[dependabot]

Bumps the web-dependencies group in /web with 8 updates:

Package	From	To
@playwright/test	1.62.1	1.63.0
@sveltejs/vite-plugin-svelte	7.3.0	7.3.1
@types/node	24.13.3	26.6.2
bits-ui	2.19.0	2.19.3
svelte	5.57.0	5.57.1
tailwind-merge	3.6.0	3.7.0
typescript	6.0.3	7.0.2
vite-plus	0.2.8	0.3.3

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @sveltejs/vite-plugin-svelte from 7.3.0 to 7.3.1

Release notes

Sourced from @​sveltejs/vite-plugin-svelte's releases.

@​sveltejs/vite-plugin-svelte@​7.3.1

Patch Changes

• fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no vite/ segment before dist/ (#1373)

Changelog

Sourced from @​sveltejs/vite-plugin-svelte's changelog.

7.3.1

Patch Changes

• fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no vite/ segment before dist/ (#1373)

Commits

• 54c6efe Version Packages (#1398)
• 8d032b2 fix(inspector): activate under Vite+ on pnpm by matching the realpathed clien...
• See full diff in compare view

Updates @types/node from 24.13.3 to 26.6.2

Commits

• See full diff in compare view

Updates bits-ui from 2.19.0 to 2.19.3

Release notes

Sourced from bits-ui's releases.

bits-ui@2.19.3

Patch Changes

• Prevent delayed focus-scope autofocus from overriding focus already established in the scope or a nested scope. (#2165)

• fix(Dialog, AlertDialog): pass preventOverflowTextSelection to the text selection layer explicitly instead of letting it ride the rest props onto the rendered content element as a preventoverflowtextselection attribute. (#2154)

• fix(Floating): ignore autoUpdate callbacks that fire after the floating element's effect is destroyed to avoid derived_inert (#2164)

• Fix user-select: none being stranded on <body> after clicking inside forceMounted content (Popover, Tooltip, Dialog, AlertDialog, Menu, Select), which left the whole page unselectable until a reload. (#2161)

• refactor: the context-menu attribute names and the floating root/anchor state move to leaf modules, so DismissibleLayer no longer imports the menu module for two strings, and FloatingLayer / FloatingLayer.Anchor no longer import the floating content module (and @floating-ui/dom) to register a root and its trigger. No behaviour change. (#2158)

• fix(Menu): the trigger's aria-controls links to the content when the menu starts open. The content registers its id by replacing a plain field on the menu state, which a trigger rendered before the content had already read as empty and never re-read; the registration is now reactive. (#2159)

• fix(Combobox): open the trigger on a touch tap instead of on touch down, so a finger that lands on it while scrolling no longer opens the list. Takes the Select trigger's touch timing. (#2156)

• perf: avoid O(n) work per rendered item on hot paths (#2110)

  • Select/Combobox: item props now derive from per-item booleans, so moving the highlight or changing the value only rebuilds props (and re-diffs attributes) for the items that actually changed instead of every mounted item
  • Select/Combobox (multiple): selection lookups use a set instead of scanning the value array once per item
  • Calendar/RangeCalendar: data-today resolves the local timezone once per calendar rather than once per cell
  • Menu family: the document-level pointermove listener is only attached while keyboard mode is active
  • ScrollArea, Slider, NavigationMenu: internal resize observation shares a single ResizeObserver across all observed elements

• fix(TimeField): keep the day period when typing the hour and then editing another segment in 12-hour mode (#2148)

• Fix user-select: none being left on <body> when something else on the page calls preventDefault() on a pointerup, which made the whole page unselectable. The text-selection layer's release is internal cleanup and no longer skipped when the event's default action has been cancelled. (#2163)

• fix(Collapsible): invalidate deferred measurements when content is replaced or destroyed (#2149)

• Fix outside clicks being lost while dismissible content such as DropdownMenu is opening. (#2143)

bits-ui@2.19.2

Patch Changes

• fix: render the id attribute on Popper-based content elements (Tooltip, Popover, Select, Combobox, DropdownMenu, ContextMenu, Menubar, LinkPreview) so aria-describedby on triggers resolves correctly (#2094)

• fix: restore body styles on the captured document when delayed scroll-lock cleanup runs after the global document is torn down or replaced (#2133)

• fix: respect an explicit Tabs.Content tabindex while preserving the default panel tab stop (#2132)

bits-ui@2.19.1

Patch Changes

• fix(Avatar): detach image handlers on destroy and actually apply the load cleanup - #2050 (#2128)

• fix(Menu): Menu.GroupHeading no longer sets role="group", Menu.Separator now sets role="separator" (#2091)

• fix(DismissibleLayer): guard the deferred focus handler against teardown - #2080 (#2126)

... (truncated)

Commits

• 4ece125 Version Packages (#2144)
• 86d3875 test(ScrollArea): drive the resize-teardown test with a real resize (#2170)
• e60291e fix(TimeField): keep the day period after typing the hour in 12-hour mode (#2...
• c29acb2 refactor: leaf modules for the context-menu attribute names and the floating ...
• cb111ef fix: invalidate deferred Collapsible measurements on cleanup (#2149)
• fedf05f fix(Dialog, AlertDialog): pass preventOverflowTextSelection to the layer inst...
• a2f53b9 fix(Combobox): open the trigger on a touch tap instead of on touch down (#2156)
• 44e2ff7 fix(Menu): the trigger's aria-controls links to the content when the menu sta...
• cc0a50e fix(TextSelectionLayer): release the held lock before arming a new one (#2161)
• 3cffb10 fix(TextSelectionLayer): release the body lock even when pointerup is cance...
• Additional commits viewable in compare view

Updates svelte from 5.57.0 to 5.57.1

Release notes

Sourced from svelte's releases.

svelte@5.57.1

Patch Changes

• fix: cancel deferred event listeners during cleanup (#18749)

• fix: preserve global CSS in components without scopable elements (#18793)

• fix: reduce SSR render result garbage collection (#18798)

• fix: resolve the fallback of an each block in the enclosing scope (#18803)

• perf: speed up parser interactions with Acorn or avoid them where possible (#18740)

• fix: prevent effect tree of batches from interfering with each other (#18508)

• fix: serialize input default values during server rendering (#18733)

• fix: remove WAS_MARKED flag in favor of Set (#18127)

• fix: throw set_context_after_init when setContext is called after an await during SSR (#18739)

• fix: make Object.hasOwn reactive for state proxy ownership changes (#18838)

• fix: keep $state.eager when used as a variable initializer (#18809)

• perf: avoid regex matching in parser where possible (#18736)

• fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#18550)

• fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#18765)

Changelog

Sourced from svelte's changelog.

5.57.1

Patch Changes

• fix: cancel deferred event listeners during cleanup (#18749)

• fix: preserve global CSS in components without scopable elements (#18793)

• fix: reduce SSR render result garbage collection (#18798)

• fix: resolve the fallback of an each block in the enclosing scope (#18803)

• perf: speed up parser interactions with Acorn or avoid them where possible (#18740)

• fix: prevent effect tree of batches from interfering with each other (#18508)

• fix: serialize input default values during server rendering (#18733)

• fix: remove WAS_MARKED flag in favor of Set (#18127)

• fix: throw set_context_after_init when setContext is called after an await during SSR (#18739)

• fix: make Object.hasOwn reactive for state proxy ownership changes (#18838)

• fix: keep $state.eager when used as a variable initializer (#18809)

• perf: avoid regex matching in parser where possible (#18736)

• fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#18550)

• fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#18765)

Commits

• 636eaaa Version Packages (#18750)
• 8030ff2 fix: remove incorrect special handling of :export pseudo-selectors (#18839)
• a72dc8e fix: make Object.hasOwn reactive for state proxies (#18838)
• 6eb720a chore: scope.js stops importing from the analysis visitors (#18787)
• e6ae460 chore: analysis and transform stop importing each other (#18786)
• 5981c06 chore: move parser helpers next to their users (#18785)
• f2ad10e fix: preserve global CSS without scopable elements (#18793)
• a8a9b02 fix: reduce SSR render result garbage collection (#18798)
• 6be176d fix: resolve the fallback of an each block in the enclosing scope (#18803)
• 34b13ac fix: keep $state.eager when used as a variable initializer (#18809)
• Additional commits viewable in compare view

Updates tailwind-merge from 3.6.0 to 3.7.0

Release notes

Sourced from tailwind-merge's releases.

tailwind-merge@3.7.0

New Features

• Prepare some upcoming changes by @​dcastil in dcastil/tailwind-merge#713
  • Theme getters returned by fromTheme now expose the theme key they read as a themeKey property, so tooling can identify the referenced theme scale without calling the getter.
  • Release tags now include the package name, starting with tailwind-merge@3.7.0.

Bug Fixes

• Fix arbitrary values using color() or light-dark() being classified as lengths instead of colors by @​ddussi in dcastil/tailwind-merge#712
• Fix bare bg-conic not merging with other background image classes by @​dcastil in dcastil/tailwind-merge#708
• Fix columns-auto not conflicting with other columns classes by @​dcastil in dcastil/tailwind-merge#707
• Fix container sizes like inline-2xl not merging by @​dcastil in dcastil/tailwind-merge#706
• Fix max-h-none missing in max-h class group by @​mutewinter in dcastil/tailwind-merge#704
• Fix axis shorthands like px not overriding logical sides like ps by @​dcastil in dcastil/tailwind-merge#705
• Fix leading-none being removed when the leading theme scale is overridden by @​chatman-media in dcastil/tailwind-merge#689
• Fix deprecated shadow-inner being classified as shadow color instead of shadow by @​dcastil in dcastil/tailwind-merge#703

Documentation

• Add Deno to install instructions by @​bartlomieju in dcastil/tailwind-merge#687
• Add missing text-shadow theme key to configuration docs by @​dcastil in dcastil/tailwind-merge@3e6d208

Other

• Switch package manager from yarn to pnpm by @​dcastil in dcastil/tailwind-merge#680
• Harden CI security by @​dcastil in dcastil/tailwind-merge#679

