chore(deps): bump the npm-minor-patch group with 15 updates

[dependabot]

Bumps the npm-minor-patch group with 15 updates:

Package	From	To
@supabase/supabase-js	2.110.0	2.111.0
react	19.2.7	19.2.8
react-dom	19.2.7	19.2.8
react-router-dom	7.18.1	7.18.2
@astrojs/check	0.9.9	0.9.10
@eslint/js	9.39.4	9.39.5
@playwright/test	1.61.1	1.62.0
@types/node	24.13.2	24.13.3
autoprefixer	10.5.2	10.5.4
eslint	9.39.4	9.39.5
postcss	8.5.16	8.5.24
satori	0.26.0	0.29.0
tsx	4.22.4	4.23.1
typescript-eslint	8.62.1	8.65.0
vitest	3.2.6	3.2.7

Updates @supabase/supabase-js from 2.110.0 to 2.111.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.111.0

2.111.0 (2026-07-28)

🚀 Features

• auth: store PKCE verifiers in per-flow slots to survive overlapping flows (#2569)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.111.0-canary.0

2.111.0-canary.0 (2026-07-28)

🚀 Features

• auth: store PKCE verifiers in per-flow slots to survive overlapping flows (#2569)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

v2.110.9

2.110.9 (2026-07-27)

🩹 Fixes

• auth: downgrade stale refresh token console noise (#2559)
• realtime: preserve presence refs (#2566)
• repo: override sharp to >=0.35.0 to clear libvips advisory (#2548)
• repo: populate symbols in sdk-compliance so capabilities are verifiable (#2547)
• repo: bump postcss, babel, next to clear audit advisories (#2561)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• Vaibhav @​7ttp

v2.110.9-canary.3

2.110.9-canary.3 (2026-07-27)

🩹 Fixes

• realtime: preserve presence refs (#2566)

❤️ Thank You

• Vaibhav @​7ttp

v2.110.9-canary.2

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.8 (2026-07-21)

🩹 Fixes

• supabase: skip Node warning in Deno (#2541)

❤️ Thank You

• Vaibhav @​7ttp

2.110.7 (2026-07-16)

🩹 Fixes

• realtime: trigger set auth on INITIAL_SESSION event (#2531)

❤️ Thank You

• Filipe Cabaço @​filipecabaco

2.110.6 (2026-07-15)

🩹 Fixes

• supabase: warn instead of throw for unrecognized sb_ API key subtypes (#2526)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

2.110.5 (2026-07-14)

🩹 Fixes

• supabase: avoid edge runtime warning (#2522)

❤️ Thank You

• Vaibhav @​7ttp

2.110.4 (2026-07-14)

... (truncated)

Commits

• 18b5bb2 chore(release): version 2.110.9 changelogs (#2567)
• fc2e61e chore(repo): bump postcss override and fix playwright 1.62 tsconfig failure (...
• 22050de chore(release): version 2.110.8 changelogs (#2546)
• 01dbb53 fix(supabase): skip Node warning in Deno (#2541)
• 150b00c chore(release): version 2.110.7 changelogs (#2533)
• 130fa11 fix(realtime): trigger set auth on INITIAL_SESSION event (#2531)
• c90b1cd chore(release): version 2.110.6 changelogs (#2527)
• c23e1ab fix(supabase): warn instead of throw for unrecognized sb_ API key subtypes (#...
• 8af3c3a chore(release): version 2.110.5 changelogs (#2524)
• 25da097 chore(release): version 2.110.4 changelogs (#2523)
• Additional commits viewable in compare view

Updates react from 19.2.7 to 19.2.8

Release notes

Sourced from react's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-dom from 19.2.7 to 19.2.8

Release notes

Sourced from react-dom's releases.

19.2.8 (July 21st, 2026)

React Server Components

• Performance improvements when decoding (#37087 by @​eps1lon)

Commits

• 1dd4ecb [FlightReply] Performance improvements when decoding (#37087)
• b0d2fdb [19.2.x] Update required references to GitHub repo (#36753)
• See full diff in compare view

Updates react-router-dom from 7.18.1 to 7.18.2

Changelog

Sourced from react-router-dom's changelog.

v7.18.2

Patch Changes

• Updated dependencies:
  • react-router@7.18.2

Commits

• 69a653e Release v7.18.2 (#15354)
• See full diff in compare view

Updates @astrojs/check from 0.9.9 to 0.9.10

Release notes

Sourced from @​astrojs/check's releases.

