chore(deps-user): bump the user-frontend-minor group across 1 directory with 13 updates

[dependabot]

Bumps the user-frontend-minor group with 13 updates in the /frontends/user directory:

Package	From	To
@fontsource/noto-sans-sc	5.3.0	5.3.1
vue	3.5.42	3.5.44
vue-i18n	11.4.10	11.4.14
vue-router	5.3.1	5.4.0
@playwright/test	1.62.1	1.64.0
@vitejs/plugin-vue	6.0.8	6.0.10
eslint	10.10.0	10.12.0
eslint-plugin-vue	10.11.0	10.11.1
fast-check	4.9.0	4.10.2
globals	17.11.0	17.13.0
typescript-eslint	8.69.0	8.71.2
vite	8.2.2	8.3.4
vue-tsc	3.3.11	3.3.13

Updates @fontsource/noto-sans-sc from 5.3.0 to 5.3.1

Commits

• See full diff in compare view

Updates vue from 3.5.42 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
• compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
• custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
• reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
• reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
• runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
• runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
• runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
• runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
• server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
• ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
• transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
• transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

3.5.43 (2026-09-17)

Bug Fixes

• compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
• compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
• compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
• compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
• hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
• reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
• runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
• shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
• shared: preserve comment-like text in style values (#15471) (b9456cb)
• suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
• suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
• suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
• suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
• types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

Commits

• bf5f0dd release: v3.5.44
• 6930374 fix(server-renderer): propagate async setup errors (#15857)
• 8e8c547 chore(deps): update all non-major dependencies (#15585)
• 4cb0ca8 chore(deps): update playground (#15685)
• e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (#15768)
• 1caed5a chore(deps): update compiler (#15586)
• a49f451 chore(deps): update lint (#15680)
• 219b858 chore(deps): update build (#15679)
• ff35014 fix(transition): handle comment-wrapped component roots (#15853)
• d084b90 fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)
• Additional commits viewable in compare view

Updates vue-i18n from 11.4.10 to 11.4.14

Release notes

Sourced from vue-i18n's releases.

v11.4.14

What's Changed

🔒 Security Fixes

• fix(shared): neutralize srcdoc attribute in sanitizeTranslatedHtml by @​kazupon in intlify/vue-i18n#2679
• fix(core-base): escape both list and named values with escapeParameter by @​kazupon in intlify/vue-i18n#2680
• fix: ignore locales named after Object.prototype properties by @​kazupon in intlify/vue-i18n#2681

👕 Refactoring

• refactor(core-base): extract the resolved message format check by @​kazupon in intlify/vue-i18n#2674
• refactor(vue-i18n-core): remove dead branches in getCoreContext() by @​kazupon in intlify/vue-i18n#2675
• refactor(vue-i18n-core): share the fallbackContext handling in the composer by @​kazupon in intlify/vue-i18n#2676
• refactor(vue-i18n-core): simplify flat JSON handling in setLocaleMessage / mergeLocaleMessage by @​kazupon in intlify/vue-i18n#2677
• refactor(core-base): give the compile cache a proper type by @​kazupon in intlify/vue-i18n#2678

Full Changelog: intlify/vue-i18n@v11.4.13...v11.4.14

v11.4.13

What's Changed

⚡ Improvement Features

• fix(core-base): map locale unions without the UnionToTuple round-trip by @​kazupon in intlify/vue-i18n#2651

Full Changelog: intlify/vue-i18n@v11.4.12...v11.4.13

v11.4.12

What's Changed

🐛 Bug Fixes

• fix(core-base): cache locale chains by fallback identity by @​kazupon in intlify/vue-i18n#2635
• fix(vue-i18n-core): sync the core context when inheritLocale is enabled by @​kazupon in intlify/vue-i18n#2636

Full Changelog: intlify/vue-i18n@v11.4.10...v11.4.12

Changelog

Sourced from vue-i18n's changelog.

v11.4.14 (2026-10-10T11:06:13.502Z)

This changelog is generated by GitHub Releases

What's Changed

🔒 Security Fixes

• fix(shared): neutralize srcdoc attribute in sanitizeTranslatedHtml by @​kazupon in intlify/vue-i18n#2679
• fix(core-base): escape both list and named values with escapeParameter by @​kazupon in intlify/vue-i18n#2680
• fix: ignore locales named after Object.prototype properties by @​kazupon in intlify/vue-i18n#2681

👕 Refactoring

• refactor(core-base): extract the resolved message format check by @​kazupon in intlify/vue-i18n#2674
• refactor(vue-i18n-core): remove dead branches in getCoreContext() by @​kazupon in intlify/vue-i18n#2675
• refactor(vue-i18n-core): share the fallbackContext handling in the composer by @​kazupon in intlify/vue-i18n#2676
• refactor(vue-i18n-core): simplify flat JSON handling in setLocaleMessage / mergeLocaleMessage by @​kazupon in intlify/vue-i18n#2677
• refactor(core-base): give the compile cache a proper type by @​kazupon in intlify/vue-i18n#2678

Full Changelog: intlify/vue-i18n@v11.4.13...v11.4.14

v11.4.13 (2026-10-02T11:01:59.781Z)

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

• fix(core-base): map locale unions without the UnionToTuple round-trip by @​kazupon in intlify/vue-i18n#2651

Full Changelog: intlify/vue-i18n@v11.4.12...v11.4.13

v11.4.12 (2026-09-16T14:30:30.396Z)

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

• fix(core-base): cache locale chains by fallback identity by @​kazupon in intlify/vue-i18n#2635
• fix(vue-i18n-core): sync the core context when inheritLocale is enabled by @​kazupon in intlify/vue-i18n#2636

... (truncated)

Commits

• 6bb9ebd release: v11.4.14
• f6b3e75 release: v11.4.13
• 87f3745 release: v11.4.12
• See full diff in compare view

Updates vue-router from 5.3.1 to 5.4.0

Release notes

Sourced from vue-router's releases.

v5.4.0

   🚨 Breaking Changes

• experimental: Normalize query values to arrays  -  by @​posva in vuejs/router#2824 (f1fbc)

   🚀 Features

• Accept a prebuilt matcher in createRouter  -  by @​danielroe in vuejs/router#2804 (9de96)
• UseScrollRestoration and onRouteRendered  -  by @​posva in vuejs/router#2805 (e3dde)
• Diagnose experimental beforeEnter migration  -  by @​posva (b695c)
• experimental:
  • Warn about legacy optional param removal  -  by @​posva in vuejs/router#2818 (c2f92)
  • Extract hash params with definePage  -  by @​posva (dbf2d)
  • Configure required and default hash params  -  by @​posva (cef5c)
  • Never decode the hash, protect-only encoding  -  by @​posva in vuejs/router#2760 (aca2c)
  • Allow custom regexp for path params in definePage  -  by @​posva in vuejs/router#2822 (3a192)
• router:
  • Restore hashes and top by default  -  by @​posva (7c385)

   🐞 Bug Fixes

• Resolve experimental guard redirects against target on history navigation  -  by @​posva (2c5fb)
• experimental:
  • Keep declared case of static prefix in MatcherPatternPathStar.build()  -  by @​contactjawad in vuejs/router#2798 (4dc6b)
  • Make hash params optional and nullable  -  by @​posva (d9a4c)
  • Exclude defaults from required hash params  -  by @​posva (346e2)
  • Align hash parameter parsing with queries  -  by @​posva (cf251)
  • Keep last hash param instead of throwing  -  by @​posva (d1e8a)
  • Disallow required with a default for query params  -  by @​posva (f60e9)
  • Make query params with a default optional on push  -  by @​posva (fb604)
  • Do not inherit params, query, or hash on redirects  -  by @​posva (02a92)
• history:
  • Invalidate obsolete scroll positions  -  by @​posva and @​liuly0322 in vuejs/router#2814 (071f1)
• unplugin:
  • Sanitize named view in definePage import  -  by @​giaBaoJS in vuejs/router#2809 (0711d)
  • Keep hex character codes in param segments regexp  -  by @​kwy404 in vuejs/router#2811 (07663)

   🏎 Performance

• unplugin: Cache merged route overrides  -  by @​posva in vuejs/router#2821 (732b7)

    View changes on GitHub

Commits

• 596d481 release: vue-router@5.4.0
• 2970e8e chore: fix back extends
• 16a62f8 chore(deps): upgrade dependencies (#2828)
• b810a7e chore: remove unused types
• a0efbde docs: adapt
• 2c5fbd6 fix: resolve experimental guard redirects against target on history navigation
• 6ef3163 refactor: allow undefined on optional param
• 8e89a60 chore: comment
• 72ceb99 refactor: absolute position
• 57dd1d6 refactor: allow guards to return relative location
• Additional commits viewable in compare view

Updates @playwright/test from 1.62.1 to 1.64.0

Release notes

Sourced from @​playwright/test's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits

• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
• 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
• 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
• 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
• dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
• Additional commits viewable in compare view

Updates @vitejs/plugin-vue from 6.0.8 to 6.0.10

Release notes

Sourced from @​vitejs/plugin-vue's releases.

plugin-vue@6.0.10

Please refer to CHANGELOG.md for details.

plugin-vue@6.0.9

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-vue's changelog.

6.0.10 (2026-10-10)

Bug Fixes

• plugin-vue: compile transformed normal scripts outside vapor mode (#857) (7b63e3c)
• plugin-vue: correct AST reuse checks and allow Vue 3.6 RC (ccc06dd)

Documentation

• plugin-vue: clarify compiler initialization hooks (55d0cab)

6.0.9 (2026-09-14)

Bug Fixes

• deps: update all non-major dependencies (#812) (b2b559d)
• plugin-vue: initialize compiler correctly (#475) (127b03f)
• plugin-vue: transpile TS in templates with empty script block (#838) (189148e)

Miscellaneous Chores

• deps: update dependency obug to v3 (#846) (3180192)

Commits

• a03675e release: plugin-vue@6.0.10
• 7b63e3c fix(plugin-vue): compile transformed normal scripts outside vapor mode (#857)
• ccc06dd fix(plugin-vue): correct AST reuse checks and allow Vue 3.6 RC
• 55d0cab docs(plugin-vue): clarify compiler initialization hooks
• 822c69d release: plugin-vue@6.0.9
• 127b03f fix(plugin-vue): initialize compiler correctly (#475)
• 3180192 chore(deps): update dependency obug to v3 (#846)
• 189148e fix(plugin-vue): transpile TS in templates with empty script block (#838)
• b2b559d fix(deps): update all non-major dependencies (#812)
• See full diff in compare view

Updates eslint from 10.10.0 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

... (truncated)

Commits

• a438ec3 10.12.0
• 32a73f1 Build: changelog update for 10.12.0
• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
• 152067f chore: update ecosystem plugins (#21362)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
• 67eb586 docs: Update README
• bfaea12 perf: cache normalized config globals per languageOptions (#21364)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
• d166567 chore: update dependency prettier to v3.9.9 (#21371)
• Additional commits viewable in compare view

Updates eslint-plugin-vue from 10.11.0 to 10.11.1

Release notes

Sourced from eslint-plugin-vue's releases.

v10.11.1

Patch Changes

• Fixed vue/no-ref-object-reactivity-loss false negatives for values gotten in an immediately invoked function expression (IIFE) (#3115)
• Fixed vue/no-unused-properties false positive for props explicitly typed as never (#3113)
• Fixed vue/require-default-prop to no longer require a default value for defineModel (#3138)

Changelog

Sourced from eslint-plugin-vue's changelog.

10.11.1

Patch Changes

• Fixed vue/no-ref-object-reactivity-loss false negatives for values gotten in an immediately invoked function expression (IIFE) (#3115)
• Fixed vue/no-unused-properties false positive for props explicitly typed as never (#3113)
• Fixed vue/require-default-prop to no longer require a default value for defineModel (#3138)

Commits

• ec9c53a Version Packages (#3139)
• 50ffb7f docs: explain how to apply the configs to a subset of files (#3122)
• ad239b4 fix(no-unused-properties): ignore props typed as never (#3113)
• 24cb5bc fix(no-ref-object-reactivity-loss): improve IIFE handling (#3115)
• ef6f53e fix(require-default-prop): don't report on defineModel (#3138)
• 121030c Format changelog
• See full diff in compare view

Updates fast-check from 4.9.0 to 4.10.2

Release notes

Sourced from fast-check's releases.

v4.10.2

Fix interrupt plugin (throwing) [Code][Diff]

Fixes

• (PR#7333) Bug: Plugin interruptAfterTimeLimit crashes

Fix fake-timer compatibility in timeout and interrupt plugins

[Code][Diff]

Fixes

• (PR#7293) Bug: Capture timers for interruptAfterTimeLimit plugin
• (PR#7282) CI: Temporarily disable documentation updates until v5
• (PR#7279) Doc: Release note for 4.10.0

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

• (PR#7216) Introduce a plugin API
• (PR#7221) Refine plugin API
• (PR#7222) Add ability to configure plugins globally
• (PR#7224) Add the beforeEach plugin to hook in life-cycle
• (PR#7227) Create an afterEach plugin
• (PR#7232) Deprecate life-cycle methods
• (PR#7235) Support teardown of beforeEach plugin
• (PR#7228) Add timeout plugin to stop long running predicates
• (PR#7237) Deprecate timeout from parameters
• (PR#7238) Pass a store to plugins
• (PR#7239) Add extra plugin's method called onAllRunsComplete
• (PR#7240) Deprecate reporter and asyncReporter from parameters
• (

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-15T21:35:49.897627Z	6b54439	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.