Skip to content

chore(deps): update all non-major dependencies - #286

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch
Open

chore(deps): update all non-major dependencies#286
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@axe-core/playwright ^4.9.1 → ^4.14.0 age confidence devDependencies minor
@nuxt/image (source) ^1.7.0 → ^1.11.2 age confidence devDependencies minor
@playwright/test (source) ^1.45.1 → ^1.65.0 age confidence devDependencies minor
@scalar/nuxt (source) ^0.6.67 → ^0.6.88 age confidence devDependencies patch
@typescript-eslint/parser (source) ^7.16.0 → ^7.18.0 age confidence devDependencies patch
@vue/test-utils ^2.4.6 → ^2.5.1 age confidence devDependencies minor
eslint (source) ^8.57.0 → ^8.57.1 age confidence devDependencies patch
eslint-plugin-tailwindcss ^3.17.4 → ^3.18.3 age confidence devDependencies patch
node (source) >=24 → >=24.22.2 age confidence engines minor
node 24 → 24.22.2 age confidence uses-with minor
nuxt-gtag ^3.0.1 → ^3.0.3 age confidence devDependencies patch
playwright-core (source) ^1.45.1 → ^1.65.0 age confidence devDependencies minor
pnpm (source) 11.9.0 → 11.28.11 age confidence packageManager minor
pnpm (source) 11.9.0 → 11.28.11 age confidence uses-with minor
typescript (source) ^5.5.3 → ^5.9.3 age confidence devDependencies minor
vue (source) ^3.5.42 → ^3.5.45 age confidence devDependencies patch

Release Notes

dequelabs/axe-core-npm (@​axe-core/playwright)

v4.14.0

Compare Source

Bug Fixes
Features

v4.13.0

Compare Source

Features

v4.12.1

Compare Source

Features

4.11.3 (2026-04-29)

Bug Fixes

4.11.2 (2026-04-14)

Bug Fixes

4.11.1 (2026-01-09)

Bug Fixes

v4.11.3

Compare Source

Bug Fixes

v4.11.2

Compare Source

Bug Fixes

v4.11.1

Compare Source

Bug Fixes

v4.11.0

Compare Source

Bug Fixes
Features

4.10.2 (2025-05-12)

Bug Fixes

4.10.1 (2024-10-29)

Bug Fixes

v4.10.2

Compare Source

Bug Fixes
nuxt/image (@​nuxt/image)

v1.11.2

Compare Source

v1.11.1 is a security release.

🚨 Security release

This release fixes a vulnerability in the /_ipx image transformation route. ipx was affected by an integer overflow when decoding a multi-page image, so a crafted source image could corrupt memory in the server process with a single unauthenticated request (GHSA-qf89-6xm4-66wm; our advisory for the @nuxt/image side is GHSA-p5vf-pjf5-ggj3). Sites where an attacker cannot control any image source are not affected.

@nuxt/image now requires ipx ^2.1.2, which rejects oversized multi-page images with a 400 before decoding them. ipx is an optional dependency, so after upgrading run npm ls ipx to confirm a patched version resolves.

Input formats are unchanged on this release line; the mitigation is the ipx upgrade itself.

👉 Changelog

compare changes

🩹 Fixes
🤖 CI
  • automate 1.x releases with uppt (bb9669a)
❤️ Contributors

v1.11.0

Compare Source

compare changes

🚀 Enhancements
  • Add support for image helpers in nitro endpoints (#​1473)
  • ipx: Log the architecture of the build (#​1808)
🩹 Fixes
  • Remove layer0 and edgio providers (#​1763)
  • Add back layer0 and edgio providers (without) tests (a99ce09)
  • cloudflare: Don't add baseURL if there are no operations (#​1790)
  • ipx: Always use ipx provider if external baseURL is provided (#​1800)
  • ipxStatic: Strip repeated slashes from image path (#​1801)
  • Avoid deep type instantiation (12b37a2)
📖 Documentation
🏡 Chore
  • Disable shamefully-hoist (#​1795)
  • Do not ignore typescript upgrades (0809991)
  • Switch to using typesVersions field (b4af05a)
  • Allow major bumps in changelog (d486587)
  • Enable oxc-resolver build (4be31c7)
  • Release v1.11.0 (3123997)
✅ Tests
  • Exclude layer0 + edgio from unit tests (3682a90)
🤖 CI
❤️ Contributors

v1.10.0

Compare Source

compare changes

🚀 Enhancements
  • imageengine: Add new modifiers (#​1701)
  • filerobot: Add new provider (#​1680)
🩹 Fixes
  • NuxtImg: Do not access props in template (e2e61fa)
  • NuxtPicture: Make img-attrs and attrs responsive (#​1696)
📖 Documentation
📦 Build
  • Update to latest nuxt/module-builder (#​1668)
🏡 Chore
  • Skip missing commit in generating changelog (a658787)
  • Revert to previous module builder (54dc469)
  • Remove unneeded .nuxtrc config (#​1708)
  • Temporarily ignore typescript upgrade (473f8f1)
  • Bump @nuxtjs/tailwindcss (25379fb)
  • Bump @nuxtjs/tailwindcss version (36fb95e)
🤖 CI
❤️ Contributors
microsoft/playwright (@​playwright/test)

v1.65.0

Compare Source

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

  • There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
  • Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
  • Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
  • Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  reporter: [
    ['failures'],
    ['html', { onlyFailures: true }],
  ],
});

🎯 Test runner

  • New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

    test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});

  • test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

    test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

  • New PLAYWRIGHT_TRANSFORM_CACHE_DIR environment variable sets the directory for transpiled test files, for example on a Linux machine shared with other users.

New APIs

Notable Changes ⚠️

  • TypeScript class fields now follow useDefineForClassFields from your tsconfig.json, the same as tsc. It is enabled for ES2022 and later targets, and when target is not specified. A field initializer that reads a constructor parameter property now fails, because the initializer runs first:

    class LoginPage {
  // TypeError: Cannot read properties of undefined (reading 'getByRole')
  readonly submit = this.page.getByRole('button', { name: 'Submit' });

  constructor(private readonly page: Page) {}
}

    Move the initialization to the constructor, or set "useDefineForClassFields": false in your tsconfig.json.

  • Actions such as locator.click(), locator.check(), locator.tap(), locator.fill(), locator.clear() and locator.selectOption() now wait for the element to be not inert. An action on an element with the inert attribute, or inside such an element, now times out if the element stays inert.

  • A sharded run now fails with "No tests found" when no tests match across all shards. Pass --pass-with-no-tests to allow this. An empty shard still passes when other shards have tests.

  • Cookie matching now follows RFC 6265. With a URL, browserContext.cookies() and apiRequestContext.cookies() no longer return host-only cookies for subdomains or Path=/api cookies for /apiv2, and a Path=/foo/ cookie does not match /foo. APIRequestContext sends a cookie without a name as Cookie: x instead of Cookie: =x, and stores Set-Cookie: token as a cookie without a name.

  • Proxy credentials are no longer sent to websites. The credentials in the proxy option now answer only proxy challenges. To authenticate on a website, use httpCredentials.

  • Text that the browser does not render, such as text that is not assigned to a slot or text directly inside a closed <details>, is no longer part of accessible names and aria snapshots. This can change the results of page.getByRole() with a name, locator.ariaSnapshot() and expect(locator).toMatchAriaSnapshot().

  • String and URLSearchParams values of the params option in APIRequestContext requests are now appended to the query that the URL already has, instead of replacing it.

  • .css, .less and .scss imports in test files now load as empty modules instead of being removed, so the imported file must exist.

  • The blob reporter again deletes the content of its output directory before it writes the report. Playwright 1.64 kept reports with other names.

  • Test locations of imported calls such as test( in CommonJS output now point to the start of the callee, for example a.spec.ts:3:7 instead of a.spec.ts:3:11. This is the same as in ESM.

Announcements

  • ⚠️ Playwright no longer tests on Node.js 20. Use Node.js 22, 24 or 26, as listed in the system requirements.
  • 🐳 Docker images now include Node.js 26 instead of Node.js 24, and the latest patch of Chromium on the same branch.

Browser Versions

  • Chromium 158.0.8127.18
  • Mozilla Firefox 159.0
  • WebKit 27.2

This version was also tested against the following stable channels:

  • Google Chrome 157
  • Microsoft Edge 156

v1.64.1

Compare Source

Bug Fixes
  • #​43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #​43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

Compare Source

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');

for (const tool of await page.webmcp.tools())
  console.log(tool.name, tool.description);

const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    video: {
      mode: 'on',
      size: { width: 1920, height: 1080 },
      fps: 60,
      show: {
        actions: {
          style: {
            point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
            highlight: 'outline: 2px solid #&#8203;333; background: rgba(0, 128, 255, .15)',
            title: 'font-size: 16px',
          },
        },
      },
    },
  },
});
  • New fps option in testOptions.video, recordVideo and
    screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
  • New style option takes CSS declarations for the point marker, the target
    highlight and the action title. It replaces the fontSize option, which is now deprecated.
  • The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
  • Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better
    quality.
  • All video options are also available in Playwright MCP and playwright-cli.

🎯 Test runner

  • New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain npx playwright test run just your favourite one:

    // playwright.config.ts
import { defineConfig, devices } from '@playwright/test';

export default defineConfig({
  projects: [
    { name: 'chromium', use: devices['Desktop Chrome'] },
    { name: 'firefox', use: devices['Desktop Firefox'], default: false },
    { name: 'webkit', use: devices['Desktop Safari'], default: false },
  ],
});
    npx playwright test                     # runs chromium only
npx playwright test --project=firefox   # runs firefox
npx playwright test --project="*"       # runs all three, for example on CI

  • New --shuffle command line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.

    npx playwright test --shuffle
# Running 42 tests using 4 workers, shuffle seed 271828182
# ...

# Pass the seed to reproduce the same order.
npx playwright test --shuffle 271828182

  • New lock option in test.describe.configure() adds test locks to all tests in a file or a group:

    test.describe.configure({ lock: 'user-settings' });

  • New type option of toHaveScreenshot in testConfig.expect stores all unnamed screenshots as WebP:

    // playwright.config.ts
export default defineConfig({
  expect: {
    toHaveScreenshot: { type: 'webp' },
  },
});

🪆 Locator.within()

New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":

const saveButton = page.getByRole('button', { name: 'Save' });
const dialog = page.getByTestId('settings-dialog');

await saveButton.within(dialog).click();

Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:

// The third cell of every row, not the third cell in the table.
const thirdColumn = page.getByRole('cell').nth(2).within(page.getByRole('row'));
await expect(thirdColumn).toHaveText(['Apple', 'Banana', 'Cherry']);

New APIs

Breaking changes ⚠️

  • screen property is now forwarded from the device descriptors. If you use ...devices['Desktop Chrome'] and alike, window.screen and media queries now see the emulated screen size. You can opt-out by explicitly setting screen to undefined:

    // playwright.config.ts
export default defineConfig({
  use: {
    ...devices['Desktop Chrome'],
    screen: undefined,
  },
});

  • JSX in your test files now follows your tsconfig.json. Playwright compiles JSX in test files according to the jsx, jsxFactory, jsxFragmentFactory and jsxImportSource tsconfig options, and defaults to the automatic runtime from react/jsx-runtime.

  • --update-snapshots=missing now passes the test run. Tests that only create missing snapshots now pass in the 'missing' mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called 'default' and behaves as before: missing snapshots are written and the test fails.

  • Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().

Browser Versions

  • Chromium 156.0.8078.4
  • Mozilla Firefox 157.0
  • WebKit 27.2

This version was also tested against the following stable channels:

  • Google Chrome 155
  • Microsoft Edge 155

v1.63.0

Compare Source

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock.
Tests that share a lock name never run concurrently, across files, workers and projects, while
everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group.
Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended
replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments,
and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API
steps, the subtitle is the locator or the navigation url — for example, Click with subtitle getByRole('button').
Both are rendered next to the step title in the trace viewer and the HTML report.

🖼️ Aria and screen snapshots in traces

The snapshots option of tracing.start() and the testOptions.trace fixture option now accept an
object selecting what to capture on every action:

// playwright.config.ts
export default defineConfig({
  use: {
    trace: {
      mode: 'on',
      snapshots: { dom: true, aria: true, screen: true }
    },
  },
});

With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot
side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.

New APIs

Browser and Context
Locators
const response = await request.get<User>('/api/users/42');
const user = await response.json(); // typed as User
Test runner
  • New standalone testOptions.reducedMotion, testOptions.forcedColors and testOptions.contrast options.
  • New --add-reporter command line option appends a reporter on top of the ones configured in playwright.config, instead of replacing them like --reporter does.
  • New omitTags option for the list, line, dot, github and junit reporters suppresses the tags that are automatically appended to test titles.
Command line
  • npx playwright install --no-remove keeps the browsers of other Playwright installations instead of removing them.
  • npx playwright codegen --http-credentials records against pages behind HTTP authentication.
Miscellaneous
  • New built-in perfetto reporter writes a Trace Event Format file for the Perfetto UI or chrome://tracing, rendering the test run as a timeline with a lane per worker.
  • The HTML report renders a duration

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from ecc9efb to 1d54fe9 Compare October 30, 2026 02:59
@renovate

renovate Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: web/site/pnpm-lock.yaml
? Verifying lockfile against supply-chain policies (1742 entries)...
✓ Lockfile passes supply-chain policies (1742 entries in 12.7s)
Progress: resolved 1, reused 0, downloaded 0, added 0
[WARN] deprecated eslint@8.57.1
Progress: resolved 21, reused 0, downloaded 0, added 0
Progress: resolved 91, reused 0, downloaded 0, added 0
Progress: resolved 198, reused 0, downloaded 0, added 0
Progress: resolved 202, reused 0, downloaded 0, added 0
Progress: resolved 204, reused 0, downloaded 0, added 0
Progress: resolved 399, reused 0, downloaded 0, added 0
Progress: resolved 594, reused 0, downloaded 0, added 0
Progress: resolved 827, reused 0, downloaded 0, added 0
Progress: resolved 1040, reused 0, downloaded 0, added 0
Progress: resolved 1374, reused 0, downloaded 0, added 0
Progress: resolved 1696, reused 0, downloaded 0, added 0
Progress: resolved 1741, reused 0, downloaded 0, added 0
Progress: resolved 1742, reused 0, downloaded 0, added 0
[ERR_PNPM_UNUSED_PATCH] The following patches were not used: web-worker@1.5.0

Either remove them from "patchedDependencies" or update them to match packages in your dependencies.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from c56b954 to 40bf35e Compare November 5, 2026 15:07
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 40bf35e to b3d22a8 Compare November 6, 2026 01:59

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thorwolpert thorwolpert Awaiting requested review from thorwolpert thorwolpert is a code owner
@deetz99 deetz99 Awaiting requested review from deetz99 deetz99 is a code owner
@kialj876 kialj876 Awaiting requested review from kialj876 kialj876 is a code owner
@pwei1018 pwei1018 Awaiting requested review from pwei1018 pwei1018 is a code owner
@bolyachevets bolyachevets Awaiting requested review from bolyachevets bolyachevets is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants