chore(deps): update npm packages by renovate[bot] · Pull Request #1831 · voidzero-dev/vite-plus

renovate · 2026-06-14T17:38:21Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@babel/preset-typescript (source)	`7.28.5` → `7.29.7`
@blazediff/core (source)	`1.9.2` → `1.9.3`
@clack/core (source)	`1.4.0` → `1.4.1`
@napi-rs/wasm-runtime (source)	`1.1.4` → `1.1.5`
@nkzw/safe-word-list	`3.1.0` → `3.1.2`
@oxlint/plugins (source)	`=1.68.0` → `=1.69.0`
@rollup/plugin-commonjs (source)	`29.0.0` → `29.0.3`
@typescript/native-preview (source)	`7.0.0-dev.20260605.1` → `7.0.0-dev.20260611.2`
@yarnpkg/fslib (source)	`3.1.4` → `3.1.5`
fast-wrap-ansi	`0.2.0` → `0.2.2`
fs-extra	`11.3.2` → `11.3.5`
glob	`13.0.0` → `13.0.6`
minimatch	`10.2.4` → `10.2.5`
mocha (source)	`11.7.5` → `11.7.6`
obug	`2.1.1` → `2.1.2`
pixelmatch	`7.1.0` → `7.2.0`
pkg-types	`2.3.0` → `2.3.1`
playwright (source)	`1.57.0` → `1.60.0`
react (source)	`19.2.0` → `19.2.7`
react-dom (source)	`19.2.0` → `19.2.7`
reka-ui	`2.9.9` → `2.9.10`
remeda (source)	`2.34.1` → `2.39.0`
rollup (source)	`4.60.4` → `4.61.1`
semver	`7.8.1` → `7.8.4`
serve-static	`2.2.0` → `2.2.1`
std-env	`4.0.0` → `4.1.0`
tinybench	`6.0.0` → `6.0.2`
typescript (source)	`6.0.2` → `6.0.3`
vue (source)	`3.5.35` → `3.5.38`

Release Notes

babel/babel (@babel/preset-typescript)

`v7.29.7`

Compare Source

v7.29.7 (2026-05-25)

Re-release all packages with npm provenance attestations

teimurjan/blazediff (@blazediff/core)

`v1.9.3`

Compare Source

Patch Changes

87cf7cc: Fix crash when null is passed as the output buffer. diff now treats null and undefined identically (count-only), matching pixelmatch's API.

bombshell-dev/clack (@clack/core)

`v1.4.1`

Compare Source

Patch Changes

#548 2356e97 Thanks @43081j! - Remove sourcemaps and enable pretty-ish build output.

napi-rs/napi-rs (@napi-rs/wasm-runtime)

`v1.1.5`

Compare Source

Bug Fixes

wasm-runtime: preserve Buffer return values in fs-proxy (#3250) (c70f205)

rollup/plugins (@rollup/plugin-commonjs)

`v29.0.3`

2026-05-29

Bugfixes

commonjs: make #1868 es5-compatible (#1981)

`v29.0.2`

2026-03-06

Bugfixes

commonjs: conditional exports (#1952)

`v29.0.1`

2026-03-05

Bugfixes

commonjs: correctly replaces shorthand "global" property in object (#1957)

microsoft/typescript-go (@typescript/native-preview)

yarnpkg/berry (@yarnpkg/fslib)

`v3.1.5`

Compare Source

43081j/fast-wrap-ansi (fast-wrap-ansi)

`v0.2.2`

Compare Source

What's Changed

chore: fix typescript build by @43081j in #95

Full Changelog: 43081j/fast-wrap-ansi@0.2.1...0.2.2

jprichardson/node-fs-extra (fs-extra)

`v11.3.5`

Compare Source

Fix ensureLink*/ensureSymlink* identical file detection on Windows (#1068)
Fix error handling in timestamp preservation code (#1065, #1069)
Fix potential file descriptor leak on error in synchronous timestamp preservation code (#1066)

`v11.3.4`

Compare Source

Fix bug where calling ensureSymlink/ensureSymlinkSync with a relative srcPath would fail if the symlink already existed (#1038, #1064)

`v11.3.3`

Compare Source

Fix copying symlink when destination is a symlink to the same target (#1019, #1060)

isaacs/node-glob (glob)

`v13.0.6`

Compare Source

`v13.0.5`

Compare Source

`v13.0.4`

Compare Source

`v13.0.3`

Compare Source

`v13.0.2`

Compare Source

`v13.0.1`

Compare Source

isaacs/minimatch (minimatch)

`v10.2.5`

Compare Source

mochajs/mocha (mocha)

`v11.7.6`

Compare Source

🩹 Fixes

make describe().timeout() work (aafe6fd)
test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

format all code (#5629) (0696784)
remove Netlify (#5630) (8d01d33)

sxzz/obug (obug)

`v2.1.2`

Compare Source

No significant changes

View changes on GitHub

mapbox/pixelmatch (pixelmatch)

`v7.2.0`

Compare Source

Add a checkerboard option that controls whether to blend semi-transparent pixels against a checkerboard pattern (true, default) or plain white (false, pre-v7 behavior) when comparing images.

`v7.1.1`

Compare Source

Improve performance by ~8%. #165
Clearer errors on image size mismatch. #161 (by @VendorMap)
Skip antialiasing checks when includeAA is true. #160 (by @mongoose700)

unjs/pkg-types (pkg-types)

`v2.3.1`

Compare Source

compare changes

🩹 Fixes

Use untransformed typescript type exports (#261)

📖 Documentation

Improve documentation and fix typos across the project (#246)
Fix incorrect imports and add missing function docs (#248)

📦 Build

Migrate to obuild (29e54be)

🏡 Chore

Migrate to oxlint and oxfmt (67fedc4)
Update deps (78e9de1)
Update ci (e21a456)
Update test scripts (d8d7e68)
Add missing tsgo dep (d05a063)

❤️ Contributors

Daniel Roe (@danielroe)
Pooya Parsa (@pi0)
Eugene (@outslept)

microsoft/playwright (playwright)

`v1.60.0`

Compare Source

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:

await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.

🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:

await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});

await page.locator('#dropzone').drop({
  data: {
    'text/plain': 'hello world',
    'text/uri-list': 'https://example.com',
  },
});

🎯 Aria snapshots

expect(page).toMatchAriaSnapshot() now works on a Page, in addition to a Locator — equivalent to asserting against page.locator('body').
New boxes option on locator.ariaSnapshot() / page.ariaSnapshot() appends each element's bounding box as [box=x,y,width,height], useful for AI consumption.

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:

test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});

New APIs

Browser, Context and Page

Event browser.on('context') — fired when a new context is created on the browser.
BrowserContext now mirrors lifecycle events from its pages: browserContext.on('download'), browserContext.on('frameattached'), browserContext.on('framedetached'), browserContext.on('framenavigated'), browserContext.on('pageclose'), browserContext.on('pageload').

Locators and Assertions

New option description in page.getByRole() / locator.getByRole() / frame.getByRole() / frameLocator.getByRole() for matching the accessible description.
New option pseudo in expect(locator).toHaveCSS() reads computed styles from ::before or ::after.
New option style in locator.highlight() applies extra inline CSS to the highlight overlay, plus new page.hideHighlight() to clear all highlights.

Network

webSocketRoute.protocols() returns the WebSocket subprotocols requested by the page.
New option noDefaults in browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.

Errors and Reporting

New webError.location() mirrors consoleMessage.location().
consoleMessage.location() now exposes line / column properties (lineNumber / columnNumber are deprecated).
New testInfoError.errorContext surfaces additional diagnostic context, such as the aria snapshot of the receiver at the time of an expect(...) matcher failure.
reporter.onError() now receives a workerInfo argument with details about the worker for fixture teardown errors.

Test runner

New {testFileBaseName} token in testProject.snapshotPathTemplate — file name without extension.
Test runner now errors when a config tries to override a non-option fixture, and rejects workers: 0 or negative values.

🛠️ Other improvements

HTML reporter:
- npx playwright show-report accepts .zip files directly — no need to unzip first.
- Steps that contain attachments inside nested children show an indicator on the parent step.
- The repeatEachIndex is shown in the test header when non-zero.
Trace Viewer adds a pretty-print toggle for JSON / form request and response bodies in the network details panel.

Breaking Changes ⚠️

Removed long-deprecated APIs:
- Locator.ariaRef() — use the standard locator.ariaSnapshot() pipeline.
- handle option on BrowserContext.exposeBinding and Page.exposeBinding.
- logger option on BrowserType.connect and BrowserType.connectOverCDP — use tracing instead.
- Context options videosPath / videoSize — use recordVideo instead.

Browser Versions

Chromium 148.0.7778.96
Mozilla Firefox 150.0.2
WebKit 26.4

This version was also tested against the following stable channels:

Google Chrome 147
Microsoft Edge 147

Highlights

#39036 fix(msedge): fix local network permissions
#39037 chore: update cft download location
#38995 chore(webkit): disable frame sessions on fronzen builds

Browser Versions

Chromium 145.0.7632.6
Mozilla Firefox 146.0.1
WebKit 26.0

`v1.58.0`

Compare Source

facebook/react (react)

`v19.2.7`

Compare Source

`v19.2.6`: 19.2.6 (May 6th, 2026)

Compare Source

React Server Components

Type hardening and performance improvements
(by @eps1lon and @unstubbable)

`v19.2.5`: 19.2.5 (April 8th, 2026)

Compare Source

React Server Components

Add more cycle protections (#36236 by @eps1lon and @unstubbable)

`v19.2.4`: 19.2.4 (January 26th, 2026)

Compare Source

React Server Components

Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @gnoff, @lubieowoce, @sebmarkbage, @unstubbable)

`v19.2.3`: 19.2.3 (December 11th, 2025)

Compare Source

React Server Components

Add extra loop protection to React Server Functions (@sebmarkbage #35351)

`v19.2.2`: 19.2.2 (December 11th, 2025)

Compare Source

React Server Components

Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@eps1lon #35290)
Patch Promise cycles and toString on Server Functions (@sebmarkbage, @unstubbable #35289)

`v19.2.1`: 19.2.1 (December 3rd, 2025)

Compare Source

React Server Components

Bring React Server Component fixes to Server Actions (@sebmarkbage #35277)

facebook/react (react-dom)

`v19.2.7`

Compare Source

`v19.2.6`: 19.2.6 (May 6th, 2026)

Compare Source

React Server Components

Type hardening and performance improvements
(by @eps1lon and @unstubbable)

`v19.2.5`: 19.2.5 (April 8th, 2026)

Compare Source

React Server Components

Add more cycle protections (#36236 by @eps1lon and @unstubbable)

`v19.2.4`: 19.2.4 (January 26th, 2026)

Compare Source

React Server Components

Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @gnoff, @lubieowoce, @sebmarkbage, @unstubbable)

`v19.2.3`: 19.2.3 (December 11th, 2025)

Compare Source

React Server Components

Add extra loop protection to React Server Functions (@sebmarkbage #35351)

`v19.2.2`: 19.2.2 (December 11th, 2025)

Compare Source

React Server Components

Move react-server-dom-webpack/*.unbundled to private react-server-dom-unbundled (@eps1lon #35290)
Patch Promise cycles and toString on Server Functions (@sebmarkbage, @unstubbable #35289)

`v19.2.1`: 19.2.1 (December 3rd, 2025)

Compare Source

React Server Components

Bring React Server Component fixes to Server Actions (@sebmarkbage #35277)

unovue/reka-ui (reka-ui)

`v2.9.10`

Compare Source

🐞 Bug Fixes

Combobox: Keep content open when interacting with associated label - by @benjamincanac and Claude Opus 4.8 (1M context) in #2686 (ed753)
Dialog: Honor disableOutsidePointerEvents on modal content - by @zernonia and Claude Opus 4.8 (1M context) in #2677 and #2679 (5496c)
DismissableLayer: Keep body pointer-events locked when nested layer closes - by @zernonia and Claude Opus 4.8 (1M context) in #2674 and #2678 (034d2)
Listbox: Prevent virtualized list from scrolling page on mount - by @benjamincanac and Claude Opus 4.8 (1M context) in #2675 (c5dc8)
useId: Honor configured id source before vue useId - by @Mat4m0 in #2683 (b2e78)
- Behavior change: on Vue 3.5+, ConfigProvider's useId option now takes precedence over Vue's native useId, matching the documented Reka UI configuration behavior and avoiding SSR hydration mismatches when an app provides a stable ID source.

View changes on GitHub

remeda/remeda (remeda)

`v2.39.0`

Compare Source

Bug Fixes

map, mapWithFeedback: Correct types through NoInfer (#1368) (53d22a6), closes #1364

`v2.38.0`

Compare Source

Bug Fixes

drop,filter,groupBy,indexBy,isEmptyish,mapKeys,omit,pick,prop,sample,...: Remove trivial type-fest utilities (#1366) (c8a7c2b)

`v2.37.0`

Compare Source

Bug Fixes

splice: move data-last inference to curried data param (#1358) (16338d8)

`v2.36.0`

Compare Source

Bug Fixes

sample: typechecking perf issue with large literal tuples (#1355) (542185d)

`v2.35.0`

Compare Source

Bug Fixes

only: typing issue with union types (#1354) (ee955e7), closes #1353

rollup/rollup (rollup)

`v4.61.1`

Compare Source

2026-06-04

Bug Fixes

Avoid extraneous newlines when adding headers via plugins (#6403)
Fix a rare issue where starting Rollup would hang on Windows (#6404)

Pull Requests

#6402: Improve documentation for manualPureFunctions (@lukastaegert)
#6403: Does not add an extra leading line feed for addons (@TrickyPi)
#6404: fix: set report.excludeNetwork=true before getReport() to avoid blocking PTR lookups (@jdz321, @lukastaegert)

`v4.61.0`

Compare Source

2026-06-01

Features

Sort entry modules to make chunk hashes deterministic (#6391)

Pull Requests

#6376: Eliminate AWS credential exposure on fork PRs in REPL artefact workflow (@lukastaegert)
#6378: fix(deps): update minor/patch updates (@renovate[bot])
#6379: chore(deps): update dependency lint-staged to v17 (@renovate[bot], @lukastaegert)
#6380: chore(deps): update dependency lru-cache to v11 (@renovate[bot], @lukastaegert)
#6381: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)
#6382: chore(deps): update dependency @types/node to ^20.19.41 (@renovate[bot])
#6386: fix(deps): update minor/patch updates (@renovate[bot])
#6387: chore(deps): update aws-actions/configure-aws-credentials action to v6 (@renovate[bot])
#6388: fix(deps): update swc monorepo (major) (@renovate[bot], @lukastaegert)
#6389: chore(deps): lock file maintenance (@renovate[bot])
#6391: Sort entry modules to make chunk hash names deterministic (@TrickyPi)
#6394: fix(deps): update minor/patch updates (@renovate[bot], @lukastaegert)
#6395: chore(deps): update react monorepo to v19 (@renovate[bot], @lukastaegert)
#6396: fix(deps): update rust crate swc_compiler_base to v57 (@renovate[bot], @lukastaegert)
#6397: chore(deps): lock file maintenance (@renovate[bot], @lukastaegert)
#6400: docs: fix broken links (@jiyujie2006)

npm/node-semver (semver)

`v7.8.4`

Compare Source

Bug Fixes

e583226 #874 reject numeric segments after x-ranges (@pupuking723)

`v7.8.3`

Compare Source

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- "before 10am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-06-14T17:38:27Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`c116f61`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a2ee751991be100086485d3

socket-security · 2026-06-14T17:40:17Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@blazediff/core@1.9.3
	npm/@oxlint/plugins@1.69.0
	npm/@typescript/native-preview@7.0.0-dev.20260611.2

View full report

chore(deps): update npm packages

0665672

chore: update lockfiles

c116f61

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update npm packages#1831

chore(deps): update npm packages#1831
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/npm-packages

renovate Bot commented Jun 14, 2026

Uh oh!

netlify Bot commented Jun 14, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jun 14, 2026

Release Notes

v7.29.7 (2026-05-25)

Patch Changes

Patch Changes

Bug Fixes

Bugfixes

Bugfixes

Bugfixes

What's Changed

🩹 Fixes

🧹 Chores

🩹 Fixes

📖 Documentation

📦 Build

🏡 Chore

❤️ Contributors

🌐 HAR recording on Tracing

🪝 Drop API

🎯 Aria snapshots

🛑 test.abort()

New APIs

Browser, Context and Page

Locators and Assertions

Network

Errors and Reporting

Test runner

🛠️ Other improvements

Breaking Changes ⚠️

Browser Versions

Highlights

Browser Versions

v19.2.6: 19.2.6 (May 6th, 2026)

React Server Components

v19.2.5: 19.2.5 (April 8th, 2026)

React Server Components

v19.2.4: 19.2.4 (January 26th, 2026)

React Server Components

v19.2.3: 19.2.3 (December 11th, 2025)

React Server Components

v19.2.2: 19.2.2 (December 11th, 2025)

React Server Components

v19.2.1: 19.2.1 (December 3rd, 2025)

React Server Components

v19.2.6: 19.2.6 (May 6th, 2026)

React Server Components

v19.2.5: 19.2.5 (April 8th, 2026)

React Server Components

v19.2.4: 19.2.4 (January 26th, 2026)

React Server Components

v19.2.3: 19.2.3 (December 11th, 2025)

React Server Components

v19.2.2: 19.2.2 (December 11th, 2025)

React Server Components

v19.2.1: 19.2.1 (December 3rd, 2025)

React Server Components

🐞 Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Pull Requests

Features

Pull Requests

Bug Fixes

Configuration

Uh oh!

netlify Bot commented Jun 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

socket-security Bot commented Jun 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

`v19.2.6`: 19.2.6 (May 6th, 2026)

`v19.2.5`: 19.2.5 (April 8th, 2026)

`v19.2.4`: 19.2.4 (January 26th, 2026)

`v19.2.3`: 19.2.3 (December 11th, 2025)

`v19.2.2`: 19.2.2 (December 11th, 2025)

`v19.2.1`: 19.2.1 (December 3rd, 2025)

`v19.2.6`: 19.2.6 (May 6th, 2026)

`v19.2.5`: 19.2.5 (April 8th, 2026)

`v19.2.4`: 19.2.4 (January 26th, 2026)

`v19.2.3`: 19.2.3 (December 11th, 2025)

`v19.2.2`: 19.2.2 (December 11th, 2025)

`v19.2.1`: 19.2.1 (December 3rd, 2025)

netlify Bot commented Jun 14, 2026 •

edited

Loading