Full Changelog: v3.6.0...v3.7.0

Thanks to @​brandonmcconnell, @​manavm1990, @​langy, @​roboflow, @​syntaxfm, @​getsentry, @​codecov, a private sponsor, @​openclaw, @​sourcegraph, @​cesarvcanal, @​CasperKristiansson, @​jbisasky, @​frontendmasters and more via @​thnxdev for sponsoring tailwind-merge! ❤️

Commits

• 511d68a tailwind-merge@3.7.0
• 2461127 Release tooling: Pass the namespaced tag prefix and commit message to pnpm's ...
• 9d41508 add changelog for tailwind-merge@3.7.0
• c78a80f Configurator: Reuse runtime lookups during pruning
• 49c317d Monorepo: Fix contributing link and include package coverage
• 7b565ca Configurator: prune a generated config to a project's used classes (core step)
• d83e013 Releases: auto-re-pin tag-pinned links on every version bump
• b71fd41 Docs: pin every in-repo file link to a release tag instead of main
• ee29441 Docs: point the ThemeObject JSDoc link at the packaged docs location
• 9521b10 Releases: per-package pipeline with namespaced tags
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vite-plus from 0.2.8 to 0.3.3

Release notes

Sourced from vite-plus's releases.

vite-plus v0.3.3: Homebrew setup and workspace dependency fixes

This release fixes Homebrew setup, Windows installation, and workspace dependency commands. It also updates Rolldown, Oxlint, and Oxfmt.

Fixes & Enhancements

• Homebrew installations complete setup once, retain their bundled CLI, and direct upgrades to brew upgrade vite-plus (#2729), by @​fengmk2.
• Windows installations decode remote legacy PowerShell scripts correctly (#2701), by @​james-elicx.
• vp migrate removes the unsupported React Refresh allowCompoundComponents option and warns about possible lint errors (#2702), by @​fengmk2.
• New monorepo packages use the root lint configuration without a conflicting nested configuration (#2667), by @​semimikoh.
• Yarn Classic rejects filtered additions and removals instead of changing unintended dependencies (#2705), by @​jong-kyung.
• Yarn Berry rejects unsupported filtered updates and respects filters during recursive removal (#2709, #2712), by @​jong-kyung.
• Yarn and Bun warn when a command does not support --workspace-root. Yarn Classic accepts root additions through vp add and vp install <packages> (#2713), by @​jong-kyung.
• vp dedupe warns about unsupported check options (#2717), by @​jong-kyung.
• Rust command output respects NO_COLOR (#2716), by @​liangmiQwQ.
• Windows commands find lowercase shims in directories with case-sensitive file names (#2727), by @​fengmk2.

Dependency Updates

• Update rolldown@1.2.8 to rolldown@1.2.9, oxlint@1.82.0 to oxlint@1.83.0, and oxfmt@0.67.0 to oxfmt@0.68.0. The new lint and format versions can flag code that passed before. Run vp fmt after upgrading if CI runs vp check (#2725), by @​voidzero-guard[bot].

Docs

• Reorganize the guide and expand the global CLI sections (#2684, #2715), by @​liangmiQwQ.
• Explain Nushell startup requirements and recovery for XDG installations (#2704), by @​naokihaba.

Chore

• Add documentation previews for fork PRs (#2691), by @​fengmk2.
• Publish @voidzero-dev/vite-plus-prompts with npm releases (#2707), by @​fengmk2.
• Reuse native preview installations and clarify release evidence and package checks (#2693, #2708), by @​fengmk2.
• Stabilize dependency-removal snapshots and temporarily skip Socket Firewall tests on Windows (#2711, #2730), by @​fengmk2.
• Clarify package-manager comments and update the preview workflow reference (#2706, #2714), by @​jong-kyung.
• Run dependency upgrade automation with Kimi K3 (#2723), by @​Brooooooklyn.

Bundled Versions

Tool	Version	Source
vite	8.3.0	434e8e9
rolldown	1.2.9	5b4746e
tsdown	0.23.0	npm
vitest	4.1.11	npm
oxlint	1.83.0	npm
oxlint-tsgolint	7.0.2001	npm
oxfmt	0.68.0	npm

Upgrade

vp upgrade
</tr></table> 

... (truncated)

Commits

• 45f9b9a release: v0.3.3: Homebrew setup and workspace dependency fixes (#2734)
• 2722c75 fix(cli): resolve lowercase Windows shims in case-sensitive directories (#2727)
• a3035cf fix(create): remove nested monorepo lint config (#2667)
• 6089186 feat(deps): upgrade upstream dependencies (#2725)
• ae2fe51 fix(cli): honor NO_COLOR in Rust output (#2716)
• c596871 fix(installer): decode remote legacy PowerShell scripts (#2701)
• c7c1e62 fix(migrate): omit unsupported React Refresh option (#2702)
• 9fd0d0a release: v0.3.2: independent package-manager versions and Oxlint plugin APIs ...
• 5b30ff0 revert(migrate): stop merging Oxc configs in existing projects (#2696)
• ace6ceb fix(migrate): report skipped ESLint rules (#2689)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, web. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.