Skip to content

chore(deps): Bump the npm group across 1 directory with 16 updates - #62

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-804a2e8819
Open

chore(deps): Bump the npm group across 1 directory with 16 updates#62
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-804a2e8819

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group with 16 updates in the / directory:

Package From To
@primer/octicons-react 19.40.0 19.42.0
dompurify 3.4.16 3.4.17
hono 4.13.13 4.13.16
@axe-core/playwright 4.13.0 4.14.0
@cloudflare/vitest-plugin 1.4.0 1.6.0
@cloudflare/workers-types 5.20261011.1 5.20261104.1
@playwright/test 1.63.0 1.64.1
@vitest/eslint-plugin 1.6.27 1.6.28
autoprefixer 10.6.1 10.6.2
eslint 10.12.0 10.14.0
globals 17.13.0 17.14.0
postcss 8.5.29 8.5.32
typescript-eslint 8.71.1 8.72.1
vite 8.3.4 8.3.6
vitest 5.0.3 5.1.0
wrangler 4.149.0 4.158.0

Updates @primer/octicons-react from 19.40.0 to 19.42.0

Release notes

Sourced from @​primer/octicons-react's releases.

@​primer/octicons-react@​19.42.0

Minor Changes

  • #1381 d25ce68df9d08abd65431a8a48b45446432f1b45 Thanks @​edokoa! - Add the 16px git-draft-agent, git-pull-request-agent, check-agent, git-que-merge-agent, git-closed-agent, and git-merge-agent icons for agent-assisted draft, open, ready-to-merge, queued, closed, and merged pull request states.

@​primer/octicons-react@​19.41.0

Minor Changes

Commits

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

  • Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
  • Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
  • Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
  • Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
  • Added a purify-edge test runner as a compatibility check, thanks @​anzal1
  • Clarified the IN_PLACE documentation in the README about possible risks
  • Updated several dependencies
Commits

Updates hono from 4.13.13 to 4.13.16

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

  • fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

Full Changelog: honojs/hono@v4.13.14...v4.13.15

v4.13.14

What's Changed

... (truncated)

Commits
  • c91b60a 4.13.16
  • e1dd588 fix(jwt): reject a signature segment outside the base64url alphabet and a hea...
  • bf16471 Merge commit from fork
  • d88fab3 Merge commit from fork
  • 34f9043 Merge commit from fork
  • 8a103aa Merge commit from fork
  • 15bbd96 Merge commit from fork
  • 3cb29de 4.13.15
  • 17ad0e2 fix(context): allow c.header() after the response body is consumed (#5587)
  • ee88684 docs(contributing): drop the note about linking a fork branch (#5593)
  • Additional commits viewable in compare view

Updates @axe-core/playwright from 4.13.0 to 4.14.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.14.0

What's Changed

New Contributors

Full Changelog: dequelabs/axe-core-npm@v4.13.0...v4.14.0

Changelog

Sourced from @​axe-core/playwright's changelog.

4.14.0 (2026-10-06)

Bug Fixes

Features

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates @cloudflare/vitest-plugin from 1.4.0 to 1.6.0

Release notes

Sourced from @​cloudflare/vitest-plugin's releases.

@​cloudflare/vitest-plugin@​1.6.0

Minor Changes

  • #16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

    Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

    In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

  • #16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

    These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

  • #16700 dc35efb Thanks @​cjol! - Bump bundled devalue from 5.6.3 to 5.9.3 to pick up security fixes

    devalue is bundled into these packages, which use it to serialise values between Node.js and workerd. Version 5.6.3 is affected by several published advisories, and 5.9.3 includes their fixes. Serialisation behaviour does not change.

  • #16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

    These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

  • #16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, fa3edb3, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:

@​cloudflare/vitest-plugin@​1.5.1

Patch Changes

  • #16670 b14b9dc Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16609 da26b7f Thanks @​gpanders! - Fix tests failing to start with resolve.preserveSymlinks in isolated node_modules layouts

    With resolve.preserveSymlinks: true in a pnpm project, tests failed to start with No such module ".../node_modules/vitest/dist/chai", because a package's own dependencies are linked only next to its real path. Packages linked from a store inside node_modules now load from their real paths, and other files keep their symlinked paths.

