Skip to content

chore(deps): update all non-major dependencies#297

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#297
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 4, 2026

This PR contains the following updates:

Package Change Age Confidence
@iconify-json/carbon ^1.2.20^1.2.21 age confidence
@types/node (source) 24.12.224.12.4 age confidence
@vitest/coverage-v8 (source) 4.1.54.1.6 age confidence
axe-core (source) ^4.11.3^4.11.4 age confidence
eslint (source) 10.2.110.3.0 age confidence
jsdom ^29.1.0^29.1.1 age confidence
pkg-pr-new (source) 0.0.670.0.72 age confidence
playwright-core (source) 1.59.11.60.0 age confidence
pnpm (source) 10.33.210.33.4 age confidence
vite (source) 8.0.108.0.13 age confidence
vitest (source) 4.1.54.1.6 age confidence
vue (source) ^3.5.33^3.5.34 age confidence
vue-router (source) ^5.0.6^5.0.7 age confidence
vue-tsc (source) 3.2.73.2.9 age confidence

Release Notes

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.6

Compare Source

   🐞 Bug Fixes
   🏎 Performance
    View changes on GitHub
dequelabs/axe-core (axe-core)

v4.11.4

Compare Source

eslint/eslint (eslint)

v10.3.0

Compare Source

jsdom/jsdom (jsdom)

v29.1.1

Compare Source

stackblitz-labs/pkg.pr.new (pkg-pr-new)

v0.0.72

Compare Source

v0.0.71

Compare Source

v0.0.70

Compare Source

v0.0.69

Compare Source

v0.0.68

Compare Source

microsoft/playwright (playwright-core)

v1.60.0

Compare Source

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:

await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.

🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:

await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});

await page.locator('#dropzone').drop({
  data: {
    'text/plain': 'hello world',
    'text/uri-list': 'https://example.com',
  },
});

🎯 Aria snapshots

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:

test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});

New APIs

Browser, Context and Page
Locators and Assertions
Network
  • webSocketRoute.protocols() returns the WebSocket subprotocols requested by the page.
  • New option noDefaults in browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.
Errors and Reporting
Test runner
  • New {testFileBaseName} token in testProject.snapshotPathTemplate — file name without extension.
  • Test runner now errors when a config tries to override a non-option fixture, and rejects workers: 0 or negative values.

🛠️ Other improvements

  • HTML reporter:
    • npx playwright show-report accepts .zip files directly — no need to unzip first.
    • Steps that contain attachments inside nested children show an indicator on the parent step.
    • The repeatEachIndex is shown in the test header when non-zero.
  • Trace Viewer adds a pretty-print toggle for JSON / form request and response bodies in the network details panel.

Breaking Changes ⚠️

  • Removed long-deprecated APIs:
    • Locator.ariaRef() — use the standard locator.ariaSnapshot() pipeline.
    • handle option on BrowserContext.exposeBinding and Page.exposeBinding.
    • logger option on BrowserType.connect and BrowserType.connectOverCDP — use tracing instead.
    • Context options videosPath / videoSize — use recordVideo instead.

Browser Versions

  • Chromium 148.0.7778.96
  • Mozilla Firefox 150.0.2
  • WebKit 26.4

This version was also tested against the following stable channels:

  • Google Chrome 147
  • Microsoft Edge 147
pnpm/pnpm (pnpm)

v10.33.4: pnpm 10.33.4

Compare Source

Patch Changes

  • Pin the integrity of git-hosted tarballs (codeload.github.com, gitlab.com, bitbucket.org) in the lockfile so that subsequent installs detect a tampered or substituted tarball and refuse to install it. Previously the lockfile only stored the tarball URL for git dependencies, so a compromised git host or a man-in-the-middle could serve arbitrary code on later installs without lockfile changes.

    A new gitHosted: true field is recorded on git-hosted tarball resolutions in the lockfile, letting every reader/writer route them by a single typed check instead of pattern-matching the tarball URL in each call site. Lockfiles written by older pnpm versions are enriched on load (URL fallback) so the field can be relied on uniformly across the codebase.

  • Fix a regression where pnpm --recursive --filter '!<pkg>' run/exec/test/add would include the workspace root in the matched projects. The workspace root is now correctly excluded by default when only negative --filter arguments are provided, matching the documented behavior. To include the root, pass --include-workspace-root #​11341.

Platinum Sponsors

Bit

Gold Sponsors

Sanity Discord Vite
SerpApi CodeRabbit Stackblitz
Workleap Nx

v10.33.3

Compare Source

vitejs/vite (vite)

v8.0.13

Compare Source

Features
Bug Fixes
Miscellaneous Chores

v8.0.12

Compare Source

Features
Bug Fixes
  • create-vite: pass react framework to TanStack CLI (#​22397) (18f0f90)
  • deps: update all non-major dependencies (#​22420) (2be6000)
  • module-runner: prevent partial-exports race on concurrent imports of in-flight invalidated re-export chains (#​22369) (f5a22e6)
  • refer to rolldownOptions instead of deprecated rollupOptions in messages (#​22400) (b675c7b)
  • worker: apply build.target to worker bundle (#​22404) (3c93fde)
  • worker: forward define to worker bundle transform (#​22408) (d4838a0)
Miscellaneous Chores

v8.0.11

Compare Source

Features
Bug Fixes
Documentation
Miscellaneous Chores
Code Refactoring
Tests
vuejs/core (vue)

v3.5.34

Compare Source

Bug Fixes
vuejs/router (vue-router)

v5.0.7

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
vuejs/language-tools (vue-tsc)

v3.2.9

Compare Source

language-core
vscode
  • fix: trigger file rename edits when moving folders with Vue files (#​6046) - Thanks to @​KazariEX!
workspace

v3.2.8

Compare Source

language-core
  • fix: replace inline code blocks after sfc blocks processing (#​6024) - Thanks to @​KazariEX!
  • fix: support navigation for kebab-case declarations in GlobalComponents (#​6026) - Thanks to @​Gehbt!
language-service
  • feat: support TS module resolution for SCSS @import navigation (#​6033) - Thanks to @​KazariEX!
typescript-plugin
  • fix: replace language service per-method overrides with a proxy (#​6035) - Thanks to @​KazariEX!
vscode

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 4, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedaxe-core@​4.11.41001001009970
Addedjsdom@​29.1.17510010096100
Added@​vitest/​coverage-v8@​4.1.6991007999100
Added@​iconify-json/​carbon@​1.2.211001008092100
Added@​types/​node@​24.12.41001008196100
Addedeslint@​10.3.08910010095100
Added@​nuxt/​kit@​4.4.59910010095100
Addednuxt@​4.4.59810010096100

View full report

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented May 4, 2026

Open in StackBlitz

npm i https://pkg.pr.new/@nuxt/a11y@297

commit: 72290c2

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 01387cd to c622f50 Compare May 11, 2026 08:59
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from e6c234f to 8e366b7 Compare May 11, 2026 23:01
@socket-security
Copy link
Copy Markdown

socket-security Bot commented May 11, 2026

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate renovate Bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 34cb737 to d3678d8 Compare May 13, 2026 18:48
@renovate renovate Bot force-pushed the renovate/all-minor-patch branch from d3678d8 to 72290c2 Compare May 14, 2026 14:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants