Repository navigation
chore(deps): update all non-major dependencies (js/ts) j:kit-282 - #8583
Conversation
|
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
@msw/playwright 0.7.0 requires MSW 3, but the workspace remains on MSW 2.15.0.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Updates shared JavaScript/TypeScript dependencies across the monorepo.
Changes:
- Updates eight catalog dependencies.
- Regenerates transitive dependency resolutions.
| File | Description |
|---|---|
pnpm-workspace.yaml |
Updates catalog versions. |
pnpm-lock.yaml |
Refreshes resolved dependencies and peer metadata. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
| chromatic: 18.9.4 | ||
| '@msw/playwright': 0.6.7 | ||
| chromatic: 18.10.1 | ||
| '@msw/playwright': 0.7.0 |
@coveo/atomic
@coveo/atomic-hosted-page
@coveo/atomic-legacy
@coveo/atomic-react
@coveo/auth
@coveo/bueno
coveo.analytics
@coveo/create-atomic
@coveo/create-atomic-component
@coveo/create-atomic-component-project
@coveo/create-atomic-result-component
@coveo/create-atomic-rollup-plugin
@coveo/create-ui
@coveo/headless
@coveo/headless-react
@coveo/quantic
@coveo/relay
@coveo/shopify
@coveo/thermidor
@coveo/atomic-angular
commit: |
491c4b0 to
a85e9ae
Compare
a85e9ae to
e3ff1b2
Compare
e3ff1b2 to
c339c9f
Compare
c2128bd to
dcccd33
Compare
dcccd33 to
d6d87cd
Compare
d6d87cd to
e9105b8
Compare
e9105b8 to
97d1cc5
Compare
97d1cc5 to
7c2b4d0
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |

Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
0.6.7→0.7.00.0.82→0.0.832.12.0→2.13.06.1.1→6.1.218.9.4→18.13.03.4.15→3.4.175.2.1→5.3.04.7.9→4.7.1026.4.2→26.5.330.1.1→30.1.35.4.0→5.4.28.5.28→8.5.313.9.8→3.9.100.3.24→0.3.254.63.4→4.64.1214.0.2→14.0.38.3.0→8.3.44.6.5→4.6.7Release Notes
mswjs/playwright (@msw/playwright)
v0.7.0Compare Source
v0.7.0 (2026-09-28)
a542e9b) @kettanaitomicrosoft/playwright-mcp (@playwright/mcp)
v0.0.83Compare Source
Bug Fixes
browser_findtakesfilenameto save matches to a file instead of the response (microsoft/playwright#42077). (microsoft/playwright#42968)browser_navigateandbrowser_reloadreport a dialog opened during page load instead of timing out (microsoft/playwright#42817). (microsoft/playwright#42908)browser_wait_forreports whentimeis capped at 30 seconds (#1767). (microsoft/playwright#42932)"/home/"(microsoft/playwright#42807). (microsoft/playwright#42811)reduxjs/redux-toolkit (@reduxjs/toolkit)
v2.13.0Compare Source
This feature release updates our build tooling to TSDown and PNPM, adds official TypeScript 7 support, and includes a long list of bugfixes across RTK Query,
createAsyncThunk,createEntityAdapter, andcombineSlices.Changelog
Build Tooling Updates
We've fully modernizing modernized our build tooling across all of the Redux repos. That included switching from Yarn to PNPM, ESLint to Oxlint, Prettier to Oxfmt, and TSUp to TSDown.
The part that matters for users is that we now build the package with TSDown instead of
tsup. The package layout,exportsdefinitions, and exported APIs are all unchanged from 2.12. We've checked the new build withattw, and verified that CJS and ESM entry points load in both dev and prod builds, and that thelegacy-esmartifacts still target ES2017. The contents of the bundles do look a bit different (smaller CJS artifacts, slightly different helper output in thelegacy-esmfiles). If you see any behavior differences that look build-related, please file an issue!This is also our first release published via the updated PNPM-based workflow, still using NPM Trusted Publishing. We've also added
pkg.pr.newpreviews for every commit, so you can try out a PR build before it's released.Docs Updates
We've shipped a new combined Redux libraries docs site! The core docs site at https://redux.js.org now contains the docs for all of our libraries: Redux core and usage guides, Redux Toolkit, React Redux, and Reselect. The prior standalone docs sites for RTK, R-R, and Reselect now redirect to their respective sections of the combined docs. We've also done a major cleanup pass on the docs, deduplicating pages that had similarities (like the Next.js or RTK2 migration pages that lived in both the core and RTK docs), and updating outdated content (modernizing example code snippets, deleting dead links, and making RTK and hooks the default patterns shown). The RTK content now lives at https://redux.js.org/toolkit/ .
TypeScript 7 Support
TS 7.0 (the native Go port) is now out! We fixed the remaining type errors in RTK when checked by TS 7.0 and 7.1, and TS 7.0 is now part of our CI test matrix.
Per our TS support policy of matching DefinitelyTyped's support window, we've also updated our support matrix to TS 5.6+. As always, RTK may still work with earlier versions, but we no longer test against them.
RTK Query Fixes
useQueryState(and thususeQuery) was passing a new inline selector touseSelectoron every render, and also reading the store directly during render. The selector is now memoized, and the direct store read is gone. This also fixes a bug whereisSuccesscould flip fromfalsetotrueon an unrelated re-render while a query was refetching after an error.isSuccessnow correctly staysfalsein that case.datanow reflects cache updates made viaupdateQueryDatawhile a refetch is in flight, instead of showing the previous result.Polling now reads the current cache state when each poll fires, rather than the state at the time the poll was scheduled. This means
skipPollingIfUnfocusedrespects focus loss that happens after scheduling, and polls stop if their cache entry was removed.We fixed a race where a duplicate query request rejected by the thunk condition could cause queued tag invalidations to run too early and be lost, leaving stale data in the cache.
Tags with falsy ids like
0now invalidate and clean up correctly.Lazy query hooks now re-subscribe correctly when effects restart while the hook state is preserved, such as with Fast Refresh or
<Activity>.Infinite queries no longer trigger
onQueryStartedwhen fetching past the end of the list, and the infinite query hook result type now includes the page error flags.fetchBaseQueryonly treats a URL as absolute if it starts with a scheme.We also fixed an error when rehydrating state for an endpoint name that has no definition.
Other Fixes
createAsyncThunkno longer swallows aborts that happen before thependingaction is dispatched, and now correctly setsrejectedWithValuewhenrejectWithValueis called with a falsy payload.createEntityAdapter'ssetAllnow keeps the last item when given duplicate IDs, matchingsetMany. The sorted adapter'supdateManynow merges multiple updates for the same ID before applying them.combineSlicesnow keeps its internal state proxy cache per instance, so multiple combined reducers no longer interfere with each other.The immutability check middleware now handles circular references in state.
The dynamic middleware now caches its composed middleware chains when the list of middleware hasn't changed.
What's Changed
pkg.pr.newby @aryaemami59 in #5256entityAdapter):setAllwith duplicate IDs keeps last occurrence (consistent withsetMany) by @JSap0914 in #5321createAsyncThunkaborts that happen before pending by @chatman-media in #5314useRef<T | undefined>(undefined)usages in RTK Query hooks by @DucMinhNe in #5315onQueryStartedfrom triggering at end-of-list by @joseph0926 in #5182remark-typescript-toolsand update to TS7 by @markerikson in #5390rejectedWithValuefor falsyrejectWithValuepayloads by @dfedoryshchev in #5395immutableStateInvariantMiddlewareby @hamed-bavar in #5433useQueryStateandisSuccessduring refetch-after-error by @markerikson in #5456Full Changelog: reduxjs/redux-toolkit@v2.12.0...v2.13.0
vitejs/vite-plugin-react (@vitejs/plugin-react)
v6.1.2Compare Source
Fix HMR for compound components (#1484)
Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.
Fix
compiler.logDiagnosticsoption not working (#1483)With
oxc-transform-react>= 0.148, thelogDiagnosticswas not working. This version fixes it and requiresoxc-transform-react>= 0.152 as a peer dependency if you are using thecompileroption.compiler.logDiagnosticsoption is now deprecated and should be swapped for the builtincompiler.reportDiagnostics.Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)
When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.
chromaui/chromatic-cli (chromatic)
v18.13.0Compare Source
🚀 Enhancement
--untracedsupport #1522 (@codykaup)--externalssupport #1516 (@codykaup)🐛 Bug Fix
Authors: 3
v18.12.2Compare Source
🐛 Bug Fix
Authors: 2
v18.12.1Compare Source
🐛 Bug Fix
Authors: 1
v18.12.0Compare Source
🚀 Enhancement
🐛 Bug Fix
Authors: 2
v18.11.0Compare Source
🚀 Enhancement
Authors: 1
v18.10.2Compare Source
🐛 Bug Fix
staticDirsentries in the TurboSnap v2 manifest #1509 (@codykaup)Authors: 1
v18.10.1Compare Source
🐛 Bug Fix
Authors: 1
v18.10.0Compare Source
🚀 Enhancement
🐛 Bug Fix
Authors: 1
v18.9.6Compare Source
🐛 Bug Fix
Authors: 1
v18.9.5Compare Source
🐛 Bug Fix
Authors: 1
cure53/DOMPurify (dompurify)
v3.4.17: DOMPurify 3.4.17Compare Source
IN_PLACE,SAFE_FOR_TEMPLATESand shadow roots, thanks @manus-piIN_PLACEhandling of nodes that hooks or custom elements tough during sanitization, thanks @uttej-badwaneattributeNameguard in XHTML mode, thanks @KoukyosyumeiisValidAttribute()), thanks @artiphishellIN_PLACEdocumentation in the README about possible risksv3.4.16: DOMPurify 3.4.16Compare Source
IN_PLACEnode removal when working with hooks, thanks @manus-piIN_PLACEsanitization and raw-text roots, thanks @h-t-mrolluptorolldownbecause performance, thanks @ssi02014expressjs/express (express)
v5.3.0Compare Source
=====
🐞 Bug fixes
Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @YuryShkoda in #4893
Fixed the behavior of
res.send()to prevent conflicts betweenContent-LengthandTransfer-EncodingHTTP headers in responses. TheContent-Lengthheader inres.send()is now only added when aTransfer-Encodingheader is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of aTransfer-Encodingheader - by @cuishuang in #7459Upgrade
qsto^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx):arrayLimitbypasses in comma parsing and a denial of service via an attacker-controlledisBuffer- by @davetashner in #7057 and #7478, and @cyphercodes in #7305Upgrade
proxy-addrto^2.0.8, which fixes CVE-2026-90711 - by @lazerg in #7474🚀 Improvements
Allow conditional revalidation for QUERY requests.
req.freshpreviously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @Cherry in #7366Improve HTML structure in
res.redirect()responses when HTML format is accepted by adding<!DOCTYPE html>,<title>, and<body>tags for better browser compatibility - by @Bernice55231 in #5167When calling
app.renderwith options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903Upgrade
content-typeto^2.0.0, bringing a faster parser (~1.5x quickerContent-Typeparsing/formatting inres.send()) along with a behavior change:res.send()now keeps any existing parameters when adding the charset and no longer throws on aContent-Typethat fails to parse.type-isis upgraded to^2.1.0as part of the same change - by @blakeembrey in #7234The default error handler now logs the full error object instead of only its stack trace, so nested details such as
Error.causeand library-specific properties (e.g. Sequelize'sparent/original) are no longer swallowed - by @Nitin-Mohapatra in #6464Upgrade
content-dispositionto^2.0.1, which changes theContent-Dispositionheader emitted byres.download(),res.attachment(), andres.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @blakeembrey in #7233Upgrade
body-parserto^2.3.0, which fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6): an invalidlimitoption value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalidlimitvalues now throw at parser initialization instead of being ignored - by @Mayvis in #7390⚡ Performance
res.send()when sending string responses without an explicit Content-Type header - by @bjohansebas in #6991handlebars-lang/handlebars.js (handlebars)
v4.7.10Compare Source
f37c599812c226<!--and<scriptin precompiled output -609d1b1GHSA-xw65-4hp5-5hc7ceec388GHSA-p8wg-vrv2-v86fc28ee7a7d501a5703fdccGHSA-8r5x-fm3f-whwj0fcf25cea8ed82d069c1c6714e07Compatibility notes:
{{#each}}iterates iterables such asMap,Setand generators lazily, likefor...of, instead ofcopying them into an array first. Values added to the iterable while the block renders are now visited too.
Commits
i18next/i18next (i18next)
v26.5.3Compare Source
countalso when the call passes an explicitns.t(($) => $.item)already failed withoutcount, butt(($) => $.item, { ns: 'items' })compiled, although at runtime it looks upiteminstead ofitem_one/item_otherand returns the key. It now fails the same way, also withordinal: true,defaultValue, annsarray, a key prefix andi18n.t. Calls withcount,context,returnObjects: trueand arrays of selectors, as well as return types, are unchanged. Thanks @nyarthan (#2452).v26.5.2Compare Source
t()call with a missing, misspelled or wrongly typed option now reports that option again (Property 'album' is missing,Type 'string' is not assignable to type 'number'), as TypeScript 5 and 6 do. TypeScript 7 elaborated the error against the default-value signature instead and ended in'{ count: 3; albm: "Summer"; }' is not assignable to type 'string': on a failed call TypeScript explains the last of the equally matching signatures, and TypeScript 7 sorts the 3-element[key, defaultValue, options?]last. It is now written as two signatures,[key, defaultValue]and[key, defaultValue, options]. This affects the default key checks with i18next{{name}}messages as well asparseInterpolation: 'icu'and'mf2'. Which calls compile, their return types and the error positions are unchanged on TypeScript 5.9, 6 and 7.v26.5.1Compare Source
false,0or''is now returned when a flat key with the same dotted name also exists. With{ a: { b: false }, 'a.b': 'flat' },getResource('en', 'translation', 'a.b')andt('a.b')returned'flat': the nested result was checked for truthiness, so these present values fell through to the flat-key lookup. Without such a flat key they were already returned. A nestednull, which is not a valid lookup by default (returnNull: false), still falls back to the flat key. Thanks @lprnmns (#2461).v26.5.0Compare Source
parseInterpolation: 'icu'andparseInterpolation: 'mf2'typet()options from the message's ICU MessageFormat arguments (i18next-icu) or MessageFormat 2 variables (i18next-mf2), so ICU and MF2 users no longer needparseInterpolation: falseand lose argument checking. Missing, misspelled and wrongly typed arguments fail, and so does leaving out the options for a message with arguments (t('greeting')); that error names the missing arguments. Opt-in, defaulttrueis unchanged.{name}takesstring | number,{n, number},pluralandselectordinaltakenumber,{d, date}and{t, time}takeDate,selecttakes its case keys or any string (forother), and arguments nested in cases are required too.#and tags are not arguments, apostrophe quoting is read like intl-messageformat does.{$name}takesstring | number, a variable annotated with:number,:integer,:currency,:percentor:unit(inline or through.input/.local) takesnumber,:datetime,:dateand:timetakeDate,:stringtakesstring, option and markup variables (minimumFractionDigits=$digits,{#link href=$url}) are required too,.localvariables are not arguments, and|quoted literals|and\{escapes are skipped.interpolationFormatTypeMapoverrides a type by ICU format or MF2 function name, e.g.date: Date | numberor a customuppercase: string.t(),getFixedT(),i18n.t, key prefixes, namespaces, the selector API and react-i18next'sTransvalues. Messages need literal types, as the resources file from i18next-cli'stypescommand has them.false(TypeScript 6), 0.5s instead of 0.26s with TypeScript 7. Messages that no call uses cost nothing.Property 'name' is missing) instead of'{ nmae: string }' is not assignable to type 'string'from the default-value overload.v26.4.7Compare Source
cloneInstance()no longer inheritspreload.loadResources()adds everypreloadlanguage to each load, and clones copiedpreloadfrom the parent, so a clone'sinit()and everychangeLanguage()walked all preloaded languages × all namespaces throughqueueLoad()/hasResourceBundle(), although the parent had already loaded them into the shared store. With i18next-http-middleware (one clone +changeLanguage()per request), 25 preloaded languages and 20 namespaces, that was most of the per-request CPU: the reproduction from the issue went from ~90 µs to ~10 µs per request, the same as with a single language. A clone now only loads what it uses itself: itschangeLanguage()no longer waits for parent preload languages that are still loading (the parent's owninit()still does), andclone.loadNamespaces()loads the new namespace for the clone's language and fallbacks instead of every preloaded language.clone.loadLanguages()works as before, the parent instance is unchanged, and passingpreloadtocloneInstance()keeps the old behavior. Thanks @theMostCuriousHomunculus for the detailed report (#2451).v26.4.6Compare Source
toResolveHierarchy()checked the rawfallbackLngvalue against the list, but the list holds formatted codes, so any fallback written differently from its formatted form slipped through:lng: 'de-CH'withfallbackLng: 'de-ch'gavelanguages['de-CH', 'de', 'de-CH'], and the same happened withfallbackLng: 'EN'+cleanCode,lowerCaseLng, and Intl aliases (iw-IL→he-IL). Missing keys were looked up in the same language twice. Only exact duplicates are removed; the order is unchanged. Thanks @lprnmns (#2450).v26.4.5Compare Source
hasLoadedNamespace(ns, { lng })no longer staysfalseforever when the passed inlngis loaded under another code, or not at all. It checked the load state of the rawlng, butloadLanguages()stores a language under its resolved code (de-ch→de-CH,de-CH→dewithload: 'languageOnly') and skips alngoutsidesupportedLngsentirely (only the fallback gets loaded), so that state never got set. react-i18next'suseTranslation(ns, { lng })then never became ready: withuseSuspenseit kept throwing an already resolved promise and React retried forever (100% CPU, SSR never finished), without it the load effect re-rendered in a loop. It now checks the code the language is actually loaded under, and for alngoutsidesupportedLngsonly waits for the fallback, which is also whatt()resolves to. Calls withoutlngand theprecheck(react-i18next'sbindI18n: 'languageChanging') are unchanged (react-i18next#1934).v26.4.4Compare Source
$t(. Its repeated group had overlapping alternatives ([^()"']+inside(?:...)*?, and inside parentheses[^()]also matched quotes), so a string containing$t(without a closing)made the engine try every way to split the text: about 2x the runtime per extra character, and a ~25 character value hungt()for minutes. With the default config this was reachable through any interpolated value (t('greet', { name: '$t(aaaaaaaaaaaaaaaaaaaaaaaa' })): escaping does not touch$,tor(, and theskipOnVariablescheck runs the regexp on the interpolated result, sonest: falsedid not help either. Every alternative now starts with a different character (plain char,",'or(), so there is only one way to match and the cost is linear. Quoted strings and one level of parentheses in nesting options keep working (#2336). The only difference: a lone"or'inside unquoted parentheses within$t(...)is no longer matched. Affects 25.3.3 to 26.4.3. See advisory GHSA-5jr9-983r-c8x4, CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Thanks to Anisetti Chaitanya Eshwar Prasad for the responsible disclosure.nest()now resolves$t(...)in a single pass and no longer nests text that came out of a resolved value. Every nested lookup reset the shared nesting regexp, so the loop started over from the beginning of the string after each match. That had two effects. First, a$t(...)inside a variable that the nested lookup deliberately kepConfiguration
📅 Schedule: (in timezone America/Toronto)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.