Skip to content

chore(deps-dev): bump the build-and-test group across 1 directory with 7 updates - #80

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/build-and-test-3a895e839f
Open

chore(deps-dev): bump the build-and-test group across 1 directory with 7 updates#80
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/build-and-test-3a895e839f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the build-and-test group with 7 updates in the / directory:

Package From To
@playwright/test 1.63.0 1.64.1
happy-dom 20.14.5 21.0.4
tsdown 0.23.0 0.23.1
typescript 6.0.3 7.0.2
vite 8.3.1 8.3.5
vitest 5.0.2 5.0.5
vue-tsc 3.3.11 3.3.13

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • Additional commits viewable in compare view

Updates happy-dom from 20.14.5 to 21.0.4

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

  • Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
  • Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

👷‍♂️ Patch fixes

  • Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

v21.0.1

👷‍♂️ Patch fixes

v21.0.0

💣 Breaking Changes

  • Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @​capricorn86
    • An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.
    • The settings property disableCSSFileLoading has been deprecated
    • Added the new settings properties enableCSSFileLoading and enableIframePageLoading
    • If you don't believe that you are at risk, you can keep the same behavior as in <=v20.14.6 by sending in { enableCSSFileLoading: true, enableIframePageLoading: true } as broswer settings (e.g. new Window({ settings }));

v20.14.6

👷‍♂️ Patch fixes

Commits
  • fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
  • 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
  • 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
  • 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
  • f55c7e0 chore: Update security documentation (#2509)
  • 2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
  • 0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
  • f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
  • See full diff in compare view

Updates tsdown from 0.23.0 to 0.23.1

Release notes

Sourced from tsdown's releases.

v0.23.1

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 6493257 chore: release v0.23.1
  • ba6acb9 chore: upgrade deps
  • 6cbfec7 chore(deps): update dependency unplugin-vue to v8 (#1090)
  • eb40c95 chore: declare package side effects
  • f9c95d0 chore: align pnpm workspace settings
  • e64bde4 chore: configure pnpm via devEngines
  • 83f0c57 fix(pkg): pack tarball inside npm publish --dry-run (#1076)
  • 1745223 fix(entry): honor custom root for object entry (#1072)
  • 9655dcb chore: upgrade deps
  • 30da631 docs: correct default value of minify
  • Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates vite from 8.3.1 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

... (truncated)

Commits
  • 981f07f release: v8.3.5 (#23856)
  • 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
  • 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
  • 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
  • 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
  • 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
  • df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
  • a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
  • 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
  • 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
  • Additional commits viewable in compare view

Updates vitest from 5.0.2 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates vue-tsc from 3.3.11 to 3.3.13

Release notes

Sourced from vue-tsc's releases.

v3.3.13

language-core

  • fix: generate setup macros without static imports (85f665e)

vscode

  • fix: avoid registerHooks on buggy Node versions (7e0d6c4)

Contributors: @​KazariEX, @​serkodev

v3.3.12

language-core

  • security: improved handling of untrusted Vue files (cea0698)
  • feat: infer first parameter type of default factory for defineModel (1be73b8)
  • feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)
  • fix: keep union props when using withDefaults (084f30f)
  • fix: keep inference-only props string single-line with block comments (55ca36f)
  • fix: support calling template bindings without .value (7ad4a94)
  • fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)
  • fix: pad directive hook signatures to check short-arity directive bindings (94052b8)
  • fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)
  • fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)
  • fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)
  • fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)
  • perf: precompile attribute glob matchers (7d2e603)

component-meta

  • fix: stop checking JS Vue files as TS (045a6a7)

typescript-plugin

  • fix: don't abort reference span fix-up at style-less files (e46126c)

tsc

  • fix: prevent watch mode crash on incremental build (a59da36)

vscode

  • perf: reduce focus mode overhead (b0936d1)

Contributors: @​johnsoncodehk, @​serkodev, @​KazariEX, @​00200200, @​camonunez, @​Cherry, @​hungateJoseph, @​uturnr, @​ValentinYoushkevich, @​xia-chao

Changelog

Sourced from vue-tsc's changelog.

3.3.13 (2026-10-10)

language-core

  • fix: generate setup macros without static imports (85f665e)

vscode

  • fix: avoid registerHooks on buggy Node versions (7e0d6c4)

Contributors: @​KazariEX, @​serkodev

3.3.12 (2026-10-02)

language-core

  • security: improved handling of untrusted Vue files (cea0698)
  • feat: infer first parameter type of default factory for defineModel (1be73b8)
  • feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)
  • fix: keep union props when using withDefaults (084f30f)
  • fix: keep inference-only props string single-line with block comments (55ca36f)
  • fix: support calling template bindings without .value (7ad4a94)
  • fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)
  • fix: pad directive hook signatures to check short-arity directive bindings (94052b8)
  • fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)
  • fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)
  • fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)
  • fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)
  • perf: precompile attribute glob matchers (7d2e603)

component-meta

  • fix: stop checking JS Vue files as TS (045a6a7)

typescript-pluginDescription has been truncated

@dependabot
dependabot Bot requested a review from maoxor as a code owner October 19, 2026 04:55
@dependabot @github

dependabot Bot commented on behalf of github Oct 19, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
chore(deps-dev): bump the build-and-test group across 1 directory wit…
dabab11 
…h 7 updates

Bumps the build-and-test group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.14.5` | `21.0.4` |
| [tsdown](https://github.com/rolldown/tsdown) | `0.23.0` | `0.23.1` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.1` | `8.3.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.2` | `5.0.5` |
| [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.11` | `3.3.13` |



Updates `@playwright/test` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `happy-dom` from 20.14.5 to 21.0.4
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.14.5...v21.0.4)

Updates `tsdown` from 0.23.0 to 0.23.1
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.23.0...v0.23.1)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

Updates `vite` from 8.3.1 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

Updates `vitest` from 5.0.2 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

Updates `vue-tsc` from 3.3.11 to 3.3.13
- [Release notes](https://github.com/vuejs/language-tools/releases)
- [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vuejs/language-tools/commits/v3.3.13/packages/tsc)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: build-and-test
- dependency-name: happy-dom
  dependency-version: 21.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: build-and-test
- dependency-name: tsdown
  dependency-version: 0.23.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: build-and-test
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: build-and-test
- dependency-name: vite
  dependency-version: 8.3.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: build-and-test
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: build-and-test
- dependency-name: vue-tsc
  dependency-version: 3.3.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: build-and-test
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/build-and-test-3a895e839f branch from c043468 to dabab11 Compare October 26, 2026 05:57

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maoxor maoxor Awaiting requested review from maoxor maoxor is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants