chore(deps): bump the pnpm-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the pnpm-dependencies group with 7 updates in the / directory:

Package	From	To
@types/node	26.4.0	26.5.1
knip	6.32.3	6.35.1
tsx	4.23.12	4.23.13
vite-plus	0.3.0	0.3.1
fastify	5.12.1	5.12.4
vue-router	5.3.0	5.3.1
@playwright/test	1.62.1	1.63.0

Updates @types/node from 26.4.0 to 26.5.1

Commits

• See full diff in compare view

Updates knip from 6.32.3 to 6.35.1

Release notes

Sourced from knip's releases.

Release 6.35.1

• Exit with code 2 when a plugin config file fails to load (#1947) (37b26426694380ef70ee45f63358faf63355a58d) - thanks @​WooWan!
• Fix sponsorship income calculations (0d9cf344b8cc0104c06d11e2c78f3f01b1df548b)
• Update sponsors page (2659063d87f558b4fc18369a4b143849eaa7543e)
• Fix npm alias attribution under Yarn PnP (resolve #2024) (7be11aa4fd50b8a3d6e276f03efb450d6d142c26)

Release 6.35.0

• fix: track pnpm workspace override catalogs (#1999) (c6497a18c6534ee914b27bb459d7778a7b93a914) - thanks @​gioboa!
• fix: track spreads under string-literal keys (#2003) (9ce68ed42a3c22fa4f4711b06d6d80a0e7f2ba13) - thanks @​gioboa!
• fix: don't flag a tag that suppresses member issues (#2004) (2e7d498cf1e53f0bbad5e16c335c5e1417432ffd) - thanks @​devYRPauli!
• fix: resolve Nuxt Virtual Component Imports (#2006) (a21f972ed68aaa6d145dd883b4ce4d68c71e6afb) - thanks @​gioboa!
• Update raw transfer problems doc with low RAM machines (#2014) (31789404cca5a8ba119b4ae97b959b7e2c595345) - thanks @​s-h-a-d-o-w!
• fix: recognize pnpm stage as built-in (#2015) (aaab35a948b458e3031989c13c13d099fdd6f229) - thanks @​gioboa!
• fix: support object-form Rstest test environments (#2010) (6c27aab20de5b6d31d71513b016548e74fc494ba) - thanks @​gioboa!
• fix: honor explicit entry export analysis (#2012) (a092e4075a6a37107c0da05c8e59343d5a7c8fab) - thanks @​gioboa!
• Document that pnpm.overrides is read from the root manifest only (f69a7f6d4fa2c68f76a9ba91fb876c5963a9e978)
• Compile source on demand (resolve #1906) (3662c9545e8bb980a5503fdea48ecc6f7e2ad3b3)
• Update dependency bun to v1.4.2 (#2019) (90b384da25203c07acb9303336622f794d77b575) - thanks @​renovate[bot]!
• feat: support configuring preprocessors in knip.json (#1920) (16d03f75ae752cb419684868ff14d89b01e84e62) - thanks @​bytedoe!
• Fix Windows paths in cache persistence and test fixtures (a4c7a93a81e04afde09d7977298b397cee9a68c2)
• fix: add a fallback to seach for lock file at cwd if its missing at the root level (#2020) (f66c9f1631347f0256f2276748de89b0d8448017) - thanks @​JayaKrishnaNamburu!
• fix: ignore raw Vite import globs (#2017) (75d56286b41ba3e3b4aad53b603736ec357fac75) - thanks @​gioboa!
• Edit docs re. cycles issue type/reporter (resolve #2021) (f1e690b5a4d8f2b3d13388aa3a95216b9691becb)
• Update dependencies (e2bd3fcc2274b52d35adf0eaec2c555d74873433)
• Resolve Vite public script entries (resolve #2023) (1cc979b7e37a4dcde5e8e9e75a8d79cf663c606e)
• Add mise plugin (resolve #2001) (db6d8919af4e870432cdda205e6271a166c84645)
• Add editor severity setting for diagnostics (resolve #1955) (4afbbcf8b16454a1d1c201d50cf8e8bd28d2cb91)

Release 6.34.0

• fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
• 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
• Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
• Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
• Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
• Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
• fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
• fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
• Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
• Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
• Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
• Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

• Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
• Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
• Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
• Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
• Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
• Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
• fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!

... (truncated)

Commits

• 68a5344 Release knip@6.35.1
• 7be11aa Fix npm alias attribution under Yarn PnP (resolve #2024)
• 37b2642 Exit with code 2 when a plugin config file fails to load (#1947)
• c2d652c Release knip@6.35.0
• 4afbbcf Add editor severity setting for diagnostics (resolve #1955)
• db6d891 Add mise plugin (resolve #2001)
• 1cc979b Resolve Vite public script entries (resolve #2023)
• e2bd3fc Update dependencies
• 75d5628 fix: ignore raw Vite import globs (#2017)
• a4c7a93 Fix Windows paths in cache persistence and test fixtures
• Additional commits viewable in compare view

Updates tsx from 4.23.12 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• See full diff in compare view

Updates vite-plus from 0.3.0 to 0.3.1

Release notes

Sourced from vite-plus's releases.

vite-plus v0.3.1: manage package-manager versions with vp env

vp env now manages Node.js and package-manager versions together. This release also fixes TanStack Start routing and stale Vitest aliases.

Breaking Changes

Package-manager setup

Vite+ replaces Corepack with managed npm, pnpm, yarn, and bun commands. It removes the corepack shim and legacy global package-manager installations (#2391), by @​liangmiQwQ.

Replace Corepack setup commands in shell profiles, CI jobs, and Dockerfiles:

Previous setup	Replacement
corepack enable	vp env setup
vp install -g pnpm@<version>	vp env default pnpm@<version>
vp install -g yarn@<version>	vp env default yarn@<version>
vp install -g bun@<version>	vp env default bun@<version>
vp install -g corepack	Use the managed package-manager commands directly

Use vp env pin <manager>@<version> to set a project version.

vp env command scope and JSON output

Unscoped vp env commands now operate on Node.js and package managers. Package managers support independent defaults, project pins, session overrides, and installation commands (#2398), by @​liangmiQwQ.

Add node to limit an operation to Node.js, for example, vp env off node or vp env unpin node. Bare versions, such as vp env default 22.19.0, still select Node.js.

Update scripts that read JSON output:

Command	New output structure
vp env current --json	node and package_manager objects
vp env list --json, vp env list-remote --json	node and package_managers groups

See the environment guide.

vp pack migration to tsdown@0.23

vp pack now uses tsdown@0.23, which removes deprecated options and changes defaults (#2614), by @​fengmk2.

1. Run vp migrate to update supported static configurations and package scripts, including projects that already use Vite+.
2. Check migration warnings in vite.config.*, tsdown.config.*, and package.json.
3. Update dynamic configurations manually. Arrays built with .map() require manual changes, even when migration reports no warning.
4. Run vp pack to check the result.

Previous option	Replacement
bundle: false	unbundle: true
outExtension	outExtensions
publicDir / --public-dir	copy / --copy

... (truncated)

Commits

• 13e1e5a release: v0.3.1: manage package-manager versions with vp env (#2623)
• 0931d9b fix(cli): share Vite runtime through the core alias (#2617)
• 3bbae42 feat(migrate): upgrade pack config for tsdown 0.23 (#2614)
• 7123545 chore(deps): update dependency voidzero-dev/setup-vp to v1.19.0 (#2619)
• b87593c fix(cli): recover from stale Vitest aliases (#2605)
• 21f6c42 ci: gate npm publishes on dependency propagation (#2601)
• 809d8b8 feat(deps): upgrade upstream dependencies (#2613)
• 585353f docs: fix Zed Oxc configuration (#2592)
• 4f97f30 feat(cli): expose dependency alignment plans (#2600)
• 03b659c feat(cli): add --quiet to vp check (#2593)
• Additional commits viewable in compare view

Updates fastify from 5.12.1 to 5.12.4

Release notes

Sourced from fastify's releases.

v5.12.4

Fixed the fastify.js version mismatch.

Full Changelog: fastify/fastify@v5.12.2...v5.12.4

v5.12.2

⚠️ Security release

• Fix for GHSA-9q9j-q6p8-xq58
• Fix for GHSA-hwr6-493r-vm6h
• Fix for GHSA-p68q-wchp-6fh7
• Fix for GHSA-667r-xxjv-c9mm

What's Changed

• [Backport 5.x] fix: callNotFound should run not-found preHandler regardless of registration order by @​github-actions[bot] in fastify/fastify#6973
• [Backport 5.x] chore: npm ignore remaining agent files by @​github-actions[bot] in fastify/fastify#7003

Full Changelog: fastify/fastify@v5.12.1...v5.12.2

Commits

• 1690e35 Bumped v5.12.4
• 1c991c4 Bumped v5.12.3
• 942a2be Bumped v5.12.2
• 853f6e2 test(validation): cover normalization and async branches
• f02d8d4 fix(validation): do not unwrap async validator results
• 93c239a fix: reject malformed URLs before custom 404 handlers
• 7de6e81 fix(validation): compile boolean false request schemas
• 179619c fix(validation): normalize header names in every schema subschema
• dd2ba36 [Backport 5.x] chore: npm ignore remaining agent files (#7003)
• e305d84 [Backport 5.x] fix: callNotFound should run not-found preHandler regardless o...
• See full diff in compare view

Updates vue-router from 5.3.0 to 5.3.1

Release notes

Sourced from vue-router's releases.

v5.3.1

   🐞 Bug Fixes

• experimental: Handle non-string params for isActive  -  by @​posva (92cfd)

    View changes on GitHub

Commits

• 9a66989 release: vue-router@5.3.1
• 4fa1401 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 in the actions group (#2795)
• 92cfd6f fix(experimental): handle non-string params for isActive
• See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions