chore(deps): update dependency msw to v3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
msw (source)	^2.15.0 → ^3.0.2

---

Release Notes

mswjs/msw (msw)

v3.0.2

Compare Source

v3.0.2 (2026-10-03)

Bug Fixes

• vite: support virtual:msw imports in vitest (#​2802) (e73c381) @​kettanaito

v3.0.1

Compare Source

v3.0.1 (2026-09-30)

Bug Fixes

• treat CONNECT requests as the transport mechanism (#​2796) (7cad86a) @​kettanaito

v3.0.0

Compare Source

v3.0.0 (2026-09-28)

• v3.0.0 (#​2692) (2bb4342) @​kettanaito @​Andarist

⚠️ BREAKING CHANGES

• MSW is now ESM-only (#​2765).
• Deprecate support for Node.js v18 and v20 (#​2729). The minimal supported Node.js version is v22.
• msw/native is removed in favor of @msw/react-native.
• Require TypeScript 5.9 as the minimal version.
• Deprecate support for TypeScript 5.1 and 5.2 (#​2730)
• worker.stop() returns a Promise (#​2724). Awaiting it is relevant only for in-flight critical scenarios.
• graphql is now exported as msw/graphql (#​2691). GraphQL is now handled as a proper optional peer dependency.
• Removes the handleRequest() utility. Please use the defineNetwork() API instead.
• GraphQLLinkHandlers type has been renamed to GraphQLLink.
• The file:// requests now throw in Node.js as they normally do (not supported by fetch).
• The Content-Length request header is now removed by bypass().
• HTTP-to-WebSocket upgrade requests performed via fetch() now throw in Node.js as they normally do (not supported by fetch).
• Cookies are no longer managed in Node.js for better compatibilty. Instead, whatever is the default behavior of your environment that's the cookie behavior you get. This has no effect on the browser.
• WebSocket connection life cycle event has been renamed to websocket:connection (#​2783).
• onUnhandledRequest option has been renamed to onUnhandledFrame.
• The library no longer patches setTimeout to circumvent fake timers in test runners. You should advance the fake timers normally for delayed mocked responses to resolve.
• The library no longer returns a mocked cookie string on request.headers.get('cookie') in the handlers. It returns null in all environments. Please use the cookies resolver argument to have cookie-based logic.

Features

• Supports Node.js v24 and v26.
• Supports TypeScript v6.0 and v7.0.
• You can import individual utilities, like delay or passthrough, from the new msw/utils entrypoint for smaller footprint on your bundle.
• Support GraphQL v17.0.
• Support intercepting page navigations and form submissions (#​2721).
• Support GraphQL subscriptions (#​285, #​2763).
• Migrate from path-to-regexp to @msw/url (#​2678).
• Remove the following dependencies:
  • graphql
  • path-to-regexp
  • picocolors
  • statuses
  • strict-event-emitter
• Adds a Vite plugin for MSW (#​2781).
• Adds a websocket:error life cycle event to listen to WebSocket connection errors (#​2784).
• Support modifying the intercepted request headers in passthrough scenarios (#​2786).
• Support a new WebSocket Extension API that allows for better custom experiences (#​2791).

Bug fixes

• Fix an issue where preventing a page closure via the beforeunload listener would unregister the MSW worker (#​1105).
• Fix an issue that caused intermittent test failures in Vitest Browser Mode and Firefox if using maxWorkers: 1 (#​2726).
• Fix an issue where in-flight requests were incorrectly passthrough when performed before calling worker.stop() (#​2724, #​2597).
• Fix an issue where persisting cookies in localStorage would cause a maximum quota exceeded errors.
• Fix various issues related to the network interception in Node.js.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9b5d002c-5fe4-433d-8d3f-d82a36545ec3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	msw@​2.15.0 ⏵ 3.0.2	+5			+2

View full report