chore(deps): Bump the minor-and-patch group across 1 directory with 5 updates

[dependabot]

Bumps the minor-and-patch group with 5 updates in the / directory:

Package	From	To
@joint/core	4.3.1	4.3.3
fast-xml-parser	5.11.0	5.11.1
@playwright/test	1.62.1	1.63.0
@types/react-dom	19.2.4	19.2.7
@vitejs/plugin-react	6.1.0	6.1.1

Updates @joint/core from 4.3.1 to 4.3.3

Release notes

Sourced from @​joint/core's releases.

@​joint/core@​4.3.3

Patch Changes

• mvc.Collection - store cids in a map separate from ids, so a model id in the cid namespace (e.g. 'c12') is never shadowed by another model's auto-generated cid — previously graph.getCell() could return the wrong cell or a newly added cell could be silently merged away as a duplicate (f7455fd9)

@​joint/core@​4.3.2

Patch Changes

• 0a2991b: alg.rightAnglePath: refactor to consolidate duplicate code into helpers
• 68a4758: dia.Paper - the guard option can now veto blank pointerdowns; its view argument is undefined when the event did not hit a cell view
• 54d9800: routers.rightAngle - refactor the path-finding algorithm into a separate utility

Commits

• e0ee1a6 Version Packages (#3492)
• 27f2bcb fix(joint-react): prevent stale layout:update entries from resurrecting remov...
• 86fba0d chore: fix changelogs according to new custom logic (#3493)
• f66524f fix(joint-router-avoid): cancel a queued one-shot pass superseded by start() ...
• 9651d0d fix(joint-router-avoid): fire idle after incremental main-thread changes (#3489)
• f7455fd fix(mvc.Collection): id lookups can return the wrong model when a user id col...
• 552bc8b chore: custom changeset changelog format (#3469)
• 47b468b chore: GHA permissions hardening (#3474)
• ff42a94 chore: Regenerate prod as part of release.yml GHA (#3475)
• 536203a Version Packages (#3479)
• Additional commits viewable in compare view

Updates fast-xml-parser from 5.11.0 to 5.11.1

Release notes

Sourced from fast-xml-parser's releases.

v5.11.1

What's Changed

• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#858
• Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#856
• Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#854
• docs: fix two 404 documentation links by @​rajanpanth in NaturalIntelligence/fast-xml-parser#862

New Contributors

• @​rajanpanth made their first contribution in NaturalIntelligence/fast-xml-parser#862

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.1 / 2026-08-27

• fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

• feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
• fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
• fix: DOCTYPE to read SYSTEM/PUBLIC
• deps: strnum v2.4.2

5.10.1 / 2026-07-17

• fix: multiple DOCTYPE declarations.
• deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

• upgrade:
  • xml-naming v0.3.0: cache support
  • PEM v1.6.2: sibling bug fix
  • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

• update strnum

*5.9.2 / 2026-06-17

• dummy release to test changes in github action

*5.9.1 / 2026-06-17

• dummy release to test release from github action

*5.9.0 / 2026-06-15

• update strnum to 2.3.0
  • you can set hex, binary, enotation, infinity, unicode
• validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

• integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
  • This will consider xml-version as well. '1.0' is default
• update strnum to 2.3.0
  • You can set octal and binary parsing which is bydeault off
• update fast-xml-builder to 1.2.0
  • can sanitize tag names if found invalid
  • fix format output

5.7.3 / 2006-05-05

• fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

... (truncated)

Commits

• 3617550 5.11.1
• 6021128 update for release
• 6ddcb65 remove regex from validator
• 7d60815 docs: fix two 404 documentation links (#862)
• 4e3857b Bump actions/setup-node from 6.4.0 to 7.0.0 (#854)
• fcc62fb Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.1 (#856)
• 23a9019 Bump actions/checkout from 7.0.0 to 7.0.1 (#858)
• See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @types/react-dom from 19.2.4 to 19.2.7

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.0 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions