chore(deps): bump the minor-and-patch group across 2 directories with 5 updates

[dependabot]

Bumps the minor-and-patch group with 2 updates in the /packages/install-counter-worker directory: @cloudflare/workers-types and wrangler.
Bumps the minor-and-patch group with 3 updates in the /web directory: react-virtuoso, @biomejs/biome and ultracite.

Updates @cloudflare/workers-types from 4.20260524.1 to 4.20260613.1

Commits

• See full diff in compare view

Updates wrangler from 4.94.0 to 4.100.0

Release notes

Sourced from wrangler's releases.

wrangler@4.100.0

Minor Changes

• #14119 2047a32 Thanks @​tahmid-23! - Serve local R2 bucket objects publicly via the dev server

  When running wrangler dev locally, objects in each local R2 binding are now reachable under /cdn-cgi/local/r2/public/<bucket-id>/<key> on the existing dev server, simulating a public bucket. The <bucket-id> is the bucket's bucket_name when set, otherwise its binding. Bindings configured with remote: true are not exposed.

• #14202 e8561c2 Thanks @​jamesopstad! - Add experimental --x-new-config flag for authoring config in TypeScript

  This is an experimental, opt-in feature. When enabled, wrangler dev, wrangler build, wrangler deploy, wrangler versions upload, and wrangler versions deploy load the Worker's configuration from a cloudflare.config.ts file instead of wrangler.json / wrangler.jsonc / wrangler.toml. Additionally, an optional wrangler.config.ts file can be provided for Wrangler-specific dev/build configuration.

  • cloudflare.config.ts (required) — Worker runtime configuration (bindings, triggers, observability, placement, limits, compatibility, routes, etc.). Authored via defineWorker from wrangler/experimental-config.
  • wrangler.config.ts (optional) — Tooling / bundling / dev-server configuration (noBundle, minify, alias, define, rules, tsconfig, build, dev, assetsDirectory, etc.). Authored via defineWranglerConfig from wrangler/experimental-config.

  Per-environment configuration is via ctx.mode branching inside the function form of either file.

  Example cloudflare.config.ts:

  import { defineWorker, bindings } from "wrangler/experimental-config";
  import * as entrypoint from "./src/index.ts" with { type: "cf-worker" };
  export default defineWorker((ctx) => ({
  name: "my-worker",
  entrypoint,
  compatibilityDate: "2026-05-18",
  env: {
  MY_KV: bindings.kv(),
  MY_TEXT: bindings.text(The mode is ${ctx.mode}),
  },
  }));

  Example wrangler.config.ts:

  import { defineWranglerConfig } from "wrangler/experimental-config";
  export default defineWranglerConfig({
  minify: true,
  assetsDirectory: "./public",
  });

  Because this is experimental, the flag, the config formats, and the wrangler/experimental-config exports may change in any release.

Patch Changes

• #14185 98c9afe Thanks @​penalosa! - Use the shared env-credential resolver from @cloudflare/workers-auth

... (truncated)

Commits

• 341bd13 Version Packages (#14237)
• e8561c2 Wrangler support for experimental new config (#14202)
• 4597f08 Bump the workerd-and-workers-types group with 2 updates (#14256)
• 2ae6099 move build earlier in deploy path (#14259)
• 25722ac Gate Network.enable on an attached DevTools client (#14243)
• 98c9afe [workers-auth] Make OAuth identity and token storage injectable for reuse by ...
• 10b5538 Improve authentication error messages with specific failure reasons (#14213)
• e305126 [wrangler] Add cf-wrangler delegate entrypoint; remove @​cloudflare/wrangler-b...
• 818c105 Improve R2 Sippy error messages (#14233)
• f3990b2 Bump the workerd-and-workers-types group with 2 updates (#14246)
• Additional commits viewable in compare view

Updates react-virtuoso from 4.17.0 to 4.18.7

Release notes

Sourced from react-virtuoso's releases.

react-virtuoso@4.18.7

Patch Changes

• #1399 1fca093 Thanks @​petyosi! - Fix horizontal Virtuoso item positioning and scrolling in RTL layouts.

react-virtuoso@4.18.6

Patch Changes

• #1393 fa9dd31 Thanks @​petyosi! - Fix useWindowScroll SSR layout collapse by rendering the window viewport in normal flow while preserving sticky top items.

react-virtuoso@4.18.5

Patch Changes

• #1388 5871779 Thanks @​petyosi! - Fix useSyncExternalStore detection for React 19+

  The version check used startsWith('18') which excluded React 19, causing it to fall back to the legacy useState+useLayoutEffect subscription path. This could cause tearing issues in concurrent rendering scenarios. Changed to parseInt(React.version) >= 18 to correctly use useSyncExternalStore for React 18 and above.

react-virtuoso@4.18.4

Patch Changes

• #1375 620b260 Thanks @​marcospassos! - Fix atBottomStateChange in useWindowScroll lists when the Virtuoso instance is rendered below other page content.

react-virtuoso@4.18.3

Patch Changes

• 161db63 Thanks @​petyosi! - Use changeset publish for proper git tagging and GitHub release creation

Changelog

Sourced from react-virtuoso's changelog.

4.18.7

Patch Changes

• #1399 1fca093 Thanks @​petyosi! - Fix horizontal Virtuoso item positioning and scrolling in RTL layouts.

4.18.6

Patch Changes

• #1393 fa9dd31 Thanks @​petyosi! - Fix useWindowScroll SSR layout collapse by rendering the window viewport in normal flow while preserving sticky top items.

4.18.5

Patch Changes

• #1388 5871779 Thanks @​petyosi! - Fix useSyncExternalStore detection for React 19+

  The version check used startsWith('18') which excluded React 19, causing it to fall back to the legacy useState+useLayoutEffect subscription path. This could cause tearing issues in concurrent rendering scenarios. Changed to parseInt(React.version) >= 18 to correctly use useSyncExternalStore for React 18 and above.

4.18.4

Patch Changes

• #1375 620b260 Thanks @​marcospassos! - Fix atBottomStateChange in useWindowScroll lists when the Virtuoso instance is rendered below other page content.

4.18.3

Patch Changes

• 161db63 Thanks @​petyosi! - Use changeset publish for proper git tagging and GitHub release creation

4.18.2

Patch Changes

• #1361 7b38166 Thanks @​petyosi! - Replace ESLint and Prettier with oxlint and oxfmt for faster linting and formatting. Modernize TypeScript configuration with verbatimModuleSyntax and ES2022 build targets.

  Source code changes are non-behavioral: stricter equality checks (===/!== instead of truthiness), ?? instead of || for defaults, early returns instead of else blocks, self-closing JSX tags, and removal of unnecessary JSX fragments. LogLevel in react-virtuoso is changed from a TypeScript enum to a const object — the named exports (LogLevel.DEBUG, etc.) work identically, but enum reverse-mapping (LogLevel[0]) is no longer supported.

4.18.1

Patch Changes

• #1328 2d2c1c5 Thanks @​petyosi! - Fix missing type for table

4.18.0

Minor Changes

... (truncated)

Commits

• b017378 Version Packages (#1400)
• 354fbf1 Merge pull request #1399 from petyosi/petyosi/fix-horizontal-rtl
• 1fca093 Fix horizontal RTL list positioning (#1395)
• 5fdb613 Version Packages
• fa9dd31 Fix window-scroll SSR viewport layout
• c787356 Speed up Release workflow by caching Playwright browsers
• 21422d7 Version Packages (#1389)
• 5871779 Fix useSyncExternalStore detection for React 19+
• 66fd0e5 Version Packages (#1377)
• a5bfd6c Apply PR review
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-virtuoso since your current version.

Updates @biomejs/biome from 2.3.8 to 2.5.0

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.0

2.5.0

Minor Changes

• #9539 f0615fd Thanks @​ematipico! - Added a new reporter called concise. When --reporter=concise is passed the commands format, lint, check and ci, the diagnostics are printed in a compact manner:

  ! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused.
  ! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused.
  × index.ts:8:5: lint/suspicious/noImplicitAnyLet: This variable implicitly has the any type.
  × main.ts:2:10: lint/suspicious/noRedeclare: Shouldn't redeclare 'z'. Consider to delete it or rename it.
  

• #9495 2056b23 Thanks @​aviraldua93! - Added the useKeyWithClickEvents a11y lint rule for HTML files (.html, .vue, .svelte, .astro). This is a port of the existing JSX rule. The rule enforces that elements with an onclick handler also have at least one keyboard event handler (onkeydown, onkeyup, or onkeypress) to ensure keyboard accessibility.

  Inherently keyboard-accessible elements (<a>, <button>, <input>, <select>, <textarea>, <option>) are excluded, as are elements hidden from assistive technologies (aria-hidden) or with role="presentation" / role="none".

  <!-- Invalid: no keyboard handler -->
  <div onclick="handleClick()">Click me</div>
  <!-- Valid: has keyboard handler -->
  <div onclick="handleClick()" onkeydown="handleKeyDown()">Click me</div>
  <!-- Valid: inherently keyboard-accessible -->
  <button onclick="handleClick()">Submit</button>

• #9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUndeclaredClasses for HTML, JSX, and SFC files (Vue, Astro, Svelte). The rule detects CSS class names used in class="..." (or className) attributes that are not defined in any <style> block or linked stylesheet reachable from the file.

  <!-- .typo is used but never defined -->
  <html>
    <head>
      <style>
        .button {
          color: blue;
        }
      </style>
    </head>
    <body>
      <div class="button typo"></div>
    </body>
  </html>

• #9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUnusedClasses for CSS. The rule detects CSS class selectors that are never referenced in any HTML or JSX file that imports the stylesheet. This is a project-domain rule that requires the module graph.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.0

Minor Changes

• #9539 f0615fd Thanks @​ematipico! - Added a new reporter called concise. When --reporter=concise is passed the commands format, lint, check and ci, the diagnostics are printed in a compact manner:

  ! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused.
  ! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused.
  × index.ts:8:5: lint/suspicious/noImplicitAnyLet: This variable implicitly has the any type.
  × main.ts:2:10: lint/suspicious/noRedeclare: Shouldn't redeclare 'z'. Consider to delete it or rename it.
  

• #9495 2056b23 Thanks @​aviraldua93! - Added the useKeyWithClickEvents a11y lint rule for HTML files (.html, .vue, .svelte, .astro). This is a port of the existing JSX rule. The rule enforces that elements with an onclick handler also have at least one keyboard event handler (onkeydown, onkeyup, or onkeypress) to ensure keyboard accessibility.

  Inherently keyboard-accessible elements (<a>, <button>, <input>, <select>, <textarea>, <option>) are excluded, as are elements hidden from assistive technologies (aria-hidden) or with role="presentation" / role="none".

  <!-- Invalid: no keyboard handler -->
  <div onclick="handleClick()">Click me</div>
  <!-- Valid: has keyboard handler -->
  <div onclick="handleClick()" onkeydown="handleKeyDown()">Click me</div>
  <!-- Valid: inherently keyboard-accessible -->
  <button onclick="handleClick()">Submit</button>

• #9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUndeclaredClasses for HTML, JSX, and SFC files (Vue, Astro, Svelte). The rule detects CSS class names used in class="..." (or className) attributes that are not defined in any <style> block or linked stylesheet reachable from the file.

  <!-- .typo is used but never defined -->
  <html>
    <head>
      <style>
        .button {
          color: blue;
        }
      </style>
    </head>
    <body>
      <div class="button typo"></div>
    </body>
  </html>

• #9152 9ec8500 Thanks @​ematipico! - Added new nursery lint rule noUnusedClasses for CSS. The rule detects CSS class selectors that are never referenced in any HTML or JSX file that imports the stylesheet. This is a project-domain rule that requires the module graph.

  /* styles.css — .ghost is never used in any importing file */

... (truncated)

Commits

• c0b9832 ci: release (#10499)
• 995c1ff feat(lint): add useFunctionComponentDefinition rule (#10498)
• 311c2b2 fix(biome_configuration): avoid Markdown links in JSON schema descriptions (#...
• 04c3f19 fix: docs and readme (#10584)
• 961f41c refactor(useExportType): improve docs and code (#10569)
• 78075b7 feat(useExportType): add style option (#10561)
• 6642895 feat: rule promotion for v2.5 (#10562)
• 9a5855e feat: noRestrictedDependencies (#10467)
• 608a62f Merge branch 'main' into chore/merge-main-into-next
• 0f29b83 feat(linter): implement useIncludes rule (#10516)
• Additional commits viewable in compare view

Updates ultracite from 7.1.1 to 7.8.3

Release notes

Sourced from ultracite's releases.

ultracite@7.8.3

Patch Changes

• c863d09: Fix automatic editor extension installation during ultracite init.

  The whole command line (e.g. code --install-extension) was passed to spawnSync as the executable name, which always failed with ENOENT and silently fell back to the "install manually" message. The command is now split into the binary and its arguments, so the linter extension actually installs for VS Code-based editors.

• 6888129: Enable the eslint/no-await-in-loop rule as an error in the core Oxlint preset.

  Awaiting inside a loop forces each iteration to run sequentially, which can lead to serious performance issues when the asynchronous operations could otherwise run concurrently. Promoting this rule to an error encourages collecting promises and resolving them together (e.g. with Promise.all) instead of blocking on each one in turn.

• 62a9b5c: Fix the generated Husky pre-commit hook's error handling and section replacement.

  The standalone hook script set set -e and then tried to capture the formatter's exit code, re-stage files, and print a failure message — but a non-zero formatter exit terminated the script immediately, so none of that ever ran. The script now captures the exit code with || FORMAT_EXIT_CODE=$? so files are re-staged and failures are reported with the right exit code.

  Re-running ultracite init also deleted everything from the # ultracite marker to the end of the hook, including commands the user added after the ultracite section. The section is now terminated with an explicit # ultracite end marker and updates replace only the section between the markers (legacy sections without an end marker are detected by their closing echo line).

• 6608ceb: Make the lint-staged integration idempotent and respect dedicated config files.

  package.json was always treated as the lint-staged config because the file exists in every project, so ultracite init wrote the lint-staged config into package.json even when a dedicated .lintstagedrc.* or lint-staged.config.* file was present — leaving two conflicting configs. package.json now only counts when it actually has a lint-staged key; otherwise the dedicated config file is updated (or .lintstagedrc.json is created).

  Re-running ultracite init also appended another npx ultracite fix entry on every run because the merge concatenates arrays. Updates are now skipped when the existing config already references ultracite.

... (truncated)

Commits

• f48ea13 Version Packages (#720)
• 61ea0a1 Fix write guard error message and validate before creating directories
• 62a9b5c Fix husky hook error handling and scoped section replacement
• c1e651f Point agent logoFile values at existing logo assets
• 6608ceb Make lint-staged integration idempotent and respect dedicated configs
• 4e847f7 Forward --skip flag through npm in generated hook commands
• c863d09 Fix editor extension auto-install spawn invocation
• ecb0d5b Scope Stylelint step to style files in check/fix
• 6888129 Enable no-await-in-loop
• a9d704b Version Packages (#719)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Superseded by #139.