build(deps): bump the actions-deps group with 5 updates

[dependabot]

Bumps the actions-deps group with 5 updates:

Package	From	To
prettier	3.9.5	3.9.6
react-dom	19.2.7	19.2.8
graphql-upload	17.0.0	17.1.0
postcss	8.5.20	8.5.14
wrangler	4.112.0	4.113.0

Updates prettier from 3.9.5 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates graphql-upload from 17.0.0 to 17.1.0

Release notes

Sourced from graphql-upload's releases.

Version 17.1.0

Minor

• Updated the graphql peer dependency to ^16.3.0 || ^17.0.0, fixing #394.
• Updated the optional peer dependency @types/koa to ^2.11.4 || ^3.0.0. Koa v3 is now supported.

Patch

• Added the package field devEngines; the supported Node.js versions for developing this package are now ^22.13.0 || ^24.0.0 || >=26.0.0.
• Changed the optional peer dependency @types/express from 4.0.29 - 5 to the equivalent ^4.0.29 || ^5.0.0.
• Updated dev dependencies.
• Updated GitHub Actions CI config:
  • Run tests with Node.js v18, v20, v22, v24, v26.
  • Test Node.js versions prior to v22 with GraphQL v16 and polyfills.
  • Updated actions/checkout to v7.
  • Updated actions/setup-node to v7.
• Migrated config for TypeScript v7 and fixed new TypeScript errors in tests.
• Avoid using the TypeScript type any in tests.
• Updated VS Code workspace settings.
• Renamed the test helper directory from test to test-helpers and removed the custom glob from the package script tests.
• Use the Node.js test runner to enforce code coverage:
  • Removed the dev dependency coverage-node.
  • Updated the package script test.
• Improved the function graphqlUploadExpress:
  • Fixed the middleware hanging if a multipart request disconnects before finishing, and added related tests.

    [!IMPORTANT]

    This is a critical bugfix. After updating, test that aborted GraphQL multipart requests are handled appropriately in your Express app. See how the Express middleware in this repo is tested.

  • Fixed monkey patching of the Express response method send; it now correctly returns the Express response instead of void.
  • More detailed JSDoc description.
• Improved the function graphqlUploadKoa:
  • Fixed the middleware hanging if a multipart request disconnects before finishing, and added related tests.

    [!IMPORTANT]

    This is a critical bugfix. After updating, test that aborted GraphQL multipart requests are handled appropriately in your Koa app. See how the Koa middleware in this repo is tested.

  • More detailed JSDoc description.
• Added an internal helper function requestFinished for waiting for a request to finish (either because it disconnects early, or it finishes uploading), with tests, replacing separate (and in some places buggy) code in middleware and tests.
• Improved the test helper function abortingMultipartRequest:
  • Removed the dev dependency form-data-encoder.
  • It now works with more than just text files.
  • Changed the parameter abortMarker type from string text to a Uint8Array byte sequence.
  • Use a new test helper function isAbortError, with tests.
  • Added tests.
• Removed the test helper class CountReadableStream and refactored the function ignoreStream tests.
• Test that GraphQLUpload is a GraphQL scalar.
• Improved tests:
  • Polyfills to support old Node.js versions are now loaded using the Node.js CLI option --import, instead of side effect imports in test modules.
  • Use getDefaultHighWaterMark from node:stream to avoid hardcoded assumptions about chunk sizes.
  • Replaced strictEqual assertions of true with ok.
  • Replaced @ts-ignore comments with better code or @ts-expect-error comments.

... (truncated)

Changelog

Sourced from graphql-upload's changelog.

17.1.0

Minor

• Updated the graphql peer dependency to ^16.3.0 || ^17.0.0, fixing #394.
• Updated the optional peer dependency @types/koa to ^2.11.4 || ^3.0.0. Koa v3 is now supported.

Patch

• Added the package field devEngines; the supported Node.js versions for developing this package are now ^22.13.0 || ^24.0.0 || >=26.0.0.
• Changed the optional peer dependency @types/express from 4.0.29 - 5 to the equivalent ^4.0.29 || ^5.0.0.
• Updated dev dependencies.
• Updated GitHub Actions CI config:
  • Run tests with Node.js v18, v20, v22, v24, v26.
  • Test Node.js versions prior to v22 with GraphQL v16 and polyfills.
  • Updated actions/checkout to v7.
  • Updated actions/setup-node to v7.
• Migrated config for TypeScript v7 and fixed new TypeScript errors in tests.
• Avoid using the TypeScript type any in tests.
• Updated VS Code workspace settings.
• Renamed the test helper directory from test to test-helpers and removed the custom glob from the package script tests.
• Use the Node.js test runner to enforce code coverage:
  • Removed the dev dependency coverage-node.
  • Updated the package script test.
• Improved the function graphqlUploadExpress:
  • Fixed the middleware hanging if a multipart request disconnects before finishing, and added related tests.

    [!IMPORTANT]

    This is a critical bugfix. After updating, test that aborted GraphQL multipart requests are handled appropriately in your Express app. See how the Express middleware in this repo is tested.

  • Fixed monkey patching of the Express response method send; it now correctly returns the Express response instead of void.
  • More detailed JSDoc description.
• Improved the function graphqlUploadKoa:
  • Fixed the middleware hanging if a multipart request disconnects before finishing, and added related tests.

    [!IMPORTANT]

    This is a critical bugfix. After updating, test that aborted GraphQL multipart requests are handled appropriately in your Koa app. See how the Koa middleware in this repo is tested.

  • More detailed JSDoc description.
• Added an internal helper function requestFinished for waiting for a request to finish (either because it disconnects early, or it finishes uploading), with tests, replacing separate (and in some places buggy) code in middleware and tests.
• Improved the test helper function abortingMultipartRequest:
  • Removed the dev dependency form-data-encoder.
  • It now works with more than just text files.
  • Changed the parameter abortMarker type from string text to a Uint8Array byte sequence.
  • Use a new test helper function isAbortError, with tests.
  • Added tests.
• Removed the test helper class CountReadableStream and refactored the function ignoreStream tests.
• Test that GraphQLUpload is a GraphQL scalar.
• Improved tests:
  • Polyfills to support old Node.js versions are now loaded using the Node.js CLI option --import, instead of side effect imports in test modules.
  • Use getDefaultHighWaterMark from node:stream to avoid hardcoded assumptions about chunk sizes.
  • Replaced strictEqual assertions of true with ok.

... (truncated)

Commits

• 282f5e2 Version 17.1.0.
• b21d5cd Corrections.
• ae6ad7a Avoid the major change of updated Node.js version support.
• dfe51d5 Consistent SemVer range approach.
• e54ef6f Fix an incorrect peer dependency range.
• 70a595c Fix changelog typos.
• 750caf9 Fix various JSDoc description typos.
• c52a186 Support GraphQL.js v17.
• ddbda73 Avoid @ts-ignore comments.
• f6caa2e Improve code comments.
• Additional commits viewable in compare view

Updates postcss from 8.5.20 to 8.5.14

Changelog

Sourced from postcss's changelog.

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

... (truncated)

Commits

• 3ec1394 Release 8.5.14 version
• f2bb827 Update dependencies
• d75953d Merge pull request #2084 from 43081j/raw-raws-rawing
• 68bd213 fix: always call raw to retrieve raw values
• af58cf1 Release 8.5.13 version
• f227dbd Temporary ignore pnpm 11 config
• d3abd40 Update dependencies
• dd06c3e Revert stringifier changes because of the conflict with postcss-scss
• ae889c8 Try to fix CI
• e0093e4 Move to pnpm 11
• Additional commits viewable in compare view

Attestation changes

This version has no provenance attestation, while the previous version (8.5.20) was attested. Review the package versions before updating.

Updates wrangler from 4.112.0 to 4.113.0

Release notes

Sourced from wrangler's releases.

wrangler@4.113.0

Minor Changes

• #14471 f03b108 Thanks @​DiogoSantoss! - Apply Email Routing addresses during Worker trigger deployment

  Worker trigger deployment now reconciles the Worker's Email Routing rules with the top-level addresses config. This runs for wrangler deploy, wrangler triggers deploy, and clients of @cloudflare/deploy-helpers. After the Worker uploads, or when wrangler triggers deploy runs after a version promotion, the deploy helper asks the Email Routing API for a plan, renders the changes grouped by zone (+ added, ~ updated, - deleted, ! conflict), prompts once for destructive changes in interactive mode, and applies accepted changes through the per-zone rule endpoints. Purely additive plans apply without a prompt, while non-interactive destructive plans fail without modifying rules.

• #14679 deae171 Thanks @​dario-piotrowicz! - Add exclude_packages option to dependencies_instrumentation configuration

  The dependencies_instrumentation config object now accepts an optional exclude_packages field — an array of package name patterns (with glob-style * wildcards) to exclude from the dependency metadata collected during deploy and version uploads.

  // wrangler.json
  {
    "dependencies_instrumentation": {
      "exclude_packages": ["@internal/*", "secret-tool"]
    }
  }

• #14721 4e92e32 Thanks @​dmmulroy! - Support Artifacts sources when creating Queue event subscriptions

  wrangler queues subscription create now accepts the artifacts and artifacts.repo source types supported by the Cloudflare API.

• #13352 d1d6945 Thanks @​penalosa! - Expand automatic resource provisioning to Queue, Dispatch Namespace, and Flagship bindings

  Deployments can now omit the resource name or ID for these bindings. Wrangler will inherit the existing binding on subsequent deploys, create a deterministically named resource automatically, or offer existing resources during an interactive deploy with automatic creation disabled.

• #14688 a0c8bb1 Thanks @​NuroDev! - Print Local Explorer API details for headless agent-driven wrangler dev sessions

  When wrangler dev is started in a headless AI agent environment, Wrangler now prints the Local Explorer API URL and basic resource routes so agents can inspect local Workers and bindings without relying on the interactive UI.

• #14724 a50f73a Thanks @​jamesopstad! - Add a settings export to the experimental cloudflare.config.ts config

  Account-level settings (accountId, complianceRegion) now live in a dedicated, named settings export authored via defineSettings, rather than on the Worker config. A cloudflare.config.ts can export at most one settings object; the Worker itself is the default export.

  // cloudflare.config.ts
  import { defineSettings, defineWorker } from "wrangler/experimental-config";
  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  export const settings = defineSettings({
  accountId: "<your-account-id>",
  });
  export default defineWorker({
  name: "my-worker",
  entrypoint,
  compatibilityDate: "2026-05-18",
  });

... (truncated)

Commits

• 88f42e7 Version Packages (#14740)
• 9e61971 unskip agent memory remote bindings test (#14786)
• 0df3d43 [wrangler] Extract remote bindings into a package (#14720)
• 4815711 [miniflare] Report the Worker's error for HEAD requests (#14766)
• af6e91d skip agent memory e2e binding test (#14782)
• d83a476 [wrangler] Remove stray characters from Sites asset-key error message (#14773)
• 2b390d7 Add nub to recognised package managers (#14595)
• a50f73a Support settings export in new config (#14724)
• a0c8bb1 feat(wrangler): surface Local Explorer API to headless agents (#14688)
• deae171 Add exclude_packages option to dependencies_instrumentation configuration...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7f5e52b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

💻 Website Preview

The latest changes are available as preview in: https://pr-8312.graphql-tools-8ja.pages.dev

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.