chore(deps)(deps): bump the dependencies group with 12 updates

[dependabot]

Bumps the dependencies group with 12 updates:

Package	From	To
@silverassist/next-script-loader	0.1.0	0.1.1
@playwright/test	1.62.1	1.63.0
@swc/core	1.16.1	1.16.2
@types/node	26.4.0	26.4.1
@types/react-dom	19.2.5	19.2.7
globals	17.11.0	17.12.0
jest	30.5.0	30.5.1
jest-environment-jsdom	30.5.0	30.5.1
lint-staged	17.4.1	17.5.0
next	16.3.3	16.3.4
tsdown	0.22.14	0.23.0
typescript-eslint	8.68.0	8.69.0

Updates @silverassist/next-script-loader from 0.1.0 to 0.1.1

Release notes

Sourced from @​silverassist/next-script-loader's releases.

v0.1.1

Fixed

• reload() had no re-entrancy protection: two calls for the same variant in quick succession (before the first's script finished loading) tore down and recreated the script twice, and since removing a <script> element doesn't reliably cancel its in-flight network request, both could execute and each apply their side effects. reload() now shares the in-flight promise for a same-variant call already in progress, the same way load() already did.

Added

• getGeneration() and an optional unload(atGeneration?) parameter -- a monotonically increasing counter, bumped on every load()/reload() call, that a delayed unmount cleanup can capture and pass back to unload() to detect it's been superseded by a newer mount and skip itself entirely (including the reference-count decrement).

Changelog

Sourced from @​silverassist/next-script-loader's changelog.

0.1.1 (Unreleased)

Fixed

• reload() had no re-entrancy protection: two calls for the same variant in quick succession (before the first's script finished loading) tore down and recreated the script twice. Since removing a <script> element doesn't reliably cancel its in-flight network request, both the superseded and the current script could go on to execute and each apply their side effects — the concrete case that surfaced this was @silverassist/leadcapture-form's remount-detection effect double-firing under React Strict Mode's dev-only effect replay, rendering its widget twice. reload() now shares the in-flight promise for a same-variant call already in progress, the same way load() already did.

Added

• getGeneration() and an optional unload(atGeneration?) parameter: a monotonically increasing counter, bumped on every load()/reload() call, that a delayed unmount cleanup can capture and pass back to unload() to detect it's been superseded by a newer mount and skip itself entirely (including the reference-count decrement). Generalizes the hand-rolled generation guard leadcapture-form carried since 0.1.0, needed because reload() doesn't change the reference count.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​silverassist/next-script-loader since your current version.

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @swc/core from 1.16.1 to 1.16.2

Changelog

Sourced from @​swc/core's changelog.

[1.16.2] - 2026-09-04

Bug Fixes

• (es/compat) Preserve for-of var binding scope (#12158) (f6d5bd1)

• (es/decorators) Drop params from getter replacing decorated private method (#12161) (d56f594)

• (es/flow) Preserve Flow component type semantics (#12090) (c8d5b49)

• (es/minifier) Mark for update and test as executed multiple time (#12131) (1260e36)

• (es/minifier) Report for loop var decl as assign (#12136) (783bbc2)

• (es/minifier) Don't replace value-used console.*.bind() calls with undefined (#12138) (ed74223)

• (es/minifier) Drop spans of cached globals values (#12129) (9a306b8)

• (es/minifier) Preserve effects of returned value calls (#12140) (c37b5a9)

• (es/minifier) Avoid JSX sequence inlining loop (#12149) (4e79b94)

• (es/minifier) Preserve bindings in copied inline arrows (#12141) (cf7b5c9)

• (es/minifier) Preserve do-while control-flow targets (#12160) (f62c437)

• (es/minifier) Preserve pure annotation ownership (#12180) (ec780f9)

• (es/parser) Retry ambiguous Program parsing (#12142) (141a320)

• (es/parser) Preserve await grammar boundaries (#12156) (c732683)

• (es/quote) Restore await parsing (#12163) (918f517)

... (truncated)

Commits

• 5ae9149 chore: Publish 1.16.2 with swc_core v78.0.0
• 5c24a37 chore: Publish 1.16.2-nightly-20260904.1 with swc_core v78.0.0
• See full diff in compare view

Updates @types/node from 26.4.0 to 26.4.1

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.5 to 19.2.7

Commits

• See full diff in compare view

Updates globals from 17.11.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

Commits

• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• See full diff in compare view

Updates jest from 30.5.0 to 30.5.1

Release notes

Sourced from jest's releases.

v30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

• @​HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

Changelog

Sourced from jest's changelog.

30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

Commits

• 9ab14fe v30.5.1
• See full diff in compare view

Updates jest-environment-jsdom from 30.5.0 to 30.5.1

Release notes

Sourced from jest-environment-jsdom's releases.

v30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

New Contributors

• @​HuzaifaChaudary made their first contribution in jestjs/jest#16413

Full Changelog: jestjs/jest@v30.5.0...v30.5.1

Changelog

Sourced from jest-environment-jsdom's changelog.

30.5.1

Fixes

• [jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
• [jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
• [jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
• [jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
• [jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

• [jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

Commits

• 9ab14fe v30.5.1
• See full diff in compare view

Updates lint-staged from 17.4.1 to 17.5.0

Release notes

Sourced from lint-staged's releases.

v17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

Changelog

Sourced from lint-staged's changelog.

17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

Commits

• dcb59f6 Merge pull request #1846 from lint-staged/changeset-release/main
• 9c8c6dc chore(changeset): release
• 586466f Merge pull request #1849 from lint-staged/improve-intent-to-add
• 45eda5f refactor: improve --intent-to-add detection
• 26372e3 Merge pull request #1848 from lint-staged/fix-color-detection
• d718ccc fix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streams
• be78a51 Merge pull request #1847 from lint-staged/intent-to-add
• f9063b7 feat: refuse to run when files were staged with --intent-to-add
• a767299 Merge pull request #1845 from lint-staged/updates
• 61ffd25 style: add VS Code extension config
• Additional commits viewable in compare view

Updates next from 16.3.3 to 16.3.4

Release notes

Sourced from next's releases.

v16.3.4

Follow-up release to v16.3.3 re-enabling AVIF Image Optimization (#97949).

The following bug fixes have been backported. It does not include all pending features/changes on canary.

• testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• Fix build error when aliasing typescript to @​typescript/typescript6 (#97997)
• Fix unset crossOrigin in Turbopack manifests (#97930)

Credits

Huge thanks to @​eps1lon, @​mischnic, and @​timneutkens for helping!

Commits

• 299180d v16.3.4
• 12e173d [16.3.x] Re-enable AVIF image optimization and require sharp 0.35.4 (#97949)
• 5d9022e [backport] Fix unset crossOrigin in Turbopack manifests (#97930)
• d8f4560 [16.3.x] Fix build error when aliasing typescript to @​typescript/typescript6 ...
• 656aebf [16.3] testmode: Fix infinite recursion in testmode passthrough fetch (#97691)
• f37c1d6 [16.3.x] ci: remove pull_request_stats workflow (#97975)
• See full diff in compare view

Updates tsdown from 0.22.14 to 0.23.0

Release notes

Sourced from tsdown's releases.

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in rolldown/tsdown#1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)

... (truncated)

Commits

• ced9a2c chore: release v0.23.0
• f5f9ea9 docs: add Ember support guide (#1043)
• 8ac89dc chore: upgrade Vitest to v5
• 96a4098 feat: expose programmatic watch controls (#1062)
• 61718d7 chore: upgrade deps
• d04119c chore: upgrade deps
• 55f89c5 chore(deps): update pnpm to v12.1.0 (#1060)
• 946224d fix: ignore optional dependencies in type definitions
• 62f01cd chore: release v0.23.0-rc.1
• bf53f43 fix(cli): camel-case nested flag keys
• Additional commits viewable in compare view

Updates typescript-eslint from 8.68.0 to 8.69.0

Release notes

Sourced from typescript-eslint's releases.

v8.69.0

8.69.0 (2026-08-31)

🚀 Features

• eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

• eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)
• eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
• eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
• website: respect allowJs playground config (#12744)

❤️ Thank You

• Abdu Alim Arlikhozhaev @​Arlikhozhaev
• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• wonbeanie @​wonbeanie
• Younsang Na @​nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.69.0 (2026-08-31)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 9a6e546 chore(release): publish 8.69.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

🕒 Auto-merge held by the release-age cooldown (minimum 7 day(s)).

These bumped versions are too new to auto-merge — a guard against freshly-published malicious or broken releases:

• @playwright/test@1.63.0 (3.4d < 7d)
• @swc/core@1.16.2 (3.5d < 7d)
• @types/node@26.4.1 (6.5d < 7d)
• @types/react-dom@19.2.7 (4.9d < 7d)
• globals@17.12.0 (6.9d < 7d)
• jest@30.5.1 (7.0d < 7d)
• jest-environment-jsdom@30.5.1 (7.0d < 7d)
• lint-staged@17.5.0 (3.0d < 7d)
• tsdown@0.23.0 (4.6d < 7d)

The PR stays open for manual review. It will not merge on its own; re-run this workflow (or merge manually) once the versions have aged.