[moodysalem]

Combines four Dependabot updates into one change, pinned to exactly the versions those PRs resolved:

• @types/bun 1.4.3 → 1.4.4 (bun-types 1.4.4), from Bump @types/bun from 1.4.3 to 1.4.4 #236
• @cloudflare/workers-types 5.20261019.1 → 5.20261023.1, from Bump @cloudflare/workers-types from 5.20261019.1 to 5.20261023.1 #235
• wrangler 4.151.2 → 4.152.0 (miniflare 5.20261019.0-beta → 5.20261019.2-beta; workerd stays at 1.20261019.1), from Bump wrangler from 4.151.2 to 4.152.0 #234
• oxlint-tsgolint 7.0.2004 → 7.0.2005, from Bump oxlint-tsgolint from 7.0.2004 to 7.0.2005 #233

The bun.lock diff is exactly the union of the four Dependabot lockfile diffs. A plain bun install would also have picked up newer releases (wrangler 4.153.0, workers-types 5.20261026.1, workerd 1.20261023.1, undici 7.30.1), so those are left out on purpose. No source, config or workflow files change.

Verification

• Every changed bun.lock integrity matches npm view <pkg>@<version> dist.integrity. wrangler, miniflare, workers-types and oxlint-tsgolint have npm provenance attestations. None of the changed packages adds an install script.
• bun install --frozen-lockfile passes from a clean node_modules.
• bun run format:check, bun run lint, bun run typecheck and bun test all pass (193 pass, 0 fail across 21 files; this includes the OpenAPI snapshot and response contract tests).
• I compared wrangler deploy --dry-run --env prod --minify --outdir … on main (4.151.2) and on this branch (4.152.0):
  • index.js is byte-identical (sha256 c748d4dd…5e262f).
  • Upload size (920.08 KiB / 258.19 KiB gzip), bindings and warnings are the same.
  • In the source map, only the embedded package.json and the outdir-dependent sourceRoot differ.
• With wrangler dev 4.152.0, /openapi.json returns 200 and matches the committed openapi.json. CORS preflight returns 204.

Upstream changes reviewed

The wrangler 4.151.3 and 4.152.0 changes are:

• Remote Hyperdrive bindings in local dev.
• A Workflows jurisdiction setting.
• auth token --json output.
• R2 create location reporting.
• Compliance-region remote config diff.
• --strict optional-field comparison.
• Named-entrypoint-only Workers in dev.
• An explicit error for Bun's dispatcher limitation in local dev.

This Worker's deploy configuration uses none of these features, and the deploy output above is unchanged.

Supersedes #233, #234, #235 and #236.