chore(deps-dev): bump the npm-development group across 1 directory with 8 updates

[dependabot]

Bumps the npm-development group with 8 updates in the / directory:

Package	From	To
@next/bundle-analyzer	16.3.3	16.3.4
@sentry/core	10.69.0	10.73.0
@testing-library/user-event	14.6.6	14.6.7
@types/node	26.4.0	26.4.1
@types/react-dom	19.2.5	19.2.7
eslint-config-next	16.3.3	16.3.4
knip	6.32.3	6.34.0
tsx	4.23.12	4.23.13

Updates @next/bundle-analyzer from 16.3.3 to 16.3.4

Release notes

Sourced from @​next/bundle-analyzer's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits

• 299180d v16.3.4
• See full diff in compare view

Updates @sentry/core from 10.69.0 to 10.73.0

Release notes

Sourced from @​sentry/core's releases.

10.73.0

Important Changes

• feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

  withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

  // next.config.mjs
  - import { withSentryConfig } from '@sentry/nextjs';
  + import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

• feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
• fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)

• test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

Bundle size 📦

Path	Size
@​sentry/browser	27.1 KB
@​sentry/browser - with treeshaking flags	25.58 KB
@​sentry/browser (incl. Tracing)	45.54 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.28 KB
@​sentry/browser (incl. Tracing, Profiling)	50.17 KB
@​sentry/browser (incl. Tracing, Replay)	83.87 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	100.83 KB
@​sentry/browser (incl. Feedback)	43.87 KB
@​sentry/browser (incl. sendFeedback)	31.78 KB
@​sentry/browser (incl. FeedbackAsync)	36.79 KB
@​sentry/browser (incl. Metrics)	28.16 KB
@​sentry/browser (incl. Logs)	28.38 KB
@​sentry/browser (incl. Metrics & Logs)	29.06 KB
@​sentry/react	28.86 KB
@​sentry/react (incl. Tracing)	47.74 KB
@​sentry/vue	32.4 KB
@​sentry/vue (incl. Tracing)	47.46 KB
@​sentry/svelte	27.12 KB
CDN Bundle	29.43 KB

... (truncated)

Changelog

Sourced from @​sentry/core's changelog.

10.73.0

Important Changes

• feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)

  withSentryConfig is now available from @sentry/nextjs/config, the path it moves to in v11. Importing it from @sentry/nextjs still works on v10 but logs a warning once, so you can change your next.config file today and upgrade to v11 without touching it again.

  // next.config.mjs
  - import { withSentryConfig } from '@sentry/nextjs';
  + import { withSentryConfig } from '@sentry/nextjs/config';

Other Changes

• feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler and setupFasitfyErrorHandler (#23734)
• fix(v10/cloudflare): Instrument Durable Object handlers installed as read-only properties (#23769)

• test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)

10.72.0

Important Changes

• AI integrations no longer report errors that propagate to the caller (#23638, #23639, #23640)

  Across all AI integrations (OpenAI, Anthropic, Google GenAI, LangChain, and LangGraph), the SDK no longer sends an event to Sentry for errors that the AI framework propagates to your code. Previously the instrumentation reported these as unhandled (handled: false) before your own error handling ran, so an error your code caught still showed up in Sentry as an unhandled crash. The span is still marked as errored and the error still propagates, so reporting is left to your application: if your code does not handle the error, it reaches Sentry's global error handlers and is captured as unhandled, just like any other uncaught error. Errors that a provider surfaces as data on an otherwise successful response (such as Anthropic error-shaped responses or Google GenAI blocked content) are still captured, since your code never sees them propagate.

• feat(v10/cloudflare): Add rpcTracePropagationBindings (#23737, #23738)

  The new rpcTracePropagationBindings option names the env bindings that outgoing RPC calls propagate trace context to. Strings match a binding name exactly, regular expressions match by pattern, and the default empty array propagates to nothing. RPC has no headers to carry trace context, so the SDK appends it as a trailing argument that only a Sentry-instrumented receiver removes again. List only the bindings whose receiver you know runs Sentry. Setting the option takes precedence over enableRpcTracePropagation, which is now deprecated. When you build with the Sentry Cloudflare Vite plugin, the bindings that resolve to this worker (its own Durable Objects and self service bindings) are derived from your wrangler config and added for you.

Other Changes

• fix(v10/astro): support astro v7 route patterns properly (#23657)
• fix(v10/bundler-plugins): Preserve full file path in component annotation source maps (#23595)
• fix(v10/core): Store child span timeout handle in _childSpanTimeoutID (#23673)
• fix(v10/node): Only end the process session when it is still ok (#23731)
• fix(v10/react-router): Use react-router's own instrumentation types instead of a mirrored copy (#23589)
• fix(v10/replay): Suppress Worker destroyed error on session expiry (#23654)
• fix(v10/server-utils): Keep orchestrion registration out of tree-shaking (#23591)
• fix(v10/server-utils): Stop shipping orchestrion bundler plugins as production dependencies (#23667)
• fix(v10/server-utils): Support openai v7 in auto-instrumentation (#23713)
• fix(v10/sveltekit): Detect native tracing in flattened SvelteKit 3 config (#23656)

... (truncated)

Commits

• f109d92 release: 10.73.0
• 1a3e04e meta(changelog): Update changelog for 10.73.0 (#23778)
• da8d769 test(v10/nextjs): Drop nextjs-16-cf-workers canary variant (#23775)
• bea4d38 feat(v10/node): Deprecate shouldHandleError on setupExpressErrorHandler a...
• 605caaf feat(v10/nextjs): Add @sentry/nextjs/config entry point (#23766)
• da17307 fix(v10/cloudflare): Instrument Durable Object handlers installed as read-onl...
• 2c4ca38 Merge branch 'release/10.72.0' into v10
• 0d23628 release: 10.72.0
• ac2094d meta(changelog): Update changelog for 10.72.0 (#23743)
• f325434 feat(v10/cloudflare): Derive rpcTracePropagationBindings from the wrangler co...
• Additional commits viewable in compare view

Updates @testing-library/user-event from 14.6.6 to 14.6.7

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.7

14.6.7 (2026-09-02)

Bug Fixes

• normalize DataTransfer format aliases (#1326) (1e0020b)
• feature: Add iframe support for user.keyboard typing (#1275) (1e0020b)

Commits

• 1e0020b fix: normalize DataTransfer format aliases (#1326)
• d4b0593 feature: Add iframe support for user.keyboard typing (#1275)
• See full diff in compare view

Updates @types/node from 26.4.0 to 26.4.1

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.5 to 19.2.7

Commits

• See full diff in compare view

Updates eslint-config-next from 16.3.3 to 16.3.4

Release notes

Sourced from eslint-config-next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits

• 299180d v16.3.4
• See full diff in compare view

Updates knip from 6.32.3 to 6.34.0

Release notes

Sourced from knip's releases.

Release 6.34.0

• fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
• 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
• Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
• Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
• Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
• Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
• fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
• fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
• Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
• Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
• Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
• Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

• Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
• Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
• Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
• Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
• Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
• Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
• fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!
• Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)
• Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)
• Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)
• Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)
• Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)
• Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)
• Update dependencies (28510146c2b97d88f7188f1239b9307aac7dbf0c)
• Replace non-breaking space in module graph comment (4e22bfcd09deccc92ed158f5554fe3e03f3a2c51)
• Update fix format test for oxfmt package.json key sorting (65011bf6054d03fb5580f3381867b07d1b8a9a0c)
• fix(webpack): resolve entry descriptors using import field (#1981) (cad8910e7fb89c2510fc9f5885289335dd4e60da) - thanks @​DreamLongYT!
• fix: count enum element access as a whole-object read (#1958) (5a47d603aa23b388ae7ce4fe301656f1abc43b14) - thanks @​addielaruee!
• Resolve oxlint/vite-plus import resolvers from settings (#1983) (c1165b70efe27398b86fa50bcea7d85c253d3ee7) - thanks @​DreierF!
• fix(nuxt): resolve string extends configs (#1984) (4a5d7068d6264ea45c78c832abe7ba052763517e) - thanks @​DreamLongYT!
• Wrap up webpack entry resolution (505decdb821f9b76d194742cee7e98c75ef7d8e9)
• Keep element access precise for number-like enum member names (bcbac3a8b8283da3b32256584b3cc6569ae5c02f)
• Resolve Object.* enum enumeration through import aliases (347967daaed817ca20e1ad6148388a66ec8b421b)
• Resolve named string-key access on namespace-qualified enums (2ac1fbc1e92f3dae662ca4d4701cf010346be49a)
• Normalize line endings in nuxt-config-string fixture (9fe2b2b2db8690685ec7c6cf8b3d39b9ed7b3fdc)
• Resolve nuxt layer sources from all extends entry shapes (db136151d9f98801837b33646ef7b02ae7b5a86d)
• Report unused exports behind Vitest module promise mocks (resolve #1966) (74954c219367ca1577184cca08c30dbb3fb6222e)
• Check line endings against .gitattributes in pnpm run ci (ddc9fd0cc3328260665203c8573702bb6c9d0dd6)

Commits

• 4ffebb7 Release knip@6.34.0
• f0cf11d Assert counters in targeted regression tests
• 96ff2df Declare webpack directly instead of through @types/webpack
• c4e0f08 Update dependencies
• cc47061 Resolve Nuxt #shared imports from the shared directory (#1991)
• 462ae45 fix: compile files with workspace-scoped compilers (#1997)
• ab90e24 fix(cli): validate numeric options instead of passing NaN through (#1975)
• 964085d Set an explicit Bun test timeout
• 1c90b49 Make prop access consistent while at it
• f93ad09 Respect JSDoc tags on URL dependencies (resolve #1943)
• Additional commits viewable in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[BigSimmo]

Consolidated into #2648 at b9e55e5. The complete original head 0ce9b87 is retained as an ancestor, including its code, tests and audit requests. Closing this duplicate review/CI stream under the authorised consolidation; source branch retained. Current verification and remaining merge prerequisites are recorded on #2648. This closure does not claim that the successor is merged or that its required CI is green.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml