chore: bump npm dependencies (2026-10-02)

[claude]

Requested via Slack thread

Before: Several npm packages in the main Worker and in mta-sts-worker were behind their latest releases. Two were a major version behind (Sentry and TypeScript).

After: Every dependency is on its latest release except vitest 5, which can't be used yet. npm audit reports 0 vulnerabilities in both packages. Lint, typecheck, build and the coverage run all pass.

Summary

How: I ran npm outdated and npm audit in / and /mta-sts-worker, then bumped everything that still builds. npm regenerated both lockfiles; none were edited by hand.

This branch has been rebuilt from current main as one commit, twice, because two main commits conflicted with its lockfiles:

• Dependabot's chore(deps): bump undici from 7.29.0 to 7.29.1 in /mta-sts-worker in the npm_and_yarn group across 1 directory #884 moved mta-sts-worker's wrangler to 4.147.0.
• security(deps): bump sharp 0.35.5, source-map-js 1.2.2 #895 bumped sharp to 0.35.5 and source-map-js to 1.2.2, and added a sharp override to mta-sts-worker.

Both of #895's bumps are now on main, so they are no longer part of this PR.

Other changes that come with the bumps:

• Biome 2.5.15 adds a new noUnsafeOptionalChaining finding. It is fixed in src/dashboard/routes.ts with an equivalent guarded optional chain ((x as {record?: string} | undefined)?.record ?? null). That code already sits behind a typeof … === "string" check, so runtime behavior doesn't change. Biome also reformats test/cron-rescan.test.ts and test/rate-limit-mount-order.test.ts (whitespace only).
• wrangler 4.149 adds default module declarations (*.txt, *.html, *.sql, *.bin, *.wasm) to the output of wrangler types. I regenerated worker-configuration.d.ts with npm run types so npm run typecheck (wrangler types --check) stays green.

Bumped

Root (dmarcheck):

• @biomejs/biome 2.5.2 -> 2.5.15
• @cloudflare/vitest-pool-workers 0.19.0 -> 0.23.0
• @cloudflare/workers-types 5.20260921.1 -> 5.20261011.1
• @emnapi/core 1.11.1 -> 1.11.3
• @sentry/cloudflare 10.75.1 -> 11.6.0 (major)
• @types/node 26.1.0 -> 26.6.5
• hono 4.13.9 -> 4.13.13
• jose 6.2.3 -> 6.2.12
• minimatch 10.2.5 -> 10.2.6
• tsx 4.22.4 -> 4.23.15
• typescript 6.0.3 -> 7.0.2 (major)
• wrangler 4.136.1 -> 4.149.0

mta-sts-worker:

• @cloudflare/workers-types 5.20261004.1 -> 5.20261011.1
• wrangler 4.147.0 -> 4.149.0

Held back

• vitest 4.1.11 -> 5.0.3 and @vitest/coverage-v8 4.1.11 -> 5.0.3: @cloudflare/vitest-pool-workers 0.23.0 (latest) has vitest ^4.1 as a peer dependency, so vitest 5 has to wait for a pool-workers release that supports it.

Owner / zone steps

None. This PR touches package.json / package-lock.json, which are CODEOWNERS-gated (dependency supply chain), so it needs a code-owner review. Two majors are worth a quick look:

• Sentry 11: check that error capture still works after deploy.
• TypeScript 7 (the native compiler): tsc --noEmit is clean.

Security notes

npm audit is clean in both packages, and so is npm audit --audit-level=high --omit=dev (the CI gate). The only source change is the equivalent optional-chain rewrite above.

Testing

• npm run lint: pass
• npm run typecheck (wrangler types --check + tsc 7.0.2): pass
• wrangler deploy --dry-run: pass for both the root Worker and mta-sts-worker
• vitest run (workers + node projects): 1847 passed, 1 failed out of 1848. The failure is test/integration/mta-sts-runtime.test.ts ("successfully fetches and parses the dmarc.mx MTA-STS policy"), which fetches the live dmarc.mx MTA-STS policy. The sandbox this was built in has restricted network egress, and the test also fails there on unmodified main. CI shows whether it passes with real network access.
• vitest run --project=node --coverage (including the per-file coverage floors): 1809/1809 passed

Refs

Routine dependency maintenance; no linked issue.

🤖 Generated with Claude Code

https://claude.ai/code/session_016b3nTyqPN7GWSZ1uoTgQKp

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	dmarcheck	371031b	Oct 11 2026, 09:21 PM

[schmug]

lgtm