chore(deps): update all dependencies

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@axe-core/playwright	4.13.0 → 4.14.0			devDependencies	minor
@commitlint/cli (source)	21.2.3 → 21.2.4			devDependencies	patch
@commitlint/config-conventional (source)	21.2.3 → 21.2.4			devDependencies	patch
@playwright/test (source)	1.64.0 → 1.64.1			devDependencies	patch
@radix-ui/react-dialog (source)	1.1.23 → 1.3.1			devDependencies	minor
@react-navigation/native (source)	7.5.0 → 7.5.1			dependencies	patch
@react-navigation/native-stack (source)	7.20.0 → 7.21.0			dependencies	minor
@vitest/browser (source)	5.0.3 → 5.0.5			devDependencies	patch
@vitest/browser-playwright (source)	5.0.3 → 5.0.5			devDependencies	patch
eslint (source)	10.12.0 → 10.13.0			devDependencies	minor
jsdom	30.1.2 → 30.1.3			devDependencies	patch
node (source)	24.21.0 → 24.22.0				minor
react (source)	19.3.0 → 19.3.1			devDependencies	patch
react (source)	19.3.0 → 19.3.1			dependencies	patch
react-dom (source)	19.3.0 → 19.3.1			devDependencies	patch
react-dom (source)	19.3.0 → 19.3.1			dependencies	patch
react-native (source, changelog)	0.87.1 → 0.88.0			devDependencies	minor
typescript-eslint (source)	8.71.1 → 8.71.2			devDependencies	patch
vitest (source)	5.0.3 → 5.0.5			devDependencies	patch

---

Release Notes

dequelabs/axe-core-npm (@​axe-core/playwright)

v4.14.0

Compare Source

Bug Fixes

• exempt axe-core from the pnpm release-age cooldown (#​1441) (0bcb185), closes #​1346 #​1346 #​1442 #​1346

Features

• Update axe-core to v4.14.0 (#​1456) (dccfe7a)

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.4

Compare Source

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.2.4

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

microsoft/playwright (@​playwright/test)

v1.64.1

Compare Source

Bug Fixes

• #​43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #​43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

radix-ui/primitives (@​radix-ui/react-dialog)

v1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

v1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

v1.2.0

• Added support for multiple aria-describedby attributes.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18

react-navigation/react-navigation (@​react-navigation/native)

v7.5.1

Compare Source

react-navigation/react-navigation (@​react-navigation/native-stack)

v7.21.0

Compare Source

Features

• add options to hide left and right item backgrounds (54e18fd) - by @​danchily2
• add visibilityPriority and submenu description to header items (#​13284) (6ebba1e) - by @​satya164

vitest-dev/vitest (@​vitest/browser)

v5.0.5

Compare Source

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in #​11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in #​11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in #​11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in #​11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in #​11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in #​11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in #​11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in #​11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in #​11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in #​11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in #​11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in #​11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in #​11596 (8dd67)
• reporter:
  • End reason &#​39;failed&#​39; on worker crash  -  by @​AriPerkkio in #​11568 (6ae8e)

    View changes on GitHub

v5.0.4

Compare Source

   🚀 Features

• experimental:
  • Tag cache directories with CACHEDIR.TAG  -  by @​lifeiscontent in #​11461 (a8ea3)
  • Support test.ui.theme option  -  by @​sheremet-va in #​11499 (1da66)
  • Highlight selector multiple matches in trace view  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11489 (5abba)
  • Print how many tests were affected and a total when running --changed  -  by @​sheremet-va in #​11424 (a2336)
  • Add an option to cache dependencies instead of statically parsing them  -  by @​sheremet-va in #​11515 (c0601)
  • Add fit and zoom controls to trace viewer  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11490 (f5dd9)

   🐞 Bug Fixes

• Fail the run on git and location filter errors  -  by @​sheremet-va in #​11430 (30d03)
• Enable fsModuleCache by default  -  by @​sheremet-va in #​11435 (ad208)
• Track project files and mocks with --changed  -  by @​sheremet-va in #​11432 (b0f2b)
• Refactor caching, fix : in project and change the shape of results cache  -  by @​sheremet-va in #​11453 (9673c)
• Keep full $ string values when taskTitleValueFormatTruncate is 0  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11485 (4f7e1)
• Resolve node builtins in client environments  -  by @​sheremet-va in #​11417 (56b31)
• Fix module graph builtin externals after #​11421  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11491 and #​11421 (008e1)
• Wrap module mocks during in-source testing  -  by @​sheremet-va in #​11505 (36d19)
• Handle line endings in snapshot  -  by @​sheremet-va in #​11522 (4c468)
• Respect root in projects  -  by @​sheremet-va in #​11521 (26642)
• Resolve mocks in directories with spaces  -  by @​sheremet-va in #​11539 (caaef)
• api:
  • Publish the api token atomically  -  by @​umairnawaz333 in #​11323 (6f990)
• browser:
  • Close the mock route interception race  -  by @​cplieger and @​sheremet-va in #​8339 and #​11083 (d6620)
  • Allow toHaveTextContent without arguments  -  by @​nomadical in #​11425 (8ebcf)
  • Apply API options without browser config  -  by @​sheremet-va in #​10852 (ad055)
  • Preserve undefined command arguments  -  by @​sheremet-va and @​AriPerkkio in #​11497 (1576d)
  • Wait for setup mocks before importing a test file  -  by @​kasperpeulen in #​11520 (b61d1)
  • Avoid extra scroll outside the iframe  -  by @​sheremet-va in #​11523 (662e8)
  • Run browser instances as workers  -  by @​sheremet-va in #​11525 (bf04b)
    • ⚠️ This can degrade performance if you have a custom maxWorkers setting. Previously, it was applied incorrectly and could lead to Vitest using too many resources. For example, a lower number would still open too many browsers. Fixing it means Vitest opens less instances by default now.
  • Open one cdp session per tester  -  by @​sheremet-va in #​11542 (69e63)
  • Clean up unmocked and pending mocks  -  by @​sheremet-va in #​11537 (5c955)
• coverage:
  • V8 browser memory leak between test files  -  by @​AriPerkkio in #​11466 (2297d)
  • allowExternal fails to include uncovered files  -  by @​AriPerkkio in #​11513 (4ef00)
  • Filenames containing brackets incorrectly showing as uncovered  -  by @​AriPerkkio in #​11531 (0fa80)
  • Istanbul coverage wrong when module transform warmups  -  by @​AriPerkkio in #​11529 (9f61d)
• deps:
  • Update all non-major dependencies  -  by @​sheremet-va in #​11167 (c74e0)
• expect:
  • Fix Map and Set deep equality in some assertions  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11402 (b4e79)
  • Check value in chai-style returned  -  by @​sheremet-va in #​11500 (1aca0)
• mocker:
  • Fix native loader mocking edge cases  -  by @​sheremet-va in #​11540 (cd423)
• pretty-format:
  • Support boxed symbols  -  by @​lehni in #​11445 and #​11446 (eba44)
• reporters:
  • Junit to strip ANSI sequences from all XML attributes  -  by @​meganemura and Claude Opus 5.5 in #​11407 (e1a73)
• runner:
  • Don't cache failed fixture setups  -  by @​hamed-bavar in #​11237 and #​11238 (4ee66)
• typecheck:
  • Use typescript pool in toTestSpecification  -  by @​sheremet-va in #​11451 (5f273)
• ui:
  • Remove duplicate browser-open call opening two tabs  -  by @​feastyr69 in #​11356 and #​11358 (d7e13)
  • Simplify explorer filtering + fix nested tests when search matches a suite  -  by @​hi-ogawa, Hiroshi Ogawa, Codex and Claude Opus 5.5 in #​11262 (a627b)
  • Store module graph once per environment  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11421 (af903)
  • Mount index.html handler on the ui base path  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11517 (1bc24)
  • Center split pane resize handle  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in #​11506 (e658b)
• vm:
  • Bind this to module.exports  -  by @​sheremet-va in #​11504 (b618a)

   🏎 Performance

• Reuse fsModuleCache when filtering by source  -  by @​sheremet-va in #​11428 (7ebd9)
• spy: Reset only mocks that were called or reconfigured  -  by @​johan-gorter and Claude Opus 5.5 in #​11197 (28ef9)

    View changes on GitHub

eslint/eslint (eslint)

v10.13.0

Compare Source

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#​21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#​21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#​21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#​21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#​21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#​21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#​21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#​21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#​21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#​21398) (renovate[bot])
• e5aea41 chore: update ecosystem plugins (#​21390) (ESLint Bot)

jsdom/jsdom (jsdom)

v30.1.3

Compare Source

• Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
• Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
• Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
• Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
• Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
• Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
• Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
• Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
• Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
• Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
• Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
• Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
• Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
• Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

nodejs/node (node)

v24.22.0: 2026-10-14, Version 24.22.0 'Krypton' (LTS), @​richardlau prepared by @​aduh95

Compare Source

Notable Changes

• [ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #​65627
• [c162c68ff0] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #​65553
• [a4ab3d84d7] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #​65484
• [c2f1e829ea] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #​65484
• [51aad5a80d] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #​63411
• [d11c65d2f2] - doc: add araujogui to collaborators (Guilherme Araújo) #​66090
• [acc1578179] - doc: deprecate Server.prototype._listen2 in node:net (Antoine du Hamel) #​65593
• [a7f8de6362] - (SEMVER-MINOR) net: support sending net.BoundSocket to threads and child processes (Guy Bedford) #​64725
• [60c3eb61bd] - (SEMVER-MINOR) perf_hooks: implement SlidingWindowHistogram (James M Snell) #​65825
• [6b3e6f9d5c] - (SEMVER-MINOR) perf_hooks: implement qrde analysis support in Histogram (James M Snell) #​65806
• [75456a3512] - (SEMVER-MINOR) perf_hooks: implement Histogram meanCI API (James M Snell) #​65606
• [72d1b40c56] - (SEMVER-MINOR) perf_hooks: add CBOR export/import for histogram exchange (James M Snell) #​65434
• [41161dda87] - (SEMVER-MINOR) sqlite: add StatementSync.prototype.close() (Guilherme Araújo) #​64232
• [adbc757d70] - (SEMVER-MINOR) sqlite: add StatementSync.prototype[Symbol.dispose]() (Guilherme Araújo) #​64232
• [241339f072] - (SEMVER-MINOR) src,lib: add util.markPromiseAsHandled (James M Snell) #​65805
• [63b0974d9e] - (SEMVER-MINOR) util: implement util.throttle (James M Snell) #​65899
• [a3bbb5a26f] - (SEMVER-MINOR) util: implement debounce (James M Snell) #​65899

Commits

• [e6832b2cb1] - assert: fix TypeError on deepStrictEqual with null Map key or Set member (Sergey Sannikov) #​64449
• [a079177d9f] - benchmark: add --csv option to compare.js with --analyze (James M Snell) #​65922
• [10b1a0f70f] - benchmark: fix max-regressions detection in compare.js (James M Snell) #​65587
• [e0c7ba8ad5] - benchmark: add --analyze option to benchmark/scatter.js (James M Snell) #​65594
• [21fed10bb0] - benchmark: add crypto class benchmarks (Filip Skokan) #​65518
• [fa912242b7] - buffer: fix unaligned UTF-16LE decoding (Matteo Collina) #​65905
• [a6bd0c1413] - build: suppress OpenSSL asm warnings with clang (Richard Lau) #​66023
• [94e12139ee] - build: derive V8_LOGGING_LEVEL from dcheck_always_on (Joyee Cheung) #​65744
• [7a2f322943] - build: fix quiet default for make builds (Shelley Vohr) #​65826
• [c280d650b0] - build: allow linking shared dependencies in the GN build (Shelley Vohr) #​65797
• [4b23a4472c] - build: enable the V8 sandbox in shared-cage builds (Shelley Vohr) #​62237
• [676e15c003] - build: define V8_CONTIGUOUS_COMPRESSED_RO_SPACE for shared cage (Shelley Vohr) #​65464
• [f784058482] - build: remove obsolete configure flags (Chengzhong Wu) #​65456
• [f63f37d243] - build: activate correct default flags for riscv64 (Stewart X Addison) #​65708
• [da46ac075d] - build: derive NODE_ARCH from target_cpu in the GN build (Shelley Vohr) #​65491
• [249e9a16dd] - build,src: gate jspi flag on V8_ENABLE_WEBASSEMBLY (Piotr Kubaj) #​66082
• [146f00f64b] - child_process: clear timeout timer on spawn-time error too (kishore280) #​65506
• [13987f4418] - crypto: remove redundent std::move call (Antoine du Hamel) #​66111
• [ef957ac85f] - crypto: skip private RSA parameters in key details (Filip Skokan) #​66108
• [8feccc5e22] - crypto: use provider EC group names (Filip Skokan) #​66108
• [764e0d1120] - crypto: fetch ciphers for private-key encoding (Filip Skokan) #​66108
• [50ffed1979] - crypto: decode PKCS#1 keys through providers (Filip Skokan) #​66108
• [56c16b2fd6] - crypto: derive keys through EVP_KDF (Filip Skokan) #​66108
• [a4effe6809] - crypto: use names for asymmetric key algorithms (Filip Skokan) #​65966
• [ddbf974b47] - (SEMVER-MINOR) crypto: add crypto.parsePKCS12() (Brian Muenzenmeyer) #​65627
• [8e631aa48f] - crypto: add Hybrid KEMs to Web Cryptography (Filip Skokan) #​65759
• [5c51129e16] - crypto: optimize private EC JWK import (Filip Skokan) #​65908
• [c2ec40c2d7] - crypto: disable non-FIPS WebCrypto paths in FIPS mode (Filip Skokan) #​65172
• [e198aa0f79] - crypto: read RSA-PSS restrictions from provider (Filip Skokan) #​66108
• [253784f0e9] - crypto: optimize and benchmark key preparation (Filip Skokan) #​65892
• [80a6ad509b] - crypto: avoid EC reconstruction for signature sizing (Filip Skokan) #​65908
• [5b592b772c] - crypto: avoid EC raw export reconstruction (Filip Skokan) #​65908
• [ee956ae3bf] - crypto: export EC JWK coordinates directly (Filip Skokan) #​65908
• [684008be58] - crypto: read EC curve metadata directly (Filip Skokan) #​65908
• [f4665f1c41] - crypto: validate the limit of PBKDF2 iterations (Filip Skokan) #​65704
• [624abbecd7] - crypto: use primordials in HKDF info validation (Filip Skokan) #​65704
• [e4d916f175] - crypto: add mgf1Hash for RSA-OAEP (Adam Mcgrath) #​65073
• [db8a9162a8] - crypto: fix multi-prime RSA JWKs (Filip Skokan) #​65649
• [022ac83504] - crypto: cache valid ECDH key pairs (Filip Skokan) #​65615
• [c61953ebcc] - crypto: add strict mode to --force-fips (Filip Skokan) #​65645
• [db6ea132a5] - crypto: add FIPS indicator diagnostics channel (Filip Skokan) #​65645
• [c162c68ff0] - (SEMVER-MINOR) crypto: add a generic MAC API (Filip Skokan) #​65553
• [2b62aafd20] - crypto: validate JWK usages before key_ops (Filip Skokan) #​65550
• [ec7819db69] - crypto: fix RSA-PSS oversized salt handling (Filip Skokan) #​65550
• [a4ab3d84d7] - (SEMVER-MINOR) crypto: discover ciphers from OpenSSL providers (Filip Skokan) #​65484
• [c2f1e829ea] - (SEMVER-MINOR) crypto: discover hashes from OpenSSL providers (Filip Skokan) #​65484
• [51aad5a80d] - (SEMVER-MINOR) crypto: enable SIV and GCM-SIV modes in Cipher/Decipher APIs (Filip Skokan) #​63411
• [5a46a9acbb] - crypto: improve SubtleCrypto.supports() accuracy (Filip Skokan) #​65222
• [191ebfb26c] - crypto: fix public PKCS8 export error (한국) #​65609
• [b6d7ed372b] - crypto: fix private SPKI export error (Filip Skokan) #​65550
• [79509c25a4] - crypto: correct CCM decryption FIPS error message (kyungrae) #​65450
• [9adc87bc16] - crypto: harden X509Certificate state (Filip Skokan) #​65518
• [c63aa331b4] - crypto: optimize key slot caching (Filip Skokan) #​65518
• [87daea43a7] - crypto: add null checks for OPENSSL_INIT_new() (Nora Dossche) #​63457
• [98ca5e9358] - crypto: prevent Hmac.digest() from returning uninitialized memory (Matteo Collina) #​65112
• [0c090a28cd] - crypto: avoid throwing CryptoKey brand checks (Filip Skokan) #​65503
• [a13cc3f723] - crypto: avoid throwing KeyObject brand checks (Filip Skokan) #​65503
• [[b8db0045ef](https://redirect.github.co

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.