chore: bump the npm-non-major group with 7 updates

[dependabot]

Bumps the npm-non-major group with 7 updates:

Package	From	To
@sentry/react	10.58.0	10.59.0
dompurify	3.4.10	3.4.11
katex	0.16.47	0.17.0
react-aria	3.49.0	3.50.0
@cloudflare/vite-plugin	1.41.0	1.42.1
oxfmt	0.45.0	0.55.0
wrangler	4.101.0	4.103.0

Updates @sentry/react from 10.58.0 to 10.59.0

Release notes

Sourced from @​sentry/react's releases.

10.59.0

Important Changes

• feat(react-router): Add support for React Router v8 (#21633)

  The SDK now supports React Router v8, in both the framework and SPA (@sentry/react) modes.

• feat(react): Add version-agnostic React Router SPA exports (#21633)

  @sentry/react now exports version-agnostic wrappers for React Router v6+ SPA instrumentation. The new exports replace the version-specific V6/V7 variants, which are now deprecated:

  Deprecated	New
  reactRouterV6BrowserTracingIntegration / V7	reactRouterBrowserTracingIntegration
  withSentryReactRouterV6Routing / V7	wrapReactRouterRouting
  wrapCreateBrowserRouterV6 / V7	wrapCreateBrowserRouter
  wrapCreateMemoryRouterV6 / V7	wrapCreateMemoryRouter
  wrapUseRoutesV6 / V7	wrapUseRoutes

  The deprecated exports continue to work and will be removed in the next major version.

Other Changes

• feat(aws-serverless): Instrument aws-sdk clients >= 3.1046.0 (#21548)
• feat(bun): Add orchestrion bun build plugin (#21410)
• feat(cloudflare): Instrument sync KV (#21316)
• feat(core): Disable gen_ai message truncation by default when streamGenAiSpans is enabled (#21603)
• feat(deno): Add orchestrion deno runtime hook (#21451)
• feat(hono): Extend peer dependency range (#21550)
• feat(node): Collapse orchestrion opt-in to a single option (#20900)
• fix: Diagnostics channel Node v18 (#21631)
• fix(browser): Clean up pageload readystatechange listener (#21632)
• fix(core): Capture scopes on span before emitting spanStart event (#21644)
• fix(core): Defer TwP sampling by reading trace state from the scope (#21549)
• fix(core): Prevent outgoing HTTP instrumentation from crashing on // request paths (#21645)
• fix(core): Set production as default sentry.environment attribute value on streamed spans (#21637)
• fix(nextjs): Register safe random ID context at module load (#21573)

• chore: Change deprecation/deprecation to oxlint equivalent (#21604)
• chore: Switch license headers to SPDX format (#21357)
• chore(deps-dev): Bump esbuild from 0.20.0 to 0.28.1 (#21511)
• chore(deps): Bump esbuild from 0.25.0 to 0.28.1 in /dev-packages/e2e-tests/test-applications/node-profiling-esm (#21514)
• chore(deps): Bump react-router-6 to 6.30.4 (#21566)
• ci: Assign server team as codeowner for server-utils package (#21601)
• ci: Dedup flaky test issues across esm/cjs variants (#21595)
• ci: Do not apply Bug label to flaky test issues (#21593)

... (truncated)

Changelog

Sourced from @​sentry/react's changelog.

10.59.0

Important Changes

• feat(react-router): Add support for React Router v8 (#21633)

  The SDK now supports React Router v8, in both the framework and SPA (@sentry/react) modes.

• feat(react): Add version-agnostic React Router SPA exports (#21633)

  @sentry/react now exports version-agnostic wrappers for React Router v6+ SPA instrumentation. The new exports replace the version-specific V6/V7 variants, which are now deprecated:

  Deprecated	New
  reactRouterV6BrowserTracingIntegration / V7	reactRouterBrowserTracingIntegration
  withSentryReactRouterV6Routing / V7	wrapReactRouterRouting
  wrapCreateBrowserRouterV6 / V7	wrapCreateBrowserRouter
  wrapCreateMemoryRouterV6 / V7	wrapCreateMemoryRouter
  wrapUseRoutesV6 / V7	wrapUseRoutes

  The deprecated exports continue to work and will be removed in the next major version.

Other Changes

• feat(aws-serverless): Instrument aws-sdk clients >= 3.1046.0 (#21548)
• feat(bun): Add orchestrion bun build plugin (#21410)
• feat(cloudflare): Instrument sync KV (#21316)
• feat(core): Disable gen_ai message truncation by default when streamGenAiSpans is enabled (#21603)
• feat(deno): Add orchestrion deno runtime hook (#21451)
• feat(hono): Extend peer dependency range (#21550)
• feat(node): Collapse orchestrion opt-in to a single option (#20900)
• fix: Diagnostics channel Node v18 (#21631)
• fix(browser): Clean up pageload readystatechange listener (#21632)
• fix(core): Capture scopes on span before emitting spanStart event (#21644)
• fix(core): Defer TwP sampling by reading trace state from the scope (#21549)
• fix(core): Prevent outgoing HTTP instrumentation from crashing on // request paths (#21645)
• fix(core): Set production as default sentry.environment attribute value on streamed spans (#21637)
• fix(nextjs): Register safe random ID context at module load (#21573)

• chore: Change deprecation/deprecation to oxlint equivalent (#21604)
• chore: Switch license headers to SPDX format (#21357)
• chore(deps-dev): Bump esbuild from 0.20.0 to 0.28.1 (#21511)
• chore(deps): Bump esbuild from 0.25.0 to 0.28.1 in /dev-packages/e2e-tests/test-applications/node-profiling-esm (#21514)
• chore(deps): Bump react-router-6 to 6.30.4 (#21566)
• ci: Assign server team as codeowner for server-utils package (#21601)
• ci: Dedup flaky test issues across esm/cjs variants (#21595)

... (truncated)

Commits

• 2cb0ef6 release: 10.59.0
• f77b265 Merge pull request #21655 from getsentry/prepare-release/10.59.0
• 8e32a8d meta(changelog): Update changelog for 10.59.0
• 50fe5d9 fix: Diagnostics channel Node v18 (#21631)
• 9c765e0 feat(react-router): support react router v8 (#21633)
• 815c1cf feat(deps): Bump @​babel/core from 7.29.0 to 7.29.6 (#21574)
• a520447 ref(tanstackstart-react): Use @sentry/conventions (#21498)
• 38a0485 test(cloudflare): Remove mock in DO tests (#21634)
• cb69761 feat(deno): Add orchestrion deno runtime hook (#21451)
• 1e057ba chore(deps): Bump esbuild from 0.25.0 to 0.28.1 in /dev-packages/e2e-tests/te...
• Additional commits viewable in compare view

Updates dompurify from 3.4.10 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

Commits

• 0cae518 release: 3.4.11 (#1494)
• See full diff in compare view

Updates katex from 0.16.47 to 0.17.0

Release notes

Sourced from katex's releases.

v0.17.0

0.17.0 (2026-05-22)

Performance Improvements

• simplify defineFunction to avoid destructuring, improve typing (#4222) (fb604e6)

BREAKING CHANGES

• The internal API for __defineFunction changed: you should no longer wrap properties in props.

Changelog

Sourced from katex's changelog.

0.17.0 (2026-05-22)

Performance Improvements

• simplify defineFunction to avoid destructuring, improve typing (#4222) (fb604e6)

BREAKING CHANGES

• The internal API for __defineFunction changed: you should no longer wrap properties in props.

Commits

• 3dec549 chore(release): 0.17.0 [ci skip]
• fb604e6 perf: simplify defineFunction to avoid destructuring, improve typing (#4222)
• 6caa636 refactor: tighten ParseNode types (#4219)
• afed784 docs: make first supportive organizations logos bigger (#4216)
• b02d9ac chore(deps): update dependency webpack-dev-server to v5.2.4 [security] (#4220)
• See full diff in compare view

Updates react-aria from 3.49.0 to 3.50.0

Commits

• 1c84a49 Publish
• 208099b chore: omit isNonModal from ContextualHelpPopover (#10224)
• a064c19 docs: add S2 audit skill (#10160)
• 0594914 chore: update chat story prompts to be more realistic (#10223)
• b8b0688 chore: Audit style props in AI package (#10218)
• cb43c8c docs: add CenterBaseline to style macro docs (#10216)
• 003d04d chore: remove horizontal card from ai export (#10217)
• 358d6d8 chore: make sure Tree keyboard navigation docs example renders fully on small...
• edceb07 chore: Expose keyboardNavigationBehavior="tab" in S2 (#10206)
• 6e132fb Revert "fix: preserve selection anchor for multi-Select range selection (#101...
• Additional commits viewable in compare view

Updates @cloudflare/vite-plugin from 1.41.0 to 1.42.1

Release notes

Sourced from @​cloudflare/vite-plugin's releases.

@​cloudflare/vite-plugin@​1.42.1

Patch Changes

• #14366 c6579d3 Thanks @​jamesopstad! - Resolve relative cf-worker entrypoint imports relative to the importing module

  When loading the experimental cloudflare.config.ts, a relative entrypoint imported with import ... with { type: "cf-worker" } (e.g. ./src/index.ts) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.

  Bare specifiers (such as @scope/pkg) and virtual modules (such as virtual:foo) are still left unresolved so that consumers can apply their own resolution.

• Updated dependencies [c6579d3, 444b75e, b38823f, cfd6205, cfd6205]:

  • wrangler@4.103.0
  • miniflare@4.20260617.1

@​cloudflare/vite-plugin@​1.42.0

Minor Changes

• #14339 aa49856 Thanks @​jamesopstad! - Add a build command to the experimental, internal cf-vite delegate binary

  cf-vite build runs Vite's full multi-environment app build (via the Builder API) and enables the experimental Build Output API by default, emitting a self-contained .cloudflare/output/v0/ directory. It forces experimental.newConfig and experimental.newConfig.cfBuildOutput on, so a cloudflare.config.ts is required at the project root.

Patch Changes

• #14346 e930bd4 Thanks @​haidargit! - Bump ws from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p

  GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high severity) reports a remote memory-exhaustion DoS in ws@<8.21.0: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a ws server or client via OOM. The fix shipped in ws@8.21.0 (commit 2b2abd45, released 2026-05-22), which also introduces the maxBufferedChunks and maxFragments options. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.

• #14351 6c7df19 Thanks @​jamesopstad! - Force the experimental new config on by default in the cf-vite dev delegate

• #14218 4eed569 Thanks @​matingathani! - Allow resolve.external containing only Node.js built-ins in Worker environments

  Vitest 4 automatically sets resolve.external to the full list of Node.js built-in modules for non-standard Vite environments via its internal runnerTransform plugin. Previously, the Cloudflare Vite plugin rejected any non-empty resolve.external array, throwing an incompatibility error on startup when used alongside Vitest 4.

  The validation check now allows resolve.external arrays that contain only Node.js built-in module names (both bare fs and node:fs forms). The error is only thrown when resolve.external is true or contains non-built-in package names that would prevent user code from being bundled into the Worker.

• Updated dependencies [673b09e, e930bd4, f6e49dd, 5c3bb11, 296ad65, 594544d, a79b899, 5dfb788, ca61558, 36777db]:

  • miniflare@4.20260617.0
  • wrangler@4.102.0

Changelog

Sourced from @​cloudflare/vite-plugin's changelog.

1.42.1

Patch Changes

• #14366 c6579d3 Thanks @​jamesopstad! - Resolve relative cf-worker entrypoint imports relative to the importing module

  When loading the experimental cloudflare.config.ts, a relative entrypoint imported with import ... with { type: "cf-worker" } (e.g. ./src/index.ts) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.

  Bare specifiers (such as @scope/pkg) and virtual modules (such as virtual:foo) are still left unresolved so that consumers can apply their own resolution.

• Updated dependencies [c6579d3, 444b75e, b38823f, cfd6205, cfd6205]:

  • wrangler@4.103.0
  • miniflare@4.20260617.1

1.42.0

Minor Changes

• #14339 aa49856 Thanks @​jamesopstad! - Add a build command to the experimental, internal cf-vite delegate binary

  cf-vite build runs Vite's full multi-environment app build (via the Builder API) and enables the experimental Build Output API by default, emitting a self-contained .cloudflare/output/v0/ directory. It forces experimental.newConfig and experimental.newConfig.cfBuildOutput on, so a cloudflare.config.ts is required at the project root.

Patch Changes

• #14346 e930bd4 Thanks @​haidargit! - Bump ws from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p

  GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high severity) reports a remote memory-exhaustion DoS in ws@<8.21.0: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a ws server or client via OOM. The fix shipped in ws@8.21.0 (commit 2b2abd45, released 2026-05-22), which also introduces the maxBufferedChunks and maxFragments options. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.

• #14351 6c7df19 Thanks @​jamesopstad! - Force the experimental new config on by default in the cf-vite dev delegate

• #14218 4eed569 Thanks @​matingathani! - Allow resolve.external containing only Node.js built-ins in Worker environments

  Vitest 4 automatically sets resolve.external to the full list of Node.js built-in modules for non-standard Vite environments via its internal runnerTransform plugin. Previously, the Cloudflare Vite plugin rejected any non-empty resolve.external array, throwing an incompatibility error on startup when used alongside Vitest 4.

  The validation check now allows resolve.external arrays that contain only Node.js built-in module names (both bare fs and node:fs forms). The error is only thrown when resolve.external is true or contains non-built-in package names that would prevent user code from being bundled into the Worker.

• Updated dependencies [673b09e, e930bd4, f6e49dd, 5c3bb11, 296ad65, 594544d, a79b899, 5dfb788, ca61558, 36777db]:

  • miniflare@4.20260617.0
  • wrangler@4.102.0

Commits

• 4d8ffcb Version Packages (#14353)
• cfd6205 Extract autoconfig in its own standalone package (#14295)
• dd7e101 Version Packages (#14327)
• 6c7df19 Force the experimental new config on by default in the cf-vite dev delegate (...
• aa49856 Add build command to cf-vite (#14339)
• 4eed569 [vite-plugin] fix: allow Node.js built-ins in resolve.external for Worker env...
• 36777db Wrangler support for experimental Build Output API (#14324)
• See full diff in compare view

Updates oxfmt from 0.45.0 to 0.55.0

Changelog

Sourced from oxfmt's changelog.

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

• 43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

• 6e8e818 oxfmt: Experimental .svelte support (#21700) (leaysgur)

Commits

• aa79b5b release(apps): oxlint v1.70.0 && oxfmt v0.55.0 (#23442)
• 9a2788b feat(linter/unicorn): implement prefer-export-from rule (#22935)
• 44ae845 release(apps): oxlint v1.69.0 && oxfmt v0.54.0 (#23116)
• dadafe3 docs(oxlint, oxfmt): mention migrate skills in npm READMEs (#22965)
• f88961a docs(oxfmt): annotate each config option with supported languages (#22953)
• 964a758 release(apps): oxlint v1.68.0 && oxfmt v0.53.0 (#22883)
• 68b455d release(apps): oxlint v1.67.0 && oxfmt v0.52.0 (#22735)
• 16b8058 feat(oxfmt): Support vite-plus/resolveConfig for vite.config.ts (#22454)
• 5570206 release(apps): oxlint v1.66.0 && oxfmt v0.51.0 (#22528)
• 25e5cbc release(apps): oxlint v1.65.0 && oxfmt v0.50.0 (#22458)
• Additional commits viewable in compare view

Updates wrangler from 4.101.0 to 4.103.0

Release notes

Sourced from wrangler's releases.

wrangler@4.103.0

Minor Changes

• #14295 cfd6205 Thanks @​dario-piotrowicz! - Move unstable_getWorkerNameFromProject from wrangler to @cloudflare/workers-utils

  The unstable_getWorkerNameFromProject export has been removed from the wrangler package. This function is now available as getWorkerNameFromProject (without the unstable_ prefix) from @cloudflare/workers-utils. If you were importing this function from wrangler, update your import to use @cloudflare/workers-utils instead.

• #14295 cfd6205 Thanks @​dario-piotrowicz! - Remove experimental autoconfig exports

  The experimental autoconfig exports (experimental_getDetailsForAutoConfig, experimental_runAutoConfig, experimental_AutoConfigFramework) have been removed. This logic has been moved to the @cloudflare/autoconfig package (without the experimental_ prefixes since the package itself is pre-v1).

Patch Changes

• #14366 c6579d3 Thanks @​jamesopstad! - Resolve relative cf-worker entrypoint imports relative to the importing module

  When loading the experimental cloudflare.config.ts, a relative entrypoint imported with import ... with { type: "cf-worker" } (e.g. ./src/index.ts) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.

  Bare specifiers (such as @scope/pkg) and virtual modules (such as virtual:foo) are still left unresolved so that consumers can apply their own resolution.

• #14316 444b75e Thanks @​matingathani! - Prevent wrangler dev crash when source-mapping a truncated error chunk

  When a worker logs many errors in quick succession, the stderr chunks received by wrangler dev can be truncated mid-stack-frame, leaving a call site with an invalid column number. The source map library throws in that case, which was crashing the wrangler process entirely. The error is now caught and the original (un-source-mapped) text is returned instead.

• #14118 b38823f Thanks @​aicayzer! - Fix Uint8Array step outputs in local Workflows being persisted with the full backing ArrayBuffer

  A Uint8Array returned from a Workflows step under wrangler dev was serialised together with its full underlying ArrayBuffer, causing a raw SQLITE_TOOBIG error at view sizes well below the documented 1MiB step-output limit. For example, a 200KB view sliced from an 800KB buffer (a common pattern from crypto.getRandomValues or arr.slice(...) on a larger pool) would fail. The view's bytes are now copied to a tight buffer before persistence, bringing local behaviour in line with production. Fixes #14101.

• Updated dependencies [b38823f]:

  • miniflare@4.20260617.1

wrangler@4.102.0

Minor Changes

• #14340 f6e49dd Thanks @​emily-shen! - Add cf-wrangler build delegate support

  The experimental cf-wrangler delegate binary now accepts build and emits the Build Output API directory through Wrangler's new-config build path. This lets parent tools invoke Wrangler's build-output implementation with cf-wrangler build instead of shelling out through the public Wrangler CLI.

• #14324 36777db Thanks @​jamesopstad! - Add experimental --experimental-cf-build-output flag to wrangler build

  When used alongside --experimental-new-config, wrangler build now emits a self-contained Build Output API directory under .cloudflare/output/v0/ instead of delegating to wrangler deploy --dry-run.

Patch Changes

• #14347 673b09e Thanks @​jamesopstad! - Update undici from 7.24.8 to 7.28.0

• #14346 e930bd4 Thanks @​haidargit! - Bump ws from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p

  GHSA-96hv-2xvq-fx4p / CVE-2026-48779 (high severity) reports a remote memory-exhaustion DoS in ws@<8.21.0: a peer sending a high volume of tiny fragments and data chunks over modest network traffic can crash a ws server or client via OOM. The fix shipped in ws@8.21.0 (commit 2b2abd45, released 2026-05-22), which also introduces the maxBufferedChunks and maxFragments options. This change bumps the workspace catalog entry so that miniflare, wrangler, and @cloudflare/vite-plugin all pick up the patched release.

• #14314 5c3bb11 Thanks @​harryzcy! - Bump esbuild to 0.28.1

... (truncated)

Commits

• 4d8ffcb Version Packages (#14353)
• 7649895 move auto provisioning to deploy-helpers (#14354)
• cfd6205 Extract autoconfig in its own standalone package (#14295)
• dd7e101 Version Packages (#14327)
• 5dfb788 Support dev.plugin on typed services bindings (#14269)
• 296ad65 Bump the workerd-and-workers-types group across 1 directory with 2 updates (#...
• f6e49dd add build command to cf-wrangler (#14340)
• 36777db Wrangler support for experimental Build Output API (#14324)
• a79b899 [wrangler] fix: respect find_additional_modules when no_bundle is set (#14315)
• 5c3bb11 Bump esbuild to 0.28.1 (#14314)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions