Skip to content

Bump the npm-patch-and-minor group across 1 directory with 12 updates - #163

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-patch-and-minor-75aab395f1
Closed

Bump the npm-patch-and-minor group across 1 directory with 12 updates#163
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-patch-and-minor-75aab395f1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-patch-and-minor group with 12 updates in the / directory:

Package From To
@playwright/test 1.64.1 1.65.0
@asamuzakjp/css-color 7.1.9 7.2.0
@eslint-community/regexpp 4.12.2 4.12.3
@monogrid/gainmap-js 3.7.2 3.7.3
semver 7.8.5 7.8.6
ast-v8-to-istanbul 1.0.7 1.0.8
parse5 8.0.1 8.1.1
playwright 1.64.1 1.65.0
playwright-core 1.64.1 1.65.0
tinybench 6.2.2 6.2.3
tough-cookie 6.0.2 6.1.0
undici 8.12.3 8.12.4

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

  • There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
  • Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
  • Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
  • Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

  • New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

    test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});

  • test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

    test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

... (truncated)

Commits
  • a1f35e1 chore: mark v1.65.0 (#43925)
  • a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
  • 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
  • daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
  • 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
  • 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
  • 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
  • d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
  • 6e3f5ff docs: release notes for v1.65 (#43874)
  • aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
  • Additional commits viewable in compare view

Updates @asamuzakjp/css-color from 7.1.9 to 7.2.0

Release notes

Sourced from @​asamuzakjp/css-color's releases.

v7.2.0

What's Changed

Full Changelog: asamuzaK/cssColor@v7.1.9...v7.2.0

Commits

Updates @eslint-community/regexpp from 4.12.2 to 4.12.3

Release notes

Sourced from @​eslint-community/regexpp's releases.

v4.12.3

4.12.3 (2026-11-08)

Bug Fixes

  • updates unicode resource with latest (#221) (1eb755f)
Commits

Updates @monogrid/gainmap-js from 3.7.2 to 3.7.3

Release notes

Sourced from @​monogrid/gainmap-js's releases.

v3.7.3

3.7.3 (2026-11-05)

Bug Fixes

  • encode: write the MPF primary image type Chrome expects (#90) (b3cfd9f), closes #89
Changelog

Sourced from @​monogrid/gainmap-js's changelog.

3.7.3 (2026-11-05)

Bug Fixes

  • encode: write the MPF primary image type Chrome expects (#90) (b3cfd9f), closes #89
Commits
  • 2529e4e chore(release): 3.7.3 [skip ci]
  • b3cfd9f fix(encode): write the MPF primary image type Chrome expects (#90)
  • e91eafd chore(deps-dev): bump three and @​types/three (#88)
  • 892af77 docs: document relative brightness, content boost and gamut handling when enc...
  • See full diff in compare view

Updates semver from 7.8.5 to 7.8.6

Release notes

Sourced from semver's releases.

v7.8.6

7.8.6 (2026-11-02)

Bug Fixes

Chores

Changelog

Sourced from semver's changelog.

7.8.6 (2026-11-02)

Bug Fixes

Chores

Commits

Updates ast-v8-to-istanbul from 1.0.7 to 1.0.8

Release notes

Sourced from ast-v8-to-istanbul's releases.

v1.0.8

What's Changed

Full Changelog: AriPerkkio/ast-v8-to-istanbul@v1.0.7...v1.0.8

Commits
  • e14e741 1.0.8
  • a3880e7 fix: static class methods always reported as covered (#216)
  • cd07180 chore: remove rollup dev dependency
  • 3ceeca8 chore(deps): update vitest to v2 (#214)
  • 97dc2b8 chore(deps): update all non-major npm dependencies (#213)
  • 927f712 chore(deps): update all non-major npm dependencies (#211)
  • dfb7ceb chore: downgrade pnpm to 11 to avoid `Cannot find module '<some-path>/pnpm/12...
  • 4f303ab chore(deps): update all non-major npm dependencies (#209)
  • e8e0b7f chore(deps): update all non-major npm dependencies (#206)
  • 4ea1075 chore(deps): update all non-major npm dependencies (#205)
  • Additional commits viewable in compare view

Updates parse5 from 8.0.1 to 8.1.1

Release notes

Sourced from parse5's releases.

v8.1.1

This release fixes nineteen security-relevant issues in the tokenizer, serializer, SAX parser, rewriting stream, tree adapters and tree construction, reported by outside researchers and by Anthropic, and further issues of the same kinds found while reviewing them. The issues include crashes from a few bytes of input, parse time and memory far out of proportion to the input, and serializer output that re-parses into markup the parsed tree did not contain. Everyone who runs parse5 on untrusted input should update.

There are no CVEs or GitHub security advisories for these issues: private vulnerability reporting on this repository is only accessible to @​inikulin. The current maintainers cannot access it, so the reports could not be filed or published as advisories here.

Security fixes

  • 9b57bf87 High: a crash from two code units. A lone low surrogate followed by another low surrogate was decoded as a pair, and String.fromCodePoint then threw out of every parser entry point. Only a high surrogate now starts a pair. Reported by Joshua Rogers and by Anthropic.
  • 98a4bb34 High: a crash, also through cheerio's $.html(). Serialization recursed once per DOM level, so a few KB of nesting exhausted the call stack. It now uses an explicit stack, and the output is unchanged byte for byte. Reported by SnailSploit.
  • ea240155 High: quadratic parse time. The SAX parser's namespace stack was shifted from the front for every element, quadratic in the nesting. It is kept at its tail. Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina.
  • fa1eb9b0 High: a crash, and quadratic time before it. Nested templates were closed recursively at EOF, and the template insertion-mode stack was shifted per template. Both are iterative now. Reported by SnailSploit and by the three reporters above.
  • 20591465 High: quadratic parse time. Foster parenting scanned all preceding siblings of the table for every insertion. The reference is found without scanning. Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina.
  • 6c705d57 High: 8,002,000 attribute records from 39 KB of input. Integration-point checks read the attribute list of every element, which the htmlparser2 adapter allocates on each call. Only annotation-xml needs it, and its list is now read once per element, as the HTML Standard decides by the start tag (rereading it on every pop took 7 s for 8,000 attributes and children; a script that edits encoding mid-parse no longer changes the verdict, stated in the commit). Reported by Anthropic; the rereads on every pop were found while reviewing this series.
  • 0a61bd54 High: 210 ms from 35 KB, growing quadratically. adoptAttributes rebuilt the recipient's name Set for an empty merge, so repeated <html> and <body> tags without attributes were quadratic. It returns early. Tags that each add an attribute rebuilt it too (816 ms for 8,000 <html> tags), so the adapter now keeps the names between merges and re-indexes when the list changed under it; a script that renames an attribute between two merges to a name the cache has never seen is the one documented difference (stated in the commit). Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina; the merges that add attributes were found while reviewing this series.
  • 89dceda8 High: a crash and mutation XSS. Resetting the insertion mode matched foreign elements by tag id, so an SVG select or template selected an HTML mode; a TypeError followed from 50 bytes, and a longer shape serialized into an <img onerror> absent from the tree. Foreign elements are skipped. Reported by Anthropic.
  • f5d58d8f High: quadratic parse time from formatting tags. Formatting tags with distinct attributes (<b a=1><b a=2>…) made every insertion into the list of active formatting elements scan the list for Noah's Ark, and formatting end tags scanned and spliced it. The list is now linked and indexed by tag and by attributes, so insertion costs the tag's attributes and removal and lookup are constant. An attribute group leaves the index with its last entry, so the index does not grow with the distinct attribute sets of the input. Reported by Liyi Zhou, Ziyue Wang, Strick Sheng, Maurice Ng and Chenchen Yu (University of Sydney), and by Anthropic.
  • e2901d06 High: 13–18 s from 300 KB, also through cheerio's .append(), .html() and $(). Moving a node's children (every parseFragment result out of its root, the adoption agency's furthest block) detached them one at a time from the front of the child list, quadratic in their number. The children are copied once, detached from the end and appended in order, and both bundled adapters check the last child before searching the list, as insertBefore already did; the adapter interface is unchanged. parseFragment of 100,000 <b></b>: 4.1 s → 45 ms. Reported by Anthropic.
  • fcce48d0 High: the reported deep-nesting quadratic. Every search of the stack of open elements cost up to its depth per token: scope checks, list items, generic end tags, insertion-mode resets, end tags in foreign content, foster parenting and the adoption agency's up to eight passes per end tag. 391 KB of nested <div>s took 23.7 s, and 256 repetitions of <b>, 255 <span><div> pairs and 33 </b> took 17.2 s from 735 KB. Once 64 elements are open, the stack indexes them by tag and counts the special elements and scope boundaries at or below each, so every search is constant per token, and the adoption agency leaves a removed element's slot free instead of shifting the stack; the two documents take 39 ms and 104 ms. Stacks that never reach 64 elements are scanned as before; a stack that does keeps the index for the rest of the parse and pays for it on every push and pop (300 nested tables parse about 20% slower). Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina; the adoption-agency and foreign-content cases were found while reviewing this series.
  • #1922 High: quadratic tokenizer time from a tag with many attributes. The duplicate-attribute check compared every new name with every earlier one; tags with more than 64 attributes now use a set. Reported by SameerJS6 in #1901.
  • 53d1261c Medium: a script-stripping rewriter misses a script. When the parsed chunk was dropped between the two code points of a character reference, input after the reference was skipped: no tag events for it, while RewritingStream forwarded its raw bytes. The position is recomputed from the current buffer. Reported by Anthropic.
  • 4bffbe64 Medium: a filter bypass once the output is embedded in a page. At EOF inside a tag, the pending text's source range covered the dropped tag, so RewritingStream forwarded an unfinished tag that no listener saw. The text now ends where the tag starts. Reported by Anthropic.
  • e02abba4 Medium: XSS through the rewriter. RewritingStream#emitText chose raw output from lastStartTagName, so text after </script>, before <script> or in an SVG <style> was written unescaped and entity-encoded input became live markup. It now tracks inRawText from the tokenizer state. Reported by Joshua Rogers and by Anthropic.
  • ac2f60d5 Medium: memory proportional to an uncapped stream. The streaming parsers kept a whole run of text as one pending token until a tag; memory grew with the stream. Completed text is flushed when a parsed chunk is dropped, with exact source ranges, in every state without an unfinished token, so a stream whose every chunk ends inside a CDATA ]], a named reference or an escaped-script < is flushed too and only the pending construct stays buffered. Reported by Liyi Zhou, Ziyue Wang, Strick Sheng, Maurice Ng and Chenchen Yu (University of Sydney); the chunks ending in a delimiter or reference were found while reviewing this series.
  • fd22254c Medium: mutation XSS. The adoption agency acted on an older formatting element behind a scope boundary and moved the boundary element; the serialized tree re-parsed into an <img> absent from the input. It runs on the identified element. Reported by Anthropic.
  • 61676e2b Medium, for consumers that inspect parse5's tree and forward the original bytes. Implied end tags popped foreign elements, so a </form> closed an SVG rp and parse5 read raw text where browsers see an <img onerror>. HTML elements only. Reported by Anthropic.
  • b9093da5 Medium, same consumer pattern. Foreign end tags were matched with toLowerCase, which folds U+212A KELVIN SIGN to k; the wrong ancestors stayed open and parse5 hid an <img> browsers render. Matching is ASCII case-insensitive. Reported by Anthropic.
  • 69f69313 Medium, same consumer pattern. In a fragment, an unmatched foreign end tag was dropped at the root instead of being processed with the HTML rules, so a </form> did not reset the form pointer and a later <form action=javascript:…> was missing from the fragment. Reported by Anthropic.
  • d5f4f129 Medium, same consumer pattern. A fragment context's SVG form ancestor was taken as the form element pointer, suppressing the fragment's HTML form. Only an HTML form qualifies. Found while reviewing this series.
  • 48aba8cb Low: a self-closing <svg/> or <math/> left its namespace frame in the SAX simulator, so a stream of such roots grew the frame stack without bound and following content was tokenized as foreign; integration-point end tags now close only the frame their element opened. Frames also follow tree construction for svg and math inside the other foreign namespace, mglyph and malignmark in a MathML text integration point, and </p> and </br>. Found while reviewing this series.
  • f52fa37f Documentation. SECURITY.md now says that the current maintainers cannot see reports filed through GitHub's private vulnerability reporting, and that Tidelift is the only channel for reports.

Other changes

New Contributors

Packages

parse5 8.1.1, parse5-sax-parser 8.0.1, parse5-html-rewriting-stream 8.1.1, parse5-htmlparser2-tree-adapter 8.0.2, parse5-parser-stream 8.1.1, parse5-plain-text-conversion-stream 8.0.1. The dependent packages require the fixed parse5.

Full Changelog: inikulin/parse5@v8.1.0...v8.1.1

... (truncated)

Commits
  • 8eea616 chore: v8.1.1 (#1926)
  • fcce48d perf(parser): find open elements without scanning a deep stack
  • e2901d0 perf(parser): move children between nodes without shifting the list
  • f5d58d8 perf(parser): find and remove formatting list entries in constant time
  • 48aba8c fix(sax-parser): enter and leave foreign namespaces where tree construction does
  • f52fa37 docs(security): name Tidelift as the only channel for reports
  • d5f4f12 fix(parser): ignore a foreign form ancestor of the fragment context
  • 69f6931 fix(parser): process unmatched foreign end tags at the root of a fragment
  • b9093da fix(parser): match foreign end tags ASCII case-insensitively
  • 61676e2 fix(parser): generate implied end tags for HTML elements only
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by fb55, a new releaser for parse5 since your current version.


Updates playwright from 1.64.1 to 1.65.0

Release notes

Sourced from playwright's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

  • There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
  • Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
  • Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
  • Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

  • New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

    test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});

  • test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

    test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

... (truncated)

Commits
  • a1f35e1 chore: mark v1.65.0 (#43925)
  • a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
  • 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
  • daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
  • 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
  • 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
  • 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
  • d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
  • 6e3f5ff docs: release notes for v1.65 (#43874)
  • aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
  • Additional commits viewable in compare view

Updates playwright-core from 1.64.1 to 1.65.0

Release notes

Sourced from playwright-core's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

  • There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
  • Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
  • Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
  • Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

  • New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

    test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});

  • test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

    test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

... (truncated)

Commits
  • a1f35e1 chore: mark v1.65.0 (#43925)
  • a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
  • 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
  • daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
  • 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
  • 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
  • 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
  • d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
  • 6e3f5ff docs: release notes for v1.65 (#43874)
  • aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
  • Additional commits viewable in compare view

Updates tinybench from 6.2.2 to 6.2.3

Release notes

Sourced from tinybench's releases.

v6.2.3

   🏎 Performance

    View changes on GitHub
Commits
  • e90b98a chore: release v6.2.3
  • 36f88ae chore(deps): update all non-major dependencies (#723)
  • 89b5ca1 perf: reduce large-sample sorting overhead (#720)
  • 75a53e9 chore(deps): update dependency @​cloudflare/workers-types to v5.20261028.1 (#722)
  • 1ec5417 chore(deps): update pnpm to v12.16.1 (#721)
  • 66b4952 chore(deps): update all non-major dependencies (#719)
  • ac52571 chore(deps): update dependency @​cloudflare/workers-types to v5.20261026.1 (#718)
  • ab03a72 chore(deps): lock file maintenance (#713)
  • 0822733 chore(deps): update node.js to v26 (#715)
  • f91c85f chore(deps): pin dependencies (#717)
  • Additional commits viewable in compare view

Updates tough-cookie from 6.0.2 to 6.1.0

Release notes

Sourced from tough-cookie's releases.

v6.1.0

Notable changes

Secure cookies are rejected when set from an insecure origin (#656, #663)

CookieJar now refuses to store a Secure cookie set from a URL that isn't potentially trustworthy, such as plain http://example.com, per RFC 6265bis §5.7 step 13. https: and wss: URLs are still accepted, and so are localhost and loopback addresses while allowSecureOnLocal is enabled (the default). setCookie() now rejects with Cookie is Secure but this is not a secure connection, or drops the cookie silently when ignoreError: true is passed.

This changes behavior that existing v6 code may rely on. To keep storing Secure cookies no matter which origin set them, opt out with:

new CookieJar(store, { enforceSecureOriginOnStorage: false })

The opt-out applies only to storage. On retrieval, Secure cookies are still returned only for secure origins, the same as in v6.0.x. The setting survives serialize()/deserialize() and clone().

Other behavior changes

  • __Host- cookies now need an explicit Path=/ attribute. Having the default path come out as / is no longer enough (#608).
  • Cookie.validate() now returns false for names that aren't valid HTTP tokens, such as empty names, names with separators or control characters, and non-ASCII names. Parsing and storage are unchanged (#650).
  • An explicit SameSite=None is now kept when serializing with Cookie.toString() and getSetCookieStrings(); it used to be dropped (#639).
  • An IPv4 address in the Domain attribute is now accepted instead of being treated as a public suffix (#630).

Additions

  • New exported PrefixSecurityMode type for the prefixSecurity option (#659, #667).
  • The getCookiesSync, getCookieString*, getSetCookieStrings* and setCookieSync methods now accept a URL as well as a string, matching their async counterparts (#655).

What's Changed

... (truncated)

Commits
  • f5dd871 6.1.0
  • e99f6d6 chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 up...
  • fb8f307 chore(deps): bump esbuild and tsup (#674)
  • e0a2cc5 chore(deps): bump tldts (#669)
  • 34a379f chore(deps): bump fast-uri from 3.1.7 to 3.1.9 (#668)
  • e02c190 chore(deps-dev): bump vitest from 4.1.12 to 5.0.5 (#672)
  • 6f53e4f ci: stop patching jsdom WPT expectations in integration tests (#664)
  • d20c170 feat: add enforceSecureOriginOnStorage option to opt out of Secure-cookie ori...
  • 9ba0b1c fix: reject Secure cookies set over untrustworthy origins (#656)

@dependabot
Bump the npm-patch-and-minor group across 1 directory with 12 updates
027e4de 
Bumps the npm-patch-and-minor group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [@asamuzakjp/css-color](https://github.com/asamuzaK/cssColor) | `7.1.9` | `7.2.0` |
| [@eslint-community/regexpp](https://github.com/eslint-community/regexpp) | `4.12.2` | `4.12.3` |
| [@monogrid/gainmap-js](https://github.com/MONOGRID/gainmap-js) | `3.7.2` | `3.7.3` |
| [semver](https://github.com/npm/node-semver) | `7.8.5` | `7.8.6` |
| [ast-v8-to-istanbul](https://github.com/AriPerkkio/ast-v8-to-istanbul) | `1.0.7` | `1.0.8` |
| [parse5](https://github.com/inikulin/parse5) | `8.0.1` | `8.1.1` |
| [playwright](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [playwright-core](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [tinybench](https://github.com/tinylibs/tinybench) | `6.2.2` | `6.2.3` |
| [tough-cookie](https://github.com/salesforce/tough-cookie) | `6.0.2` | `6.1.0` |
| [undici](https://github.com/nodejs/undici) | `8.12.3` | `8.12.4` |



Updates `@playwright/test` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `@asamuzakjp/css-color` from 7.1.9 to 7.2.0
- [Release notes](https://github.com/asamuzaK/cssColor/releases)
- [Commits](asamuzaK/cssColor@v7.1.9...v7.2.0)

Updates `@eslint-community/regexpp` from 4.12.2 to 4.12.3
- [Release notes](https://github.com/eslint-community/regexpp/releases)
- [Commits](eslint-community/regexpp@v4.12.2...v4.12.3)

Updates `@monogrid/gainmap-js` from 3.7.2 to 3.7.3
- [Release notes](https://github.com/MONOGRID/gainmap-js/releases)
- [Changelog](https://github.com/MONOGRID/gainmap-js/blob/main/CHANGELOG.md)
- [Commits](MONOGRID/gainmap-js@v3.7.2...v3.7.3)

Updates `semver` from 7.8.5 to 7.8.6
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.8.5...v7.8.6)

Updates `ast-v8-to-istanbul` from 1.0.7 to 1.0.8
- [Release notes](https://github.com/AriPerkkio/ast-v8-to-istanbul/releases)
- [Commits](AriPerkkio/ast-v8-to-istanbul@v1.0.7...v1.0.8)

Updates `parse5` from 8.0.1 to 8.1.1
- [Release notes](https://github.com/inikulin/parse5/releases)
- [Commits](inikulin/parse5@v8.0.1...v8.1.1)

Updates `playwright` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `playwright-core` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `tinybench` from 6.2.2 to 6.2.3
- [Release notes](https://github.com/tinylibs/tinybench/releases)
- [Commits](tinylibs/tinybench@v6.2.2...v6.2.3)

Updates `tough-cookie` from 6.0.2 to 6.1.0
- [Release notes](https://github.com/salesforce/tough-cookie/releases)
- [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md)
- [Commits](salesforce/tough-cookie@v6.0.2...v6.1.0)

Updates `undici` from 8.12.3 to 8.12.4
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.12.3...v8.12.4)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-patch-and-minor
- dependency-name: "@asamuzakjp/css-color"
  dependency-version: 7.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-patch-and-minor
- dependency-name: "@eslint-community/regexpp"
  dependency-version: 4.12.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patch-and-minor
- dependency-name: "@monogrid/gainmap-js"
  dependency-version: 3.7.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patch-and-minor
- dependency-name: semver
  dependency-version: 7.8.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patch-and-minor
- dependency-name: ast-v8-to-istanbul
  dependency-version: 1.0.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patch-and-minor
- dependency-name: parse5
  dependency-version: 8.1.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-patch-and-minor
- dependency-name: playwright
  dependency-version: 1.65.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-patch-and-minor
- dependency-name: playwright-core
  dependency-version: 1.65.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-patch-and-minor
- dependency-name: tinybench
  dependency-version: 6.2.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patch-and-minor
- dependency-name: tough-cookie
  dependency-version: 6.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-patch-and-minor
- dependency-name: undici
  dependency-version: 8.12.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-patch-and-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from bitsforthought as a code owner November 11, 2026 15:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026
@bitsforthought bitsforthought self-assigned this Nov 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 11, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-patch-and-minor-75aab395f1 branch November 11, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bitsforthought bitsforthought Awaiting requested review from bitsforthought bitsforthought is a code owner

Assignees

@bitsforthought bitsforthought

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bitsforthought