chore(deps-dev): bump the development-dependencies group across 1 directory with 9 updates

[dependabot]

Bumps the development-dependencies group with 9 updates in the / directory:

Package	From	To
@changesets/cli	2.31.0	2.31.1
@types/node	26.1.1	26.1.2
c8	11.0.0	12.0.0
eslint-plugin-jsdoc	63.0.12	63.3.2
typescript	6.0.3	7.0.2
vite	8.1.4	8.1.5
@playwright/test	1.61.1	1.62.0
stylelint	17.14.0	17.14.1
undici	8.0.2	8.9.0

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

• a897bb8 Use a different publish tag for maintenance/v2 branch (#2162)
• e8650b9 Version Packages (#2161)
• 15cf592 Fixed handling of the npm 12 info output (#2159)
• 9f2cb2a Configure Changesets for maintenance/v2 line (#2076)
• 97247cb Change allowed publish pattern to maintenance/v* given rulesets behavior (#...
• 13286a8 Build(deps): Bump the github-actions group across 1 directory with 3 updates ...
• 8f6acd6 Update dependabot group to exclude major (#2067)
• c70c675 Setup backport workflow and sync next setup (#2057)
• 9672019 Remove SECURITY.md to defer to .github (#2055)
• 18e1661 Use internal bot for versioning (#2039)
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Updates c8 from 11.0.0 to 12.0.0

Release notes

Sourced from c8's releases.

v12.0.0

12.0.0 (2026-07-14)

⚠ BREAKING CHANGES

• yargs enforces a stricter range of Node versions ^20.19.0 || ^22.12.0 || >=23

Features

• update yargs to 18.x.x (#599) (dc2d6c8)

Changelog

Sourced from c8's changelog.

12.0.0 (2026-07-14)

⚠ BREAKING CHANGES

• yargs enforces a stricter range of Node versions ^20.19.0 || ^22.12.0 || >=23

Features

• update yargs to 18.x.x (#599) (dc2d6c8)

Commits

• ae5a0cf chore(main): release 12.0.0 (#600)
• dc2d6c8 feat!: update yargs to 18.x.x (#599)
• ee2f1cf chore(deps): update dependency @​types/node to v24 (#579)
• 923c238 build: go back to publishing manually
• See full diff in compare view

Updates eslint-plugin-jsdoc from 63.0.12 to 63.3.2

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v63.3.2

63.3.2 (2026-07-28)

Bug Fixes

• require-example: support fixer with 1-line JSDoc blocks; fixes #1736 (36f8e9e)

v63.3.1

63.3.1 (2026-07-27)

Bug Fixes

• normalize-see-links: minimally escape link targets instead of encodeURI (#1735) (ae27cd2)

v63.3.0

63.3.0 (2026-07-26)

Features

• normalize-see-links: autofix delimiter-colliding labels via escape round-trip (#1734) (cfe9cdb)

v63.2.2

63.2.2 (2026-07-24)

Bug Fixes

• update jsdoccomment and devDeps. (#1730) (3663803)

v63.2.1

63.2.1 (2026-07-23)

Bug Fixes

• update jsdoccomment, spdx-expression-parse, devDeps.; fixes #1727 (#1728) (9fd2f28)

v63.2.0

63.2.0 (2026-07-19)

Features

• normalize-see-links: add wrapBareUrls option (#1726) (77a7b1a)

v63.1.0

63.1.0 (2026-07-18)

... (truncated)

Commits

• 7d5df2e chore: update devDeps.
• 36f8e9e fix(require-example): support fixer with 1-line JSDoc blocks; fixes #1736
• 1dbf404 chore: update jsdoccomment and devDeps.
• ae27cd2 fix(normalize-see-links): minimally escape link targets instead of encodeURI ...
• cfe9cdb feat(normalize-see-links): autofix delimiter-colliding labels via escape roun...
• e62e746 docs: explain usage with defineConfig(); fixes #1729 (#1731)
• 3663803 fix: update jsdoccomment and devDeps. (#1730)
• 9fd2f28 fix: update jsdoccomment, spdx-expression-parse, devDeps.; fixes #1727 (#1728)
• 77a7b1a feat(normalize-see-links): add wrapBareUrls option (#1726)
• c03dd66 feat: add normalize-see-links rule (#1725)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vite from 8.1.4 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

• bundled-dev: avoid duplicated buildEnd (#22931) (8100320)
• client: overlay error message format align rolldown (#22869) (5a72b87)
• deps: update all non-major dependencies (#22921) (fef682d)
• deps: update rolldown-related dependencies (#22922) (3c345e4)
• module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)
• optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)
• ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

• build: fix incorrect @default for build.cssMinify (#22948) (c88c236)
• build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

• avoid scanner scanning all files under __tests__ (#22912) (c961cae)

Commits

• 5e7fe12 release: v8.1.5
• 6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
• 5a72b87 fix(client): overlay error message format align rolldown (#22869)
• f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
• 8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
• c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
• b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
• fef682d fix(deps): update all non-major dependencies (#22921)
• 3c345e4 fix(deps): update rolldown-related dependencies (#22922)
• 369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
• Additional commits viewable in compare view

Updates @playwright/test from 1.61.1 to 1.62.0

Release notes

Sourced from @​playwright/test's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

</tr></table> 

... (truncated)

Commits

• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• 2934858 fix: correct pending navigation log spacing (#41949)
• 4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
• bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
• 15c4f55 fix(mcp): identify downloads explicitly (#41933)
• f5fa967 fix(network): request.postData() returns null for empty string body override ...
• 0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
• 244a1ff feat(firefox): roll to r1538 (#41938)
• Additional commits viewable in compare view

Updates stylelint from 17.14.0 to 17.14.1

Release notes

Sourced from stylelint's releases.

17.14.1

It fixes 4 bugs.

• Fixed: quiet option suppresses report* warning reports (#9387) (@​ychampion).
• Fixed: reported range of unknown rules (#9385) (@​ybiquitous).
• Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@​sarathfrancis90).
• Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@​sarathfrancis90).

Changelog

Sourced from stylelint's changelog.

17.14.1 - 2026-07-20

It fixes 4 bugs.

• Fixed: quiet option suppresses report* warning reports (#9387) (@​ychampion).
• Fixed: reported range of unknown rules (#9385) (@​ybiquitous).
• Fixed: declaration-block-no-redundant-longhand-properties autofix producing invalid background shorthand when background-size is present (#9364) (@​sarathfrancis90).
• Fixed: rule-empty-line-before false positives for shared-line comments with except: ["after-single-line-comment"] (#9394) (@​sarathfrancis90).

Commits

• cd66b03 Release 17.14.1 (#9397)
• 7c30fc5 Refactor to replace void with undefined in union types (#9395)
• 57c8d0e Fix rule-empty-line-before false positives for shared-line comments with `e...
• 226f10a Bump @​vscode/windows-process-tree from 0.7.0 to 0.8.0 (#9392)
• 13c3c5c Bump globby from 16.2.0 to 16.2.1 (#9393)
• 6dafcf5 Document unknown-effort contributions (#9391)
• 54c2bc8 Fix test for Yarn PnP with npm v12 (#9390)
• 3e7eb56 Fix declaration-block-no-redundant-longhand-properties invalid background...
• 438196e Bump postcss from 8.5.15 to 8.5.16 in the postcss group across 1 directory (#...
• c1e1489 Fix quiet option to suppress report* warning reports (#9387)
• Additional commits viewable in compare view

Updates undici from 8.0.2 to 8.9.0

Release notes

Sourced from undici's releases.

v8.9.0

⚠️ Security fixes

High severity

• GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
• GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

• fix(decompress): preserve response trailers by @​Ram-blip in nodejs/undici#5572
• build(deps-dev): bump ws from 8.21.0 to 8.21.1 by @​dependabot[bot] in nodejs/undici#5576
• fix: validate coerced header values for CRLF by @​mcollina in nodejs/undici#5579
• fix: handle frozen globalThis in setGlobalDispatcher by @​mhayk in nodejs/undici#5574
• Ignore auto-generated .npmrc on Windows by @​tsctx in nodejs/undici#5583

New Contributors

• @​mhayk made their first contribution in nodejs/undici#5574

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

• fetch: use ReadableStreamTee for cloning streams by @​KhafraDev in nodejs/undici#5517
• fix(benchmarks): adjust got after v15 upgrade by @​slagiewka in nodejs/undici#5526
• feat(mock): support asynchronous reply options callbacks by @​Develop-KIM in nodejs/undici#5534
• docs: clarify proxy threat model by @​mcollina in nodejs/undici#5530
• docs: clarify MockAgent pool usage by @​vibhor-aggr in nodejs/undici#5542
• docs: clarify parser timeout precision by @​vibhor-aggr in nodejs/undici#5543
• fix: handle flat alternating header arrays in cache normalizeHeaders by @​mcollina in nodejs/undici#5536
• chore(benchmarks): require(esm) on ESM-only packages by @​slagiewka in nodejs/undici#5527
• fix: run idle socket validation off setImmediate instead of setTimeout by @​carlotestor in nodejs/undici#5499
• docs: add custom interceptor example by @​vibhor-aggr in nodejs/undici#5548
• fix(h1): ignore type of service errors by @​mcollina in nodejs/undici#5547
• fix(fetch): convert null init in Response.json by @​Ram-blip in nodejs/undici#5540
• fix(redirect): remove body headers after POST-to-GET by @​Ram-blip in nodejs/undici#5551
• build(deps-dev): bump fast-check from 4.8.0 to 4.9.0 by @​dependabot[bot] in nodejs/undici#5556
• fix(h2): allow stream-bodied requests to multiplex on a busy session by @​GiHoon1123 in nodejs/undici#5538
• fix(h2): destroy aborted stream synchronously instead of via setImmediate by @​staylor in nodejs/undici#5559
• fix(decompress): skip HEAD responses by @​Ram-blip in nodejs/undici#5564
• ci: build undici with node.js v26 by @​shivarm in nodejs/undici#5237

... (truncated)

Commits

• 21a8e1e Bumped v8.9.0 (#5589)
• 7d3cf92 fix: validate blob body content type
• c601fff fix(cache): harden cache directive parsing
• 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
• e11a68e fix(retry): reject partial content length mismatch
• 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
• 4fe5bc5 fix: handle empty qualified private cache directive
• 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
• a17e301 Ignore auto-generated .npmrc on Windows (#5583)
• a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: c360671

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​vite@​8.1.4 ⏵ 8.1.5			+1
	npm/​eslint-plugin-jsdoc@​63.0.12 ⏵ 63.3.2				+1
	npm/​typescript@​7.0.2
	npm/​c8@​11.0.0 ⏵ 12.0.0				+2
	npm/​@​changesets/​cli@​2.31.0 ⏵ 2.31.1	+1			+1
	npm/​stylelint@​17.14.0 ⏵ 17.14.1	+1
	npm/​@​playwright/​test@​1.61.1 ⏵ 1.62.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/vite@8.1.5 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm eslint-plugin-jsdoc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/eslint-plugin-jsdoc@63.3.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/eslint-plugin-jsdoc@63.3.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report