Bump the npm-development group with 20 updates

[dependabot]

Bumps the npm-development group with 20 updates:

Package	From	To
@playwright/test	1.61.1	1.63.0
@testing-library/jest-dom	6.9.1	7.0.1
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
@vitest/coverage-v8	4.1.9	5.0.0
concurrently	9.2.4	10.0.5
eslint	10.6.0	10.10.0
globals	17.7.0	17.12.0
jsdom	29.1.1	30.0.1
smtp-server	3.19.1	3.19.8
tsx	4.23.0	4.23.13
typescript	5.9.3	7.0.2
typescript-eslint	8.62.0	8.69.0
vitest	4.1.9	5.0.0
@vitejs/plugin-react	4.7.0	6.1.1
autoprefixer	10.4.27	10.5.5
tailwindcss	3.4.19	4.3.3
vite	6.4.3	8.2.2
@types/bcryptjs	2.4.6	3.0.0
@types/node	22.19.17	26.4.1

Updates @playwright/test from 1.61.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @testing-library/jest-dom from 6.9.1 to 7.0.1

Release notes

Sourced from @​testing-library/jest-dom's releases.

v7.0.1

7.0.1 (2026-08-09)

Bug Fixes

• declare vitest as an optional peer dependency (#733) (3782c78)

v7.0.0

7.0.0 (2026-07-20)

Features

• add toContainAnyBy* and toContainOneBy* query matchers (1e39089)

BREAKING CHANGES

• @​testing-library/dom is now a required peer dependency. The minimum supported Node.js version is now 22.

Repaired release for testing-library/jest-dom#731

v6.10.0

6.10.0 (2026-07-20)

Features

• add toContainAnyBy* and toContainOneBy* query matchers (#731) (cae44df)

Commits

• 3782c78 fix: declare vitest as an optional peer dependency (#733)
• 1e39089 feat: add toContainAnyBy* and toContainOneBy* query matchers
• cae44df feat: add toContainAnyBy* and toContainOneBy* query matchers (#731)
• 55c07ce ci: switch release to npm trusted publishing (#726)
• 213256f docs: move toHaveSelection from the deprecated section (#717)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/jest-dom since your current version.

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @testing-library/user-event from 14.6.1 to 14.6.7

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.7

14.6.7 (2026-09-02)

Bug Fixes

• normalize DataTransfer format aliases (#1326) (1e0020b)
• feature: Add iframe support for user.keyboard typing (#1275) (1e0020b)

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

• default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

• tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

• keyboard event repeat property (#1312) (d7e80e3)

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

• release: manually release a patch version (#1321) (1d18b1f), closes #1317

v14.6.2

14.6.2 (2026-08-03)

Commits

• 1e0020b fix: normalize DataTransfer format aliases (#1326)
• d4b0593 feature: Add iframe support for user.keyboard typing (#1275)
• 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
• 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
• d7e80e3 fix: keyboard event repeat property (#1312)
• 43d8e6c ci: remove broken npm backfill step (#1322)
• 1d18b1f fix(release): manually release a patch version (#1321)
• 232f3e6 docs: add migration note and clean up README badges (#1320)
• 83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
• e8da819 ci: publish to npm via OIDC trusted publishing (#1317)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.

