chore(deps): bump the npm-dependencies group across 1 directory with 14 updates

[dependabot]

Bumps the npm-dependencies group with 14 updates in the / directory:

Package	From	To
markdown-it	14.3.0	15.0.2
@playwright/test	1.62.1	1.63.0
@types/node	26.4.1	26.6.1
@types/vscode	1.80.0	1.138.0
@typescript-eslint/eslint-plugin	8.69.0	8.70.0
@typescript-eslint/parser	8.69.0	8.70.0
@vscode/vsce	3.9.2	4.0.0
eslint	10.9.1	10.10.0
eslint-plugin-jsdoc	64.3.5	64.5.2
mocha	12.0.0	12.0.2
ovsx	1.1.1	1.2.0
playwright	1.62.1	1.63.0
typescript	6.0.3	7.0.2
typescript-eslint	8.69.0	8.70.0

Updates markdown-it from 14.3.0 to 15.0.2

Changelog

Sourced from markdown-it's changelog.

[15.0.2] - 2026-09-11

Security

• Fixed quadratic complexity in smartquotes when quote types don't match, #1209. Also limited the smartquotes stack to 1000 unmatched openers.

[15.0.1] - 2026-08-27

Changed

• doc: replace oxide theme with custom one.

Fixed

• Fixed code span parsing after lookaheads for unclosed link and image labels, #1201.
• Preserve spaces in code spans whose content consists only of spaces, #1180.
• Preserve brackets around IPv6 address literals when normalizing links, #1204.

Security

• Fixed quadratic complexity when replacing fuzzy links.
• Fixed quadratic complexity in scheme backscan (inline linkify rule).

[15.0.0] - 2026-07-30

Added

• Exposed parser internals classes as static properties on markdownit.
• Bundled TypeScript declarations. Remove @types/markdown-it if you used it.
• Added the markdown-it/browser export with bundled ESM and UMD builds.
• Added colored CLI help on supported terminals via argparse 3.
• Added reference labels to link/image tokens, #938.
• Added reference_definition tokens. They remain stripped by default for backwards compatibility, #1055. Also adjusted the line-break heuristic to keep output exactly the same.

Changed

• [breaking] linkify-it => v6
  • No fuzzy links by default.
  • No auth part check by default.
  • Unicode punctuation terminates the link by default (should help with CJK).
  • See linkify-it changelog for other changes.
• Package root now resolves to prebuilt ESM and CJS files instead of raw sources. Distribution files were reorganized under dist/ and dist/browser/.
• Migrated to Typescript.
• entities => v8. Can be rolled back to v7 if compatibility issues happen.
• Moved validateLink, normalizeLink and normalizeLinkText from properties to prototype methods.
• Reworked issue templates and contribution guidelines.

... (truncated)

Commits

• 3c51991 15.0.2 released
• cf27366 Polish #1209 and limit smartquotes stack to 1000 openers
• 1b379c1 Fix quadratic complexity in smartquotes rule when quote types don't match (#1...
• 924b203 15.0.1 released
• 25c3895 Changelog update
• aaadcfa Fix quadratic complexity in scheme backscan (inline linkify rule)
• 09fa071 Fix quadratic complexity when replacing fuzzy links
• 988c82b fix: don't strip spaces from all-space code spans
• 26b9a7b Polish previous commit
• e8c6688 fix: preserve IPv6 brackets in normalizeLink (#1204)
• Additional commits viewable in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @types/node from 26.4.1 to 26.6.1

Commits

• See full diff in compare view

Updates @types/vscode from 1.80.0 to 1.138.0

Commits

• See full diff in compare view

Updates @typescript-eslint/eslint-plugin from 8.69.0 to 8.70.0

Release notes

Sourced from @​typescript-eslint/eslint-plugin's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/eslint-plugin's changelog.

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)

❤️ Thank You

• Josh Goldberg ✨ @​JoshuaKGoldberg
• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• f66bdca test(eslint-plugin): [member-ordering] use RuleTester directly in `optional...
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• f8e1e4e fix(eslint-plugin): [no-unnecessary-condition] no false positive on RHS of a ...
• 889cece fix(eslint-plugin): [member-ordering] don't report fields that read fields de...
• 1a5a8b1 feat(eslint-plugin): [no-generated-empty-object-type] add rule (#12730)
• See full diff in compare view

Updates @typescript-eslint/parser from 8.69.0 to 8.70.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.70.0 (2026-09-07)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• See full diff in compare view

Updates @vscode/vsce from 3.9.2 to 4.0.0

Release notes

Sourced from @​vscode/vsce's releases.

v4.0.0

Changes:

• #1329: Offer prompted migration of legacy PAT credentials
• #1325: Remove leven dependency
• #1324: Replace form-data with Node streams
• #1326: Fix MSAL declaration build failure
• #1323: Relock deps and mirror to package.json
• #1314: Replace chalk with Node styling
• #1312: Remove parse-semver dependency
• #1313: Reduce secretlint dependency tree
• #1315: chore(deps): bump the github-actions group with 2 updates
• #1306: Pin GitHub Actions to full-length commit SHAs

• #1309: Replace glob with tinyglobby
• #1308: Raise Node.js baseline to 22
• #1305: Update and replace many dependencies
• #1298: chore(deps): bump js-yaml from 4.2.0 to 4.3.1
• #1297: Hide OIDC option from publish help
• #1296: Remove redundant secretlint dependency
• #1295: chore(deps): bump fast-uri from 3.1.4 to 3.1.5
• #1294: chore(deps): bump brace-expansion
• #1293: chore(deps): bump fast-uri from 3.1.2 to 3.1.4
• #1292: chore(deps): bump linkify-it from 5.0.1 to 5.0.2
• #1291: auth: support OIDC trusted publishing
• #1289: chore(deps): bump js-yaml and @​textlint/linter-formatter
• #1288: chore(deps): bump form-data from 4.0.4 to 4.0.6
• #1287: chore(deps): bump markdown-it from 14.1.1 to 14.2.0
• #1284: chore(deps): bump tmp from 0.2.6 to 0.2.7

This list of changes was auto generated.

v3.9.3-12

Changes:

• #1329: Offer prompted migration of legacy PAT credentials
• #1325: Remove leven dependency
• #1324: Replace form-data with Node streams
• #1326: Fix MSAL declaration build failure
• #1323: Relock deps and mirror to package.json
• #1314: Replace chalk with Node styling
• #1312: Remove parse-semver dependency

This list of changes was auto generated.

... (truncated)

Commits

• 9f25124 Merge pull request #1329 from microsoft/benibenj/migrate-legacy-pat-storage
• 7d84e92 Offer prompted migration of legacy PAT credentials
• 75cae44 Merge pull request #1325 from jakebailey/remove-leven
• ae9f2b7 Merge pull request #1324 from jakebailey/remove-form-data
• fa08d59 Capture both output streams in the CLI tests
• 3fb79d8 Fix multipart stream lifecycle issues
• bee68cf Extract command suggestion helper and test it
• b40452e Merge pull request #1326 from microsoft/benibenj/agents/validate-package-lock...
• d2cd4d4 Keep PR CI workflow unchanged
• fa0fdf7 Fix MSAL declaration build failure
• Additional commits viewable in compare view

Updates eslint from 10.9.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
• Additional commits viewable in compare view

Updates eslint-plugin-jsdoc from 64.3.5 to 64.5.2

Release notes

Sourced from eslint-plugin-jsdoc's releases.

v64.5.2

64.5.2 (2026-09-16)

Bug Fixes

• set optional typescript peer dep. to any to undo breaking change (f469cdf)

v64.5.1

64.5.1 (2026-09-16)

Bug Fixes

• specify typescript as an optional peer dependency; fixes #1768 (d147779)

v64.5.0

64.5.0 (2026-09-15)

Features

• ts-ban-ts-comments: add rule mirrorring typescript-eslint's ban-ts-comments rule (afff498)

v64.4.0

64.4.0 (2026-09-14)

Features

• convert-to-jsdoc-comments, no-bad-blocks: add LibreJS tags (99d2abf)

v64.3.10

64.3.10 (2026-09-12)

Bug Fixes

• convert-to-jsdoc-comments: merge stacked line comments into a single JSDoc block (64a8dca), closes #1764

v64.3.9

64.3.9 (2026-09-10)

Bug Fixes

• no-undefined-types: recognize class members from the class's own JSDoc (eade377), closes #1762

v64.3.8

64.3.8 (2026-09-09)

... (truncated)

Commits

• f469cdf fix: set optional typescript peer dep. to any to undo breaking change
• d147779 fix: specify typescript as an optional peer dependency; fixes #1768
• afff498 feat(ts-ban-ts-comments): add rule mirrorring typescript-eslint's `ban-ts-c...
• 99d2abf feat(convert-to-jsdoc-comments, no-bad-blocks): add LibreJS tags
• 64a8dca fix(convert-to-jsdoc-comments): merge stacked line comments into a single J...
• eade377 fix(no-undefined-types): recognize class members from the class's own JSDoc
• 1b3c339 fix(getJsdocProcessorPlugin): key positions by file; drop suggestions
• 5cac70a fix(no-undefined-types): recognize sibling class members from a property's ...
• 43921f3 chore: update jsdoccomment, devDeps.
• 342b6f6 fix(no-unnecessarry-type-assertion): avoid treating as redundant object ann...
• Additional commits viewable in compare view

Updates mocha from 12.0.0 to 12.0.2

Release notes

Sourced from mocha's releases.

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

• fail nested tests on beforeEach failure (#6292) (a75b43b)
• give CLI reporter-option precedence over config file (#6331) (571110f)
• propagate spec file path on parallel worker death (#6268) (55a544a)
• use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
• watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

• add remaining external services (#6316) (bfe0b5d)
• update copyright year, holder, and URLs (#6303) (288c075)

🧹 Chores

• add "stale branch" workflow (#6315) (ad17f9f)
• add dependency conflict detection workflow (#6246) (ef0ae32)
• add folder for reproducing issues (#6330) (6728030)
• add stale triage reminder for unreviewed issues (#6314) (ee35133)
• auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
• convert file-unloader to ESM (#6294) (dc73f4c)
• deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
• deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
• deps: update dependency knip to v6.35.0 (#6324) (a2416af)
• deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)
• exclude "v11.x" from "stale branch" workflow (#6338) (e7b7fe1)
• fix owner in auto-add workflow (#6309) (037aa8b)
• fixup "auto-add" workflow (#6308) (b3f7cbc)
• fixup workflow perms in-job (#6327) (633480c)
• provide write perms to workflows (#6325) (d6f6f4c)
• remove "stale" label on author activity (#6312) (e60fbda)
• remove unused .editorconfig file (#6306) (880269f)
• replace find-conflicts with improved smoke versions (#6344) (2668e71)
• set author to Mark Wiemer (#6305) (cd2a730)
• site: update Astro (7.3.2) and fast-uri (3.1.7) (#6301) (a4f2213)
• stabilize --parallel integration suite (#6313) (856a1ae)
• stop auto-adding PRs to project (#6352) (a8309fd)
• track Codecov in issue without failing CI (#6323) (c39f602)
• widen --exit detection window (#6293) (ee3a4b1)

v12.0.1

12.0.1 (2026-09-08)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.2 (2026-09-17)

🩹 Fixes

• fail nested tests on beforeEach failure (#6292) (a75b43b)
• give CLI reporter-option precedence over config file (#6331) (571110f)
• propagate spec file path on parallel worker death (#6268) (55a544a)
• use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
• watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

• add remaining external services (#6316) (bfe0b5d)
• update copyright year, holder, and URLs (#6303) (288c075)

🧹 Chores

• add "stale branch" workflow (#6315) (ad17f9f)
• add dependency conflict detection workflow (#6246) (ef0ae32)
• add folder for reproducing issues (#6330) (6728030)
• add stale triage reminder for unreviewed issues (#6314) (ee35133)
• auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
• convert file-unloader to ESM (#6294) (dc73f4c)
• deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
• deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
• deps: update dependency knip to v6.35.0 (#6324) (a2416af)
• deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)
• exclude "v11.x" from "stale branch" workflow (#6338) (e7b7fe1)
• fix owner in auto-add workflow (#6309) (037aa8b)
• fixup "auto-add" workflow (#6308) (b3f7cbc)
• fixup workflow perms in-job (#6327) (633480c)
• provide write perms to workflows (#6325) (d6f6f4c)
• remove "stale" label on author activity (#6312) (e60fbda)
• remove unused .editorconfig file (#6306) (880269f)
• replace find-conflicts with improved smoke versions (#6344) (2668e71)
• set author to Mark Wiemer (#6305) (cd2a730)
• site: update Astro (7.3.2) and fast-uri (3.1.7) (#6301) (a4f2213)
• stabilize --parallel integration suite (#6313) (856a1ae)
• stop auto-adding PRs to project (#6352) (a8309fd)
• track Codecov in issue without failing CI (#6323) (c39f602)
• widen --exit detection window (#6293) (ee3a4b1)

12.0.1 (2026-09-08)

🩹 Fixes

... (truncated)

Commits

• 70db1c7 chore(main): release 12.0.2 (#6300)
• 571110f fix: give CLI reporter-option precedence over config file (#6331)
• a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
• a8309fd chore: stop auto-adding PRs to project (#6352)
• 2668e71 chore: replace find-conflicts with improved smoke versions (#6344)
• 6728030 chore: add folder for reproducing issues (#6330)
• e7b7fe1 chore: exclude "v11.x" from "stale branch" workflow (#6338)
• a923e25 Ping maintainers on stale branch review issues (#6326)
• 633480c chore: fixup workflow perms in-job (#6327)
• cd2a730 chore: set author to Mark Wiemer (#6305)
• Additional commits viewable in compare view

Updates ovsx from 1.1.1 to 1.2.0

Release notes

Sourced from ovsx's releases.

CLI v1.2.0

Added

• Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
• Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
• Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
• Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
• Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2....

  Description has been truncated