[dependabot]

Bumps the development-dependencies group with 21 updates in the / directory:

Package	From	To
fallow	3.0.0	3.28.0
typescript	6.0.3	7.0.2
@testing-library/react	16.3.2	16.3.3
jsdom	29.1.1	30.1.1
hono	4.12.27	4.13.9
@hono/node-server	2.0.8	2.1.1
supertest	7.2.2	7.3.0
@types/supertest	7.2.0	7.2.1
tsx	4.23.0	4.23.15
@playwright/test	1.61.1	1.63.0
@vitejs/plugin-react	6.0.3	6.1.1
concurrently	10.0.3	10.0.5
vite	8.1.3	8.3.1
@astrojs/starlight	0.41.3	0.42.4
astro	7.0.6	7.3.5
starlight-package-managers	0.12.0	0.13.0
starlight-llms-txt	0.11.0	0.12.0
@stryker-mutator/core	9.6.1	10.0.0
@stryker-mutator/vitest-runner	9.6.1	10.0.0
@vitest/coverage-v8	4.1.9	5.0.1
vitest	4.1.9	5.0.1

Updates fallow from 3.0.0 to 3.28.0

Release notes

Sourced from fallow's releases.

v3.28.0: baselines carry a kind, request outcomes on every surface, Module Federation and Nuxt reads

Features

• Every saved baseline now says which command wrote it. --save-baseline writes a top-level kind field with dead-code, dupes or health. Older baselines without it still load, and an older fallow still loads a baseline saved by this release.
• Pointing --baseline at the wrong command's file is no longer silent. The run prints a warning with both command names and the path, and the file suppresses nothing. In the JSON output, baseline_staleness.unrecognised_format is true. The same warning appears in the pull-request comment, the merge-request note and the Check Run. The GitHub job summary shows the file path through the new baseline-path output, and fallow audit prints one warning per baseline it cannot use.
• The JSON output says what narrowed a run. baseline_staleness.scope_reasons lists the reasons, for example changed-since or production. A narrowed run with a baseline also gets a recheck-baseline entry in next_steps, and the bare fallow command gets it too.
• request_outcomes is now in the output of fallow flags, fallow suppressions and fallow security. The first two report their changed-since entry, and fallow security --sarif-file gets a sarif-file entry.
• An empty diff no longer looks like a clean project. When a diff filter applies, its request_outcomes entry has a scope_size with the number of added lines. A diff with zero added lines reports scope_size: 0. The Action, the GitLab template, the MCP tools and the pull-request comment then all say that the clean result covers nothing.
• hotspots-skipped now has a cause: not-a-repository, invalid-since or churn-file-unreadable.
• A config that a plugin cannot read shows up in workspace_diagnostics. When a Module Federation exposes or remotes is not a static object literal, the run records plugin-config-unreadable with the plugin, the key and the reason. It sets degrades_analysis, so the Action and the GitLab template print it in their degraded-inputs warning. Nuxt has a related case: a components: or imports: shape that fallow cannot model. Such a project records plugin-effect-not-modeled, and that entry is silent.
• The JSON output and both CI integrations report a run that widened to the whole project. They also report a --sarif-file that could not be written, and a format that cannot group results with --group-by.
• fallow reads Module Federation exposes and remotes. It reads module-federation.config.* and inline plugin options in webpack, rspack, rsbuild, vite and Next.js configs. The plugin call can sit anywhere in the config: in a nested plugin array, in a variable, under tools.rspack.plugins or in a webpack(config) hook. Options held in a const in the same file are read, and so is the array form of exposes. Each exposes target becomes a runtime entry point, and each remotes alias counts as a provided dependency for the code under that config's directory.
• Nuxt autoImports credits a global/ or islands/ component under the name Nuxt gives it. Each workspace root now gets its own verdict from its own config. components: true, imports: {} and imports: { dirs: [] } count as the Nuxt default. A name imported or re-exported from #components or #imports marks its file as used, and #layers/<name>/ works as a path alias.

Changed

• fallow dead-code no longer exits 2 when the baseline belongs to another command. It warns and continues. --fail-on-stale-baseline fails the run on such a file. Saving over a baseline of another kind is refused with exit 2.
• The GitHub Action and the GitLab template log why a JSON read failed. The cause goes to the debug log, and a green run gets no extra line.
• fallow security --base warns when it cannot map the analysis root into the base worktree.

Bug fixes

• A package name in a bundler entry is credited as a dependency. A value like react-hot-loader/patch or webpack-hot-middleware/client?reload=true in a webpack, rspack or rsbuild entry used to become an entry pattern that matched no file. The package then showed up as unused.
• The MCP audit and decision_surface tools detect the base ref again. This regressed in 3.1.0. Thanks @​codingthat for the report and the reproduction (#2699).
• autoImports: true works in a Nuxt project that turns the scan off. components: false, imports: { scan: false } and the other scan-off shapes no longer count as a custom layout, so unused convention files are reported. Thanks @​Tsuyoshi84 for the report (#2695).

Upgrade notes

• A CI job that points --baseline at another command's file now fails when --fail-on-stale-baseline is set. Give each command its own baseline file.
• A Nuxt project with autoImports: true and one of the scan-off shapes will see new unused-file findings. Add a file to entry when it is used in a way fallow cannot see.
• If you switch on workspace_diagnostics[].kind, handle the two new kinds. Every new JSON field is optional.

Full Changelog: fallow-rs/fallow@v3.27.0...v3.28.0

v3.27.0: every CI gate can fail the job, baseline staleness in CI, gate results in MCP

Features

• An armed gate reports its result in the JSON output. A run that arms a gate gets gate_outcomes, an object keyed by gate name. Each entry has status (pass, warn, fail or skipped) and enforced. Where a comparison happened, you also get observed, threshold and threshold_label. Only the gates the run armed appear in the object. A dead-code run can exit 1 on the default severity rules with no object at all. The key set is open, and a gate name you do not recognise means "some gate". (#2680, #2681, #2683, #2685)
• The JSON output reports a stale baseline, and CI can fail on it. 3.26.0 printed the stale-baseline warning and --fail-on-stale-baseline on stderr only, and --quiet removes that output. The GitHub Action and the GitLab template both run with --quiet. dead-code / check, the bare run, dupes and health report one baseline_staleness object, in grouped output too. It holds the entry counts, change_scoped, the warning result and gate_trips. Both integrations show a stale baseline as a warning and in the job summary. On a pull request the main run covers changed files only. The integrations therefore re-read the baseline once over the whole project. That re-read took 0.11s with a cache and 0.24s with type-aware analysis on an 870-file TypeScript project. Whether a stale baseline fails the job depends on the new fail-on-stale-baseline input and the FALLOW_FAIL_ON_STALE_BASELINE variable. The pull-request comment and the merge-request note do not include the warning yet. Thanks @​cloud-walker for the report, which traced the gap through the action scripts. (#2673)
• min-score is an Action input and a GitLab variable. Before this release you could set it only through args: / FALLOW_ARGS. --min-score implies --score, so the integrations add --complexity when no health section input is set. That keeps the annotations, the SARIF upload and the pull-request comment populated. The CLI turns its own findings rule off for such a run, and the integrations do the same, which leaves the decision to the score. min-score and min-severity apply to command: health and exit 2 elsewhere. (#2682)
• A run that analyzed no source file reports it. The run prints a warning and passes by default. fail-on-empty-analysis: true (FALLOW_FAIL_ON_EMPTY_ANALYSIS on GitLab) makes it fail. The JSON output has a no-source-files-analyzed diagnostic and the new workspace_diagnostics[].degrades_analysis field. When findings cover less than the whole project, the integrations print one combined warning with the diagnostic kinds and their counts. (#2686)
• An MCP tool result reports what each gate concluded. The tools run the CLI with --quiet and turn exit 1 into a successful result, which hid every gate result from the agent. The root warnings array reports a stale baseline together with the re-save remedy. It also lists every gate that concluded fail or warn, with its numbers. A run that covered less than the whole project gets one entry too. The subprocess, Code Mode and typed routes all do this. find_dupes with a threshold takes the route that can evaluate it. A response with nothing to report is unchanged. (#2676)
• fallow report --from shows the gate results in CI. It prints them as a notice annotation and as a line in the job summary, the pull-request comment and the merge-request note. The line is informational and never fails a step. (#2684)

Changed

• security-gate fails the job independently of fail-on-issues. In both integrations the security branch sat inside the fail-on-issues conditional, and fail-on-issues: false meant that branch never ran.
• The Action's inline Check threshold step is gone. Its logic moved into the analyze step, and the gates-failed output names the gates that decided the result.
• In combined mode the duplication threshold does not fail the run, and the JSON output has enforced: false for it. Standalone dupes exits 1 as before. The default GitLab job forwards the threshold in combined mode, and that pipeline prints a warning with the reason.
• --fail-on-stale-baseline changes one field in the output. That field is gate_outcomes["stale-baseline"].enforced. Nothing in baseline_staleness depends on the flag, not even gate_trips.

... (truncated)

Commits

• bd8fca5 chore: release v3.28.0
• b04ec44 docs(changelog): edit the unreleased entries for the 3.28.0 release (#2759)
• f9fb3f9 refactor(cli): resolve the base analysis root and the short HEAD through the ...
• c3197ec feat(plugins): read Module Federation options wherever a config declares them...
• 234d24c feat(baseline): give saved baselines a kind and report an unrecognised one on...
• 7e2e7ad feat(plugins): record a plugin config fallow cannot read as a workspace diagn...
• 4cec981 docs(release): let the preflight name repository secrets instead of blocking ...
• d4264c2 fix(plugins): credit bundler entry packages and close the Nuxt autoImports pr...
• 173ee40 ci(release): run credential jobs in a main-only release environment (#2746)
• 731a504 feat(output): carry the request outcomes and skip causes four commands left o...
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates jsdom from 29.1.1 to 30.1.1

Release notes

Sourced from jsdom's releases.

v30.1.1

• Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
• Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
• Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
• Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
• Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
• Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
• Fixed the storageQuota option being ignored by frames.
• Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
• Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
• Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
• Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
• Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
• Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
• Fixed :focus matching in shadow trees. (@​asamuzaK)
• Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during element.replaceWith().
• Fixed the ordering of script execution, custom element callbacks, iframe loading, and mutation observer notifications during DOM insertion, including in shadow trees.
• Fixed queued events and navigation continuing after window.close() or iframe removal, and prevented new scripts, resource loads, timers, and animation frames from starting in destroyed documents. (@​scttcper)
• Fixed parent documents waiting indefinitely for loading to finish when a child iframe removes itself during loading.
• Fixed request cancellation across redirects, during pending requestInterceptor() callbacks, and when reusing an XMLHttpRequest after aborting it.
• Fixed resource loading and JSDOM.fromURL() potentially hanging when response handling throws and response stream cleanup does not finish.
• Fixed successful cached resource loads being treated as aborted.
• Fixed getComputedStyle() and document.styleSheets using the wrong stylesheet order after inserting or updating <style> elements.
• Fixed getComputedStyle() ignoring nested @import and @media rules in imported stylesheets, and returning stale results after imports finish loading.
• Fixed style invalidation, stylesheet removal, and frame source updates in shadow trees.
• Fixed repeated getComputedStyle() calls changing case-sensitive background URLs, and inconsistent resolution of border shorthands containing system colors. (@​scttcper)
• Fixed computed border widths, including borderless elements incorrectly reporting 16px, which regressed in v30.0.0. (@​Alberto-BaseNet)
• Fixed getComputedStyle() to resolve 'font-weight' keywords to numeric values. (@​tianrking)
• Fixed getComputedStyle() to convert lengths to pixels inside CSS math functions containing percentages, and to resolve percentages in 'font-size' math functions. (@​soroushm)

... (truncated)

Commits

• 0a117f4 30.1.1
• 103f67d Remove unnecessary window cleanup from API tests
• cdda00a Test HTTP/2 document and subresource loading
• 7ab92ce Update @​asamuzakjp/dom-selector to v9.2.1
• d940c20 Share jsdom settings across descendant windows
• 6ba40cb Fix and simplify option propagation
• 3b3be70 Preserve CSS priorities across declaration updates
• 97b2758 Align focusing and unfocusing with HTML
• b7b460b Update w3c-xmlserializer to v6
• 71d562f Update html-encoding-sniffer to v7
• Additional commits viewable in compare view

Updates hono from 4.12.27 to 4.13.9

Release notes

Sourced from hono's releases.

v4.13.9

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380
• fix(accepts): match media types and language tags case-insensitively in honojs/hono#5376
• fix(linear-router): don't match an empty path segment as a param in honojs/hono#5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in honojs/hono#5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in honojs/hono#5379
• fix(aws-lambda): treat binary +xml archive media types as binary in honojs/hono#5424
• fix(aws-lambda): preserve empty query parameters in honojs/hono#5292
• fix(lambda-edge): sync content type detection with aws-lambda in honojs/hono#5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in honojs/hono#5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

What's Changed

• docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343
• perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340
• fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351
• fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311
• fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349
• fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357
• fix(request): keep the request media type when reusing a cached body in honojs/hono#5366
• docs(combine): fix except() JSDoc param and add missing @​returns in honojs/hono#5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

... (truncated)

Commits

• 7c3b0df 4.13.9
• 6cadf75 fix(lambda-edge): fail with a descriptive error on a malformed event (#5358)
• de310ac fix(lambda-edge): sync content type detection with aws-lambda (#5426)
• 28e8572 fix(aws-lambda): preserve empty query parameters (#5292)
• 0d86899 fix(aws-lambda): treat binary +xml archive media types as binary (#5424)
• 52febbc fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url (#5...
• f950277 fix(pretty-json): don't break responses with unparseable JSON bodies (#5377)
• 00ee875 fix(linear-router): don't match an empty path segment as a param (#5373)
• f5a5346 fix(accepts): match media types and language tags case-insensitively (#5376)
• cb5bea3 fix(jsx): replace Suspense and ErrorBoundary content across newlines (#5380)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.0.8 to 2.1.1

Release notes

Sourced from @​hono/node-server's releases.

v2.1.1

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in honojs/node-server#389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

v2.1.0

What's Changed

• feat: add Early Hints (HTTP 103) middleware by @​bilal-azam in honojs/node-server#378
• fix(listener): avoid uncaught error when force-closing a non-standard socket by @​mohamedramadan14 in honojs/node-server#383

New Contributors

• @​bilal-azam made their first contribution in honojs/node-server#378
• @​mohamedramadan14 made their first contribution in honojs/node-server#383

Full Changelog: honojs/node-server@v2.0.12...v2.1.0

v2.0.12

What's Changed

• test: replace supertest by @​BlankParticle in honojs/node-server#379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

v2.0.11

What's Changed

• test: use a custom helper for path traversal tests by @​BlankParticle in honojs/node-server#377
• perf(request): fast-path QUERY methods by @​usualoma in honojs/node-server#376
• perf(request): fast-path PATCH method by @​yusukebe in honojs/node-server#380

Full Changelog: honojs/node-server@v2.0.10...v2.0.11

v2.0.10

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

What's Changed

... (truncated)

Commits

• 73c03ad 2.1.1
• 5515aa0 perf: lazily materialize request headers (#389)
• 82ba34e 2.1.0
• 1f2909a fix(listener): avoid uncaught error when force-closing a non-standard socket ...
• 977a242 feat: add Early Hints (HTTP 103) middleware (#378)
• a813b6c 2.0.12
• caf48ba fix(response): copy headers when init is a foreign Response (#382)
• 3b1dd68 test: replace supertest (#379)
• 834e54f 2.0.11
• ba72bcd perf(request): fast-path PATCH method (#380)
• Additional commits viewable in compare view

Updates supertest from 7.2.2 to 7.3.0

Release notes

Sourced from supertest's releases.

v7.3.0

• fix: stabilize ephemeral server requests and assertions 71dc5fb
• Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd8535d99 3b5ba5c
• Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2.3.2 c3419b2
• Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1 7e409db
• Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expansion-1.1.21 b55a7f9
• Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslist-4.29.0 7a5deaa
• Merge pull request #900 from forwardemail/dependabot/npm_and_yarn/fast-uri-3.1.8 a75f6ee
• Merge pull request #901 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.15.2 c2cb33e
• Merge pull request #896 from pnookala-godaddy/codex/ephemeral-loopback-bind 7fb34e7
• chore(deps-dev): bump js-yaml from 3.14.2 to 3.15.2 c357584
• chore(deps-dev): bump browserslist from 4.25.1 to 4.29.0 2a01b57
• chore(deps-dev): bump fast-uri from 3.0.6 to 3.1.8 343394d
• chore(deps-dev): bump brace-expansion from 1.1.12 to 1.1.21 6b203e9
• Merge pull request #881 from forwardemail/dependabot/npm_and_yarn/qs-6.14.2 d40ca7e
• fix: match ephemeral server address family b6f5995
• chore(deps-dev): bump lodash from 4.17.21 to 4.18.1 81766ca
• chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 985ac7c
• chore(deps): bump minimatch 58baa5f
• chore(deps): bump qs from 6.14.1 to 6.14.2 c406e82

---

forwardemail/supertest@v7.2.2...v7.3.0

Commits

• a3f5cb8 7.3.0
• 71dc5fb fix: stabilize ephemeral server requests and assertions
• 3b5ba5c Merge pull request #883 from forwardemail/dependabot/npm_and_yarn/multi-acd85...
• c3419b2 Merge pull request #886 from forwardemail/dependabot/npm_and_yarn/picomatch-2...
• 7e409db Merge pull request #887 from forwardemail/dependabot/npm_and_yarn/lodash-4.18.1
• b55a7f9 Merge pull request #898 from forwardemail/dependabot/npm_and_yarn/brace-expan...
• 7a5deaa Merge pull request #899 from forwardemail/dependabot/npm_and_yarn/browserslis...
• a75f6ee Merge pull request #900 from forwardemail/dependabot/npm_and_yarn/fast-uri-3.1.8
• c2cb33e Merge pull request #901 from forwardemail/dependabot/npm_and_yarn/js-yaml-3.15.2
• 7fb34e7 Merge pull request #896 from pnookala-godaddy/codex/ephemeral-loopback-bind
• Additional commits viewable in compare view

Updates @types/supertest from 7.2.0 to 7.2.1

Commits

• See full diff in compare view

Updates tsx from 4.23.0 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

... (truncated)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• Additional commits viewable in compare view

Updates @playwright/test from 1.61.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @vitejs/plugin-react from 6.0.3 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via t...

Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 79ff3959-10f8-4c68-82bb-02640ccc8aeb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}