[dependabot]

Bumps the production-dependencies group with 9 updates in the / directory:

Package	From	To
@testing-library/dom	10.4.1	10.4.2
typescript	5.9.3	7.0.2
@oxc-project/runtime	0.139.0	0.153.0
open	11.0.0	11.0.4
ws	8.21.0	8.22.0
vite	7.3.6	8.3.4
linkedom	0.18.12	0.18.13
magic-string	0.30.21	1.4.3
express	5.2.1	5.3.0

Updates @testing-library/dom from 10.4.1 to 10.4.2

Release notes

Sourced from @​testing-library/dom's releases.

v10.4.2

10.4.2 (2026-09-13)

Bug Fixes

• deps: pin @​types/node to a TypeScript 4-compatible version (#1386) (6049cc0)

Commits

• 6049cc0 fix(deps): pin @​types/node to a TypeScript 4-compatible version (#1386)
• e395d5b Switch to trusted publishing (#1368)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/dom since your current version.

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates @oxc-project/runtime from 0.139.0 to 0.153.0

Release notes

Sourced from @​oxc-project/runtime's releases.

oxc crates_v0.153.0

🚀 Features

• 61003c7 minifier: Fold undefined argument in non delegating yield (#27324) (Armano)
• 07833c0 ast: Tie debug_name return lifetime to the underlying AST node (#27295) (sadan)
• adb1139 minifier: Merge import statements against the same module (#25534) (翠)
• cc82598 minifier: Merge import and export statements against the same module (#25533) (翠)
• 1c352ce minifier: Minimize bitwise binary expressions (#27107) (Armano)
• d1a0bcc minifier: Merge statements after terminating if block branches (#26667) (Armano)
• 7a95376 minifier: Merge adjucent if stmt with the same content (#26445) (Armano)

🐛 Bug Fixes

• 6a7d48b parser: Report abstract private field error on modifier (#27314) (camc314)
• 2ff6fb5 parser: Include generator marker in overload diagnostic span (#27313) (camc314)
• 4359a66 parser: Reject TypeScript class modifiers in JavaScript (#27312) (camc314)
• 565d75d minifier: Correct indopedency when processing nested sequences (#27273) (Armano)
• d0b9372 parser: Remove type-dependent tuple rest diagnostics (#27234) (camc314)
• 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
• b2793fa parser: Reject module syntax in script (#27220) (leaysgur)
• 5914a24 parser: Report TS1243 for abstract async methods (#27192) (camc314)
• c6c6e5e parser: Report TS1242 for interfaces with abstract modifier (#27191) (camc314)
• dd0bbb9 parser: Avoid duplicate index signature modifier diagnostic (#27190) (camc314)
• 8f61129 regex: Decode escaped capturing group names (#27156) (camc314)
• da1fed2 minifier: Fold conditional expressions with long sequences (#27083) (Armano)
• 0c601f4 isolated-declarations: Allow adding undefined to keyof parameter types (#27173) (Dunqing)
• 4896287 isolated-declarations: Support readonly parameter types (#27009) (sama Pyb)
• 72d62a1 transformer/explicit-resource-management: Transform classic for loop using declarations (#27148) (camc314)
• 4cf9ae2 minifier: Preserve sibling declarations in arguments copy rewrite (#27140) (camc314)
• 24b7015 transformer/explicit-resource-management: Lower using in catch and finally (#27142) (camc314)

⚡ Performance

• 99e3c15 minifier: Small performance improvement when merging imports (#27238) (Armano)
• d37d1db codegen: Pre-allocate sourcemap builder vectors (#27230) (codspeed)
• 466ef10 minifier: Update expressions in place in merge_import_export (#27226) (Armano)
• 028ffb8 minifier: Update nodes in place in wrap_to_avoid_ambiguous_else (#27194) (Armano)
• 6fcd135 minifier: Avoid conversion from ident to str when for substitute symbols (#27209) (Armano)
• 0b9799d minifier: Reduce usage of minimize_conditional (#26028) (Armano)
• 3ca3ded minifier: Short-circuit IfStatement termination on alternate (#25198) (Armano)

📚 Documentation

• 335ce79 agents: Scope verification for local and stacked work (#27299) (Dunqing)

oxc crates_v0.152.0

🚀 Features

• 02331c8 str: Add JSStr, JSChar and JSStrBuilder types (#26435) (Dunqing)
• 52ae63f regular_expression: Support buffer boundary assertions (#27048) (Boshen)

... (truncated)

Commits

• 7f56ec9 release(crates): oxc v0.153.0 (#27342)
• dfbc0d1 release(crates): oxc v0.152.0 (#27133)
• bec650f release(crates): oxc v0.151.0 (#26875)
• 5a6e37e release(crates): oxc v0.150.0 (#26632)
• 60fa138 release(crates): oxc v0.149.0 (#26397)
• 34feccb fix(runtime): remove stale regenerator exports (#26243)
• 894c8f9 release(crates): oxc v0.148.0 (#26198)
• 4e25843 release(crates): oxc v0.147.0 (#26046)
• 0389c40 release(crates): oxc v0.146.0 (#25912)
• 4a4a1fb release(crates): oxc v0.145.0 (#25865)
• Additional commits viewable in compare view

Updates open from 11.0.0 to 11.0.4

Release notes

Sourced from open's releases.

v11.0.4

• Fix browser/browserPrivate not detecting Safari or Brave as the default browser 6ae6196

---

sindresorhus/open@v11.0.3...v11.0.4

v11.0.3

• Fix Windows launches being killed when the parent process exits 734b821

---

sindresorhus/open@v11.0.2...v11.0.3

v11.0.2

• Update dependencies 6f006ad

---

sindresorhus/open@v11.0.1...v11.0.2

v11.0.1

• Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4

---

sindresorhus/open@v11.0.0...v11.0.1

Commits

• 4151110 11.0.4
• 6ae6196 Fix browser/browserPrivate not detecting Safari or Brave as the default b...
• 81deafb 11.0.3
• 734b821 Fix Windows launches being killed when the parent process exits
• ccf1fd6 11.0.2
• 52d2d62 Use hasOwn (#372)
• 6f006ad Update dependencies
• f38acc8 11.0.1
• 6ac3fe4 Fix WSL failure when the working directory is unreachable from Windows
• a30acc7 Meta tweaks
• See full diff in compare view

Updates ws from 8.21.0 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

• Introduced the protocols option (8b918b01).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

8.21.1

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c0).
• The default values of the maxBufferedChunks and maxFragments options have been reduced (f197ac65).

Commits

• 297202c [dist] 8.22.0
• 8b918b0 [feature] Introduce the protocols option
• 73e03eb [ci] Update actions/setup-node action to v7
• d9b8954 [fix] Change the ready state after validating the arguments (#2337)
• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• Additional commits viewable in compare view

Updates vite from 7.3.6 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
• build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
• build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
• bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
• client: skip rewriting unchanged adopted styles (#23697) (fa71469)
• css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
• deps: update all non-major dependencies (#23648) (8a4c19c)
• deps: update rolldown-related dependencies (#23649) (794516d)
• dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
• don't treat modules ending with js-like query as js (#23687) (fcb6f12)
• html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
• html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
• optimizer: scan deep imports with custom extensions (#23678) (8579189)
• remove input option unescaping for now (#23694) (facc2fb)
• server: match static aliases on path boundaries (#23643) (b28db28)
• watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

• module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

• bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Commits

• b6c20f6 release: v8.3.4 (#23702)
• b28db28 fix(server): match static aliases on path boundaries (#23643)
• bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
• fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
• 2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
• 3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
• facc2fb fix: remove input option unescaping for now (#23694)
• 70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
• cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
• fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
• Additional commits viewable in compare view

Updates linkedom from 0.18.12 to 0.18.13

Commits

• fcd88e0 0.18.13
• 195f7aa brought in better spec-compliant style and getComputed
• b9ee7fd fix: reading an unset style property returns "" per CSSOM, not undefined (#328)
• 2450493 Fix #320 - Updated build status
• d001308 removed unnecessary .npmrc line + updated dev/dependencies - not htmlparser2
• See full diff in compare view

Updates magic-string from 0.30.21 to 1.4.3

Release notes

Sourced from magic-string's releases.

v1.4.3

   🐞 Bug Fixes

• Replace the matched text when an offset is set  -  by @​youdie006 in Rich-Harris/magic-string#362 (607e8)
• Preserve inserts when update spans several chunks  -  by @​theRizwan in Rich-Harris/magic-string#361 (fb89b)

    View changes on GitHub

v1.4.2

   🐞 Bug Fixes

• Keep the outro when splitting a removed chunk  -  by @​wahidrizka in Rich-Harris/magic-string#358 (2a665)
• Skip empty matches inside removed content in replaceAll  -  by @​wahidrizka in Rich-Harris/magic-string#359 (2eb0f)

   🏎 Performance

• Look up removed content without scanning every chunk  -  by @​wahidrizka in Rich-Harris/magic-string#357 (ca9e8)

    View changes on GitHub

v1.4.1

   🐞 Bug Fixes

• Flush the shared encoder buffer at the end of every drain  -  by @​wahidrizka in Rich-Harris/magic-string#356 (f682c)

    View changes on GitHub

v1.4.0

   🚀 Features

• Add affinity option to move()  -  by @​antfubot in Rich-Harris/magic-string#351 (f849b)
• bundle: Add toMagicString() to flatten a Bundle into a MagicString  -  by @​antfubot in Rich-Harris/magic-string#353 (3a7c7)

   🐞 Bug Fixes

• Don't resurrect removed content in replace/replaceAll  -  by @​antfubot in Rich-Harris/magic-string#352 (c847b)

   🏎 Performance

• Encode mappings incrementally in generateMap to cut peak memory  -  by @​antfubot in Rich-Harris/magic-string#350 (1401f)

    View changes on GitHub

v1.3.2

   🐞 Bug Fixes

• Return an empty slice when the end index resolves to zero  -  by @​wahidrizka in Rich-Harris/magic-string#346 (55319)
• Carry trimStart and trimEnd into the outro and intro  -  by @​wahidrizka in Rich-Harris/magic-string#348 (07d2f)
• Treat moving a range to where it already sits as a no-op  -  by @​wahidrizka in Rich-Harris/magic-string#347 (22ed1)
• Preserve inserts anchored to the edges of a removed range  -  by @​cpruijsen and @​antfu in Rich-Harris/magic-string#282 and Rich-Harris/magic-string#349 (bd7ee)

... (truncated)

Changelog

Sourced from magic-string's changelog.

1.4.3 (2026-10-05)

Bug Fixes

• preserve inserts when update spans several chunks (#361) (fb89bad)
• replace the matched text when an offset is set (#362) (607e8e4)

1.4.2 (2026-09-23)

Bug Fixes

• keep the outro when splitting a removed chunk (#358) (2a665f6)
• skip empty matches inside removed content in replaceAll (#359) (2eb0f6f)

Performance Improvements

• look up removed content without scanning every chunk (#357) (ca9e867)

1.4.1 (2026-09-15)

Bug Fixes

• flush the shared encoder buffer at the end of every drain (#356) (f682ccf)

1.4.0 (2026-09-15)

Bug Fixes

• don't resurrect removed content in replace/replaceAll (#352) (c847b0e)

Features

• add affinity option to move() (#351) (f849b39)
• bundle: add toMagicString() to flatten a Bundle into a MagicString (#353) (3a7c7b0)

Performance Improvements

• encode mappings incrementally in generateMap to cut peak memory (#350) (1401f6c)

1.3.2 (2026-09-15)

Bug Fixes

• carry trimStart and trimEnd into the outro and intro (#348) (07d2fcb)
• preserve inserts anchored to the edges of a removed range (#282) (#349) (bd7ee85)
• return an empty slice when the end index resolves to zero (#346) (5531971)
• treat moving a range to where it already sits as a no-op (#347) (22ed11b)

1.3.1 (2026-09-10)

... (truncated)

Commits

• 993d27d chore: release v1.4.3
• fb89bad fix: preserve inserts when update spans several chunks (#361)
• 607e8e4 fix: replace the matched text when an offset is set (#362)
• 64b6a6e chore: release v1.4.2
• 2eb0f6f fix: skip empty matches inside removed content in replaceAll (#359)
• 2a665f6 fix: keep the outro when splitting a removed chunk (#358)
• 335fca2 docs: correct repeated and overlapping removal restrictions (#360)
• ca9e867 perf: look up removed content without scanning every chunk (#357)
• c2d19f1 chore: clearify public/private state
• c308bb7 chore: release v1.4.1
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.