2216) (d6f594cc767fa41c6f94cf49bfa0302be4b9de40) - thanks @​abrahamguo!
• Update to pnpm@^11 + pnpm dedupe (ef5b819eddbb0b4ff92804524aca590797a199fc)
• Stop growing and rewriting the analysis cache on warm runs (close #2213) (54b02dd84181867f41f98a6c80209dad32fa3da6)
• Use entry in plugins that do not resolve their config files (0b0e3285e3a440650b86a776b5e2a1fc1816bca8)
• Reuse graph reachability for incremental sessions (#2190) (38d926a652e820a375fe59d04ba0980393882153) - thanks @​jakeleventhal!
• fix: reload discovered configuration in watch sessions (#2211) (cefef30891c4428635e5cfc7b147faa42857247d) - thanks @​jakeleventhal!
• Keep editor sessions and views current (#2215) (cfe91abb5e6064230a71926f0d7565fce94486c0) - thanks @​jakeleventhal!
• Add Lingui plugin (#2212) (611e7dbe1c6675612e457324aae411bf4cda5b11) - thanks @​clean99!
• Update dependency bun to v1.4.4 (#2219) (3f35bbdf863057f69f237ab507053271019fc315) - thanks @​renovate[bot]!
• Read CSpell configuration from package.json (#2228) (86ab963cf3cd279a8b8af3a3f0098d24762c59cb) - thanks @​clean99!
• Ignore file discovery order in session configuration test (51a8d33dbe04e76da8f2e2ed24d8943d0e9e15fe)
• Fix strict mode for caught optional peer imports (#2218) (e535f40b8cacea80c830282544975f0be2191323) - thanks @​jay23606!
• Add kysely-codegen plugin (#2223) (a50e8423d28406bd20c213334d3aac4857c1cce0) - thanks @​clean99!
• Add PurgeCSS plugin (#2224) (668aea696a217d7c537791771be6044fc5ae375b) - thanks @​clean99!
• Document plugin args and path bases, issue key order and real-world fixes (8e48df60c4502c66d9daba87d5f436898ae60116)
• Add Mastra plugin (#2227) (dd4e1f72de127eb8328dd941fa4492034f29d69d) - thanks @​ashokram-si!
• Count findPackageJSON() bare specifiers as dependencies (#2235) (d4e387b31235d49fe755acb79553b385aa0de4c9) - thanks @​abrahamguo!
• Add universal hooks file to SvelteKit entries (#2237) (f286584f168d27255769bd9529b49a3518e4f788) - thanks @​APX403!
• Attribute extended tsconfig plugins correctly (#2230) (8d1d1d1e54204287b8321a0a5d50cbfa4562759e) - thanks @​gioboa!
• Resolve reporter in the Mocha plugin (#2232) (c413715a334be72094a02af0dbb37e36e878e262) - thanks @​X-Guardian!
• Read nyc.config.cjs and nyc.config.mjs in the nyc plugin (#2240) (724c3c9bd44d9919f35fa5b5be955fa3b6c9339d) - thanks @​SwastikTripathi!
• Read hidden .biome.json and .biome.jsonc in the Biome plugin (#2239) (dde22a754d9cd7a4e98aaeef6b0ad8b22b14040d) - thanks @​SwastikTripathi!
• fix: narrow Remix plugin enabler to @​remix-run/dev (#2242) (5e10c52abfe21839dc9bd515fd900ff035fac170) - thanks @​gioboa!
• Document alsoReferenceOwner on Input (387e97f0988da93d74df53ad46a906db3d29dba8)
• Document path bases and the dir option per input type (98180d375b154663d8c9b967c9b8b54c0de06927)
• Emit the Gatsby production entries from resolveConfig (c224f16c629cec5ec56ce06b8bcf9207255ba69f)
• Emit the TanStack Router entry files from resolveConfig (c2598a3dae1e9616191d88d81eafcde6ab0f5b82)
• Discover Marko tag files when only marko-tag.json files exist (c264697fab8c0783f2e23c983aacb1d4178953fc)
• Remove the static public/sw.js production entry from the vite-plugin-pwa plugin (b3f9a56216195e279ec73935f0de1e6ff490230c)
• Keep absolute build.lib.entry paths in the Vitest plugin (5d974fa1bdfe3bbc696645139cc04bb963d5f9d9)
• Resolve Vite alias targets from the workspace without prefixing absolute paths (8f93e9d3425e47d9933baec078d1cdf9ad8a49ca)
• Keep absolute testDir paths in the Playwright plugin (4e3e6b3d8b978a7f4a99438c661a86a93c73745d)
• Keep absolute stories paths in the Storybook plugin (321decc499e3ec15b75c4abace3a58a0cd8f6b50)
• Resolve an absolute basePath in the Karma plugin (64e8b1bbe28e0c0f9f80112683b5c5f51f7d4512)
• Keep absolute local plugin paths in the Docusaurus plugin (058930d9eb30490c796af1ee8bab3682e852dae2)
• Keep absolute local plugin paths in the Serverless Framework plugin (0176d78dec4cd8ba9204c61c3c0ec7385a02ae9c)
• Resolve Nx run-commands cwd from the workspace root (39c08aab2149cf11f74c60195b3fdf0bcadc29f2)
• Resolve package specifiers in Marko tag definitions (168ee52857cf646ac0f1b18528bf6867fdd10c4f)
• Keep absolute include paths in the Taskfile plugin (7945ec15a327bd65ad6ed00809ba4f12b3f3d814)
• Resolve Lefthook root from the repository root (f28fae68d56c527f9c6388d983344e5694e5a906)
• Pass specifiers with dir instead of absolutizing them in the webpack, Nx and textlint plugins (1ad804d6f24f55c28ffd9d306b1bb43175064429)
• Drop redundant relative calls on entry patterns in the rstest and Marko plugins (9096f254bade552cdd556255157dd440ee634b27)
• Use toAbsolute in the Jasmine, Lunaria and electron-vite plugins (b4266efef59359dcb2632b97a7c6335f9d47251d)
• Mark inputs from the start script as production (2fb10243bb1385060d8f94204081f750405460ec)
• Mark inputs from scripts in production files as production (af469e9c88bd87e3b71b8d010abf069115cf2a19)

... (truncated)

Commits

• 0d14731 Release knip@6.44.0
• 153ba1e Escape pipes in symbols in the markdown reporter (#2254)
• 624da93 Detect SWC plugins in options set directly on a webpack rule (#2252)
• acbbbf5 Support pnpm workspace config includes (#2238)
• e118ef4 Treat packageExtensions peers as optional (#2246)
• 1a58eb5 Add --output-file option to write reporter output to a file (#2243)
• 5d10668 Let core resolve script entries from dir in the Playwright, Railway and mis...
• 381e3e3 Parse MCP server commands against their cwd
• 98d0b98 Parse GitHub Actions step scripts against their working directory
• 2070464 Pin the scope of negations and workspace exclusions for plugin entry patterns...
• Additional commits viewable in compare view

Updates wrangler from 4.152.0 to 4.156.0

Release notes

Sourced from wrangler's releases.

wrangler@4.156.0

Minor Changes

• #16532 25802bc Thanks @​simonha9! - Allow the experimental wrangler d1 insights command to run across every D1 database in the account

  The database name is now optional. With no name, the command returns the top queries across every D1 database in the account, and each result gains a databaseId field.

Patch Changes

• #16369 ec0bea4 Thanks @​MattieTK! - Stop autoconfig in non-interactive runs when a project root holds both static files and a Pages functions directory

  When a project without a detected framework has a functions directory, autoconfig asks whether it is a Cloudflare Pages project. Non-interactive runs (CI and coding agents) assume it is not and continue as a static site. When the static files are in the project root, that deploys the root as static assets, and the Pages Functions (the project's API routes) are not deployed.

  In that case autoconfig now stops with an error explaining that Pages Functions cannot be migrated automatically yet. For Pages Functions it suggests moving the static files into a subdirectory and deploying with wrangler pages deploy, or migrating the Functions to a Worker; for a functions directory that is not Pages Functions, it suggests moving the static files into a subdirectory or adding a configuration file. Projects whose static files are already in a subdirectory, projects detected as Pages or with a detected framework, and interactive runs where the user answers the prompt are unaffected.

• #16367 b4653b4 Thanks @​MattieTK! - Write a protective .assetsignore when autoconfig uses the project root as the static assets directory

  Autoconfig is meant to write an .assetsignore when the project root itself is the assets directory, so that local files are not uploaded as public assets. The check compared the detected output directory, which is relative ("."), with the absolute project path, so it never matched and no .assetsignore was written. A static project with an index.html at its root (for example after wrangler setup or a zero-config wrangler deploy) then uploaded files such as .env, .dev.vars, .git and node_modules as public assets.

  The check now resolves the assets directory that the generated configuration uses and compares it with the project root, so frameworks that set their own build output directory (such as Nuxt or SvelteKit) do not get an unused root .assetsignore. The generated .assetsignore also covers what a Cloudflare Pages upload skips, alongside the existing .wrangler, .dev.vars* and .env* entries: /_worker.js, /_routes.json and /functions at the root (so nested paths such as blog/functions/index.html are still uploaded), node_modules, .git and .DS_Store at any depth, and .npmrc. If an existing .assetsignore only lists a narrower pattern such as .env, .env* is added so that files like .env.production are skipped too. When the project root of an assets-only project contains a Pages functions directory or _worker.js, autoconfig now warns that it will not be deployed, since it is excluded from the assets and not run as server code.

• #16532 25802bc Thanks @​simonha9! - Fail the experimental wrangler d1 insights command with an actionable error when the GraphQL Analytics API rejects the request

  Previously the command printed an empty []. Rate limit errors now say how long to wait before retrying, and authorization errors name the "Account Analytics: Read" permission the API token needs.

• #16013 8b64bec Thanks @​swalker326! - Fix Durable Object self-references in tests and container validation

  Durable Object bindings that explicitly name the Worker itself now resolve to the test runner in @cloudflare/vitest-plugin, for both cloudflare.config.ts and Wrangler configuration files. Named Wrangler environments use their effective Worker name, keeping bindings to the base Worker external. Container validation also accepts these self-references, using the effective deployment name to distinguish local and external bindings.

  Explicit binding targets remain intact during configuration conversion, so deploying with --name or a CI name override preserves the intended Durable Object target.

• Updated dependencies [15fbaed, d8899ac]:

  • miniflare@5.20261023.3-beta

wrangler@4.155.0

Minor Changes

• #16536 a95d647 Thanks @​WalshyDev! - Support remote Analytics Engine bindings in local development

  Setting remote: true on an Analytics Engine dataset now sends writeDataPoint() calls from wrangler dev and the Vite plugin to the real dataset. Without it, writes are still dropped locally.

  {
    "analytics_engine_datasets": [
      {
        "binding": "EVENTS",
        "dataset": "my-dataset",
        "remote": true
      }
    ]

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3beb05f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.