Update dependency ranges and lockfiles

deno.json

@@ -36,20 +36,20 @@
     "./test/smoke/harness"
   ],
   "imports": {
-    "@cloudflare/workers-types": "npm:@cloudflare/workers-types@^4.20250529.0",
-    "@david/dax": "jsr:@david/dax@^0.43.2",
+    "@cloudflare/workers-types": "npm:@cloudflare/workers-types@^4.20260511.1",
+    "@david/dax": "jsr:@david/dax@^0.46.1",
     "@fxts/core": "npm:@fxts/core@^1.21.1",
     "@hongminhee/localtunnel": "jsr:@hongminhee/localtunnel@^0.3.0",
     "@js-temporal/polyfill": "npm:@js-temporal/polyfill@^0.5.1",
-    "@logtape/file": "jsr:@logtape/file@^2.0.5",
-    "@logtape/logtape": "jsr:@logtape/logtape@^2.0.5",
+    "@logtape/file": "jsr:@logtape/file@^2.0.7",
+    "@logtape/logtape": "jsr:@logtape/logtape@^2.0.7",
     "@nestjs/common": "npm:@nestjs/common@^11.0.1",
-    "@opentelemetry/api": "npm:@opentelemetry/api@^1.9.0",
-    "@opentelemetry/context-async-hooks": "npm:@opentelemetry/context-async-hooks@^2.5.0",
-    "@opentelemetry/core": "npm:@opentelemetry/core@^2.5.0",
-    "@opentelemetry/sdk-metrics": "npm:@opentelemetry/sdk-metrics@2.5.0",
-    "@opentelemetry/sdk-trace-base": "npm:@opentelemetry/sdk-trace-base@^2.5.0",
-    "@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@^1.39.0",
+    "@opentelemetry/api": "npm:@opentelemetry/api@^1.9.1",
+    "@opentelemetry/context-async-hooks": "npm:@opentelemetry/context-async-hooks@^2.7.1",
+    "@opentelemetry/core": "npm:@opentelemetry/core@^2.7.1",
+    "@opentelemetry/sdk-metrics": "npm:@opentelemetry/sdk-metrics@2.7.1",
+    "@opentelemetry/sdk-trace-base": "npm:@opentelemetry/sdk-trace-base@^2.7.1",
+    "@opentelemetry/semantic-conventions": "npm:@opentelemetry/semantic-conventions@^1.40.0",
     "@optique/config": "jsr:@optique/config@^1.0.2",
     "@optique/core": "jsr:@optique/core@^1.0.2",
     "@optique/run": "jsr:@optique/run@^1.0.2",
@@ -63,21 +63,22 @@
     "@std/yaml": "jsr:@std/yaml@^1.0.8",
     "@types/node": "npm:@types/node@^22.16.0",
     "amqplib": "npm:amqplib@^0.10.9",
+    "asn1js": "npm:asn1js@^3.0.10",
     "@solidjs/start/middleware": "npm:@solidjs/start@^1.3.0/middleware",
     "@solidjs/start/server": "npm:@solidjs/start@^1.3.0/server",
     "astro": "npm:astro@^5.17.3",
     "byte-encodings": "npm:byte-encodings@^1.0.11",
     "chalk": "npm:chalk@^5.6.2",
-    "es-toolkit": "npm:es-toolkit@^1.43.0",
+    "es-toolkit": "npm:es-toolkit@^1.46.1",
     "h3": "npm:h3@^1.15.0",
     "hono": "jsr:@hono/hono@^4.8.3",
     "ioredis": "npm:ioredis@^5.8.2",
     "json-preserve-indent": "npm:json-preserve-indent@^1.1.3",
-    "mysql2": "npm:mysql2@^3.18.0",
-    "mysql2/promise": "npm:mysql2@^3.18.0/promise",
+    "mysql2": "npm:mysql2@^3.22.3",
+    "mysql2/promise": "npm:mysql2@^3.22.3/promise",
     "postgres": "npm:postgres@^3.4.7",
     "preact": "npm:preact@10.19.6",
-    "tsdown": "npm:tsdown@^0.21.6"
+    "tsdown": "npm:tsdown@^0.22.0"
   },
   "unstable": [
     "fs",

docs/package.json

@@ -1,6 +1,6 @@
 {
   "devDependencies": {
-    "@braintree/sanitize-url": "^7.1.1",
+    "@braintree/sanitize-url": "^7.1.2",
     "@cloudflare/workers-types": "catalog:",
     "@deno/kv": "^0.8.4",
     "@fedify/amqp": "workspace:^",
@@ -46,7 +46,7 @@
     "@types/node": "catalog:",
     "amqplib": "catalog:",
     "better-sqlite3": "catalog:",
-    "dayjs": "^1.11.13",
+    "dayjs": "^1.11.20",
     "debug": "^4.4.1",
     "drizzle-orm": "catalog:",
     "express": "catalog:",

examples/express/package.json

@@ -26,7 +26,7 @@
   "devDependencies": {
     "@types/express": "^4.17.21",
     "@types/node": "^22.5.1",
-    "tsx": "^4.19.0",
+    "tsx": "^4.21.0",
     "typescript": "^5.5.4"
   },
   "dependencies": {

examples/fastify/package.json

@@ -15,6 +15,6 @@
   },
   "devDependencies": {
     "@types/node": "catalog:",
-    "tsx": "^4.19.0"
+    "tsx": "^4.21.0"
   }
 }

examples/koa/package.json

@@ -26,7 +26,7 @@
   "devDependencies": {
     "@types/koa": "catalog:",
     "@types/node": "^22.5.1",
-    "tsx": "^4.19.0",
+    "tsx": "^4.21.0",
     "typescript": "^5.5.4"
   },
   "dependencies": {

packages/cfworkers/deno.json

@@ -3,7 +3,7 @@
   "version": "2.3.0",
   "license": "MIT",
   "imports": {
-    "@cloudflare/workers-types/experimental": "npm:@cloudflare/workers-types@^4.20250906.0/experimental"
+    "@cloudflare/workers-types/experimental": "npm:@cloudflare/workers-types@^4.20260511.1/experimental"
   },
   "exports": {
     ".": "./src/mod.ts"

packages/cli/deno.json

@@ -6,8 +6,8 @@
   "imports": {
     "@hongminhee/localtunnel": "jsr:@hongminhee/localtunnel@^0.3.0",
     "@inquirer/prompts": "npm:@inquirer/prompts@^7.8.4",
-    "@jimp/core": "npm:@jimp/core@^1.6.0",
-    "@jimp/wasm-webp": "npm:@jimp/wasm-webp@^1.6.0",
+    "@jimp/core": "npm:@jimp/core@^1.6.1",
+    "@jimp/wasm-webp": "npm:@jimp/wasm-webp@^1.6.1",
     "@poppanator/http-constants": "npm:@poppanator/http-constants@^1.1.1",
     "chalk": "npm:chalk@^5.6.2",
     "cli-table3": "npm:cli-table3@^0.6.5",
@@ -17,9 +17,9 @@
     "inquirer-toggle": "npm:inquirer-toggle@^1.0.1",
     "ora": "npm:ora@^8.2.0",
     "shiki": "npm:shiki@^1.6.4",
-    "smol-toml": "npm:smol-toml@^1.6.0",
+    "smol-toml": "npm:smol-toml@^1.6.1",
     "srvx": "npm:srvx@^0.8.7",
-    "valibot": "jsr:@valibot/valibot@^1.2.0",
+    "valibot": "jsr:@valibot/valibot@^1.4.0",
     "#kv": "./src/kv.node.ts"
   },
   "exclude": [

packages/cli/package.json

@@ -87,8 +87,8 @@
     "@standard-schema/spec": "catalog:",
     "@hongminhee/localtunnel": "^0.3.0",
     "@inquirer/prompts": "^7.8.4",
-    "@jimp/core": "^1.6.0",
-    "@jimp/wasm-webp": "^1.6.0",
+    "@jimp/core": "^1.6.1",
+    "@jimp/wasm-webp": "^1.6.1",
     "@js-temporal/polyfill": "catalog:",
     "@logtape/file": "catalog:",
     "@logtape/logtape": "catalog:",
@@ -104,12 +104,12 @@
     "icojs": "^0.19.5",
     "inquirer": "^12.9.4",
     "inquirer-toggle": "^1.0.1",
-    "jimp": "^1.6.0",
+    "jimp": "^1.6.1",
     "ora": "^8.2.0",
     "shiki": "^1.6.4",
-    "smol-toml": "^1.6.0",
+    "smol-toml": "^1.6.1",
     "srvx": "^0.8.7",
-    "valibot": "^1.2.0"
+    "valibot": "^1.4.0"
   },
   "devDependencies": {
     "@types/bun": "catalog:",

packages/create/tsdown.config.ts

@@ -7,5 +7,5 @@ export default defineConfig({
   outExtensions() {
     return { js: ".js", dts: ".d.ts" };
   },
-  external: [/^node:/],
+  deps: { neverBundle: [/^node:/] },
 });

packages/denokv/deno.json

@@ -4,7 +4,7 @@
   "license": "MIT",
   "imports": {
     "@std/assert": "jsr:@std/assert@^1.0.13",
-    "es-toolkit": "npm:es-toolkit@^1.30.0"
+    "es-toolkit": "npm:es-toolkit@^1.46.1"
   },
   "exports": {
     ".": "./src/mod.ts"

packages/fedify/deno.json

@@ -17,7 +17,6 @@
     "@multiformats/base-x": "npm:@multiformats/base-x@^4.0.1",
     "@std/assert": "jsr:@std/assert@^0.226.0",
     "@std/url": "jsr:@std/url@^0.225.1",
-    "asn1js": "npm:asn1js@^3.0.7",
     "fast-check": "npm:fast-check@^3.22.0",
     "fetch-mock": "npm:fetch-mock@^12.5.2",
     "json-canon": "npm:json-canon@^1.0.1",

packages/fedify/package.json

@@ -167,7 +167,7 @@
     "fetch-mock": "catalog:",
     "miniflare": "^4.20250523.0",
     "tsdown": "catalog:",
-    "tsx": "^4.19.4",
+    "tsx": "^4.21.0",
     "typescript": "catalog:",
     "wrangler": "^4.17.0"
   },

packages/fedify/tsdown.config.ts

@@ -2,6 +2,11 @@ import { glob } from "node:fs/promises";
 import { join, sep } from "node:path";
 import { defineConfig } from "tsdown";
 
+function isTestingHelperImporter(importer: string | undefined): boolean {
+  const normalized = importer?.replaceAll(sep, "/");
+  return normalized?.includes("/src/testing/") ?? false;
+}
+
 export default [
   defineConfig({
     entry: [
@@ -40,14 +45,19 @@ export default [
       ...(await Array.fromAsync(glob(`src/**/*.test.ts`)))
         .map((f) => f.replace(sep, "/")),
     ],
-    external: [/^node:/, "@fedify/fixture"],
-    // Bundle @fedify/fixture back in for src/testing/ files (needed for
-    // cfworkers), while keeping it external for test files so that
-    // pnpm pack --recursive does not try to resolve the private package:
-    noExternal: (id: string, importer: string | undefined) => {
-      if (id !== "@fedify/fixture") return false;
-      const normalized = importer?.replaceAll(sep, "/");
-      return normalized?.includes("/src/testing/") ?? false;
+    deps: {
+      neverBundle: (id: string, parentId?: string) => {
+        if (id.startsWith("node:")) return true;
+        if (id !== "@fedify/fixture") return;
+        return !isTestingHelperImporter(parentId);
+      },
+      // Bundle @fedify/fixture back in for src/testing/ files (needed for
+      // cfworkers), while keeping it external for test files so that
+      // pnpm pack --recursive does not try to resolve the private package:
+      alwaysBundle: (id: string, importer: string | undefined) => {
+        if (id !== "@fedify/fixture") return;
+        return isTestingHelperImporter(importer);
+      },
     },
     inputOptions: {
       onwarn(warning, defaultHandler) {

packages/fixture/tsdown.config.ts

@@ -16,7 +16,7 @@ export default [
     dts: { compilerOptions: { isolatedDeclarations: true, declaration: true } },
     format: ["esm", "cjs"],
     platform: "neutral",
-    external: [/^node:/],
+    deps: { neverBundle: [/^node:/] },
     hooks: {
       "build:done": async (ctx) => {
         for await (const file of glob("src/fixtures/**/*.json")) {
@@ -35,10 +35,12 @@ export default [
     dts: false,
     format: ["esm", "cjs"],
     platform: "node",
-    external: [
-      /^node:/,
-      "@fedify/vocab-runtime",
-    ],
+    deps: {
+      neverBundle: [
+        /^node:/,
+        "@fedify/vocab-runtime",
+      ],
+    },
   }),
 ];
 

packages/init/package.json

@@ -48,7 +48,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@david/dax": "npm:dax@^0.45.0",
+    "@david/dax": "npm:dax@^0.46.1",
     "@fxts/core": "catalog:",
     "@inquirer/prompts": "^7.8.4",
     "@logtape/logtape": "catalog:",

packages/init/src/json/kv.json

@@ -75,7 +75,7 @@
       "pnpm"
     ],
     "dependencies": {
-      "npm:mysql2": "^3.20.0"
+      "npm:mysql2": "^3.22.3"
     },
     "imports": {
       "@fedify/mysql": {

packages/init/src/json/mq.json

@@ -75,7 +75,7 @@
       "pnpm"
     ],
     "dependencies": {
-      "npm:mysql2": "^3.20.0"
+      "npm:mysql2": "^3.22.3"
     },
     "imports": {
       "@fedify/mysql": {

packages/init/tsdown.config.ts

@@ -9,7 +9,7 @@ export default defineConfig({
   outExtensions() {
     return { js: ".js", dts: ".d.ts" };
   },
-  external: [/^node:/],
+  deps: { neverBundle: [/^node:/] },
   hooks: {
     "build:done": async (ctx) => {
       await cp(

packages/lint/package.json

@@ -61,7 +61,7 @@
   },
   "devDependencies": {
     "@types/eslint": "^9.0.0",
-    "@types/estree": "^1.0.8",
+    "@types/estree": "^1.0.9",
     "eslint": "^9.0.0",
     "tsdown": "catalog:",
     "typescript": "catalog:"

packages/sqlite/package.json

@@ -69,7 +69,7 @@
   "dependencies": {
     "@js-temporal/polyfill": "catalog:",
     "@logtape/logtape": "catalog:",
-    "es-toolkit": "^1.31.0"
+    "es-toolkit": "^1.46.1"
   },
   "peerDependencies": {
     "@fedify/fedify": "workspace:^"

packages/vocab-runtime/deno.json

@@ -14,7 +14,6 @@
   },
   "imports": {
     "@multiformats/base-x": "npm:@multiformats/base-x@^4.0.1",
-    "asn1js": "npm:asn1js@^3.0.6",
     "byte-encodings": "npm:byte-encodings@^1.0.11",
     "fetch-mock": "npm:fetch-mock@^12.5.4",
     "jsonld": "npm:jsonld@^9.0.0",

packages/vocab-runtime/tsdown.config.ts

@@ -8,14 +8,14 @@ export default [
     dts: { compilerOptions: { isolatedDeclarations: true, declaration: true } },
     format: ["esm", "cjs"],
     platform: "neutral",
-    external: [/^node:/],
+    deps: { neverBundle: [/^node:/] },
   }),
   defineConfig({
     outDir: "dist/tests",
     entry: (await Array.fromAsync(glob(`src/**/*.test.ts`)))
       .map((f) => f.replace(sep, "/")),
     format: ["esm", "cjs"],
     platform: "node",
-    external: [/^node:/, "@fedify/fixture"],
+    deps: { neverBundle: [/^node:/, "@fedify/fixture"] },
   }),
 ];

packages/vocab-tools/deno.json

@@ -12,7 +12,7 @@
   },
   "imports": {
     "@cfworker/json-schema": "npm:@cfworker/json-schema@^4.1.1",
-    "yaml": "npm:yaml@^2.8.1"
+    "yaml": "npm:yaml@^2.9.0"
   },
   "exclude": [
     "dist",

packages/vocab-tools/package.json

@@ -70,7 +70,7 @@
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
     "byte-encodings": "catalog:",
-    "es-toolkit": "^1.39.10",
-    "yaml": "^2.8.1"
+    "es-toolkit": "^1.46.1",
+    "yaml": "^2.9.0"
   }
 }

packages/vocab-tools/tsdown.config.ts

@@ -7,7 +7,7 @@ export default defineConfig({
   dts: { compilerOptions: { isolatedDeclarations: true, declaration: true } },
   format: ["esm", "cjs"],
   platform: "neutral",
-  external: [/^node:/],
+  deps: { neverBundle: [/^node:/] },
   hooks: {
     "build:done": async (ctx) => {
       await cp(

packages/vocab/tsdown.config.ts

@@ -18,7 +18,7 @@ export default [
     dts: { compilerOptions: { isolatedDeclarations: true, declaration: true } },
     format: ["esm", "cjs"],
     platform: "neutral",
-    external: [/^node:/],
+    deps: { neverBundle: [/^node:/] },
     outputOptions(outputOptions, format) {
       if (format === "cjs") {
         outputOptions.intro = `
@@ -37,7 +37,7 @@ export default [
     entry: (await Array.fromAsync(glob(`src/**/*.test.ts`)))
       .map((f) => f.replace(sep, "/")),
     dts: false,
-    external: [/^node:/, "@fedify/fixture"],
+    deps: { neverBundle: [/^node:/, "@fedify/fixture"] },
     inputOptions: {
       onwarn(warning, defaultHandler) {
         if (

packages/webfinger/deno.json

@@ -12,7 +12,7 @@
     "url": "https://hongminhee.org/"
   },
   "imports": {
-    "es-toolkit": "npm:es-toolkit@^1.42.0",
+    "es-toolkit": "npm:es-toolkit@^1.46.1",
     "fetch-mock": "npm:fetch-mock@^12.5.4"
   },
   "exclude": [