chore(deps): update npm dependencies

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change	Pending
@eslint-react/eslint-plugin (source)	devDependencies	patch	5.18.1 → 5.18.2	5.18.3
@playwright/test (source)	overrides	minor	1.61.1 → 1.62.1
@playwright/test (source)	devDependencies	minor	1.61.1 → 1.62.1
electron-to-chromium	overrides	patch	1.5.380 → 1.5.401	1.5.402
globals	devDependencies	minor	17.8.0 → 17.9.0
playwright (source)	overrides	minor	1.61.1 → 1.62.1
playwright-core (source)	overrides	minor	1.61.1 → 1.62.1
rollup (source)	devDependencies	patch	4.62.3 → 4.62.4
typescript-eslint (source)	devDependencies	minor	8.65.0 → 8.66.0

---

Release Notes

Rel1cx/eslint-react (@​eslint-react/eslint-plugin)

v5.18.2

Compare Source

🐞 Fixes

• react-x/no-nested-component-definitions: fixed a regression where nested components wrapped in useCallback (e.g. const C = useCallback(() => <div />, []);) were no longer reported — the rule now resolves the component name through well-known component wrappers (memo, forwardRef, useCallback, observer, react-redux's connect, Relay's create*Container helpers, Apollo's graphql, and with* HOCs, including curried forms like connect(...)(Component)) up to the enclosing variable declarator, and no longer misreports array method callbacks (flatMap, forEach, reduce, etc.) in list rendering patterns. (#​1928, closes #​1927)

🏗️ Internal

• Bumped effect to 3.22.1, eslint-plugin-jsdoc to 63.3.3, textlint to 15.8.0, js-yaml to 4.3.1, axios to 1.19.0, nx to 23.1.1, vite to 8.2.0, @vitejs/plugin-react to 6.0.5, fumadocs to 16.14.0, fumadocs-mdx to 15.2.2, preact to 10.29.8, globals to 17.9.0, lucide-react to 1.28.0, @types/react to 19.2.18, @types/react-dom to 19.2.4, and pnpm to 11.20.0.

Full Changelog: Rel1cx/eslint-react@v5.18.1...v5.18.2

microsoft/playwright (@​playwright/test)

v1.62.1

Compare Source

Bug Fixes

• #​41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #​41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #​41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #​42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #​42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried.
The default 'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

• New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

• New apiResponse.timing() returns resource timing information for an API response.

Evaluation

• New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
• page.evaluate() and related methods now accept functions as evaluate arguments.
• page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

• Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

• The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

Kilian/electron-to-chromium (electron-to-chromium)

v1.5.401

Compare Source

v1.5.400

Compare Source

v1.5.399

Compare Source

v1.5.398

Compare Source

v1.5.397

Compare Source

v1.5.396

Compare Source

v1.5.395

Compare Source

v1.5.394

Compare Source

v1.5.393

Compare Source

v1.5.392

Compare Source

v1.5.391

Compare Source

v1.5.389

Compare Source

v1.5.388

Compare Source

v1.5.387

Compare Source

v1.5.386

Compare Source

v1.5.385

Compare Source

v1.5.384

Compare Source

v1.5.383

Compare Source

v1.5.382

Compare Source

v1.5.381

Compare Source

sindresorhus/globals (globals)

v17.9.0

Compare Source

• Update globals (2026-08-01) (#​348) 5a958ed

---

rollup/rollup (rollup)

v4.62.4

Compare Source

2026-08-01

Bug Fixes

• Resolve a regression when using Rollup on older Linux distributions (#​6467)

Pull Requests

• #​6463: docs: add llms.txt documentation index for LLMs and agents (@​abyworkings-coder, @​lukastaegert)
• #​6464: fix(deps): update minor/patch updates (@​renovate[bot])
• #​6465: chore(deps): lock file maintenance (@​renovate[bot])
• #​6466: chore(deps): lock file maintenance (@​renovate[bot])
• #​6467: ci: fix linux-gnu glibc regression and enforce glibc ≤ 2.28 compatibility (@​lukastaegert)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.66.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.87%. Comparing base (d2aff33) to head (5d42bc4).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #324   +/-   ##
=======================================
  Coverage   75.87%   75.87%           
=======================================
  Files         109      109           
  Lines        1621     1621           
  Branches      496      496           
=======================================
  Hits         1230     1230           
  Misses        343      343           
  Partials       48       48           

Flag	Coverage Δ
unit	60.49% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[tsd-agent-bot]

🤖 Automated review by tsd-agent-bot (tsd-agent-lab pr-review skill). Findings are advisory — please verify before acting on them.

Full review (53 lines)

Code Review: PR #324 — chore(deps): update npm dependencies

1. Summary of Intent

This is an automated Konflux bot dependency-update PR that bumps devDependencies only:

• electron-to-chromium: 1.5.380 → 1.5.385 (the only literal version change in package.json)
• Transitive lockfile churn for @commitlint/*, conventional-changelog-angular, conventional-commits-parser, and @eslint-react/* / eslint-plugin-react-* plugin family (5.10.0 → 5.10.2)
• Removal of a handful of now-unused transitive packages (array-ify, compare-func, dot-prop, is-obj) and restructuring of conventional-commits-parser into nested scoped node_modules entries

No runtime (production) dependency is touched. All changes are patch-level version bumps confined to lint tooling, commit-message tooling, and browser-capability data used by Playwright/Browserslist at build/test time.

2. Correctness, Safety, and Risk Analysis

• Blast radius is minimal: electron-to-chromium is a pure data package (browser engine → Chromium version mapping) with no executable API surface consumed by application code; a patch bump here cannot introduce runtime behavior changes in the shipped console UI.
• devDependency-only scope: @eslint-react/* and eslint-plugin-react-* bumps affect only lint-time static analysis. Worst case is a new lint rule/rule change causing CI lint failures, which is self-evidencing (CI will fail loudly, not silently).
• commitlint family bumps: affects commit-message linting only (likely a git hook / CI check), not application runtime.
• Lockfile consistency: the diff describes structural reshuffling (nested scoped node_modules entries replacing a flat conventional-commits-parser entry) — this is a normal npm dedupe/resolution outcome and not inherently risky, though it's worth confirming the lockfile was regenerated with a consistent npm version to avoid unrelated lockfile format drift.
• Duplicate/overlapping bot PRs: this repo has multiple concurrent bot PRs (chore(deps): update npm dependencies (major) #325, chore(deps): lock file maintenance npm dependencies #330) touching overlapping transitive dependencies (e.g., the same @commitlint/* family). This isn't a defect in chore(deps): update npm dependencies #324 itself, but merging order matters — merging chore(deps): update npm dependencies #324 and then chore(deps): lock file maintenance npm dependencies #330 (or vice versa) could produce redundant/conflicting lockfile diffs or merge conflicts that a human will need to resolve or re-trigger the bot for.
• No CI results included in this review: the review is diff-only; actual verification that lint/build/test pass with the bumped @eslint-react rules is not observable here and should be confirmed via the PR's CI status before merge.

3. Findings

Critical

None identified. No runtime dependencies, security-sensitive code, or data-handling logic is touched.

High

None identified. No production behavior, error handling, or user-facing logic is affected by this diff.

Medium

• Location: package-lock.json (repo-wide, overlapping with sibling PR chore(deps): lock file maintenance npm dependencies #330)
  Issue: This PR and sibling PR chore(deps): lock file maintenance npm dependencies #330 both touch the @commitlint/* / conventional-changelog-angular transitive dependency tree. If both are merged independently (rather than sequentially with a rebase in between), the second merge may produce lockfile conflicts or the bot may need to re-run to reconcile the lockfile.
  Recommendation: Merge bot PRs one at a time in sequence (oldest/lowest risk first), letting Konflux/Renovate re-generate or auto-close superseded PRs rather than merging concurrently.
  Confidence: medium

• Location: package.json / package-lock.json — @eslint-react/* and eslint-plugin-react-* family bump (5.10.0 → 5.10.2)
  Issue: Even patch bumps to ESLint plugins can introduce new or stricter rule defaults that fail existing code under --max-warnings 0-style CI gates. This isn't visible from the diff alone.
  Recommendation: Confirm the PR's CI lint job is green before merging; if it fails, it's a tooling/config fix, not a revert-worthy defect.
  Confidence: low (speculative, no CI output available in this review)

Low

• Location: package.json
  Issue: Minor stylistic/process note — since this is a fully automated, low-risk, dev-tooling-only bump, it's a good candidate for auto-merge (if the repo has branch protection + required CI checks configured), reducing manual review overhead for future instances of this PR pattern.
  Recommendation: Consider configuring auto-merge for Konflux bot PRs that touch only devDependencies with patch-level bumps, gated on CI passing.
  Confidence: low

4. Overall Assessment

Ready to merge, contingent only on green CI (lint, build, and e2e/Playwright test jobs, given electron-to-chromium and the ESLint plugin family are both exercised there). There are no correctness, security, or production-risk concerns — this PR is strictly devDependency and build/test-tooling churn with all patch-level bumps and zero runtime dependency changes.

Blocking items: none from a code-review standpoint. The only operational consideration is sequencing this merge relative to sibling bot PRs (#325, #330) that touch overlapping lockfile regions, to avoid unnecessary merge conflicts.

Key risks: negligible. The sole residual risk is a lint-rule regression from the @eslint-react patch bump surfacing in CI, which would be self-evident and low-cost to address (either fix the flagged code or pin the plugin version) rather than a silent production risk.