@​astrojs/check@​0.9.10

Patch Changes

• #17447 b01a692 Thanks @​ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

Changelog

Sourced from @​astrojs/check's changelog.

0.9.10

Patch Changes

• #17447 b01a692 Thanks @​ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

Commits

• 112d3ea [ci] release (#17469)
• b01a692 chore(deps): update yargs to v18 (#17447)
• 3652d1c chore: merge main into next
• 8062391 chore(deps): dedupe vite installations (#16788)
• ce88423 Dedupe vite (#16787)
• b8061a6 refactor: use TypeScript project service in ESLint (#16623)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• See full diff in compare view

Updates @eslint/js from 9.39.4 to 9.39.5

Release notes

Sourced from @​eslint/js's releases.

v9.39.5

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)

Commits

• 202117b chore: package.json update for @​eslint/js release
• See full diff in compare view

Updates @playwright/test from 1.61.1 to 1.62.0

Release notes

Sourced from @​playwright/test's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

</tr></table> 

... (truncated)

Commits

• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• 2934858 fix: correct pending navigation log spacing (#41949)
• 4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
• bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
• 15c4f55 fix(mcp): identify downloads explicitly (#41933)
• f5fa967 fix(network): request.postData() returns null for empty string body override ...
• 0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
• 244a1ff feat(firefox): roll to r1538 (#41938)
• Additional commits viewable in compare view

Updates @types/node from 24.13.2 to 24.13.3

Commits

• See full diff in compare view

Updates autoprefixer from 10.5.2 to 10.5.4

Release notes

Sourced from autoprefixer's releases.

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

Changelog

Sourced from autoprefixer's changelog.

10.5.4

• Fixed prefixed rule duplication (by @​xianjianlf2).

10.5.3

• Fixed brackets and gradient parser (@​alanturing881).

Commits

• 4cad00f Release 10.5.4 version
• e62a4b1 Update CI config
• c8f0d0a Update dependencies
• cae3577 Move back to latest pnpm 11
• fd31eb3 Fix duplicated prefixed selectors on reformatted CSS (#1552)
• 958d390 Release 10.5.3 version
• 21d2adb Fix gradient parser
• f7ddae9 Fix bracket parser
• 10ea5e7 Update dependencies and remove patch
• b6e8a2a Update Dev Container
• Additional commits viewable in compare view

Updates eslint from 9.39.4 to 9.39.5

Release notes

Sourced from eslint's releases.

v9.39.5

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@0.8.2 (#20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#20619) (Copilot)

Commits

• 4a24e8c 9.39.5
• 1fba874 Build: changelog update for 9.39.5
• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#21077)
• 202117b chore: package.json update for @​eslint/js release
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#21...
• 253be16 fix: handle unavailable require cache (backport of #20812 to v9.x) (#21065)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#21068)
• 74930ed docs: switch build to Node.js 24 (#20894)
• daf7791 chore: pin fflate@0.8.2 (#20895)
• eaec8bb docs: Add ESLint v9.x EOL notice (#20828)
• Additional commits viewable in compare view

Updates postcss from 8.5.16 to 8.5.24

Release notes

Sourced from postcss's releases.

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Changelog

Sourced from postcss's changelog.

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

Commits

• 0ebe8ad Release 8.5.24 version
• 73218c6 Update dependencies
• 9a114f6 Preserve the BOM when stringifying (#2119)
• 9069261 Fix types check
• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• Additional commits viewable in compare view

Updates satori from 0.26.0 to 0.29.0

Release notes

Sourced from satori's releases.

0.29.0

0.29.0 (2026-07-23)

Features

• add support for webp images (#622) (b712d5b), closes #607 #539 #273 #311

0.28.2

0.28.2 (2026-07-21)

Bug Fixes

• replace Yoga build flag for browsers (#774) (dc2e1c5), closes #749

0.28.1

0.28.1 (2026-07-20)

Bug Fixes

• render text matching Object.prototype property names as glyphs (#761) (504b4c9)

0.28.0

0.28.0 (2026-07-14)

Features

• trigger npm publish after OIDC fix (#771) (b5c1f64)

0.27.0

0.27.0 (2026-04-29)

Bug Fixes

• Fixed error when rendering React Fragments inside <svg>

Commits

• b712d5b feat: add support for webp images (#622)
• dc2e1c5 fix: replace Yoga build flag for browsers (#774)
• 504b4c9 fix: render text matching Object.prototype property names as glyphs (#761)
• b5c1f64 feat: trigger npm publish after OIDC fix (#771)
• 8119856 docs: fix flexWrap default from 'wrap' to 'nowrap' (#767)
• 2120646 ci: publish via npm trusted publishing (OIDC) (#770)
• 2d3af44 fix: SSRF guard for server-side image fetches + pluggable fetcher (#769)
• 9feec94 fix: text matching Object.prototype property names rendered as image (#768)
• 91ade3b ci: declare minimum permissions on PR title workflow (#756)
• ab49faf chore: migrate workspace to pnpm 10 (#762)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for satori since your current version.

Updates tsx from 4.22.4 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

• support tsImport after global preload (8d4ffc2)
• watch: avoid clearing piped output (95d0672)
• watch: treat script and dependency paths literally (79fddde)

Performance Improvements

• index transform cache lazily (e818ad6)
• load esbuild lazily in CLI (d067938)
• map Node TypeScript formats directly (cdcc623)
• use sync module hooks on Node v22.22.3+ (f8992f1)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 79fddde fix(watch): treat script and dependency paths literally
• e818ad6 perf: index transform cache lazily
• cdcc623 perf: map Node TypeScript formats directly
• d067938 perf: load esbuild lazily in CLI
• 95d0672 fix(watch): avoid clearing piped output
• 6fd4607 docs: add per-page metadata
• f4176d8 docs: generate sitemap
• 8d4ffc2 fix: support tsImport after global preload
• f0e89b2 docs: document Node's public type-stripping API vs internal loader path
• f8992f1 perf: use sync module hooks on Node v22.22.3+
• Additional commits viewable in compare view

Updates typescript-eslint from 8.62.1 to 8.65.0

Release notes

Sourced from typescript-eslint's releases.

v8.65.0

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)
• eslint-plugin: [no-restricted-imports] deprecate extension rule (#12527, #19562, #11889)
• eslint-plugin: [no-shadow] specialized error on enum declaration and member shadowing (#12578)
• parser: add onUnsupportedTypeScriptVersion option to error on unsupported TypeScript versions (#12465)
• typescript-estree: throw for invalid import defer syntax (#12552)

🩹 Fixes

• eslint-plugin: [prefer-string-starts-ends-with] handle escaped $ ending regex literals (#12515)
• eslint-plugin: [unbound-method] report unbound methods accessed via member expression on union types (#12448)
• eslint-plugin: [no-unnecessary-parameter-property-assignment] don't flag computed assignments with a variable key (#12568)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger
• Serhii Leniv @​Serhii-Leniv
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.64.0

8.64.0 (2026-07-13)

🚀 Features

• support parsing import defer (#12513)
• eslint-plugin: [no-loop-func] support using / await using declarations and deprecate the rule (#12500)
• typescript-estree: throw for invalid definite assignment in class properties (#12543)

🩹 Fixes

• eslint-plugin: [require-array-sort-compare] handle constrained arrays (#12512)

❤️ Thank You

• Evyatar Daud @​StyleShit
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.65.0 (2026-07-20)

🚀 Features

• add warning when TS 7 is detected (#12529)

❤️ Thank You

• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.64.0 (2026-07-13)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.63.0 (2026-07-06)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 63ba81b chore(release): publish 8.65.0
• eaf4576 feat: add warning when TS 7 is detected (#12529)
• 0d06406 chore: add attw validation to repo (#12437)
• c2386e4 chore(deps): update dependency prettier to v3.9.5 (#12486)
• 414d9ab chore(release): publish 8.64.0
• 290cf6c chore(release): publish 8.63.0
• See full diff in compare view

Updates vitest from 3.2.6 to 3.2.7

Release notes

Sourced from vitest's releases.

v3.2.7

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10679 (b795e)

    View changes on GitHub

Commits

• c0c203d chore: release v3.2.7 (#10719)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cloudflare-workers-and-pages]

Deploying cloudcertprep with    Cloudflare Pages

Latest commit:	7c031cc
Status:	✅  Deploy successful!
Preview URL:	https://1cb6e0c6.cloudcertprep.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-npm-ymfc.cloudcertprep.pages.dev

View logs