Skip to content

chore(deps): update all non-major dependencies - #145

Merged
sapphi-red merged 1 commit into
mainfrom
renovate/all-minor-patch
Oct 12, 2026
Merged

chore(deps): update all non-major dependencies#145
sapphi-red merged 1 commit into
mainfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@babel/core (source) ^8.0.6 → ^8.0.7 age confidence
@babel/runtime (source) ^7.29.7 → ^7.29.10 age confidence
@babel/runtime (source) ^8.0.5 → ^8.0.7 age confidence
@oxc-node/cli (source) ^0.1.3 → ^0.1.6 age confidence
@oxc-node/core ^0.1.3 → ^0.1.6 age confidence
@swc/core (source) ^1.16.13 → ^1.16.18 age confidence
@types/node (source) ^24.19.1 → ^24.19.2 age confidence
@vitejs/plugin-react (source) ^6.1.1 → ^6.1.2 age confidence
execa ^10.0.1 → ^10.1.0 age confidence
oxfmt (source) ^0.71.0 → ^0.72.0 age confidence
oxlint (source) ^1.86.0 → ^1.87.0 age confidence
oxlint-tsgolint ^7.0.2003 → ^7.0.2004 age confidence
playwright-chromium (source) ^1.63.0 → ^1.64.0 age confidence
pnpm (source) 12.9.1 → 12.11.2 age confidence

Release Notes

babel/babel (@​babel/core)

v8.0.7

Compare Source

🐛 Bug Fix
  • babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • babel-plugin-transform-for-of
  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • babel-parser
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • babel-plugin-transform-block-scoping
  • babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • babel-traverse
  • Other
  • babel-core
🏠 Internal
  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
babel/babel (@​babel/runtime)

v7.29.10

Compare Source

v7.29.10 (2026-10-07)

🐛 Bug Fix
  • babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs3
  • babel-traverse
🏠 Internal
  • babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
Committers: 2
oxc-project/oxc-node (@​oxc-node/cli)

v0.1.6

Compare Source

v0.1.5

Compare Source

Bug Fixes

v0.1.4

Compare Source

Note: Version bump only for package oxc-node

swc-project/swc (@​swc/core)

v1.16.18

Compare Source

Bug Fixes

v1.16.17

Compare Source

Bug Fixes
Features

  • (ci) Restrict pull requests to trusted contributors (#​12463) (ee297d6)

  • (es/codegen) Support configurable output indentation (#​12490) (2058335)

    • BREAKING: support configurable output indentation (#​12490)
Miscellaneous Tasks
Performance
Refactor
  • (es/parser) Isolate parser state and make grammar parameters explicit (#​12425) (5898e8a)
Ci
  • Refresh CodSpeed main baseline (c19d531)
vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.1.2

Compare Source

Fix HMR for compound components (#​1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#​1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #​1478) (#​1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

sindresorhus/execa (execa)

v10.1.0

Compare Source

Behavior changes

These are bug fixes, but they might affect code that relied on the previous incorrect behavior.

  • extendEnv: false without the env option no longer inherits process.env, per docs 67acf60
  • Windows: Arguments of .cmd and .bat files are now escaped like Rust does, which fixes batch files reading %~1 (#​1261) 93bddc4
  • Invalid stdio values, such as negative file descriptors, now throw c6bd387
  • Using the same file as input and output now throws, even when the paths are written differently 587045a
  • Synchronous methods now enforce per-file-descriptor maxBuffer values 9547e51
  • Synchronous methods now throw on the signal option, like asynchronous methods 59de065
  • Synchronous methods now write the raw output bytes to files, like asynchronous methods af6264a
Fixes
  • Fix subprocess.kill() signaling the current process group when the subprocess failed to spawn 5464d43
  • Fix crashes when spawning fails with EMFILE/ENFILE (#​1262), or when a file target cannot be opened 15c46cd 1cee524
  • Fix error.stdout and error.stderr being undefined when synchronous methods fail to spawn (#​1263) bfe4633
  • Fix the subprocess promise hanging until an output stream is read 004f3b3
  • Fix subprocess.pipe() with the stdio option, and destination subprocesses left running 8d3f0a9 ecda56b
  • Fix result.all when only some file descriptors are buffered or split into lines 758768f
  • Fix the encoding option and line splitting in transforms 6adb3c3
  • Fix input and output transforms with synchronous methods 516a5e2 e0b5dbc
  • Fix template strings with emojis and line continuations b67f199
  • Fix killDescendants signaling unrelated processes on Windows 9c5c71c
  • Fix IPC with serialization: 'json', strict: true and the verbose option 9842f1a 698a1b8 b548d8b
  • Fix the subprocess error being hidden when the current directory was deleted 91d9ded
  • Fix shebang scripts on Windows when the file is small 7c1a631
oxc-project/oxc (oxfmt)

v0.72.0: oxfmt v0.72.0

Compare Source

💥 BREAKING CHANGES
  • e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#​27256) (leaysgur)
🚀 Features
  • b538e3c formatter_css: Parse embedded CSS as a block's contents (#​27284) (leaysgur)
🐛 Bug Fixes
  • 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#​27334) (leaysgur)
  • 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#​27331) (leaysgur)
  • e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#​27326) (leaysgur)
  • df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#​27325) (leaysgur)
  • 7f65b75 formatter: Format assignment target property as assignment-like (#​27289) (leaysgur)
  • 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#​27288) (leaysgur)
  • 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#​27283) (leaysgur)
  • 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#​27278) (leaysgur)
  • dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#​27277) (leaysgur)
  • 1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#​27275) (leaysgur)
  • fd4ddce formatter_json: Flatten block comment only array|object (#​27274) (leaysgur)
  • 267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#​27241) (leaysgur)
  • 2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#​27237) (Nicolas Le Cam)
  • c2de02b formatter: Decide embedded template layout from AST, not source shape (#​27218) (leaysgur)
  • c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#​27216) (leaysgur)
  • 36e14df formatter: Keep comments between callee and its opener on the callee side (#​27172) (leaysgur)
  • 6da7657 oxfmt: Render diagnostics with source in Stdin mode (#​27130) (leaysgur)
  • e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#​27129) (leaysgur)
  • 30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#​27128) (leaysgur)
⚡ Performance
  • 72f42a3 formatter_markdown: Pre-allocate the IR buffer (#​27333) (leaysgur)
  • cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#​27211) (leaysgur)
  • 0aba566 oxfmt: Do not resolve root js config from nested context (#​27147) (leaysgur)
📚 Documentation
  • 51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#​27327) (leaysgur)
  • 656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#​27279) (leaysgur)
  • 66545bf formatter_markdown: Record setext heading wrap divergence (#​27221) (leaysgur)
  • af4b269 oxfmt: Document why format() API does not take cwd (#​27131) (leaysgur)
microsoft/playwright (playwright-chromium)

v1.64.0

Compare Source

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');

for (const tool of await page.webmcp.tools())
  console.log(tool.name, tool.description);

const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    video: {
      mode: 'on',
      size: { width: 1920, height: 1080 },
      fps: 60,
      show: {
        actions: {
          style: {
            point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
            highlight: 'outline: 2px solid #&#8203;333; background: rgba(0, 128, 255, .15)',
            title: 'font-size: 16px',
          },
        },
      },
    },
  },
});
  • New fps option in testOptions.video, recordVideo and
    screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
  • New style option takes CSS declarations for the point marker, the target
    highlight and the action title. It replaces the fontSize option, which is now deprecated.
  • The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
  • Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better
    quality.
  • All video options are also available in Playwright MCP and playwright-cli.

🎯 Test runner

  • New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain npx playwright test run just your favourite one:

    // playwright.config.ts
import { defineConfig, devices } from '@playwright/test';

export default defineConfig({
  projects: [
    { name: 'chromium', use: devices['Desktop Chrome'] },
    { name: 'firefox', use: devices['Desktop Firefox'], default: false },
    { name: 'webkit', use: devices['Desktop Safari'], default: false },
  ],
});
    npx playwright test                     # runs chromium only
npx playwright test --project=firefox   # runs firefox
npx playwright test --project="*"       # runs all three, for example on CI

  • New --shuffle command line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.

    npx playwright test --shuffle
# Running 42 tests using 4 workers, shuffle seed 271828182
# ...

# Pass the seed to reproduce the same order.
npx playwright test --shuffle 271828182

  • New lock option in test.describe.configure() adds test locks to all tests in a file or a group:

    test.describe.configure({ lock: 'user-settings' });

  • New type option of toHaveScreenshot in testConfig.expect stores all unnamed screenshots as WebP:

    // playwright.config.ts
export default defineConfig({
  expect: {
    toHaveScreenshot: { type: 'webp' },
  },
});

🪆 Locator.within()

New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":

const saveButton = page.getByRole('button', { name: 'Save' });
const dialog = page.getByTestId('settings-dialog');

await saveButton.within(dialog).click();

Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:

// The third cell of every row, not the third cell in the table.
const thirdColumn = page.getByRole('cell').nth(2).within(page.getByRole('row'));
await expect(thirdColumn).toHaveText(['Apple', 'Banana', 'Cherry']);

New APIs

Breaking changes ⚠️

  • screen property is now forwarded from the device descriptors. If you use ...devices['Desktop Chrome'] and alike, window.screen and media queries now see the emulated screen size. You can opt-out by explicitly setting screen to undefined:

    // playwright.config.ts
export default defineConfig({
  use: {
    ...devices['Desktop Chrome'],
    screen: undefined,
  },
});

  • JSX in your test files now follows your tsconfig.json. Playwright compiles JSX in test files according to the jsx, jsxFactory, jsxFragmentFactory and jsxImportSource tsconfig options, and defaults to the automatic runtime from react/jsx-runtime.

  • --update-snapshots=missing now passes the test run. Tests that only create missing snapshots now pass in the 'missing' mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called 'default' and behaves as before: missing snapshots are written and the test fails.

  • Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().

Browser Versions

  • Chromium 156.0.8078.4
  • Mozilla Firefox 157.0
  • WebKit 27.2

This version was also tested against the following stable channels:

  • Google Chrome 155
  • Microsoft Edge 155
pnpm/pnpm (pnpm)

v12.11.2: pnpm 12.11.2

Compare Source

This release fixes --workspace-concurrency=Infinity, filters set by an updateConfig hook, and store fetches with enable-modules-dir=false.

Patch Changes

  • --workspace-concurrency=Infinity now runs workspace projects with no concurrency limit. It used to fail with invalid digit found in string #​16793.

  • pnpm install and other recursive commands now apply the filter and filterProd that an updateConfig hook sets. They used to run on every workspace project #​16792.

  • enable-modules-dir=false now also fetches the packages an install reuses from an existing lockfile, so the store holds every package the lockfile lists.

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx Latitude

v12.11.1: pnpm 12.11.1

Compare Source

This release fixes two ways pnpm install could fail, runs tools of any Rust release through pnx, and treats registry.npmjs.com as an alias of the npm registry.

Patch Changes

  • pnpm install no longer fails when packageManager pins the pnpm version that is already running and the registry does not publish that version. pnpm warns and continues. A registry mirror that has not synced a release no longer blocks the commands of a project pinned to it.

  • pnpm install no longer fails with ERR_PNPM_CMD_SHIM_CHMOD when node_modules/.bin holds a shim that another user created, if everyone can already execute it and it is not world-writable. This happens when several users share one checkout.

  • enable-modules-dir=false (enableModulesDir: false through the Node.js addon) fetches the registry packages the host can install into the store again, as pnpm v10 did, while still writing nothing under node_modules. The setting exists for a node_modules that something else mounts from the store, such as a FUSE daemon, and that consumer no longer has to download each package on first access. A plain --lockfile-only run still fetches nothing.

  • pnpm pack and pnpm publish no longer put .npmignore and .gitignore files in the tarball. A files entry that names one still ships it.

  • pnpm now treats https://registry.npmjs.com/ as an alias of https://registry.npmjs.org/. Registry requests, credentials, and trusted publishing use the canonical hostname.

  • pnx --package=rust@<channel> <tool> runs a tool of that Rust release, for example pnx --package=rust@nightly-2026-01-01 cargo build. pnpm installs the release with the components and targets from rust-toolchain.toml and the target of each --target argument.

  • pnpm install now links agent skills for more coding agents. It detects the agent from ANTIGRAVITY_AGENT, COPILOT_AGENT, COPILOT_CLI, CODEX_THREAD_ID, CODEX_SANDBOX, AI_AGENT, and CLAUDE_CODE pnpm/tasks#116.

  • When the registry rejects pnpm stage publish, the error message now starts with "Failed to stage package".

Platinum Sponsors

Bit OpenAI Notion
CodeRabbit

Gold Sponsors

Sanity Discord Vite
SerpApi Stackblitz Workleap
Nx

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@socket-security

socket-security Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedplaywright-chromium@​1.63.0 ⏵ 1.64.090 +110066 +199100
Updated@​oxc-node/​core@​0.1.3 ⏵ 0.1.695 +110076 +195 +2100
Updated@​babel/​runtime@​8.0.5 ⏵ 8.0.710010078 +193 -1100
Updated@​babel/​core@​8.0.6 ⏵ 8.0.79810079 +195100
Updated@​oxc-node/​cli@​0.1.3 ⏵ 0.1.693 +51007995 +2100
Updated@​types/​node@​24.19.1 ⏵ 24.19.210010081 +196100
Updatedexeca@​10.0.1 ⏵ 10.1.098100100 +184 -5100
Updatedoxfmt@​0.71.0 ⏵ 0.72.094 +110088 +196100
Updatedoxlint@​1.86.0 ⏵ 1.87.0991009195 -1100
Updated@​swc/​core@​1.16.13 ⏵ 1.16.189210010096 +2100
Updatedoxlint-tsgolint@​7.0.2003 ⏵ 7.0.2004991009793100
Updated@​vitejs/​plugin-react@​6.1.1 ⏵ 6.1.2100 +1100100 +194100

View full report

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 24921ae to 11ec7c8 Compare October 12, 2026 06:08
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 11ec7c8 to ff49f88 Compare October 12, 2026 09:02
@sapphi-red
sapphi-red merged commit a4444dc into main Oct 12, 2026
16 checks passed
@sapphi-red
sapphi-red deleted the renovate/all-minor-patch branch October 12, 2026 09:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sapphi-red sapphi-red sapphi-red approved these changes

Assignees

No one assigned

Labels

dependencies plugin: babel plugin: emotion plugin: jsx-remove-attributes plugin: styled-jsx plugin: transform-imports

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sapphi-red