  • Updated dependencies [b14b9dc, 44d1ee4, b14b9dc, d2eda1c, 2750917, 34f34b3]:

@​cloudflare/vitest-plugin@​1.5.0

Minor Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-plugin's changelog.

1.6.0

Minor Changes

  • #16186 f1d81a2 Thanks @​leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

    Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

    In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

  • #16700 dc35efb Thanks @​cjol! - Bump bundled brace-expansion to pick up security fixes

    These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

  • #16700 dc35efb Thanks @​cjol! - Bump bundled devalue from 5.6.3 to 5.9.3 to pick up security fixes

    devalue is bundled into these packages, which use it to serialise values between Node.js and workerd. Version 5.6.3 is affected by several published advisories, and 5.9.3 includes their fixes. Serialisation behaviour does not change.

  • #16700 dc35efb Thanks @​cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

    These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

  • #16695 b2061f4 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • Updated dependencies [dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, dc35efb, b8387a5, fa3edb3, 4cde694, b2061f4, b2061f4, f1d81a2, 4bb491b, 36e64f2, 92c4b97]:

1.5.1

Patch Changes

  • #16670 b14b9dc Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-03

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16609 da26b7f Thanks @​gpanders! - Fix tests failing to start with resolve.preserveSymlinks in isolated node_modules layouts

    With resolve.preserveSymlinks: true in a pnpm project, tests failed to start with No such module ".../node_modules/vitest/dist/chai", because a package's own dependencies are linked only next to its real path. Packages linked from a store inside node_modules now load from their real paths, and other files keep their symlinked paths.

  • Updated dependencies [b14b9dc, 44d1ee4, b14b9dc, d2eda1c, 2750917, 34f34b3]:

1.5.0

... (truncated)

Commits

Updates @cloudflare/workers-types from 5.20261011.1 to 5.20261104.1

Commits

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • Additional commits viewable in compare view

Updates @vitest/eslint-plugin from 1.6.27 to 1.6.28

Release notes

Sourced from @​vitest/eslint-plugin's releases.

v1.6.28

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • c5df105 chore: release v1.6.28
  • 8eb6991 fix(parse-vitest-fn-call): recognize member-form hooks like test.aroundAll ...
  • e2aaac6 fix(prefer-describe-function-title): ignore type-only imports (#957)
  • 4c0ae5a fix(prefer-spy-on): pass an implementation to mockImplementation in the fix (...
  • a6acf78 fix(prefer-comparison-matcher): skip non-numeric operands with typecheck (#984)
  • 743f81f fix(unbound-method): account for optional chaining (#975)
  • 8bdb180 docs: typo in prefer-to-contain rule docs (#973)
  • 0bea6e1 refactor(valid-expect): remove unneeded conditions and use optional chaining ...
  • b3636d8 docs(consistent-test-it): fixed the description of the consistent-test-it opt...
  • 22d672a chore: Update TypeScript version to v6 (#945)
  • Additional commits viewable in compare view

Updates autoprefixer from 10.6.1 to 10.6.2

Release notes

Sourced from autoprefixer's releases.

10.6.2

  • Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
  • Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
  • Fixed selector duplicates on multiple Autoprefixer runs.
  • Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
  • Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
  • Fixed source maps for Grid prefixes (by @​dualfroz).
Changelog

Sourced from autoprefixer's changelog.

10.6.2

  • Added /* autoprefixer: ignore next warning */ (by @​dualfroz).
  • Fixed losing unprefixed selectors in old browsers in grouping (by @​ybai08).
  • Fixed selector duplicates on multiple Autoprefixer runs.
  • Fixed case-insensitive pseudo-selector prefixing (by @​jakezwang).
  • Fixed -webkit-cross-fade() for images with numbers (by @​mkantautas).
  • Fixed source maps for Grid prefixes (by @​dualfroz).
Commits
  • a7dbf4d Release 10.6.2 version
  • c3cd98d Fix selector duplicates on multiple Autoprefixer runs
  • 5ae399e Keep unprefixed selectors in prefixed grouping rules (#1561)
  • 50ca3e2 Fix -webkit-cross-fade() for images with numbers (#1562)
  • 0efb61b Add /* autoprefixer: ignore next warning */ control comment (#1560)
  • 7ca1fad Set source for Grid prefixes in source maps (#1559)
  • c6d89bc Fix case-insensitive pseudo-selector prefixing (#1558)
  • See full diff in compare view

Updates eslint from 10.12.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

  • d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

  • 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
  • 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
  • 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
  • 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
  • 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
  • cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
  • 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

  • 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
  • dab466e docs: Update README (GitHub Actions Bot)
  • 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
  • 7697550 docs: Update README (GitHub Actions Bot)

@dependabot
chore(deps): Bump the npm group across 1 directory with 16 updates
5cd448e 
Bumps the npm group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@primer/octicons-react](https://github.com/primer/octicons) | `19.40.0` | `19.42.0` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.16` | `3.4.17` |
| [hono](https://github.com/honojs/hono) | `4.13.13` | `4.13.16` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` |
| [@cloudflare/vitest-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-plugin) | `1.4.0` | `1.6.0` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261011.1` | `5.20261104.1` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [@vitest/eslint-plugin](https://github.com/vitest-dev/eslint-plugin-vitest) | `1.6.27` | `1.6.28` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.6.1` | `10.6.2` |
| [eslint](https://github.com/eslint/eslint) | `10.12.0` | `10.14.0` |
| [globals](https://github.com/sindresorhus/globals) | `17.13.0` | `17.14.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.29` | `8.5.32` |
| [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.71.1` | `8.72.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.4` | `8.3.6` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.1.0` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.149.0` | `4.158.0` |



Updates `@primer/octicons-react` from 19.40.0 to 19.42.0
- [Release notes](https://github.com/primer/octicons/releases)
- [Changelog](https://github.com/primer/octicons/blob/main/CHANGELOG.md)
- [Commits](https://github.com/primer/octicons/compare/@primer/octicons-react@19.40.0...@primer/octicons-react@19.42.0)

Updates `dompurify` from 3.4.16 to 3.4.17
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.16...3.4.17)

Updates `hono` from 4.13.13 to 4.13.16
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.13...v4.13.16)

Updates `@axe-core/playwright` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0)

Updates `@cloudflare/vitest-plugin` from 1.4.0 to 1.6.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-plugin/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-plugin@1.6.0/packages/vitest-plugin)

Updates `@cloudflare/workers-types` from 5.20261011.1 to 5.20261104.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@playwright/test` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `@vitest/eslint-plugin` from 1.6.27 to 1.6.28
- [Release notes](https://github.com/vitest-dev/eslint-plugin-vitest/releases)
- [Commits](vitest-dev/eslint-plugin-vitest@v1.6.27...v1.6.28)

Updates `autoprefixer` from 10.6.1 to 10.6.2
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.6.1...10.6.2)

Updates `eslint` from 10.12.0 to 10.14.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.12.0...v10.14.0)

Updates `globals` from 17.13.0 to 17.14.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.13.0...v17.14.0)

Updates `postcss` from 8.5.29 to 8.5.32
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.29...8.5.32)

Updates `typescript-eslint` from 8.71.1 to 8.72.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.72.1/packages/typescript-eslint)

Updates `vite` from 8.3.4 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `vitest` from 5.0.3 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

Updates `wrangler` from 4.149.0 to 4.158.0
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.158.0/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@primer/octicons-react"
  dependency-version: 19.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: dompurify
  dependency-version: 3.4.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: hono
  dependency-version: 4.13.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@cloudflare/vitest-plugin"
  dependency-version: 1.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261104.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@vitest/eslint-plugin"
  dependency-version: 1.6.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: autoprefixer
  dependency-version: 10.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: eslint
  dependency-version: 10.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: globals
  dependency-version: 17.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: postcss
  dependency-version: 8.5.32
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: typescript-eslint
  dependency-version: 8.72.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: wrangler
  dependency-version: 4.158.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from matbrgz as a code owner November 8, 2026 15:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@matbrgz matbrgz Awaiting requested review from matbrgz matbrgz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants