Skip to content

chore: bump the npm group across 1 directory with 9 updates - #24

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-27ad8ba0f0
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-27ad8ba0f0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the npm group with 9 updates in the / directory:

Package From To
@playwright/test 1.62.1 1.63.0
@types/node 26.4.1 26.6.2
exifreader 4.44.0 4.45.2
jsdom 30.0.1 30.1.1
oxfmt 0.66.0 0.70.0
oxlint 1.81.0 1.85.0
oxlint-tsgolint 7.0.2001 7.0.2002
rolldown 1.2.6 1.2.9
vitest 4.1.11 5.0.1

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates @types/node from 26.4.1 to 26.6.2

Commits

Updates exifreader from 4.44.0 to 4.45.2

Release notes

Sourced from exifreader's releases.

4.45.2: ICC and PNG Buffer fixes, metadataRange security fix

Changed

  • A custom build that excludes the exif module is now a little smaller. It no longer carries the code that computes the gps group of the expanded result (Latitude, Longitude and Altitude), which is derived from Exif GPS tags and so could never be produced in such a build. A build with only PNG support ({"include": {"png": true}}) goes from 35459 to 34666 bytes, around 0.2 KiB gzipped. A custom build that includes exif produces a byte-identical bundle.

Fixed

  • ICC text tags, such as the copyright notice in older profiles, no longer have up to six characters cut off at the end.
  • An ICC profile with a large text or description tag, over 64 KB in some JavaScript engines, no longer loses all of its ICC tags.
  • Reading the text metadata (tEXt, zTXt or iTXt chunks) of a PNG image no longer throws an error when the image is passed in as a Buffer from the buffer package, the Buffer polyfill used in browser bundles.
  • Reading the ICC profile (iCCP chunk) of a PNG image with async: true no longer throws an error when the image is passed in as a Buffer from the buffer package, the Buffer polyfill used in browser bundles.
  • A malformed ICC profile whose description or localized-text tag starts in its last few bytes no longer loses every ICC tag.

Security

  • Fixed an information disclosure vulnerability where length: 'auto' could put bytes from outside the data being parsed into metadataRange.buffer. This happened when the data was a Buffer from the buffer package, the Buffer polyfill used in browser bundles, that is a view into a larger buffer, and the metadata of the image extended past the end of the data, as in a truncated or crafted file. The buffer now stops at the end of the data.

Full Changelog: mattiasw/ExifReader@v4.45.1...v4.45.2

4.45.1: Fix ICC profile denial-of-service vulnerability

Security

  • Fixed a denial-of-service vulnerability where a crafted image could make ICC profile parsing use excessive memory and time. The number of tags read from a profile and the total amount of data decoded from them now have limits well above what real profiles use (GHSA-wr98-5fqg-jwf3). Reported by @​manus-pi.

Full Changelog: mattiasw/ExifReader@v4.45.0...v4.45.1

4.45.0: Security fixes and custom build corrections

Changed

  • A custom build that includes neither the exif nor the xmp module is now smaller. It no longer carries the code that computes the composite tags (FocalLength35efl, ScaleFactorTo35mmEquivalent and FieldOfView), which are derived from tags in those two groups and so could never be produced in such a build. A build with only PNG support ({"include": {"png": true}}) goes from 36002 to 34694 bytes, around 0.5 KiB gzipped. A custom build that includes either module produces a byte-identical bundle and returns the same tags.
  • A custom build that excludes the exif module no longer carries the 0th, Exif, GPS and interoperability tag name tables. They came in whenever anything imported the shared tag name module, so a build that kept mpf carried them even though it could never read an Exif tag. Leaving them out takes a build configured with {"exclude": {"exif": true}} from 117324 down to 96920 bytes, around 5 KiB gzipped, and one configured with {"include": {"jpeg": true, "mpf": true}} from 54329 down to 32383 bytes, around 6 KiB gzipped. A custom build that includes exif produces a byte-identical bundle and returns the same tags.

Fixed

  • A custom build whose include pattern names the thumbnail module but not

... (truncated)

Changelog

Sourced from exifreader's changelog.

[4.45.2] - 2026-09-21

Changed

  • A custom build that excludes the exif module is now a little smaller. It no longer carries the code that computes the gps group of the expanded result (Latitude, Longitude and Altitude), which is derived from Exif GPS tags and so could never be produced in such a build. A build with only PNG support ({"include": {"png": true}}) goes from 35459 to 34666 bytes, around 0.2 KiB gzipped. A custom build that includes exif produces a byte-identical bundle.

Fixed

  • ICC text tags, such as the copyright notice in older profiles, no longer have up to six characters cut off at the end.
  • An ICC profile with a large text or description tag, over 64 KB in some JavaScript engines, no longer loses all of its ICC tags.
  • Reading the text metadata (tEXt, zTXt or iTXt chunks) of a PNG image no longer throws an error when the image is passed in as a Buffer from the buffer package, the Buffer polyfill used in browser bundles.
  • Reading the ICC profile (iCCP chunk) of a PNG image with async: true no longer throws an error when the image is passed in as a Buffer from the buffer package, the Buffer polyfill used in browser bundles.
  • A malformed ICC profile whose description or localized-text tag starts in its last few bytes no longer loses every ICC tag.

Security

  • Fixed an information disclosure vulnerability where length: 'auto' could put bytes from outside the data being parsed into metadataRange.buffer. This happened when the data was a Buffer from the buffer package, the Buffer polyfill used in browser bundles, that is a view into a larger buffer, and the metadata of the image extended past the end of the data, as in a truncated or crafted file. The buffer now stops at the end of the data.

[4.45.1] - 2026-09-18

Security

  • Fixed a denial-of-service vulnerability where a crafted image could make ICC profile parsing use excessive memory and time. The number of tags read from a profile and the total amount of data decoded from them now have limits well above what real profiles use (GHSA-wr98-5fqg-jwf3). Reported by @​manus-pi.

[4.45.0] - 2026-09-10

Changed

... (truncated)

Commits
  • 045f5de 4.45.2
  • e8ee2bb Update changelog for 4.45.2
  • fa36279 Document the MPL 2.0 file header rule and add it where missing
  • 8a2faee Tell agents not to push or open a PR without being asked
  • 5eaec6d Read compressed ICC profiles from a Node Buffer backed DataView
  • 507b057 Remove the unused Constants stub from the pipeline spec deps
  • 1e10c4e Remove dead code from the thumbnail merge step
  • 9beb077 Cover the MPF and maker note flags in the tag name tables
  • ad5f7bb Keep parsed ICC tags when a tag header runs past the profile end
  • 33d1813 Index ICC chunks by number instead of searching for each one
  • Additional commits viewable in compare view

Updates jsdom from 30.0.1 to 30.1.1

Release notes

Sourced from jsdom's releases.

v30.1.1

  • Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
  • Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
  • Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
  • Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
  • Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
  • Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
  • Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
  • Fixed the storageQuota option being ignored by frames.
  • Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
  • Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
  • Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
  • Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
  • Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

  • Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
  • Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
  • Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
  • Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
  • Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
  • Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
  • Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
  • Changed window.close() to preserve access to the document and its DOM through retained references.
  • Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
  • Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
  • Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
  • Fixed :focus matching in shadow trees. (@​asamuzaK)
  • Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
  • Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
  • Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
  • Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
  • Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
  • Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
  • Fixed successful cached resource loads being treated as aborted.
  • Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
  • Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
  • Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
  • Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
  • Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
  • Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
  • Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)

... (truncated)

Commits
  • 0a117f4 30.1.1
  • 103f67d Remove unnecessary window cleanup from API tests
  • cdda00a Test HTTP/2 document and subresource loading
  • 7ab92ce Update @​asamuzakjp/dom-selector to v9.2.1
  • d940c20 Share jsdom settings across descendant windows
  • 6ba40cb Fix and simplify option propagation
  • 3b3be70 Preserve CSS priorities across declaration updates
  • 97b2758 Align focusing and unfocusing with HTML
  • b7b460b Update w3c-xmlserializer to v6
  • 71d562f Update html-encoding-sniffer to v7
  • Additional commits viewable in compare view

Updates oxfmt from 0.66.0 to 0.70.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.70.0

🚀 Features

  • 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)
Commits

Updates oxlint from 1.81.0 to 1.85.0

Release notes

Sourced from oxlint's releases.

oxlint v1.85.0

🚀 Features

  • 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)
Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.82.0] - 2026-09-07

🚀 Features

  • 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)
Commits
  • 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
  • f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
  • 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
  • b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
  • aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
  • 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
  • See full diff in compare view

Updates oxlint-tsgolint from 7.0.2001 to 7.0.2002

Release notes

Sourced from oxlint-tsgolint's releases.

v7.0.2002

What's Changed

... (truncated)

Commits
  • acd88e1 perf(prefer-regexp-exec): defer argument type resolution (#1207)
  • 1490844 perf(use-unknown-in-catch-callback-variable): defer annotation fixes (#1206)
  • d11b717 perf(strict-boolean-expressions): avoid temporary variant maps (#1205)
  • fe1ecf3 perf(no-unsafe-unary-minus): skip type queries for literals (#1203)
  • e42a510 perf(no-deprecated): skip type queries for empty allow lists (#1202)
  • 94ee8ac perf(restrict-template-expressions): avoid unnecessary base-type checks (#1204)
  • 7bbe341 perf(await-thenable): skip aggregator checks for empty calls (#1201)
  • 8296505 perf(no-base-to-string): avoid temporary certainty slices (#1200)
  • 6366773 perf(no-unnecessary-template-expression): defer single-interpolation fixes (#...
  • 8300b95 perf(unbound-method): check native names before resolving symbols (#1198)
  • Additional commits viewable in compare view

Updates rolldown from 1.2.6 to 1.2.9

Release notes

Sourced from rolldown's releases.

v1.2.9

[1.2.9] - 2026-09-16

🚀 Features

🐛 Bug Fixes

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

❤️ New Contributors

... (truncated)

Changelog

Sourced from rolldown's changelog.

[1.2.9] - 2026-09-16

🚀 Features

🐛 Bug Fixes

⚡ Performance

🧪 Testing

⚙️ Miscellaneous Tasks

❤️ New Contributors

... (truncated)

Commits

Updates vitest from 4.1.11 to 5.0.1

Release notes

Sourced from vitest's releases.

v5.0.1

   🚀 Features

  • ui:
    • Move trace attempts selector to viewer header  -  by @​hi-ogawa, Hiroshi Ogawa and Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 21, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-27ad8ba0f0 branch from bd8b3df to c48592f Compare September 24, 2026 23:15
Bumps the npm group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.6.2` |
| [exifreader](https://github.com/mattiasw/ExifReader) | `4.44.0` | `4.45.2` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.0.1` | `30.1.1` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.66.0` | `0.70.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.81.0` | `1.85.0` |
| [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) | `7.0.2001` | `7.0.2002` |
| [rolldown](https://github.com/rolldown/rolldown/tree/HEAD/packages/rolldown) | `1.2.6` | `1.2.9` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.11` | `5.0.1` |



Updates `@playwright/test` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `@types/node` from 26.4.1 to 26.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `exifreader` from 4.44.0 to 4.45.2
- [Release notes](https://github.com/mattiasw/ExifReader/releases)
- [Changelog](https://github.com/mattiasw/ExifReader/blob/main/CHANGELOG.md)
- [Commits](mattiasw/ExifReader@v4.44.0...v4.45.2)

Updates `jsdom` from 30.0.1 to 30.1.1
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.0.1...v30.1.1)

Updates `oxfmt` from 0.66.0 to 0.70.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.70.0/npm/oxfmt)

Updates `oxlint` from 1.81.0 to 1.85.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.85.0/npm/oxlint)

Updates `oxlint-tsgolint` from 7.0.2001 to 7.0.2002
- [Release notes](https://github.com/oxc-project/tsgolint/releases)
- [Commits](oxc-project/tsgolint@v7.0.2001...v7.0.2002)

Updates `rolldown` from 1.2.6 to 1.2.9
- [Release notes](https://github.com/rolldown/rolldown/releases)
- [Changelog](https://github.com/rolldown/rolldown/blob/main/CHANGELOG.md)
- [Commits](https://github.com/rolldown/rolldown/commits/v1.2.9/packages/rolldown)

Updates `vitest` from 4.1.11 to 5.0.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/vitest)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 26.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: exifreader
  dependency-version: 4.45.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: jsdom
  dependency-version: 30.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: oxfmt
  dependency-version: 0.68.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: oxlint
  dependency-version: 1.83.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: oxlint-tsgolint
  dependency-version: 7.0.2002
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: rolldown
  dependency-version: 1.2.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 5.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-27ad8ba0f0 branch from c48592f to 38699fc Compare September 25, 2026 23:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants