chore(deps-dev): bump the development-dependencies group across 1 directory with 17 updates

[dependabot]

Bumps the development-dependencies group with 17 updates in the / directory:

Package	From	To
@cloudflare/vite-plugin	1.53.0	1.57.1
@eslint/js	9.39.5	10.0.1
@next/eslint-plugin-next	16.3.1	16.3.5
@types/node	22.20.1	26.6.2
@vitejs/plugin-react	6.1.0	6.1.1
@vitejs/plugin-rsc	0.5.34	0.5.35
eslint	9.39.5	10.11.0
globals	17.11.0	17.12.0
playwright	1.62.1	1.63.0
prettier	3.9.6	3.9.8
react-server-dom-webpack	19.2.8	19.3.0
selenium-webdriver	4.47.0	4.49.0
typescript	5.9.3	7.0.2
typescript-eslint	8.67.0	8.70.1
vinext	1.0.0-beta.7	1.0.0-beta.11
vite	8.2.2	8.3.0
wrangler	4.124.0	4.136.1

Updates @cloudflare/vite-plugin from 1.53.0 to 1.57.1

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.57.1

Patch Changes

• Updated dependencies [0ed4c54, 703922d, 14d946d]:
  • wrangler@4.136.1
  • @​cloudflare/unenv-preset@​2.16.2

@​cloudflare/vite-plugin@​1.57.0

Minor Changes

• #15713 3c75cad Thanks @​jamesopstad! - Identify experimental Build Output resource configs by filename and location

  The root remains config.json, Worker configs are now worker.config.json, and Container configs are now container.config.json. Resource configs no longer contain top-level type discriminators, while settings and build context are stored together in the root config.

• #15713 3c75cad Thanks @​jamesopstad! - Define experimental Cloudflare configuration with a single default export

  Experimental cloudflare.config.ts files now define settings and resources together in a default-exported defineConfig() call. Add a Worker under worker, add Containers to the containers array, or omit both to provide settings only.

  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  export default defineConfig({
  accountId: "...",
  complianceRegion: "public",
  worker: {
  name: "my-worker",
  compatibilityDate: "2026-09-18",
  entrypoint,
  },
  });

Patch Changes

• #15711 91e2f86 Thanks @​ghostwriternr! - Allow local Container images without exposed ports

  Wrangler and the Cloudflare Vite plugin no longer reject images that omit Docker EXPOSE metadata. Local Containers can run command-only workloads or serve traffic through workerd without declaring an unused image port.

• Updated dependencies [3c75cad, 3c75cad, 91e2f86, c5913a6, 35668d7, 3c75cad, 45b3b81, 8235e6a, 0751490, 43b1f85, 731a2ee]:

  • wrangler@4.136.0
  • miniflare@5.20260921.0-alpha

@​cloudflare/vite-plugin@​1.56.0

Minor Changes

• #15609 1f070c8 Thanks @​emily-shen! - Build Containers when emitting experimental Build Output

  Wrangler and the Cloudflare Vite plugin now build Dockerfile-backed Container images when experimental Build Output is enabled. Container configs are emitted under .cloudflare/output/v0/containers with local image references, while existing registry references pass through unchanged.

• #15329 c4c9b75 Thanks @​akshitsinha! - Evaluate Flagship flags locally during development

... (truncated)

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.57.1

Patch Changes

• Updated dependencies [0ed4c54, 703922d, 14d946d]:
  • wrangler@4.136.1
  • @​cloudflare/unenv-preset@​2.16.2

1.57.0

Minor Changes

• #15713 3c75cad Thanks @​jamesopstad! - Identify experimental Build Output resource configs by filename and location

  The root remains config.json, Worker configs are now worker.config.json, and Container configs are now container.config.json. Resource configs no longer contain top-level type discriminators, while settings and build context are stored together in the root config.

• #15713 3c75cad Thanks @​jamesopstad! - Define experimental Cloudflare configuration with a single default export

  Experimental cloudflare.config.ts files now define settings and resources together in a default-exported defineConfig() call. Add a Worker under worker, add Containers to the containers array, or omit both to provide settings only.

  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  export default defineConfig({
  accountId: "...",
  complianceRegion: "public",
  worker: {
  name: "my-worker",
  compatibilityDate: "2026-09-18",
  entrypoint,
  },
  });

Patch Changes

• #15711 91e2f86 Thanks @​ghostwriternr! - Allow local Container images without exposed ports

  Wrangler and the Cloudflare Vite plugin no longer reject images that omit Docker EXPOSE metadata. Local Containers can run command-only workloads or serve traffic through workerd without declaring an unused image port.

• Updated dependencies [3c75cad, 3c75cad, 91e2f86, c5913a6, 35668d7, 3c75cad, 45b3b81, 8235e6a, 0751490, 43b1f85, 731a2ee]:

  • wrangler@4.136.0
  • miniflare@5.20260921.0-alpha

1.56.0

Minor Changes

• #15609 1f070c8 Thanks @​emily-shen! - Build Containers when emitting experimental Build Output

... (truncated)

Commits

• 6e77127 Version Packages (#15747)
• b168333 chore(deps): upgrade oxfmt to 0.68.0 (#15746)
• 264fb44 Version Packages (#15710)
• 3c75cad Define experimental Cloudflare configuration with a single default export (#1...
• 91e2f86 [wrangler] Allow Containers without EXPOSE (#15711)
• f9e7727 Version Packages (#15697)
• 643e5cc [wrangler] Support Preview builds in Build Output (#15701)
• 1f070c8 Add dev/build support for Containers with experimental new config (#15609)
• 5b69153 Version Packages (#15687)
• a939a6c [vite-plugin] Support named Container images (#15674)
• Additional commits viewable in compare view

Updates @eslint/js from 9.39.5 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

• c87d5bd fix: update eslint (#20531) (renovate[bot])
• d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
• 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
• 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

• 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
• 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
• b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

• e5c281f chore: updates for v9.39.3 release (Jenkins)
• 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
• 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
• 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
• da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
• 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

• f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
• a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
• c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
• fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
• 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
• 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
• ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
• 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
• c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
• 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
• a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
• a89059d feat!: Program range span entire source text (#20133) (Pixel998)
• 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
• f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
• aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
• f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
• 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
• 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
• 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
• 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
• f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

• bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
• 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
• 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

• 84fb885 chore: package.json update for @​eslint/js release
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
• f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
• b4b3127 chore: package.json update for @​eslint/js release
• 0b14059 chore: package.json update for @​eslint/js release
• fa31a60 feat!: add name to configs (#20015)
• 1e2cad5 chore: package.json update for @​eslint/js release
• 454a292 feat!: update eslint:recommended configuration (#20210)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
• See full diff in compare view

Updates @next/eslint-plugin-next from 16.3.1 to 16.3.5

Release notes

Sourced from @​next/eslint-plugin-next's releases.

v16.3.5

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• next/image: Skip 0-byte entries when initializing disk LRU cache (#98185)
• next/image: Reject empty images when reading/writing to the disk cache (#98186)
• Emit whole-app server NFTs when output: 'standalone' is used with an adapter (#98167)
• Add CSP nonce to script tags of loading and template files (#98403)
• Fix use cache prerender signal retention (#98448)

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

Commits

• ca2c75e v16.3.5
• 299180d v16.3.4
• a9a1cb7 v16.3.3
• d0ac882 v16.3.2
• See full diff in compare view

Updates @types/node from 22.20.1 to 26.6.2

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.0 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• See full diff in compare view

Updates @vitejs/plugin-rsc from 0.5.34 to 0.5.35

Release notes

Sourced from @​vitejs/plugin-rsc's releases.

plugin-rsc@0.5.35

Features

• plugin-rsc: expose Node.js stream APIs (#1276) (32105d5)

Bug Fixes

• deps: update all non-major dependencies (#1375) (9ab698e)
• deps: update all non-major dependencies (#1427) (fb2d6f3)
• deps: update all non-major dependencies (#1433) (61006e6)
• deps: update all non-major dependencies (#1442) (55895a4)
• deps: update dependency magic-string to v1 (#1443) (c9eba3e)
• deps: update dependency strip-literal to v4 (#1457) (9657ea1)
• deps: update react-related dependencies (#1452) (61b650f)

Miscellaneous Chores

• deps: update dependency @​types/react-dom to ^19.2.5 (#1432) (e7c2b6d)
• deps: update dependency @​types/react-dom to ^19.2.7 (#1444) (f135533)
• deps: update tsdown to v0.23 (#1451) (736efe2)

Code Refactoring

• rsc: replace utils package (#1454) (389897e)

Tests

• rsc: copy use cache/server mixed directive handling to examples/use-cache-persistent (#1417) (523e45b)

Changelog

Sourced from @​vitejs/plugin-rsc's changelog.

0.5.35 (2026-09-16)

Features

• plugin-rsc: expose Node.js stream APIs (#1276) (32105d5)

Bug Fixes

• deps: update all non-major dependencies (#1375) (9ab698e)
• deps: update all non-major dependencies (#1427) (fb2d6f3)
• deps: update all non-major dependencies (#1433) (61006e6)
• deps: update all non-major dependencies (#1442) (55895a4)
• deps: update dependency magic-string to v1 (#1443) (c9eba3e)
• deps: update dependency strip-literal to v4 (#1457) (9657ea1)
• deps: update react-related dependencies (#1452) (61b650f)

Miscellaneous Chores

• deps: update dependency @​types/react-dom to ^19.2.5 (#1432) (e7c2b6d)
• deps: update dependency @​types/react-dom to ^19.2.7 (#1444) (f135533)
• deps: update tsdown to v0.23 (#1451) (736efe2)

Code Refactoring

• rsc: replace utils package (#1454) (389897e)

Tests

• rsc: copy use cache/server mixed directive handling to examples/use-cache-persistent (#1417) (523e45b)

Commits

• a309c8b release: plugin-rsc@0.5.35 (#1459)
• 9657ea1 fix(deps): update dependency strip-literal to v4 (#1457)
• 389897e refactor(rsc): replace utils package (#1454)
• 61b650f fix(deps): update react-related dependencies (#1452)
• 736efe2 chore(deps): update tsdown to v0.23 (#1451)
• f135533 chore(deps): update dependency @​types/react-dom to ^19.2.7 (#1444)
• c9eba3e fix(deps): update dependency magic-string to v1 (#1443)
• 55895a4 fix(deps): update all non-major dependencies (#1442)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e7c2b6d chore(deps): update dependency @​types/react-dom to ^19.2.5 (#1432)
• Additional commits viewable in compare view

Updates eslint from 9.39.5 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits

• 3c0b7c6 10.11.0
• 321f0a7 Build: changelog update for 10.11.0
• 520dd77 perf: Implement fast paths in critical areas (#21210)
• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
• 24310e3 chore: update ecosystem plugins (#21324)
• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
• Additional commits viewable in compare view

Updates globals from 17.11.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

Commits

• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• See full diff in compare view

Updates playwright from 1.62.1 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never ...

Description has been truncated