build(deps): bump the application-dependencies group across 1 directory with 16 updates

[dependabot]

Bumps the application-dependencies group with 16 updates in the / directory:

Package	From	To
penpal	7.0.6	8.0.1
react-router	7.18.4	8.4.0
@types/node	24.12.4	26.6.4
@vitejs/plugin-react	6.1.1	6.1.2
eslint	10.10.0	10.12.0
eslint-plugin-react-refresh	0.5.6	0.5.7
globals	17.12.0	17.13.0
hardhat	3.12.0	3.18.1
jsdom	30.0.1	30.1.2
prettier	3.9.6	3.9.9
solc	0.8.30	0.8.37
typescript	6.0.3	7.0.2
typescript-eslint	8.70.0	8.71.0
viem	2.52.2	2.57.3
vite	8.3.0	8.3.2
vitest	5.0.0	5.0.3

Updates penpal from 7.0.6 to 8.0.1

Release notes

Sourced from penpal's releases.

v8.0.1

• Corrects logging so received remote method replies are labeled as replies instead of calls.

v8.0.0

Version 8 is here! This version primarily focuses on eliminating memory leaks and reducing file size (roughly 10% smaller) by removing backward-compatibility baggage.

Migration

A Penpal participant (e.g., window, iframe, worker) running version 8 will not be able to communicate with a participant running Penpal version 6 or older. However, a Penpal participant running version 8 can communicate successfully with a participant running Penpal version 7. Plan accordingly when upgrading.

Breaking changes

Destroying a pending connection now rejects its promise

What

Calling connection.destroy() before the handshake completes now rejects connection.promise with a PenpalError whose code is CONNECTION_DESTROYED. The same rejection occurs when the remote participant destroys a pending connection. Previously, the promise could remain pending indefinitely.

Code that intentionally destroys pending connections should handle that rejection. See Destroying the Connection.

Why

If an application using the previous version of Penpal were to destroy the Penpal connection by calling connection.destroy() while the connection was still being established, Penpal would leave the connection promise (connection.promise) unresolved (neither fulfilled nor rejected). This was a conscious design choice (and a deviation from the original design) because handling a rejected promise in this scenario can be annoying to deal with as reported in Aaronius/penpal#51. However, this was a poor design choice, since leaving the promise unresolved can cause memory leaks. This is described by @​cimak in Aaronius/penpal#51. It is better to reject the promise than to leave the promise unresolved.

Exposed methods must be defined directly on the methods object

What

Penpal version 8 only allows remote callers to invoke methods defined directly on the object passed to connect, including its nested objects. It no longer searches the object's prototype chain.

Most applications already use this pattern and require no changes:

connect({
  messenger,
  methods: {
    add(a, b) {
      return a + b;
    },
    account: {
      getName() {
        return 'Alice';
      },
    },
  },
});

The main case affected is passing a class instance directly. Class methods normally live on the class prototype, so this no longer exposes add:

... (truncated)

Commits

• 789a51d Prepare v8.0.1
• c3e9783 Fix reply debug message
• d71816f Enable debugging in examples
• 4d39dfc Publish examples with GitHub Pages
• 8546aa9 Clarify example method results
• 664c15a Make examples easier to follow
• c2a2fb9 Prepare v8.0.0
• 73e8689 Harden v8 release preparation
• caefec7 Merge remote-tracking branch 'origin/main' into 8.x
• 8e5df8f Bring examples into the main repository
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for penpal since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates react-router from 7.18.4 to 8.4.0

Release notes

Sourced from react-router's releases.

v8.4.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v840

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

v8.3.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v830

v8.2.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v820

v8.1.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v810

v8.0.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v801

v8.0.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v800

Changelog

Sourced from react-router's changelog.

v8.4.0

Minor Changes

• Deprecate the createStaticRouter({ branches }) option (#15297)
  • createStaticRouter now caches route branches internally, ignores branches, and logs a deprecation warning when the option is provided
  • The deprecated EntryContext.branches property remains available for compatibility but is always an empty array

Patch Changes

• Prevent stale route discovery during manifest version-mismatch recovery (#15489)
  • Keep concurrent manifest responses pending while a document reload is in progress
  • Report a discovery error when a previous reload failed to resolve a version mismatch instead of loading a stale route or reloading repeatedly
  • Fail pending requests if a document reload does not complete within five seconds or the document is restored from the back-forward cache, allowing subsequent requests to recover
• Preserve lazy route module import errors during SPA navigations instead of replacing them with a missing dataStrategy result error (#15464)
• Switch to more granular internal router contexts to avoid unnecessary route component re-renders when unrelated data router state changes (#15376)
  • ⚠️ This contains some breaking changes to exported UNSAFE_ contexts, so please review carefully if you are using those unsafe exports
• Correctly escape streamed RSC redirect locations in meta tag attributes (#15491)
• Avoid unintended document.startViewTransition calls during initial hydration and router.revalidate() calls (#15484)
• Fix SingleFetchNoResultError thrown when a fetcher revalidates against a splat route during lazy route discovery (#15395)
  • Track discovery per fetcher load so revalidation waits for the current load's discovery, even when the fetcher key is reused, while still restarting interrupted loaders after discovery completes
• Preserve the underlying decode failure as the cause of the Unable to decode turbo-stream response error (#15450)

Unstable Changes

⚠️ Unstable features are not recommended for production use

• Add a Data Mode future.unstable_routePatternMatching flag for more efficient route matching powered by @remix-run/route-pattern (#15298)
  • Add an unstable_validateParams route field to reject invalid parameter values and continue matching
• Document access control requirements for RSC Server Functions (#15490)
  • Treat every Server Function as a public endpoint that must perform all of its own access control checks
  • Recommend route actions when access control should be provided by route middleware

v8.3.1

Patch Changes

• Fix Expected fetcher: <key> error thrown on navigation when a fetcher is aborted during its post-action revalidation (#15365)
• Fix lazy route discovery caching a path as discovered when the triggering navigation was aborted after the manifest response settled but before the route tree was patched, which permanently (for the session) shadowed the real route behind a catch-all or produced 404s on every subsequent visit (#15399)
• Improve route matching performance for long paths (#15417)
• Improve validation of action request origins (#15419)
• Fix <ScrollRestoration> leaving history.scrollRestoration set to "auto" after a bfcache restore, which let the browser restore scroll on subsequent history traversals before the destination route had rendered (#15397)
• Properly respect the relative option in useSubmit/fetcher.submit when resolivng the action path (#15400)
• Add additional URL validation on client side navigations/redirects (#15445)

v8.3.0

Patch Changes

• Encode path params in href/generatePath per RFC 3986 path-segment rules instead of encodeURIComponent (#15310)

... (truncated)

Commits

• 7ccdcec Release v8.4.0 (#15496)
• dc95459 Prepare v8.4.0 release notes
• 5fe40ed Fix change file
• f329d4b Skip view transitions on revalidation and initial hydration (#15484)
• 34ffffb Preload the route-pattern matcher before opting in (#15506)
• 4091c34 Document RSC server function access control (#15490)
• 6f2a0e0 Restore upstream route-pattern dependency (#15505)
• 10908b2 docs: fix router comment spelling (#15495)
• acf1f20 Fix empty terminating splats with route-pattern matching (#15499)
• c58d715 Fix HTML attribute escaping for RSC redirects (#15491)
• Additional commits viewable in compare view

Updates @types/node from 24.12.4 to 26.6.4

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.1 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Commits

• ac47648 release: plugin-react@6.1.2 (#1491)
• 98277e7 fix(deps): update all non-major dependencies (#1486)
• 12eddea fix(hmr): better handle compound components (#1484)
• 3cfb1d1 fix(plugin-react): fix compiler.logDiagnostics (#1483)
• 6de9915 fix(plugin-react): disable refresh for non-jsx with compiler enabled (#1485)
• ee97d2f fix(deps): update all non-major dependencies (#1445)
• b0a014d chore: use Babel 8 for babel compiler playgrounds (#1460)
• 61b650f fix(deps): update react-related dependencies (#1452)
• 736efe2 chore(deps): update tsdown to v0.23 (#1451)
• See full diff in compare view

Updates eslint from 10.10.0 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

• 4618052 feat: handle astral letters in new-cap (#21357) (sary)
• 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
• efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
• 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
• 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
• b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
• 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
• 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

• 67eb586 docs: Update README (GitHub Actions Bot)
• 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
• 8816c1d docs: Update README (GitHub Actions Bot)
• 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

• 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
• bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
• d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
• 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
• 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
• 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
• f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
• b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
• 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

... (truncated)

Commits

• a438ec3 10.12.0
• 32a73f1 Build: changelog update for 10.12.0
• bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
• bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
• 152067f chore: update ecosystem plugins (#21362)
• b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
• 67eb586 docs: Update README
• bfaea12 perf: cache normalized config globals per languageOptions (#21364)
• 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
• d166567 chore: update dependency prettier to v3.9.9 (#21371)
• Additional commits viewable in compare view

Updates eslint-plugin-react-refresh from 0.5.6 to 0.5.7

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

Commits

• fd40d83 Add allowCompoundComponents option [publish] (#117)
• See full diff in compare view

Updates globals from 17.12.0 to 17.13.0

Release notes

Sourced from globals's releases.

v17.13.0

• Update globals (2026-10-01) (#354) b007369

---

sindresorhus/globals@v17.12.0...v17.13.0

Commits

• ce512bc 17.13.0
• b007369 Update globals (2026-10-01) (#354)
• 16cb1fe Meta tweaks
• See full diff in compare view

Updates hardhat from 3.12.0 to 3.18.1

Release notes

Sourced from hardhat's releases.

Hardhat v3.18.1

This is a small bugfix release with fixes for simulated network predeploys and Solidity test error formatting.

Changes

• #8631 d014d43 Thanks @​Kropiunig! - Fixed edr-simulated networks with forking.enabled: false starting without the chain's predeploys (e.g. OP's GasPriceOracle and L1Block, or the L1 beacon roots and history storage contracts).

• #8636 8b24451 Thanks @​schaable! - Fixed the formatting of errors reported while running Solidity tests.

• Updated dependencies:

  • @​nomicfoundation/hardhat-utils@​4.4.0

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

Hardhat v3.18.0

This release includes two enhancements along with performance improvements and bug fixes: test profiles can now be used in Solidity tests, see our test profiles guide, and hardhat-mocha has been updated to mocha@12.

Changes

• #8590 e2ebf54 Thanks @​schaable! - Added Solidity test profiles, allowing test settings to vary across environments such as local development and CI.

• #8595 562cc0b Thanks @​ChristopherDedominici! - Made ethers derive secp256k1 public keys with EDR's native implementation instead of its pure-JS one, speeding up new Wallet(secretKey), Wallet.createRandom(), HD wallet derivation and computeAddress.

• #8624 1377eb0 Thanks @​ChristopherDedominici! - Updated mocha to ^12.0.0 in the hardhat --init mocha-ethers template project.

• #8574 e28e4f5 Thanks @​anaPerezGhiglia! - Removed the pre-Byzantium hardforks (chainstart, homestead, dao, tangerineWhistle, spuriousDragon) from the accepted hardfork and hardforkHistory values, as EDR cannot execute them.

• #8635 ad92657 Thanks @​popescuoctavian! - Upgraded EDR to v0.22.0.

• #8601 34087dd Thanks @​cdesch! - Improved HTTP proxy support.

• #8616 8b73917 Thanks @​rome-xi! - Fixed invalid HTTPS_PROXY/HTTP_PROXY values being reported as unexpected errors instead of a Hardhat error.

• Updated dependencies:

  • @​nomicfoundation/hardhat-errors@​3.1.0
  • @​nomicfoundation/hardhat-utils@​4.3.0

---

💡 The Nomic Foundation is hiring! Check our open positions.

---

Hardhat v3.17.0

This release includes a new default gas estimation mode for eth_estimateGas to prevent misleading results when internal calls run out of gas, as well as improved performance for test suites using ethers.

Changes

• #8501 5faee42 Thanks @​ChristopherDedominici! - Add gasEstimationMode config option to EDR networks, defaulting to a new "noInternalOutOfGas" mode to prevent misleading eth_estimateGas results when internal calls run out of gas.

... (truncated)

Changelog

Sourced from hardhat's changelog.

