Bump the js-dependencies group with 15 updates

[dependabot]

Bumps the js-dependencies group with 15 updates:

Package	From	To
oxfmt	0.46.0	0.55.0
oxlint	1.34.0	1.70.0
stylelint	17.8.0	17.13.0
typescript	5.9.2	6.0.3
solid-js	1.9.3	1.9.13
@playwright/test	1.59.1	1.61.0
@types/bun	1.3.12	1.3.14
@astrojs/sitemap	3.7.2	3.7.3
@iconify-json/simple-icons	1.2.79	1.2.86
astro	6.1.8	6.4.8
@astrojs/check	0.9.8	0.9.9
@axe-core/playwright	4.11.2	4.11.3
sharp	0.35.1	0.35.2
@types/convict-format-with-validator	6.0.5	6.0.6
@anthropic-ai/sdk	0.104.1	0.105.0

Updates oxfmt from 0.46.0 to 0.55.0

Changelog

Sourced from oxfmt's changelog.

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

• 43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

• 6e8e818 oxfmt: Experimental .svelte support (#21700) (leaysgur)

[0.45.0] - 2026-04-13

🐛 Bug Fixes

• 50c389b oxfmt: Support .editorconfig quote_type (#20989) (leaysgur)

[0.44.0] - 2026-04-06

🐛 Bug Fixes

• dd2df87 npm: Export package.json for oxlint and oxfmt (#20784) (kazuya kawaguchi)
• 4216380 oxfmt: Support .editorconfig tab_width fallback (#20988) (leaysgur)

[0.43.0] - 2026-03-30

🚀 Features

• 6ef440a oxfmt: Support bool for object style options (#20853) (leaysgur)

... (truncated)

Commits

• aa79b5b release(apps): oxlint v1.70.0 && oxfmt v0.55.0 (#23442)
• 9a2788b feat(linter/unicorn): implement prefer-export-from rule (#22935)
• 44ae845 release(apps): oxlint v1.69.0 && oxfmt v0.54.0 (#23116)
• dadafe3 docs(oxlint, oxfmt): mention migrate skills in npm READMEs (#22965)
• f88961a docs(oxfmt): annotate each config option with supported languages (#22953)
• 964a758 release(apps): oxlint v1.68.0 && oxfmt v0.53.0 (#22883)
• 68b455d release(apps): oxlint v1.67.0 && oxfmt v0.52.0 (#22735)
• 16b8058 feat(oxfmt): Support vite-plus/resolveConfig for vite.config.ts (#22454)
• 5570206 release(apps): oxlint v1.66.0 && oxfmt v0.51.0 (#22528)
• 25e5cbc release(apps): oxlint v1.65.0 && oxfmt v0.50.0 (#22458)
• Additional commits viewable in compare view

Updates oxlint from 1.34.0 to 1.70.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

• 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
• 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
• bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
• 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
• 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
• 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
• ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

• 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
• 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
• 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
• 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
• a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
• ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
• 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
• ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
• e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
• 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
• 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
• fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
• ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
• dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
• 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
• cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

• 25d577e language_server: Start tools in parallel (#15500) (Sysix)
• 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
• 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
• 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
• 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
• 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

• 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
• 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
• a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
• 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
• 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
• 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.70.0] - 2026-06-15

🚀 Features

• 2e8bda4 linter/vue: Implement no-dupe-keys rule (#23350) (bab)
• 1490a0a linter/react: Implement react-compiler rule (#23202) (Boshen)
• dd560ae linter/unicorn: Implement no-array-fill-with-reference-type rule (#23397) (Mikhail Baev)
• af36c2f linter: Add schema for react/jsx-curly-brace-presence (#23400) (WaterWhisperer)
• 47d34a3 linter: Add schema for react/jsx-handler-names (#23393) (WaterWhisperer)
• f4250d0 linter: Add schema for unicorn/import-style (#23386) (WaterWhisperer)
• 30c74ce linter: Add schema for jsx_a11y/no-noninteractive-element-to-interactive-role (#23384) (Sysix)
• cfbe8dc linter: Add schema for jsx_a11y/no-interactive-element-to-noninteractive-role (#23382) (WaterWhisperer)
• d15b7ff linter: Add schema for typescript/no-restricted-types (#23381) (WaterWhisperer)
• 028a811 linter: Add schema for jsx-a11y/media-has-caption (#23377) (Sysix)
• b3b1038 linter: Add schema for jsx-a11y/label-has-associated-control (#23376) (Sysix)
• 7ada6b2 linter: Add schema for jsx_a11y/no-distracting-elements (#23379) (WaterWhisperer)
• ee3dd49 linter: Add schema for jsx-a11y/img-redundant-alt (#23374) (Sysix)
• df5f8dd linter: Add short descriptions to most lint rules. (#23365) (Connor Shea)
• e3fd735 linter: Add schema for jsx_a11y/alt-text (#23369) (Sysix)
• 0f2fff4 linter: Add schema for react/exhaustive-deps (#23372) (Mikhail Baev)
• e3e4e10 linter: Add schema for react_perf/jsx-no-new-object-as-prop (#23368) (Mikhail Baev)
• 9366d44 linter: Add schema for unicorn/prefer-at (#23366) (WaterWhisperer)
• f57b55d linter: Add schema for typescript/array-type (#23355) (Sysix)
• 0dcf912 linter: Add schema for typescript/ban-ts-comment (#23354) (Sysix)
• 51fa83e linter: Add schema for react/no-did-update-set-state (#23357) (Mikhail Baev)
• 59db0bd linter: Add schema for consistent-generic-constructors (#23353) (Sysix)
• c4775c0 linter: Add schema for typescript/consistent-type-assertions (#23349) (Sysix)
• 6e516f7 linter: Add schema for typescript/consistent-type-imports (#23348) (Sysix)
• 012134d linter: Add schema for react/jsx-no-target-blank (#23345) (WaterWhisperer)
• 0806aae linter: Add schema for jsx_a11y/no-noninteractive-tabindex (#23337) (Mikhail Baev)
• 0708b5a linter: Add schema for react/jsx-filename-extension (#23315) (Mikhail Baev)
• 150bce1 linter: Add schema for typescript/no-empty-object-type (#23309) (Sysix)
• f9e36f1 linter: Add schema for typescript/no-duplicate-type-constituents (#23308) (Sysix)
• 937accf linter: Add schema for typescript/no-invalid-void-type (#23307) (Sysix)
• 3e042b9 linter: Add schema for typescript/no-misused-promises (#23306) (Sysix)
• da212d1 linter: Add schema for typescript/no-unnecessary-condition (#23305) (Sysix)
• f8f0d38 linter: Add schema for typescript/parameter-properties (#23304) (Sysix)
• 2275fc7 linter: Add schema for typescript/prefer-nullish-coalescing (#23302) (Sysix)
• d353858 linter: Add schema for typescript/prefer-string-starts-ends-with (#23301) (Sysix)
• 03060f5 linter: Add schema for typescript/triple-slash-reference (#23300) (Sysix)
• 6619cee linter: Add schema for promise/param-names (#23298) (Sysix)
• 8bf108e linter: Add schema for promise/catch-or-return (#23297) (Sysix)
• 48158d0 linter: Add schema for vitest/consistent-each-for (#23294) (Sysix)
• 7e74c98 linter: Add schema for vitest/consistent-test-filename (#23293) (Sysix)
• ff94d4a linter: Add schema for vitest/consistent-vitest-vi (#23292) (Sysix)
• 2409a10 linter: Add schema for vitest/prefer-import-in-mock (#23291) (Sysix)
• 3d782b7 linter: Add schema for react/no-unstable-nested-components (#23287) (Mikhail Baev)
• 0a0bc2f linter/jsx-a11y: Add allowedRedundantRoles option to no-redundant-roles (#22820) (bab)
• 80758a5 linter/vue: Implement no-side-effects-in-computed-properties rule (#23282) (bab)
• e3869ac linter: Add schema for react/no-object-type-as-default-prop (#23279) (Mikhail Baev)

... (truncated)

Commits

• aa79b5b release(apps): oxlint v1.70.0 && oxfmt v0.55.0 (#23442)
• 5cb8d1b fix(linter/jsx-a11y/control-has-associated-label): reject excessive label dep...
• f682e25 docs(linter): remove manually written options doc for `eslint/prefer-arrow-ca...
• 2e8bda4 feat(linter/vue): implement no-dupe-keys rule (#23350)
• 64c942c docs(linter): remove manually written options doc for eslint/no-sequences (...
• 1490a0a feat(linter/react): implement react-compiler rule (#23202)
• 965358e refactor(linter): reuse RuleNoConfig reference for rule schema (#23390)
• dd560ae feat(linter/unicorn): implement no-array-fill-with-reference-type rule (#23...
• af36c2f feat(linter): add schema for react/jsx-curly-brace-presence (#23400)
• 47d34a3 feat(linter): add schema for react/jsx-handler-names (#23393)
• Additional commits viewable in compare view

Updates stylelint from 17.8.0 to 17.13.0

Release notes

Sourced from stylelint's releases.

17.13.0

It fixes 3 bugs, including a false negative one.

• Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#9324) (@​sarathfrancis90).
• Fixed: selector-max-type false positives for nested selectors (#9319) (@​romainmenke).
• Fixed: selector-type-no-unknown false positives for install (#9308) (@​Mouvedia).

17.12.0

It fixes 3 bugs, including a false negative one.

• Fixed: block-no-empty reported range when using comments (#9294) (@​romainmenke).
• Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@​romainmenke).
• Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@​romainmenke).

17.11.1

It fixes 2 bugs.

• Fixed: node_modules ignore for codeFilename paths containing a dot-prefixed directory (#9282) (@​tuhtah).
• Fixed: declaration-block-no-redundant-longhand-properties range for contiguous redundant longhand properties (#9273) (@​pamelalozano16).

17.11.0

It adds 2 features, including a loader property to referenceFiles: {} for when the order of appearance in the reference styles matters.

• Added: loader to experimental referenceFiles: {} (#9251) (@​romainmenke).
• Added: autofixed to the result object (#8771) (@​Rob--W).

17.10.0

It adds 3 rules and fixes 4 bugs. You can use the *-layout-mappings rules to enforce logical or physical properties, units and keywords.

• Added: selector-no-invalid rule (#9232) (@​jeddy3).
• Added: unit-layout-mappings rule (#9229) (@​jeddy3).
• Added: value-keyword-layout-mappings rule (#9233) (@​jeddy3).
• Fixed: inconsistent error messages when module is not found (#9260) (@​ybiquitous).
• Fixed: property-layout-mappings false negatives for property names in declaration values (#9222) (@​jeddy3).
• Fixed: property-layout-mappings false positives for @page properties (#9223) (@​jeddy3).
• Fixed: selector-pseudo-class-no-unknown false positives for nested webkit-scrollbar part (#9259) (@​rkdfx).

17.9.1

It fixes 4 bugs. We also documented the messageArgs each rule provides to the message configuration property.

• Fixed: ConfigurationError regression for custom syntaxes (#9245) (@​jeddy3).
• Fixed: MD5 hash algorithm to SHA256 for caching (#9241) (@​rkdfx).
• Fixed: property-no-deprecated autofix for page-break-*: always (#9214) (@​rkdfx).
• Fixed: selector-no-deprecated false positives for ::part() (#9227) (@​SaekiTominaga).

17.9.0

It adds 3 new features. Adding the referenceFiles property to your configuration object makes the no-unknown-animations, no-unknown-custom-media and no-unknown-custom-properties rules more useful.

• Added: experimental referenceFiles to configuration object (#9179) (@​jeddy3).
• Added: experimental abortSignal option to Node.js API for cancellation support (#9213) (@​adalinesimonian).

... (truncated)

Changelog

Sourced from stylelint's changelog.

17.13.0 - 2026-06-06

It fixes 3 bugs, including a false negative one.

• Fixed: declaration-block-no-duplicate-properties false negatives for interleaved non-consecutive duplicates with ignore: ["consecutive-duplicates(-*)"] (#9324) (@​sarathfrancis90).
• Fixed: selector-max-type false positives for nested selectors (#9319) (@​romainmenke).
• Fixed: selector-type-no-unknown false positives for install (#9308) (@​Mouvedia).

17.12.0 - 2026-05-20

It fixes 3 bugs, including a false negative one.

• Fixed: block-no-empty reported range when using comments (#9294) (@​romainmenke).
• Fixed: declaration-property-value-no-unknown false negatives for custom properties defined in reference files (#9292) (@​romainmenke).
• Fixed: value-keyword-layout-mappings false positives for caption-side (#9293) (@​romainmenke).

17.11.1 - 2026-05-14

It fixes 2 bugs.

• Fixed: node_modules ignore for codeFilename paths containing a dot-prefixed directory (#9282) (@​tuhtah).
• Fixed: declaration-block-no-redundant-longhand-properties range for contiguous redundant longhand properties (#9273) (@​pamelalozano16).

17.11.0 - 2026-05-05

It adds 2 features, including a loader property to referenceFiles: {} for when the order of appearance in the reference styles matters.

• Added: loader to experimental referenceFiles: {} (#9251) (@​romainmenke).
• Added: autofixed to the result object (#8771) (@​Rob--W).

17.10.0 - 2026-05-03

It adds 3 rules and fixes 4 bugs. You can use the *-layout-mappings rules to enforce logical or physical properties, units and keywords.

• Added: selector-no-invalid rule (#9232) (@​jeddy3).
• Added: unit-layout-mappings rule (#9229) (@​jeddy3).
• Added: value-keyword-layout-mappings rule (#9233) (@​jeddy3).
• Fixed: inconsistent error messages when module is not found (#9260) (@​ybiquitous).
• Fixed: property-layout-mappings false negatives for property names in declaration values (#9222) (@​jeddy3).
• Fixed: property-layout-mappings false positives for @page properties (#9223) (@​jeddy3).
• Fixed: selector-pseudo-class-no-unknown false positives for nested webkit-scrollbar part (#9259) (@​rkdfx).

17.9.1 - 2026-04-27

It fixes 4 bugs. We also documented the messageArgs each rule provides to the message configuration property.

• Fixed: ConfigurationError regression for custom syntaxes (#9245) (@​jeddy3).
• Fixed: MD5 hash algorithm to SHA256 for caching (#9241) (@​rkdfx).
• Fixed: property-no-deprecated autofix for page-break-*: always (#9214) (@​rkdfx).
• Fixed: selector-no-deprecated false positives for ::part() (#9227) (@​SaekiTominaga).

... (truncated)

Commits

• 7fcee2b Release 17.13.0 (#9342)
• 3b7287b Refactor to reuse shared utilities (#9337)
• 8e889c3 Bump lint-staged from 17.0.4 to 17.0.5 (#9334)
• a74aab4 Bump the stylelint-actions group with 5 updates (#9333)
• 74c6448 Fix declaration-block-no-duplicate-properties false negatives for interleav...
• 1cd26ac Skip changeset verification on fork PRs CI (#9331)
• 712b986 Fix vulnerable dependencies via npm audit fix (#9328)
• 27196b7 Fix CI badge in README.md (#9329)
• 179bba2 Refactor to use @import over @typedef for simple imports (#9326)
• 94eab54 Document using our PR template (#9327)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates typescript from 5.9.2 to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

TypeScript 5.9.3

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

• fixed issues query for Typescript 5.9.0 (Beta).
• fixed issues query for Typescript 5.9.1 (RC).
• No specific changes for TypeScript 5.9.2 (Stable)
• fixed issues query for Typescript 5.9.3 (Stable).

Downloads are available on:

• npm

Commits

• 050880c Bump version to 6.0.3 and LKG
• eeae9dd 🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...
• ad1c695 🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)
• 0725fb4 🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...
• 607a22a Bump version to 6.0.2 and LKG
• 9e72ab7 🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...
• 35ff23d 🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...
• e175b69 Bump version to 6.0.1-rc and LKG
• af4caac Update LKG
• 8efd7e8 Merge remote-tracking branch 'origin/main' into release-6.0
• Additional commits viewable in compare view

Updates solid-js from 1.9.3 to 1.9.13

Commits

• 3be495c v1.9.13
• 4649b37 Update DOM expression runtimes
• 265648b Merge remote-tracking branch 'origin/main'
• a22dd29 Merge pull request #2696 from brenelz/fix-resource-initial-value-inference
• 4b1919a Fix createResource initial value inference
• 3ed4753 Tighten produce draft proxy invariant test
• 75525f0 Merge pull request #2690 from brenelz/fix/2668-leaked-produce-draft-proxy-inv...
• a7959ca Fix proxy invariant crash in draft production
• cfde0a1 Harden store prototype pollution guards
• 43cbc98 Merge pull request #2683 from thomasbuilds/prototype-fix
• Additional commits viewable in compare view

Updates @playwright/test from 1.59.1 to 1.61.0

Release notes

Sourced from @​playwright/test's releases.

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

• New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
• The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

• The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
• Supported expect.soft.poll(...).
• New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
• New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
• testInfo.errors now lists each sub-error of an AggregateError as a separate entry.

... (truncated)

Commits

• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• 8133dcf cherry-pick(#41283): docs: add Ubuntu 26.04 and Node.js 26.x to system requir...
• 812432e chore: mark v1.61.0 (#41277)
• ac05145 fix(fetch): report serverAddr and securityDetails for reused sockets (#41267)
• 056efc9 fix(trace-viewer): add keyboard navigation to NetworkFilters component (#41...
• 41f7b9a chore: fixes uncovered by the .NET 1.61 roll (#41266)
• ba50778 fix(mcp): assign caps as array for legacy --vision flag (#41253)
• b8ee5ae docs: release notes for v1.61 (#41261)
• 49c1f69 fix(trace viewer): load trace from a local file (#41263)
• Additional commits viewable in compare view

Updates @types/bun from 1.3.12 to 1.3.14

Commits

• See full diff in compare view

Updates @astrojs/sitemap from 3.7.2 to 3.7.3

Release notes

Sourced from @​astrojs/sitemap's releases.

@​astrojs/sitemap@​3.7.3

Patch Changes

• #16837 783c4a6 Thanks @​jdevalk! - Improves <lastmod> accuracy in the sitemap index. Each <sitemap> entry in sitemap-index.xml is now stamped with the most recent lastmod of the URLs in the child sitemap it points to, instead of repeating a single global date on every entry. When a child sitemap has no per-URL lastmod, the entry falls back to the lastmod option as before. This gives search engines a per-file freshness signal, so they can tell which child sitemaps actually changed without refetching all of them.

Changelog

Sourced from @​astrojs/sitemap's changelog.

3.7.3

Patch Changes

• #16837 783c4a6 Thanks @​jdevalk! - Improves <lastmod> accuracy in the sitemap index. Each <sitemap> entry in sitemap-index.xml is now stamped with the most recent lastmod of the URLs in the child sitemap it points to, instead of repeating a single global date on every entry. When a child sitemap has no per-URL lastmod, the entry falls back to the lastmod option as before. This gives search engines a per-file freshness signal, so they can tell which child sitemaps actually changed without refetching all of them.

Commits

• 1e49163 [ci] release (#16832)
• 783c4a6 Stamp sitemap index entries with per-file lastmod (#16837)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• 5c543c5 refactor(astro): add internal entry points for test (#16473)
• f7566b8 refactor: unify test setup (#16445)
• ba2dbf1 refactor(astro): correct Fixture type signatures in test-utils (#16380)
• 245f300 refactor: migrate sitemap tests to typescript (#16353)
• 88fcc98 fix integrations links across docs (#16098)
• See full diff in compare view

Updates @iconify-json/simple-icons from 1.2.79 to 1.2.86

Commits

• See full diff in compare view

Updates astro from 6.1.8 to 6.4.8

Release notes

Sourced from astro's releases.

astro@6.4.8

Patch Changes

• #17109 27c80ea Thanks @​ematipico! - Harden the limits on the number of decoding on the URL.

astro@6.4.7

Patch Changes

• #17035 197e50e Thanks @​astrobot-houston! - Fixes getRelativeLocaleUrl, getAbsoluteLocaleUrl, and getAbsoluteLocaleUrlList to strip trailing slashes when trailingSlash: 'never' is configured

• #16967 3719765 Thanks @​astrobot-houston! - Fixes double URL-encoded paths returning 400 Bad Request on on-demand routes

  Previously, any URL containing a double-encoded character (like %255B, which is [ encoded twice) was unconditionally rejected with a 400 Bad Request before middleware or route handlers could run. This broke embedded tools like Sanity Studio whose client-side router legitimately produces double-encoded URLs.

  The fix replaces the rejection approach with iterative decoding — multi-level percent-encoding is now fully resolved to its canonical form before being passed to middleware and route matching. This preserves the security fix for CVE-2025-66202 (middleware authorization bypas...

  Description has been truncated

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml