You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Tests that access a shared resource — an external service, a global account setting — can now declare a named lock.
Tests that share a lock name never run concurrently, across files, workers and projects, while
everything else keeps running in parallel:
test('update user settings',{lock: 'user-settings'},async({ page })=>{// never runs at the same time as other tests holding 'user-settings'});
A test can hold multiple locks, and test.describe() accepts a lock for the whole group.
Learn more about test locks.
🪟 Locate across frames
page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:
// Finds the button in any frame on the page.awaitpage.frameLocator().getByRole('button').click();
The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.
👁️ Visible-only locators
New locator.visible() returns a locator that matches only visible elements. It is the recommended
replacement for the :visible CSS pseudo-class:
awaitpage.locator('button').visible().click();
🧾 Step params and subtitles
Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments,
and test.step() accepts subtitle and params options for your own steps:
Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.
Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review
No medium, high, or critical vulnerabilities introduced by this change.
Dependabot tests-group bump only (package.json + lockfile): @faker-js/faker 10.5.0→10.6.0, @playwright/test 1.62.1→1.63.0, vitest / @vitest/coverage-v8 4.1.10→5.0.0, happy-dom 20.11.1→20.14.0. No application source changes. Lockfile integrity hashes match npm for the bumped packages.
These stay in test/e2e tooling (not storefront runtime). Known advisories for older versions (including GHSA-82fw-gwwq-j7x9 on vitest <4.1.11) are patched by the declared versions, not newly introduced. No prior automation security threads to re-validate.
Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review
No medium, high, or critical vulnerabilities introduced by this change.
Re-reviewed after Dependabot rebase (ea17402f). Still a tests-group bump only (package.json + lockfile): @faker-js/faker 10.5.0→10.6.0, @playwright/test 1.62.1→1.63.0, vitest / @vitest/coverage-v8 4.1.10→5.0.0, happy-dom 20.11.1→20.14.0. No application source changes. Lockfile integrity hashes match npm for the bumped packages (including playwright, playwright-core, and @vitest/mocker 5.0.0).
These stay in test/e2e tooling (not storefront runtime). @vitest/browser is an optional peer only and is not installed. Known advisories for older versions are patched by the declared versions, not newly introduced: GHSA-82fw-gwwq-j7x9 / CVE-2026-84373 (vitest / @vitest/mocker <4.1.11 and 5.0.0-beta), happy-dom CVE-2026-33943 / CVE-2026-34226 (fixed in 20.8.8 / 20.8.9), faker GHSA-qxc2-j82w-r537 (fixed in 10.5.0). No @playwright/test advisories.
No prior automation security finding threads to re-validate.
Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Security review
No medium, high, or critical vulnerabilities introduced by this change.
Re-reviewed after Dependabot recreate (f79eb76d). Still a tests-group bump only (package.json + lockfile): @faker-js/faker 10.5.0→10.6.0, @playwright/test 1.62.1→1.63.0, vitest / @vitest/coverage-v8 4.1.10→5.0.0, happy-dom 20.11.1→20.14.0. No application source changes. Lockfile integrity hashes match npm for the bumped packages (including playwright, playwright-core, and @vitest/mocker 5.0.0).
These stay in test/e2e tooling (not storefront runtime). @vitest/browser is an optional peer only and is not installed. Known advisories for older versions are patched by the declared versions, not newly introduced: GHSA-82fw-gwwq-j7x9 / CVE-2026-84373 (vitest / @vitest/mocker <4.1.11 and 5.0.0-beta), happy-dom CVE-2026-33943 / CVE-2026-34226 (fixed in 20.8.8 / 20.8.9), faker GHSA-qxc2-j82w-r537 (fixed in 10.5.0). No @playwright/test advisories.
No prior automation security finding threads to re-validate.
Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge
The reason will be displayed to describe this comment to others. Learn more.
Security review
No medium, high, or critical vulnerabilities introduced by this change.
Re-reviewed after Dependabot synchronize (4e5478a4). Still a tests-group bump only (package.json + lockfile): @faker-js/faker 10.5.0→10.6.0, @playwright/test 1.62.1→1.63.0, vitest / @vitest/coverage-v8 4.1.10→5.0.0, happy-dom 20.11.1→20.14.5. No application source changes. Lockfile integrity hashes match npm for the bumped packages (including playwright, playwright-core, and @vitest/mocker 5.0.0).
These stay in test/e2e tooling (not storefront runtime). @vitest/browser is an optional peer only and is not installed. Known advisories for older versions are patched by the declared versions, not newly introduced: GHSA-82fw-gwwq-j7x9 / CVE-2026-84373 (vitest / @vitest/mocker <4.1.11 and 5.0.0-beta), happy-dom CVE-2026-33943 / CVE-2026-34226 (fixed in 20.8.8 / 20.8.9), faker GHSA-qxc2-j82w-r537 (fixed in 10.5.0). Browser-mode CVEs (GHSA-g8mr-85jm-7xhm, GHSA-p63j-vcc4-9vmv) are not reachable. No @playwright/test advisories.
No prior automation security finding threads to re-validate.
Sent by Cursor Automation: Review pull requests for exploitable security issues and flag only validated findings before merge
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update Javascript code
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps the tests group with 5 updates in the / directory:
10.5.010.6.01.62.11.63.04.1.105.0.020.11.120.14.54.1.105.0.0Updates
@faker-js/fakerfrom 10.5.0 to 10.6.0Release notes
Sourced from @faker-js/faker's releases.
... (truncated)
Changelog
Sourced from @faker-js/faker's changelog.
Commits
2cb0423chore(release): 10.6.0 (#3986)531588fchore(deps): lock file maintenance (#3923)328f018chore(deps): update eslint (#3930)a5c8bd7chore(deps): update mcr.microsoft.com/devcontainers/typescript-node:24 docker...fe3f17bchore(deps): update all non-major dependencies (#3974)ae38b18docs(lorem): document the fail default strategy for word (#3944)1ce5994fix(color): give the LCH hue its full 360 degree range (#3978)1143329fix(color): stop scaling the HSLA alpha into a percentage (#3979)a4c6757fix(vehicle): calculate VIN check digit (#3954)d68f978infra: ensure markdown rendered is only ever initialized once (#3984)Updates
@playwright/testfrom 1.62.1 to 1.63.0Release notes
Sourced from @playwright/test's releases.
... (truncated)
Commits
1b025d7chore: mark v1.63.0 (#42569)0b9956dcherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.6313dbf10cherry-pick(#42552): docs: release notes for v1.63e93b64echerry-pick(#42566): feat(test): add subtitle option to test.step (#42567)2b7a5f2test: response.body() for content-encoding:identity (#42537)648a67cfix(mcp): create parent directories for explicitly named files (#42540)7894f56docs(mcp): clarify how tool file names are resolved (#42538)52900a1devops: restore npm publishing from GitHub Actions (#42550)8c47f59docs(csharp): fix nonexistent method names in guide examples (#42507)bd6e552chore(video): emit frames with real timestamps, drop frame number quantizatio...Updates
@vitest/coverage-v8from 4.1.10 to 5.0.0Release notes
Sourced from @vitest/coverage-v8's releases.
... (truncated)
Commits
f441c6fchore: release v5.0.0 (#11130)c4473e4fix(coverage): prevent crash on/@fs/prepended virtual files (#11119)897f51fchore: release v5.0.0-rc.4 (#11107)7db80dcchore: release v5.0.0-rc.3 (#11089)5f6a5e8feat(coverage): switch to@vitest/istanbuljspackages (#11053)c6174a6fix(coverage): v8 to ignore Vite SSR's generated import bindings (#11023)af83d1bchore: release v5.0.0-rc.2 (#10976)a7fa111chore: release v5.0.0-rc.1 (#10920)0553851chore: add Knip checks (#10847)b7be731chore: release v5.0.0-beta.7 (#10825)Updates
happy-domfrom 20.11.1 to 20.14.5Release notes
Sourced from happy-dom's releases.
... (truncated)
Commits
0d4cdbefix: #2409 Preserve character references in comment data (#2410)9c920a4fix: #2407 End comments at the first comment end tag when it overlaps a com...5fb1df3fix: #2363 Avoids cloning all properties in CSSPropertyManager.toString() (...de0a1e9fix: #2344 Resolve every var() in a value, not only the first one (#2395)64b8b94fix: #2366 Invalidate the computed style cache for the whole subtree (#2367)eac5a38feat: #2357 Improves computed style cache (#2358)5b3559bfix: #2349 Fix problem with getComputedStyle with :host and :host-context s...f33da73fix: #2347 getComputedStyle should return inherited value when it is set to...68b9806feat: #2345 Adds support for :host psuedo query selector (#2346)9300a9ffix: #2342 Custom elements should be upgraded when connected to DOM (#2343)Updates
vitestfrom 4.1.10 to 5.0.0Release notes
Sourced from vitest's releases.