Updates @vitest/coverage-v8 from 4.1.9 to 5.0.0

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in vitest-dev/vitest#10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in vitest-dev/vitest#10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in vitest-dev/vitest#10212 (80f07)
• Inline expect package  -  by @​sheremet-va in vitest-dev/vitest#10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in vitest-dev/vitest#10222 (994c6)
• Require Node.js 22 and Vite 6.4  -  by @​sheremet-va in vitest-dev/vitest#10178 (38762)
• Fail expect.poll when function didn't resolve in time  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)
• Throw an error if hoistable methods are outside the top level scope  -  by @​sheremet-va in vitest-dev/vitest#10460 (d0b4f)
• toHaveTextContent is strict, add toMatchTextContent as alternative  -  by @​sheremet-va in vitest-dev/vitest#10473 (18f30)
• Don't lookup config file from ancestor directories  -  by @​hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)
• Inline @vitest/runner package, do not publish it anymore  -  by @​sheremet-va in vitest-dev/vitest#10511 (6d6e4)
• Allow mutating happy-dom/jsdom window object  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)
• Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based  -  by @​sheremet-va in vitest-dev/vitest#10516 (bdd98)
• Add screenshotDirectory config to browser.expect.toMatchScreenshot  -  by @​macarie in vitest-dev/vitest#10592 (a60de)
• Update @sinonjs/fake-timers and support mocking Temporal  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)
• Remove webdriverio package  -  by @​sheremet-va in vitest-dev/vitest#10675 (5fed6)
• Clear mocks by default before each test  -  by @​sheremet-va in vitest-dev/vitest#10613 (0f646)
• Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start  -  by @​sheremet-va in vitest-dev/vitest#10293 (334ed)
• Separate config resolution from the server creation  -  by @​sheremet-va in vitest-dev/vitest#10554 (1c0ec)
• Inline projects extend the root config by default  -  by @​sheremet-va in vitest-dev/vitest#10750 (fec00)
• Enable mocking Temporal without fake timers  -  by @​fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)
• Support nested projects  -  by @​sheremet-va in vitest-dev/vitest#10846 (ec367)
• Use > as separator in -t, calculate only once  -  by @​sheremet-va in vitest-dev/vitest#10686 (a0b20)
• Fail the test when an asynchronous assertion is not awaited  -  by @​sheremet-va in vitest-dev/vitest#10868 (86d4a)
• Share the Vite server between inline projects  -  by @​sheremet-va in vitest-dev/vitest#10848 (d87c9)
• Parse files statically in vitest list by default  -  by @​sheremet-va in vitest-dev/vitest#11088 (51e94)
• benchmark:
  • Rewrite the public API  -  by @​sheremet-va in vitest-dev/vitest#10113 (19f6e)
• browser:
  • Iframe scale  -  by @​macarie in vitest-dev/vitest#9745 (b6398)
  • Enable locators.exact by default  -  by @​sheremet-va in vitest-dev/vitest#10430 (e2032)
  • Require sessionId for orchestrator html request  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)
  • Save failure screenshots in attachmentsDir  -  by @​macarie in vitest-dev/vitest#10917 (3b5bb)
• coverage:
  • include/exclude globs too eager  -  by @​AriPerkkio in vitest-dev/vitest#9818 (edacb)
  • Allow thresholds.perFile to accept an object  -  by @​vladlenskiy and @​AriPerkkio in vitest-dev/vitest#10190 (13b78)
• expect:
  • Fix toThrow("") behavior by reverting #6710  -  by @​hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)
• mocker:
  • Deserialize automock as automock  -  by @​nami8824 in vitest-dev/vitest#10192 (2f892)
• reporters:
  • blob reporter and --merge-reports default to .vitest/blob/  -  by @​AriPerkkio in vitest-dev/vitest#10232 (d22b0)
  • Write json and junit reporter output files to .vitest by default  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @​AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

• f441c6f chore: release v5.0.0 (#11130)
• c4473e4 fix(coverage): prevent crash on /@fs/ prepended virtual files (#11119)
• 897f51f chore: release v5.0.0-rc.4 (#11107)
• 7db80dc chore: release v5.0.0-rc.3 (#11089)
• 5f6a5e8 feat(coverage): switch to @vitest/istanbuljs packages (#11053)
• c6174a6 fix(coverage): v8 to ignore Vite SSR's generated import bindings (#11023)
• af83d1b chore: release v5.0.0-rc.2 (#10976)
• a7fa111 chore: release v5.0.0-rc.1 (#10920)
• 0553851 chore: add Knip checks (#10847)
• b7be731 chore: release v5.0.0-beta.7 (#10825)
• Additional commits viewable in compare view

Updates concurrently from 9.2.4 to 10.0.5

Release notes

Sourced from concurrently's releases.

v10.0.5

What's Changed

• fix: correctly output non-ASCII text on Windows by @​DanielC000 in open-cli-tools/concurrently#604
• fix: expand wildcards from package.json5 when package.json is missing by @​DSeaStar in open-cli-tools/concurrently#608

New Contributors

• @​DanielC000 made their first contribution in open-cli-tools/concurrently#604
• @​DSeaStar made their first contribution in open-cli-tools/concurrently#608

Full Changelog: open-cli-tools/concurrently@v10.0.4...v10.0.5

v10.0.4

What's Changed

• deps: upgrade shell-quote to 1.9.0 by @​Mayvis in open-cli-tools/concurrently#599
• fix: avoid kill timeout exit delays by @​rajanpanth in open-cli-tools/concurrently#601

New Contributors

• @​Mayvis made their first contribution in open-cli-tools/concurrently#599
• @​rajanpanth made their first contribution in open-cli-tools/concurrently#601

Full Changelog: open-cli-tools/concurrently@v10.0.3...v10.0.4

v10.0.3

Republish of https://github.com/open-cli-tools/concurrently/releases/tag/v10.0.1 with Trusted Publishing enabled (see #595)

Full Changelog: open-cli-tools/concurrently@v10.0.2...v10.0.3

v10.0.2

Test version to restore Trusted Publishing. Not published to npm.

v10.0.1

• Ensure FlowController type is exported - #594

Full Changelog: open-cli-tools/concurrently@v10.0.0...v10.0.1

v10.0.0

💥 Breaking Changes

• Dropped support for Node.js <22.0.0. Older Node.js version have reached end-of-life, and certain features require new-ish JS APIs.
• concurrently is now ESM-only. It's now possible to require(esm). See here for interoperability.
• Prefix colors now default to automatic - #581 The colors used to default to reset (which does nothing). Concurrently now automatically selects a color, out of the box. The list of colors used is not jarring nor carries semantic meaning, and reads well in both dark and light terminal backgrounds.
• Removed deprecated flags and options
  • CLI flag --name-separator: use commas instead.
  • API option killOthers: use killOthersOn instead.

✨ New Features

• Support applying modifiers to hex prefix colors (e.g. #ff0000.bold) - #450

... (truncated)

Commits

• 1b8cbeb 10.0.5
• 544dba0 docs: make linter happy
• 667b701 deps: update several dev deps
• f67c57c vscode: use installed TS version
• dbb5617 fix: expand wildcards from package.json5 when package.json is missing (#608)
• 9f90a1a fix: correctly output non-ASCII text on Windows (#604)
• 94415cc ci: fix publishing to latest/backport
• 2524b65 10.0.4
• 1080199 fix: avoid kill timeout exit delays (#601)
• e668211 ci: publish to latest only on npm
• Additional commits viewable in compare view

Updates eslint from 10.6.0 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

• 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

• ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

• 3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

v10.9.0

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

... (truncated)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
• Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

v17.11.0

• Add react-native globals (#337) 61eafbf

---

sindresorhus/globals@v17.10.0...v17.11.0

v17.10.0

• Add GM_cookie to Greasemonkey globals (#349) f468407

---

sindresorhus/globals@v17.9.0...v17.10.0

v17.9.0

• Update globals (2026-08-01) (#348) 5a958ed

---

sindresorhus/globals@v17.8.0...v17.9.0

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

Commits

• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• 8c59927 17.11.0
• 61eafbf Add react-native globals (#337)
• 7bed4af 17.10.0
• f468407 Add GM_cookie to Greasemonkey globals (#349)
• 8e7b935 17.9.0
• 5a958ed Update globals (2026-08-01) (#348)
• 36c7659 17.8.0
• Additional commits viewable in compare view

Updates jsdom from 29.1.1 to 30.0.1

Release notes

Sourced from jsdom's releases.

v30.0.1

• Fixed getComputedStyle() with calc() and other functions throwing an exception, which regressed in v30.0.0. (@​asamuzaK)
• Sped up up range operations on large documents (@​leonidaz)

v30.0.0

Breaking changes:

• Node.js minimum version raised to ^22.22.2 || ^24.15.0 || >=26.0.0.

Other changes:

• Added CSS.escape() and CSS.supports() functions. (@​asamuzaK)
• Added 'background-position-x' and 'background-position-y' CSS properties. (@​olagokemills)
• Fixed getComputedStyle() to convert length values into pixels. (@​asamuzaK)
• Fixed CSS function serialization, e.g., in the return value of getPropertyValue(). (@​asamuzaK)
• Fixed the type of error thrown by document.evaluate() (@​dokson)

Commits

• 6584485 30.0.1
• 0c51df6 Update dependencies and dev dependencies
• 32adb34 Bump @​asamuzakjp/dom-selector
• 70f014a Speed up range operations on large documents
• 250d7ee Partially fix getComputedStyle with calc()
• 20a01fc 30.0.0
• 8c8e583 Precompute WPT expectation matches
• f32245c Bump Node.js floor and dependencies
• 03ef23b Add background-position longhands
• ded056f Test CSS.escape() with numeric IDs
• Additional commits viewable in compare view

Updates smtp-server from 3.19.1 to 3.19.8

Changelog

Sourced from smtp-server's changelog.

3.19.8 (2026-09-06)

Bug Fixes

• deps: move to nodemailer 10 and raise the Node floor to 20 (ac667d2)

3.19.7 (2026-09-02)

Bug Fixes

• destroy a half-open connection once the socket timeout fires (dd70e7f)

3.19.6 (2026-09-01)

Bug Fixes

• deps: update nodemailer to 9.1.1 (aa4d0f7)

3.19.5 (2026-08-31)

Bug Fixes

• deps: update nodemailer to 9.1.0 (c070be6)