Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates - #260

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-007ccd7a14
Open

chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates#260
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-007ccd7a14

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 6 updates in the / directory:

Package From To
@axe-core/playwright 4.10.2 4.13.0
@modelcontextprotocol/ext-apps 1.7.5 2.0.0
@playwright/test 1.62.0 1.63.0
@types/node 26.1.2 26.5.1
esbuild 0.28.1 0.28.2
zod 4.2.0 4.6.2

Updates @axe-core/playwright from 4.10.2 to 4.13.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.13.0

What's Changed

Full Changelog: dequelabs/axe-core-npm@v4.11.3...v4.13.0

v4.11.3

... (truncated)

Changelog

Sourced from @​axe-core/playwright's changelog.

4.13.0 (2026-08-10)

Features

4.12.1 (2026-06-22)

Features

4.11.3 (2026-04-29)

Bug Fixes

4.11.2 (2026-04-14)

Bug Fixes

4.11.1 (2026-01-09)

Bug Fixes

4.11.0 (2025-10-14)

Bug Fixes

Features

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​axe-core/playwright since your current version.


Updates @modelcontextprotocol/ext-apps from 1.7.5 to 2.0.0

Release notes

Sourced from @​modelcontextprotocol/ext-apps's releases.

v2.0.0

What's Changed

ext-apps 2.0 moves to the MCP TypeScript SDK 2.0 split packages. The MCP Apps wire protocol is unchanged: 2.x Views run in 1.x hosts and 2.x hosts render 1.x Views (covered by a test that runs the published 1.7.5 against this release in both directions). What breaks is dependencies and the TypeScript API; see the migration guide.

Breaking changes

  • Peer dependencies. @modelcontextprotocol/sdk@^1 is replaced by @modelcontextprotocol/client@^2.0.0 (required: App and AppBridge extend its Protocol), @modelcontextprotocol/server@^2.0.0 (optional, only for the ./server helpers), and zod@^4.2.0. Node.js 20+.
  • zod 3 is no longer supported. SDK 2.0 requires zod 4.2+ (the release that added Standard JSON Schema output); the 1.x fallback for zod 3.25 is gone. Raw zod shapes in registerAppTool still work as a deprecated overload; wrap them in z.object({...}) to move off it.
  • Handler context. Custom handlers receive the SDK 2.x BaseContext: extra.signal is now extra.mcpReq.signal, extra.requestId is extra.mcpReq.id.
  • setRequestHandler / setNotificationHandler are keyed by method name. The 2.x form is setRequestHandler("method", { params }, (params, ctx) => …). The 1.x (Schema, handler) form still works as a deprecated overload with a one-time warning (#769) and goes away in 3.0.
  • The double-registration guard now covers the SDK's own handlers. Registering a handler for notifications/progress or notifications/cancelled throws already registered, as ping and the on*-owned methods did in 1.x.
  • ProtocolWithEvents is removed. AppRequest, AppNotification and AppResult remain as deprecated type aliases.
  • Errors. Remote JSON-RPC errors are ProtocolError (numeric code); local failures are SdkError (string code). Host-side wire deltas: a handler-thrown -32002 reaches the View as -32602, invalid params on ui/* methods go from -32603 to -32602, and the MCP error N: message prefix is gone.
  • schema.json follows the 2.0 core schemas: structuredContent is any JSON value, result _meta documents io.modelcontextprotocol/serverInfo, toolInfo.tool.outputSchema is a loose object, and a recursive JSON-value definition is added.

SDK

  • Migrate to SDK v2 with the official Protocol and isolated role peers by @​tonxxd, building on @​khandrew1's #710 and @​felixweinberger's #712, in #720
  • SDK 2.0 fixups: regenerated lockfile, ^2.0.0 peers, restored double-registration guard, deprecated raw-shape registerAppTool overload, migration guide, wire-compat tests, MCPB build in #768
  • Fix: explicit .js extensions on relative imports so published declarations resolve under NodeNext / Node16 (#704) by @​ken-jo in #705
  • Keep the 1.x handler registration forms as deprecated overloads in #769
  • Cross-version interop test against the published ext-apps 1.7.5 in #770

Examples

  • All examples migrated to the split SDK packages (NodeStreamableHTTPServerTransport, z.object schemas, extra.mcpReq.*) in #720
  • server-pdf now advertises JSON Schema 2020-12 on every tool's inputSchema / outputSchema, which fixes #765 for clients with a strict 2020-12 validator

Docs

Security

npm audit reports 10 findings (2 critical, 4 high, 4 moderate), all in example workspaces or build tooling, none reachable from the published package, whose only runtime dependency is @standard-schema/spec:

  • seroval / solid-js (GHSA-mv8w-475r-vwqw): the Solid example's vite plugin, pinned by a root overrides
  • undici 7.28.0: cheerio in wiki-explorer-server
  • nanoid, postcss: vite
  • brace-expansion: nodemon (dev)
  • hono / @hono/node-server (GHSA-frvp-7c67-39w9): @modelcontextprotocol/node in the examples' servers; same advisory as the 1.7.5 residual, still unreachable (only getRequestListener / serve are imported)
  • qs: express 5 in examples; fflate: @types/three (dev)

All have non-major fixes available and will be picked up in a follow-up, kept off this release to keep the version diff clean.

Full Changelog: modelcontextprotocol/ext-apps@v1.7.5...v2.0.0

Commits
  • 352f6ce CI: build the WSL job on ext4, skip the unused Chromium download, list tsconf...
  • ae4f7e0 Sync the quickstart tsconfig snippets
  • a0dcf16 CI: build the WSL job on ext4, skip the unused Chromium download, list tsconf...
  • ae0fe55 Migration guide fixes and editor-visible deprecation for the 1.x handler form...
  • 853c9f7 Migration guide fixes and editor-visible deprecation for the 1.x handler form
  • 12aa50b Add cross-version interop test against the published ext-apps 1.7.5 (#770)
  • 218aef1 Keep the 1.x handler registration forms as deprecated overloads (#769)
  • 5f6346e Add cross-version interop test against published ext-apps 1.7.5
  • 4eab52e Export the legacy handler types from the root entry
  • 728b0bf Keep the 1.x handler registration forms as deprecated overloads
  • Additional commits viewable in compare view

Updates @playwright/test from 1.62.0 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates @types/node from 26.1.2 to 26.5.1

Commits

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

  • Fix tree shaking bug due to TypeScript import alias (#4507)

    This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

    import Base from './dep.js';
import Alias = Base.SomeType;

  • Fix CSS minification bug involving & (#4497)

    This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

    /* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}

    This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

  • Avoid overwriting input files without --allow-overwrite (#4484)

    For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

    This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

  • Fix incorrect code generated when using top-level await (#4498)

    Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

  • Fix a minification bug with lowered logical assignment operators (#4508)

    This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

    // Original code
function foo() {
  let x

... (truncated)

Commits
  • 609683d publish 0.28.2 to npm
  • 11b1fe4 add to release notes
  • ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
  • 04627b6 fix #4498: async TLA checks need a worklist
  • 5c15177 disable gopls in the go folder
  • fc2ee9b css: adjust parser to allow --foo: {...}
  • 209db54 release notes for css nesting bugfix
  • c625d31 fix #4497: preserve nested ampersands during minification (#4500)
  • 34474e2 better isolation of current part in js parser
  • 07f6e8c fix #4507: import assignment tree-shaking bug
  • Additional commits viewable in compare view

Updates zod from 4.2.0 to 4.6.2

Release notes

Sourced from zod's releases.

v4.6.2

A patch on top of 4.6.1.

v4.6.1

A patch on top of 4.6.0.

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

  • .validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
  • z.instanceof().properties() — validates properties of an instance
  • fromJSONSchema() — enforces six validation keywords it used to ignore
  • z.iban() — electronic-format IBAN plus mod-97 checksum
  • z.withParser() — installs a parser generated elsewhere, for environments without new Function
  • Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
  • Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
  • @zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

.validate()

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});
</tr></table>

... (truncated)

Commits
  • e359f73 4.6.2
  • 9446b5c fix: preserve undefined prefault outputs and object keys (#6587)
  • 0c483c5 docs: Zod 4.6 announcement post (#6546)
  • a00c3f3 docs: use Trigger.dev's brand-kit lockups for the platinum card
  • 62311eb 4.6.1
  • 2efa8b8 ci: give the npm wait a real budget and drop the back-publish path (#6583)
  • b12aa52 fix: preserve unique tags with defaulted discriminators (#6582)
  • dd9c36f fix(v4): defer recursive object index inference (#6580)
  • 574d480 fix(locales): clarify Tajik discriminator value message
  • c532d76 test(locales): cover Tajik error branches
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the dev-dependencies group across 1 directory w…
6bf183d 
…ith 6 updates

Bumps the dev-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.10.2` | `4.13.0` |
| [@modelcontextprotocol/ext-apps](https://github.com/modelcontextprotocol/ext-apps) | `1.7.5` | `2.0.0` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.0` | `1.63.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.5.1` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [zod](https://github.com/colinhacks/zod) | `4.2.0` | `4.6.2` |



Updates `@axe-core/playwright` from 4.10.2 to 4.13.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.10.2...v4.13.0)

Updates `@modelcontextprotocol/ext-apps` from 1.7.5 to 2.0.0
- [Release notes](https://github.com/modelcontextprotocol/ext-apps/releases)
- [Changelog](https://github.com/modelcontextprotocol/ext-apps/blob/main/RELEASES.md)
- [Commits](modelcontextprotocol/ext-apps@v1.7.5...v2.0.0)

Updates `@playwright/test` from 1.62.0 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.0...v1.63.0)

Updates `@types/node` from 26.1.2 to 26.5.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `zod` from 4.2.0 to 4.6.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.2.0...v4.6.2)

---
updated-dependencies:
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@modelcontextprotocol/ext-apps"
  dependency-version: 2.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: zod
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@github-actions

github-actions Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Trust Verify needs attention

Trust Verify completed with result: failure.

Open the workflow run

Failure details 
No structured failure details were reported; open the workflow run.

This is advisory and non-blocking; it does not change the Trust Verify verdict or merge requirements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants