[dependabot]

Bumps the development-dependencies group with 3 updates: jsdom, playwright and vite.

Updates jsdom from 30.1.3 to 31.0.0

Release notes

Sourced from jsdom's releases.

v31.0.0

Breaking changes

• Changed the optional canvas and image decoding backend from canvas to @napi-rs/canvas. Install @napi-rs/canvas v1.0.13 or later in the v1.x series alongside jsdom; installing canvas alone no longer enables this support. The new backend provides prebuilt Skia binaries on supported platforms, and rendering and encoded image bytes can differ. Projects using native canvas objects or custom font registration should follow the canvas migration guidance. Added WebP serialization through canvas.toDataURL() and canvas.toBlob(). Fixed image loading to wait for decoding before firing load, discard obsolete source requests, avoid refetching when dimensions change, and prevent failed images from drawing stale contents. Fixed canvas context and serialization behavior, including unsupported context types, read-only ctx.canvas, image-drawing exceptions, MIME type and quality normalization, and asynchronous null results from canvas.toBlob() for empty canvases or encoding failures. (@​Brooooooklyn)
• Changed CSS parsing, selector matching, and computed styles to use a new integrated implementation, with substantially expanded support and faster selector queries and repeated style reads. This includes cascade layers, nesting, @scope, custom-property substitution and registration through @property and CSS.registerProperty(), typed attr(), conditional if(), shadow-tree styling with :host, ::slotted(), and ::part(), pseudo-element computed styles, and constructable stylesheets with document.adoptedStyleSheets and shadowRoot.adoptedStyleSheets. Fixed numerous cascade, shorthand, serialization, and default-style issues; computed declarations now stay live across DOM and stylesheet changes. CSS serialization and computed values can differ from previous releases.
• Changed HTML and XML parsing to pause at blocking scripts until their required resources are ready. The JSDOM constructor, JSDOM.fromURL(), and JSDOM.fromFile() can now return partially parsed documents. Wait for DOMContentLoaded for the finished tree, or the window's load event for load-delaying resources, checking document.readyState first in case the event has already fired. XML syntax errors encountered after asynchronous parsing resumes are reported through the virtual console as "xml-parsing" errors.

Other changes

• Added window.reportError(), which dispatches an error event and reports uncanceled errors to the virtual console. (@​sarankumar1325)
• Added element.ariaBrailleLabel and element.ariaBrailleRoleDescription. (@​Kjubikstronk)
• Fixed page-completion load events to fire only on the window. Use window.addEventListener("load", ...) or window.onload instead of listening on the document.
• Fixed document.open(), including implicit calls from document.write(), to clear event listeners and handlers from the document, its descendants, and its window when replacing the input stream.
• Fixed document.write() to process successive writes through the parser's input stream, preserve insertion points across nested scripts, and make completed text immediately visible. Script-created input streams now remain open until document.close().
• Fixed dynamically inserted scripts to respect script.async = false execution order, use their source text and document from preparation time, and avoid executing after adoption into another document. Scripts parsed through inert fragment APIs no longer execute when subsequently inserted.
• Fixed unrelated images, stylesheets, and frames being delayed behind scripts, and resource completion events firing before nested stylesheet imports finish. Cyclic imports no longer prevent completion, and <style> elements in shadow trees now fire load events.
• Fixed window.stop() to cancel pending subresource and XMLHttpRequest requests in descendant frames and suppress completion events for canceled loads, while allowing subsequent requests to proceed.
• Fixed repeated document.close() calls replaying readiness and load events, and incorrect iframe load events when reopening documents from event handlers.
• Fixed memory leaks where pending request interceptor promises retained closed windows, introduced in v28.0.0.
• Fixed focus remaining on elements that become non-focusable after DOM or style changes. Focus now moves asynchronously to the document's viewport, and element.blur() can release it immediately.
• Fixed document.hasFocus() returning false before an element is focused or during focus transitions within the document, including inside frames.
• Fixed \<template> parsing and template.innerHTML serialization in XML documents, including templates with namespace prefixes. (@​b84330808)
• Fixed rect.toJSON() and performance.toJSON() to create their result objects in the method's realm instead of the host Node.js realm.

Commits

• 825fa8e 31.0.0
• 9f2e49a Add ariaBrailleLabel and ariaBrailleRoleDescription
• 4c0a35e Flush text written with document.write()
• fce11d3 Switch canvas support to @​napi-rs/canvas
• 27614bf Fix document.hasFocus() during focus changes
• 627ade2 Implement asynchronous focus fixup
• 8bd17a2 Implement reportError()
• 5ae66cf Update webidl2js and remove IDL workarounds
• ce5a100 Align development scripts and CI
• 9cc717f Adopt ESLint config v6 and oxfmt
• Additional commits viewable in compare view

Updates playwright from 1.64.1 to 1.65.0

Release notes

Sourced from playwright's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

... (truncated)

Commits

• a1f35e1 chore: mark v1.65.0 (#43925)
• a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
• 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
• daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
• 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
• 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
• 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
• d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
• 6e3f5ff docs: release notes for v1.65 (#43874)
• aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
• Additional commits viewable in compare view

Updates vite from 8.3.5 to 8.3.7

Release notes

Sourced from vite's releases.

v8.3.7

Bug Fixes

• deps: update Rolldown to v1.2.18 (#24038) (517affb)

Miscellaneous Chores

• enable more lint rules (#24035) (72f86e5)

Tests

• use onTestFinished for tear downs (#24003) (a579e35)

Build System

• generate sourcemaps in shim-deps plugin (#24023) (c02138c)

v8.3.6

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.7 (2026-11-09)

Bug Fixes

• deps: update Rolldown to v1.2.18 (#24038) (517affb)

Miscellaneous Chores

• enable more lint rules (#24035) (72f86e5)

Tests

• use onTestFinished for tear downs (#24003) (a579e35)

Build System

• generate sourcemaps in shim-deps plugin (#24023) (c02138c)

8.3.6 (2026-11-05)

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

... (truncated)

Commits

• 5def936 release: v8.3.7 (#24040)
• 517affb fix(deps): update Rolldown to v1.2.18 (#24038)
• 72f86e5 chore: enable more lint rules (#24035)
• c02138c build: generate sourcemaps in shim-deps plugin (#24023)
• a579e35 test: use onTestFinished for tear downs (#24003)
• 0fd9a29 release: v8.3.6 (#23996)
• eab1dc2 fix(html): remove adjacent module tags on the first line (#23823)
• a270391 fix(server): escape HTML attributes (#23995)
• 7139ef3 fix(worker): keep chunks conflicted with unused workers that are still used b...
• 0fdd81e fix(optimizer): resolve subpath imports (#) with Vite's resolver (#23959)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Summary by cubic

Updates the development dependencies jsdom, playwright, and vite to newer releases, bringing their latest fixes and test-runner improvements into the project.

• jsdom 31 replaces its CSS implementation and changes optional canvas support to @napi-rs/canvas; its parsing and computed-style behavior may differ.
• Updates playwright from 1.64.1 to 1.65.0 and vite from 8.3.5 to 8.3.7.

^{Written for commit 9457273. Summary will update on new commits.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsdom@​30.1.3 ⏵ 31.0.0	+1		+1	+2	-19
	playwright@​1.64.1 ⏵ 1.65.0	+1		+1
	vite@​8.3.5 ⏵ 8.3.7

View full report