3.18.1

Patch Changes

• #8631 d014d43 Thanks @​Kropiunig! - Fixed edr-simulated networks with forking.enabled: false starting without the chain's predeploys (e.g. OP's GasPriceOracle and L1Block, or the L1 beacon roots and history storage contracts).

• #8636 8b24451 Thanks @​schaable! - Fixed the formatting of errors reported while running Solidity tests.

• Updated dependencies:

  • @​nomicfoundation/hardhat-utils@​4.4.0

3.18.0

Minor Changes

• #8574 e28e4f5 Thanks @​anaPerezGhiglia! - Removed the pre-Byzantium hardforks (chainstart, homestead, dao, tangerineWhistle, spuriousDragon) from the accepted hardfork and hardforkHistory values, as EDR cannot execute them.

• #8595 562cc0b Thanks @​ChristopherDedominici! - Made ethers derive secp256k1 public keys with EDR's native implementation instead of its pure-JS one, speeding up new Wallet(secretKey), Wallet.createRandom(), HD wallet derivation and computeAddress.

• #8590 e2ebf54 Thanks @​schaable! - Added Solidity test profiles, allowing test settings to vary across environments such as local development and CI.

Patch Changes

• #8635 ad92657 Thanks @​popescuoctavian! - Upgraded EDR to v0.22.0.

• #8601 34087dd Thanks @​cdesch! - Improved HTTP proxy support.

• #8616 8b73917 Thanks @​rome-xi! - Fixed invalid HTTPS_PROXY/HTTP_PROXY values being reported as unexpected errors instead of a Hardhat error.

• #8624 1377eb0 Thanks @​ChristopherDedominici! - Updated mocha to ^12.0.0 in the hardhat --init mocha-ethers template project.

• Updated dependencies:

  • @​nomicfoundation/hardhat-errors@​3.1.0
  • @​nomicfoundation/hardhat-utils@​4.3.0

3.17.0

Minor Changes

• #8501 5faee42 Thanks @​ChristopherDedominici! - Add gasEstimationMode config option to EDR networks, featuring a "noInternalOutOfGas" mode to prevent misleading eth_estimateGas results when internal calls run out of gas.

• #8580 8583e24 Thanks @​ChristopherDedominici! - Made ethers use EDR's native Keccak-256 instead of its pure-JS one.

• #8210 024b422 Thanks @​renovate! - Update the cryptography dependencies to their latest major versions: @noble/hashes and @noble/ciphers to 2, ethereum-cryptography to 3, and micro-eth-signer to 0.19.

Patch Changes

• #8596 0acd737 Thanks @​schaable! - Fixed configuration variables to stop printing of values in error messages.

• #8596 78f613c Thanks @​schaable! - Fixed error shown when an HD key cannot be derived, to only include the derivation path.

... (truncated)

Commits

• 72ad1cd Version Packages
• c5e2a26 test(solidity-test): derive the expected error code from its descriptor
• 8b24451 fix(solidity-test): print test run errors with the CLI error formatter
• 5b2999d refactor(hardhat-utils): move the Solidity integer type helpers out of hhu
• 83f7cf3 fix(deps): update npm minor/patch
• 943b38b Merge branch 'main' of github.com:NomicFoundation/hardhat into fix/disabled-f...
• 6e603be minor improvement
• c3bcf0a Version Packages
• 1e3938a Merge pull request #8590 from NomicFoundation/solidity-test-profiles
• bdcf4fe Merge pull request #8624 from NomicFoundation/update-mocha
• Additional commits viewable in compare view

Updates jsdom from 30.0.1 to 30.1.2

Release notes

Sourced from jsdom's releases.

v30.1.2

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
• Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
• Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
• Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
• Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
• Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

v30.1.1

• Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
• Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
• Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
• Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
• Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
• Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
• Fixed the storageQuota option being ignored by frames.
• Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
• Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
• Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
• Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
• Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

• Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
• Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
• Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
• Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
• Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
• Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
• Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
• Changed window.close() to preserve access to the document and its DOM through retained references.
• Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
• Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)

... (truncated)

Commits

• a23bfb7 30.1.2
• 64a75d2 Update dependencies and dev dependencies
• Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
signum	Error		Oct 8, 2026 3:17pm UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.