⬆️ bump the npm-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the npm-dependencies group with 7 updates in the / directory:

Package	From	To
@playwright/test	1.61.1	1.63.0
css-loader	7.1.4	7.1.5
html-webpack-plugin	5.6.7	5.6.8
sass	1.101.0	1.105.1
sass-loader	17.0.0	17.0.1
webpack	5.108.3	5.111.1
webpack-cli	7.2.1	7.2.3

Updates @playwright/test from 1.61.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates css-loader from 7.1.4 to 7.1.5

Release notes

Sourced from css-loader's releases.

v7.1.5

7.1.5 (2026-08-28)

Bug Fixes

• strip BOM before processing with postcss (#1684) (bd20834)

Changelog

Sourced from css-loader's changelog.

7.1.5 (2026-08-28)

Bug Fixes

• strip BOM before processing with postcss (#1684) (bd20834)

Commits

• be04ec2 chore(release): 7.1.5
• 405bdde docs: deprecate css-loader in favor of webpack's built-in CSS support (#1683)
• bd20834 fix: strip BOM before processing with postcss (#1684)
• 488cdb1 chore(deps-dev): bump lodash from 4.17.23 to 4.18.1 (#1663)
• fd4cb47 chore(deps-dev): bump flatted from 3.3.3 to 3.4.2 (#1659)
• 4bf84fa docs: clarify style-loader usage in Getting Started (#1656)
• d7441e5 chore(deps): bump immutable from 5.1.3 to 5.1.5 (#1654)
• ca53a77 chore(deps): bump minimatch (#1653)
• See full diff in compare view

Updates html-webpack-plugin from 5.6.7 to 5.6.8

Changelog

Sourced from html-webpack-plugin's changelog.

5.6.8 (2026-07-25)

Bug Fixes

• extend @​rspack/core peer dependency range (#1893) (8057b14)

Commits

• cf9c701 chore(release): 5.6.8
• 8057b14 fix: extend @​rspack/core peer dependency range (#1893)
• See full diff in compare view

Updates sass from 1.101.0 to 1.105.1

Release notes

Sourced from sass's releases.

Dart Sass 1.105.1

To install Sass 1.105.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Improve error messages for @extends across different media queries.

See the full changelog for changes in earlier releases.

Dart Sass 1.105.0

To install Sass 1.105.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Add support for first-class modules. These can be accessed using the new meta.load() and meta.get-module() functions, and may be passed as the $module argument to numerous eisting sass:meta functions.

• Add the meta.css() mixin, which includes CSS from a first-class module.

JS API

• Add a SassModule class and a corresponding Value.assertModule() method.

Dart API

• Add a SassModule class and a corresponding Value.assertModule() method.

See the full changelog for changes in earlier releases.

Dart Sass 1.104.1

To install Sass 1.104.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Fix a bug where loud comments before @use rules could be emitted multiple times under certain circumstances.

• Fix a bug in which an invalid selector at the end of an indented syntax stylesheet would cause the parser to crash instead of emitting a useful error message.

Command Line Interface

• Many-to-many compilations no longer compile any files that appear in the output directory if the output directory is also within the source directory. This fixes a bug where --watch mode could enter an infinite loop recompiling the same CSS file over and over.

... (truncated)

Changelog

Sourced from sass's changelog.

1.105.1

• Improve error messages for @extends across different media queries.

1.105.0

• Add support for first-class modules. These can be accessed using the new meta.load() and meta.get-module() functions, and may be passed as the $module argument to numerous eisting sass:meta functions.

• Add the meta.css() mixin, which includes CSS from a first-class module.

JS API

• Add a SassModule class and a corresponding Value.assertModule() method.

Dart API

• Add a SassModule class and a corresponding Value.assertModule() method.

1.104.1

• Fix a bug where loud comments before @use rules could be emitted multiple times under certain circumstances.

• Fix a bug in which an invalid selector at the end of an indented syntax stylesheet would cause the parser to crash instead of emitting a useful error message.

Command Line Interface

• Many-to-many compilations no longer compile any files that appear in the output directory if the output directory is also within the source directory. This fixes a bug where --watch mode could enter an infinite loop recompiling the same CSS file over and over.

• Sass now sets the modification time of output files to the time compilation started rather than the time it ended. This ensures that, if a source file is modified during compilation, --watch and --update mode will recompile the outputs to include the new source file contents.

1.104.0

• Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero, as well as infinity and negative infinity for polar-hue channels, to 0 as per the CSS spec.

• The special value negative zero is now serialized as -0 instead of 0 for greater compatibility when using it in CSS calculations.

... (truncated)

Commits

• db3c666 Merge pull request #2869 from sass/extend-media-errors
• 2ac4515 Improve span boundaries for media queries and selectors
• 706cfbf Fix InterpolationMap._expandInterpolationSpanRight()
• 792a948 Bump bufbuild/buf-action from 1.5.0 to 1.6.0 in /.github/util/initialize (#2870)
• 61ab702 Improve errors for @extend across media queries
• 288d4e2 Auto-merge dependabot PRs as the Sass bot account (#2866)
• 4bf2b92 Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#2865)
• 850d57e [meta.load] Add support for meta.load() and related features (#2861)
• 6180be0 Bump postcss from 8.5.26 to 8.5.28 in /pkg/sass-parser (#2863)
• da84fb5 Fix --watch not recompiling sources modified during a compilation (#2850)
• Additional commits viewable in compare view

Updates sass-loader from 17.0.0 to 17.0.1

Release notes

Sourced from sass-loader's releases.

v17.0.1

Patch Changes

• Remove the byte order mark (BOM) from the compiled CSS. dart-sass prepends it when the compiled CSS contains non ASCII characters and the style option is compressed (the default for the production mode), but a BOM is only valid at the very beginning of a file - tools like css-loader move @import at-rules above it, so it ended up in the middle of the generated CSS and broke the rule after it. Source maps are shifted accordingly. (by @​alexander-akait in #1337)

Changelog

Sourced from sass-loader's changelog.

17.0.1

Patch Changes

• Remove the byte order mark (BOM) from the compiled CSS. dart-sass prepends it when the compiled CSS contains non ASCII characters and the style option is compressed (the default for the production mode), but a BOM is only valid at the very beginning of a file - tools like css-loader move @import at-rules above it, so it ended up in the middle of the generated CSS and broke the rule after it. Source maps are shifted accordingly. (by @​alexander-akait in #1337)

Commits

• f38ee40 chore(release): new release (#1338)
• d33042b docs: explain how @use/@import requests are resolved (#1339)
• 72640db fix: remove the BOM from the compiled CSS (#1337)
• a28ab73 docs: use the built-in CSS support of webpack in examples (#1336)
• 7b81867 chore(deps): apply socket fixes (#1333)
• b17bc02 chore(deps-dev): bump postcss from 8.5.14 to 8.5.26 (#1332)
• c7a83fe chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.5 (#1331)
• 14a29c0 chore(deps-dev): bump shell-quote from 1.8.2 to 1.10.0 (#1328)
• e2a48b8 chore(deps): bump immutable from 5.1.5 to 5.1.9 (#1327)
• 87864a5 chore(deps-dev): bump @​babel/core from 7.29.0 to 7.29.6 (#1326)
• Additional commits viewable in compare view

Updates webpack from 5.108.3 to 5.111.1

Release notes

Sourced from webpack's releases.

v5.111.1

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #22142)

• Record hoisted, module and block declarations while parsing, not by re-walking. (by @​alexander-akait in #22147)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.111.1

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #22142)

... (truncated)

Commits

• 5a10675 chore(release): new release (#22105)
• 9c448c4 test: consolidate loose harness files under test/harness (#22163)
• a947604 fix(html): unquote an attribute value carrying a vertical tab (#22162)
• db556f3 test: run the printer equivalence suite against Gecko in CI (#22155)
• d174cdf perf(css): drop a fallback every browserslist target reads past (#22158)
• 39f14f2 refactor(javascript): declare block bindings from the parse (#22161)
• 0835411 test: move suite drivers into test/templates (#22159)
• b48cd77 fix(html): minify by what a value says rather than how it was spelled (#22154)
• a774f10 test: define the webpack major instead of bundling package.json (#22160)
• 4b2eed0 docs: report only what needs a decision while watching a PR (#22156)
• Additional commits viewable in compare view

Updates webpack-cli from 7.2.1 to 7.2.3

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.2.3

Patch Changes

• fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @​bjohansebas in #4834)

• feat: allow toml@5 as a peer dependency for TOML configuration files (by @​alexander-akait in #4837)

webpack-cli@7.2.2

Patch Changes

• perf: enable the Node.js compile cache (module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @​bjohansebas in #4818)

Changelog

Sourced from webpack-cli's changelog.

7.2.3

Patch Changes

• fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @​bjohansebas in #4834)

• feat: allow toml@5 as a peer dependency for TOML configuration files (by @​alexander-akait in #4837)

7.2.2

Patch Changes

• perf: enable the Node.js compile cache (module.enableCompileCache, available on Node.js >= 22.8.0) to speed up CLI startup (by @​bjohansebas in #4818)

Commits

• 7d40e4e chore(release): new release (#4839)
• 1f6593a ci: use the input names changesets/action v2 expects (#4838)
• 99cfc4f build(deps): update dependencies (#4837)
• 11be634 feat(create-webpack-app): stop asking about HTML and CSS (#4836)
• a2418aa feat(create-webpack-app): use webpack's native CSS and HTML support in init t...
• 3664b9d chore: update webpack-dev-server to v6 and test against v5 and v6 (#4834)
• ce1a219 ci: node 26 (#4763)
• 0cfc077 chore(deps): bump changesets/action in the dependencies group (#4831)
• ef262eb chore(deps): bump changesets/action in the dependencies group (#4830)
• d90f5ab chore: add gitignore to ignore autogenerated build & fix codecov option (#4828)
• Additional commits viewable in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@f43b75d). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #451   +/-   ##
=======================================
  Coverage        ?   59.48%           
=======================================
  Files           ?        2           
  Lines           ?      548           
  Branches        ?        0           
=======================================
  Hits            ?      326           
  Misses          ?      222           
  Partials        ?        0           

Flag	Coverage Δ
pytests	59.48% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🎭 Visual Regression Test Results

 103 passed
 3 skipped

Details

 106 tests across 1 suite
 3 minutes, 51 seconds
 5e8550d

Skipped tests

desktop-chrome › theme.spec.ts › Visual Regression Tests › prob-matrix - full page screenshot
mobile-chrome › theme.spec.ts › Visual Regression Tests › prob-matrix - full page screenshot
mobile-chrome › theme.spec.ts › Theme Features › f-string interpolation styling