chore(deps-dev): bump the development-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the development-dependencies group with 7 updates in the / directory:

Package	From	To
@playwright/test	1.62.1	1.63.0
@types/node	26.4.1	26.5.1
electron	43.6.0	43.7.0
eslint-plugin-vue	10.10.0	10.11.0
fast-check	4.9.0	4.10.0
happy-dom	20.14.0	20.14.3
typescript-eslint	8.69.0	8.70.0

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @types/node from 26.4.1 to 26.5.1

Commits

• See full diff in compare view

Updates electron from 43.6.0 to 43.7.0

Release notes

Sourced from electron's releases.

electron v43.7.0

Release Notes for v43.7.0

Features

• Added initiatorOrigin to webRequest and protocol handler requests, DownloadItem.getInitiatorOrigin(), and a trailing frame argument to the will-download and preconnect session events. #53704 (Also in 44, 45)
• Added the ELECTRON_DEBUG_DRAGGABLE_REGIONS environment variable, which visualizes and logs draggable regions in unpackaged apps to help debug custom title bars. #53633 (Also in 44, 45)

Fixes

• File System Access permission requests and the file-system-access-restricted event are scoped to the requesting document, grants are reset when the origin's last page closes, and write access works in in-memory sessions. #53694 (Also in 42, 44, 45)
• Fixed session.setPermissionCheckHandler receiving the top-level origin and a null webContents for hid and usb checks made from a subframe. #53689 (Also in 42, 44, 45)
• Fixed webContents.on(), removeListener() and removeAllListeners() throwing "Object has been destroyed" for console-message listeners after the WebContents was destroyed. #53496 (Also in 42, 44, 45)
• Fixed a crash on Linux when process.env was written while another thread was reading the environment, and a memory leak when a worker thread exits. #53510 (Also in 42, 44, 45)
• Fixed a possible crash on Windows when a file dialog was shown for a window that was being closed at the same time. #53584 (Also in 42, 44, 45)
• Fixed a renderer crash when the main process sent IPC to, or a page navigated, a same-process window.open() child whose contextIsolation differed from its opener's. #53540 (Also in 42, 44, 45)
• Fixed an issue where the browser-side check that blocks drag and drop between cross-site frames of the same page was disabled. #53750 (Also in 44, 45)
• Fixed crashes in setDisplayMediaRequestHandler when the granted frame had been destroyed or another tab was granted by id. #53671 (Also in 42, 44, 45)
• Fixed several non-functional DevTools integrations: the Security panel's "View certificate" button, Ctrl+wheel zooming inside DevTools, and DevTools keyboard shortcuts (e.g. F8) while the inspected page has focus. #53631 (Also in 44, 45)
• Internal <webview>, window.close() and executeJavaScript reply IPCs are validated against the sending frame. #53726 (Also in 42, 44, 45)
• <webview> without allowpopups also blocks links opened into a new window by modifier-click, and such windows navigate as the clicking document rather than as a browser-initiated load. #53718 (Also in 42, 44, 45)
• getUserMedia with chromeMediaSource: 'desktop' no longer accepts WebContents source ids; use chromeMediaSource: 'tab' with webContents.getMediaSourceId() or setDisplayMediaRequestHandler to capture a WebContents. #53707 (Also in 42, 44, 45)
• nodeIntegrationInWorker now applies only to workers created by frames that themselves have Node integration; enable nodeIntegrationInSubFrames to keep Node in workers created by subframes. #53712 (Also in 42, 44, 45)
• openExternal permission requests started by a frame that has since gone away are attributed to that frame's origin rather than to the navigating page. #53698 (Also in 42, 44, 45)
• pointerLock and keyboardLock permission requests now report the requesting frame, and execCommand('paste') requires user activation in the frame that calls it. #53701 (Also in 42, 44, 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, libyuv, PDFium and V8. #53766
• Fixed a renderer crash that could occur when printing from an iframe. #53761 (Also in 44, 45)
• Fixed the app becoming unresponsive when a page has a very large number of app-region draggable elements. #53632 (Also in 44, 45)
• Updated Node.js to v24.21.0. #53777

Commits

• c440db5 docs: add REVIEW.md and treat it as a docs-only change in CI (#53804)
• 206e0d7 feat: identify the requesting frame and initiator on network, auth and downlo...
• 9678a7f build: remove git add from lint-staged config (#53795)
• 3687f12 chore: cherry-pick a871bdb05932 from angle (#53772)
• 4315b8a chore: cherry-pick f0d76fefb52c from chromium (#53761)
• 39c5ed0 chore: bump node to v24.21.0 (43-x-y) (#53777)
• 0c64245 docs: hand-port Chrome security picks in-PR instead of dropping them (backpor...
• f480403 test: use badge fields in ts-smoke so spec type-check passes (43-x-y) (#53788)
• afe4fb7 chore: cherry-pick 159482bbcaf4 from chromium (#53771)
• e0dad4a chore: cherry-pick 31 changes from angle, chromium, libyuv, pdfium and v8 (#5...
• Additional commits viewable in compare view

Updates eslint-plugin-vue from 10.10.0 to 10.11.0

Release notes

Sourced from eslint-plugin-vue's releases.

v10.11.0

Minor Changes

• Added defineModel support to vue/require-default-prop and vue/require-valid-default-prop rules (#3032)
• Added support for SFCs using @nuxtjs/composition-api, which is now treated the same as vue or @vue/composition-api (#3100)
• Added new vue/no-shadow-native-events rule (#2558)

Patch Changes

• Fixed vue/use-v-on-exact to avoid reporting @keydown.stop when paired with an exact key-specific listener (#3082)
• Specified explicit items policies for array rule option schemas (#3112)
• Updated resources (HTML elements) (#3132 and #3133)

Changelog

Sourced from eslint-plugin-vue's changelog.

10.11.0

Minor Changes

• Added defineModel support to vue/require-default-prop and vue/require-valid-default-prop rules (#3032)
• Added support for SFCs using @nuxtjs/composition-api, which is now treated the same as vue or @vue/composition-api (#3100)
• Added new vue/no-shadow-native-events rule (#2558)

Patch Changes

• Fixed vue/use-v-on-exact to avoid reporting @keydown.stop when paired with an exact key-specific listener (#3082)
• Specified explicit items policies for array rule option schemas (#3112)
• Updated resources (HTML elements) (#3132 and #3133)

Commits

• 97c5634 Version Packages (#3106)
• abe8bef Update resources (#3133)
• f3a0276 Make wording in changeset more consistent
• 87cd113 Update resources (#3132)
• af8fb6a chore(tools/update-html-resources): fix deprecated HTML elements lookup (#3129)
• d363ec0 refactor: extract common type in VNodeListenerMap (#3111)
• 6a4ff1b chore(tools): don't fail npm run new when VS Code CLI is missing (#3116)
• a465b43 Fix eslint-plugin/no-incorrect-meta-schema lint violations (#3112)
• 97985f6 refactor: extract getNameParamNode and improve type handling (#3107)
• 834c463 feat: extend require-default-prop and require-valid-default-prop to check...
• Additional commits viewable in compare view

Updates fast-check from 4.9.0 to 4.10.0

Release notes

Sourced from fast-check's releases.

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

• (PR#7216) Introduce a plugin API
• (PR#7221) Refine plugin API
• (PR#7222) Add ability to configure plugins globally
• (PR#7224) Add the beforeEach plugin to hook in life-cycle
• (PR#7227) Create an afterEach plugin
• (PR#7232) Deprecate life-cycle methods
• (PR#7235) Support teardown of beforeEach plugin
• (PR#7228) Add timeout plugin to stop long running predicates
• (PR#7237) Deprecate timeout from parameters
• (PR#7238) Pass a store to plugins
• (PR#7239) Add extra plugin's method called onAllRunsComplete
• (PR#7240) Deprecate reporter and asyncReporter from parameters
• (PR#7229) Add plugin to interrupt after time limit
• (PR#7245) Support failOnInterrupt on the plugin
• (PR#7230) Add plugins to drop runs on already covered cases
• (PR#7259) Add ability to decorate generate via Plugins
• (PR#7231) Add the unbiased plugin to generate without bias
• (PR#7260) Deprecate parameters superseded by plugins
• (PR#7261) Deprecate v5 removals

Fixes

• (PR#7225) Bug: Proper ordering between plugins
• (PR#7127) CI: Announce on Bluesky when drafting the release
• (PR#7217) CI: Dedupe packages for pnpm
• (PR#7137) Doc: Release note for 4.9.0
• (PR#7226) Doc: Fix admonition titles on the website
• (PR#7246) Doc: Add jkomyno as code contributor
• (PR#7251) Performance: Single timer for interruptAfterTimeLimit

---

Changelog

Sourced from fast-check's changelog.

4.10.0

New plugin API and deprecations ahead of v5 [Code][Diff]

Features

• (PR#7216) Introduce a plugin API
• (PR#7221) Refine plugin API
• (PR#7222) Add ability to configure plugins globally
• (PR#7224) Add the beforeEach plugin to hook in life-cycle
• (PR#7227) Create an afterEach plugin
• (PR#7232) Deprecate life-cycle methods
• (PR#7235) Support teardown of beforeEach plugin
• (PR#7228) Add timeout plugin to stop long running predicates
• (PR#7237) Deprecate timeout from parameters
• (PR#7238) Pass a store to plugins
• (PR#7239) Add extra plugin's method called onAllRunsComplete
• (PR#7240) Deprecate reporter and asyncReporter from parameters
• (PR#7229) Add plugin to interrupt after time limit
• (PR#7245) Support failOnInterrupt on the plugin
• (PR#7230) Add plugins to drop runs on already covered cases
• (PR#7259) Add ability to decorate generate via Plugins
• (PR#7231) Add the unbiased plugin to generate without bias
• (PR#7260) Deprecate parameters superseded by plugins
• (PR#7261) Deprecate v5 removals

Fixes

• (PR#7225) Bug: Proper ordering between plugins
• (PR#7127) CI: Announce on Bluesky when drafting the release
• (PR#7217) CI: Dedupe packages for pnpm
• (PR#7137) Doc: Release note for 4.9.0
• (PR#7226) Doc: Fix admonition titles on the website
• (PR#7246) Doc: Add jkomyno as code contributor
• (PR#7251) Performance: Single timer for interruptAfterTimeLimit

---

Commits

• 4fba17d 🔖 Update CHANGELOG.md for fast-check@4.10.0, @​fast-check/jest@​2.3.0, @​fast-ch...
• a433d8b ⬆️ Update dependency @​types/node to ^24.13.4 (#7263)
• 8470c46 ⬆️ Update dependency @​microsoft/api-extractor to ^7.59.1 (#7255)
• 5382221 🗑️ Deprecate v5 removals (#7261)
• 3cc3696 🗑️ Deprecate parameters superseded by plugins (#7260)
• a93374d ✨ Add the unbiased plugin to generate without bias (#7231)
• 0f1bf99 ✨ Add ability to decorate generate via Plugins (#7259)
• 917a447 ✨ Add plugins to drop runs on already covered cases (#7230)
• 32daf74 ⚡️ Single timer for interruptAfterTimeLimit (#7251)
• 485f337 👥 Add jkomyno as code contributor (#7246)
• Additional commits viewable in compare view

Updates happy-dom from 20.14.0 to 20.14.3

Release notes

Sourced from happy-dom's releases.

v20.14.3

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #2363

v20.14.2

👷‍♂️ Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #2344

v20.14.1

👷‍♂️ Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #2366

Commits

• 5fb1df3 fix: #2363 Avoids cloning all properties in CSSPropertyManager.toString() (...
• de0a1e9 fix: #2344 Resolve every var() in a value, not only the first one (#2395)
• 64b8b94 fix: #2366 Invalidate the computed style cache for the whole subtree (#2367)
• See full diff in compare view

Updates playwright from 1.62.1 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates typescript-eslint from 8.69.0 to 8.70.0

Release notes

Sourced from typescript-eslint's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.70.0 (2026-09-07)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml