chore(deps): bump the minor-and-patch group across 1 directory with 5 updates

[dependabot]

Bumps the minor-and-patch group with 5 updates in the / directory:

Package	From	To
date-fns	4.2.1	4.4.0
turbo	2.9.14	2.9.16
ua-parser-js	2.0.9	2.0.10
@types/node	25.9.0	25.9.2
wrangler	4.95.0	4.98.0

Updates date-fns from 4.2.1 to 4.4.0

Release notes

Sourced from date-fns's releases.

v4.4.0

This release revisits the approach to CDN usage and introduces a new package, @date-fns/cdn and deprecates the date-fns CDN scripts. It allowed reducing the zipped package size from 5.83 MB down to 3.96 MB without introducing any breaking changes.

In v5.0.0-alpha.0 where CDN scripts are completely removed from date-fns the change is more significant and brings the zipped package size down to 2.89 MB.

It is just the first step in optimizing the package size. Expect further size reduction in the future v4 and v5 versions.

Changed

• DEPRECATED: The date-fns CDN scripts are now deprecated and will be removed in the next major release. Please switch to the new @date-fns/cdn package for CDN usage.

• Removed CDN source maps to reduce the package size. If you rely on them, please switch to the new @date-fns/cdn package that still includes them.

v4.3.0

Kudos to @​ImRodry and @​puneetdixit200 for their contributions.

Fixed

• Fixed missing modularized optimization fallback (for Next.js and others). See #4193.

• Fixed pt locale first day of week to be Sunday. See #4195 by @​ImRodry.

• Fixed zh-CN, zh-HK, and zh-TW locale month parsing for October, November, and December. See #4194 by @​puneetdixit200.

Commits

• cd53d25 Promote to v4.4.0
• d948ec1 Preserve but deprecate CDN versions for v4, set up v5 with polyfills
• ee65753 Add root mise :format task
• 9f5bdf5 Add positional argument to test/smoke.sh script
• 651ead6 Split CDN bundles into separate @​date-fns/cdn package
• 224c1a2 Deprecate type tests as attw hangs on date-fns package
• 7bb2842 Switch PACKAGE_OUTPUT_PATH to --dist flag in the package build script
• b6ad5ac Add flags to control package build script
• 424a783 Fix docs release after moving to monorepo setup
• f95bcf1 (docs): Add missing tsx dependency
• Additional commits viewable in compare view

Updates turbo from 2.9.14 to 2.9.16

Release notes

Sourced from turbo's releases.

Turborepo v2.9.16

What's Changed

Changelog

• release(turborepo): 2.9.15 by @​github-actions[bot] in vercel/turborepo#12955
• fix: Avoid hanging PTY shutdown by @​anthonyshew in vercel/turborepo#12958
• fix: Retry npm tlog publish failures by @​anthonyshew in vercel/turborepo#12959
• release(turborepo): 2.9.16-canary.1 by @​anthonyshew in vercel/turborepo#12960
• fix: Preserve nested Bun dependency versions by @​anthonyshew in vercel/turborepo#12963
• Revert "fix: Preserve nested Bun dependency versions" by @​anthonyshew in vercel/turborepo#12964
• release(turborepo): 2.9.16-canary.2 by @​github-actions[bot] in vercel/turborepo#12961
• fix: Preserve nested Bun dependency versions by @​anthonyshew in vercel/turborepo#12965
• fix: Don't delete existing .git when using --no-git flag by @​anthonyshew in vercel/turborepo#12968

Full Changelog: vercel/turborepo@v2.9.15...v2.9.16

Turborepo v2.9.16-canary.2

What's Changed

Changelog

• release(turborepo): 2.9.15-canary.7 by @​github-actions[bot] in vercel/turborepo#12935
• fix: Restore a few internal invariant checks by @​anthonyshew in vercel/turborepo#12933
• fix: Improve profile tracing coverage by @​anthonyshew in vercel/turborepo#12936
• fix: Use build-scale OTel duration buckets by @​anthonyshew in vercel/turborepo#12939
• fix: Preserve pnpm injected peer package entries by @​anthonyshew in vercel/turborepo#12940
• feat: Add heap allocation profiling by @​anthonyshew in vercel/turborepo#12943
• release(turborepo): 2.9.15-canary.8 by @​anthonyshew in vercel/turborepo#12945
• docs: Correct attribute presence claims in turborepo-otel by @​adityasingh2400 in vercel/turborepo#12932
• chore(turbo-codemod): Remove duplicate "in" in transforms path comment by @​mvanhorn in vercel/turborepo#12948
• chore: Switch Geist font imports to npm geist package by @​christopherkindl in vercel/turborepo#12952
• fix: Respect root gitignore during prune by @​anthonyshew in vercel/turborepo#12953
• fix: Harden OTEL endpoint validation by @​anthonyshew in vercel/turborepo#12954
• release(turborepo): 2.9.15 by @​github-actions[bot] in vercel/turborepo#12955
• fix: Avoid hanging PTY shutdown by @​anthonyshew in vercel/turborepo#12958
• fix: Retry npm tlog publish failures by @​anthonyshew in vercel/turborepo#12959
• release(turborepo): 2.9.16-canary.1 by @​anthonyshew in vercel/turborepo#12960

New Contributors

• @​adityasingh2400 made their first contribution in vercel/turborepo#12932
• @​mvanhorn made their first contribution in vercel/turborepo#12948
• @​christopherkindl made their first contribution in vercel/turborepo#12952

Full Changelog: vercel/turborepo@v2.9.15-canary.7...v2.9.16-canary.2

Turborepo v2.9.15

... (truncated)

Commits

• 5e2d466 publish 2.9.16 to registry
• b4aa626 fix: Don't delete existing .git when using --no-git flag (#12968)
• 7952b46 fix: Preserve nested Bun dependency versions (#12965)
• 5e5b248 release(turborepo): 2.9.16-canary.2 (#12961)
• 3b1b6e9 Revert "fix: Preserve nested Bun dependency versions" (#12964)
• 8d4eaf8 fix: Preserve nested Bun dependency versions (#12963)
• 2284fa9 release(turborepo): 2.9.16-canary.1 (#12960)
• 5317f65 fix: Retry npm tlog publish failures (#12959)
• 52e81bd fix: Avoid hanging PTY shutdown (#12958)
• c85d410 release(turborepo): 2.9.15 (#12955)
• Additional commits viewable in compare view

Updates ua-parser-js from 2.0.9 to 2.0.10

Release notes

Sourced from ua-parser-js's releases.

v2.0.10

Version 2.0.10

• Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
• Add new method useExtension() in UAParser to extend custom detection rules
• Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
• Improve browser detection: Huawei Browser, UCBrowser
• Improve OS detection: iOS
• Identify WebView user-agent as inapp browser
• extensions submodule:
  • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
  • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
  • Add new library: phpcrawl
• helpers submodule:
  • Fix isElectron() function return itself

What's Changed

• Add Headline ev-crawler detection by @​Carel155 in faisalman/ua-parser-js#807
• [extensions] Add new crawlers: Meta-WebIndexer, Meta-ExternalAds by @​23tux in faisalman/ua-parser-js#824
• Fix: remove desktop from enums according to documentation by @​mksotto in faisalman/ua-parser-js#808
• Add sideEffects=false to package.json by @​denisx in faisalman/ua-parser-js#781

New Contributors

• @​Carel155 made their first contribution in faisalman/ua-parser-js#807
• @​23tux made their first contribution in faisalman/ua-parser-js#824
• @​mksotto made their first contribution in faisalman/ua-parser-js#808
• @​denisx made their first contribution in faisalman/ua-parser-js#781

Full Changelog: faisalman/ua-parser-js@2.0.9...2.0.10

Changelog

Sourced from ua-parser-js's changelog.

Version 2.0.10

• Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
• Add new method useExtension() in UAParser to extend custom detection rules
• Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
• Improve browser detection: Huawei Browser, UCBrowser
• Improve OS detection: iOS
• Identify WebView user-agent as inapp browser
• extensions submodule:
  • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
  • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
  • Add new library: phpcrawl
• helpers submodule:
  • Fix isElectron() function return itself

Commits

• 4121c59 Build: Bump version 2.0.10
• 90354d3 Fix: Prevent ReDoS vulnerability by limiting Client Hints input length (GHSA-...
• 3baa3bc Test: Increase nyc timeout to fix timeout error
• 18d39b5 CI: Add GitHub Actions workflow to publish to Docker Hub
• 58b5a0c Build: Add Dockerfile for container image build
• 965c20d CI: Update fuzz test
• ad97fea Build: Set sideEffects=false in package.json for tree shaking (#781)
• 312598f CI: Add AI and spam detection to pull request workflow
• 8f9e4dc Test: Fix relative path and update done() callback in CLI test spec
• eb809ec Chore(license): Add THIRD_PARTY_NOTICES.md for third-party assets
• Additional commits viewable in compare view

Updates @types/node from 25.9.0 to 25.9.2

Commits

• See full diff in compare view

Updates wrangler from 4.95.0 to 4.98.0

Release notes

Sourced from wrangler's releases.

wrangler@4.98.0

Minor Changes

• #14089 c6c61b5 Thanks @​alsuren! - Add migrations_pattern to D1 database bindings

  The D1 binding now accepts an optional migrations_pattern field, allowing you to point wrangler d1 migrations apply and wrangler d1 migrations list at migration files in nested layouts (e.g. ORM-generated folders like migrations/0000_init/migration.sql).

  migrations_pattern is a glob (relative to the wrangler config file) and defaults to ${migrations_dir}/*.sql, which preserves today's behaviour. Files that do not match the pattern are not executed.

  {
    "d1_databases": [
      {
        "binding": "DB",
        "database_name": "my-db",
        "database_id": "...",
        "migrations_dir": "migrations",
        "migrations_pattern": "migrations/*/migration.sql"
      }
    ]
  }

  When no migrations match the configured pattern but files matching the common migrations/*/migration.sql (drizzle-style) layout do exist, Wrangler logs a hint suggesting migrations_pattern as an opt-in.

  wrangler d1 migrations create now returns an actionable error if the generated migration filename would not match the configured pattern.

• #14153 7a6b1a4 Thanks @​dario-piotrowicz! - Generalize wrangler deploy and wrangler versions upload positional argument from [script] to [path]

  Both wrangler deploy and wrangler versions upload now accept a generic [path] positional argument that can point to either a Worker entry-point file or a directory of static assets. The type is auto-detected. For example:

  • File: wrangler deploy ./src/index.ts deploys a Worker (same as before)
  • Directory: wrangler deploy ./public deploys a static assets site (no interactive confirmation prompt)

  The --script named option is now hidden and deprecated for both commands. It continues to work for backwards compatibility but only accepts file paths. Passing a directory to --script now produces a clear error message suggesting the positional path argument or --assets flag instead.

• #13863 3b8b80a Thanks @​aslakhellesoy! - getPlatformProxy() now passes through workflow bindings that have a script_name

  Workflows without a script_name are still stripped (and warned about) because the engine for an internal workflow can't run inside the empty proxy worker that backs getPlatformProxy(). Workflows with a script_name are handed to miniflare unchanged; miniflare reroutes the engine's USER_WORKFLOW binding through the dev-registry-proxy when the target worker is running in another Miniflare instance — the same mechanism Durable Objects already use.

  This means SvelteKit/Remix (and similar split-process setups) can call platform.env.MY_WORKFLOW.create({ ... }) directly from their server-side request handlers in dev, as long as the workflow class is exposed by another worker registered in the dev registry.

  Closes #7459.

• #14164 b502d54 Thanks @​G4brym! - Rename the web_search binding kind to websearch

  Pre-launch rename of the public binding type from web_search to websearch so the on-the-wire shape matches the product name (Web Search). The wrangler config key, the binding-type string sent to the Cloudflare API, and the miniflare option key all move from web_search / webSearch to websearch.

  Update your wrangler config:

... (truncated)

Commits

• c8c366e Version Packages (#14159)
• a3eea27 Bump the workerd-and-workers-types group with 2 updates (#14175)
• d462013 fix: update secret bulk command description to reflect create/update/delete (...
• acf7817 [wrangler] Show OAuth callback errors instead of hanging on wrangler login ...
• 7a6b1a4 Generalize wrangler deploy positional argument from [script] to [path] ...
• c2280cd [wrangler] fix: warn when named env silently inherits custom_domain routes (#...
• 0bb2d55 In non-interactive mode remove the skills installation message (#14162)
• c6c61b5 CFSQL-1589 migrations_pattern for configuring recursive migration discovery ...
• 8400fb9 fix(wrangler): version listing limits (#14165)
• 7949f81 Skip stale bundles during dev server reload to avoid redundant restarts (#14151)
• Additional commits viewable in compare view