chore(deps): update all non-major dependencies (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@nuxtjs/critters	^0.9.2 → ^0.10.1			dependencies	minor
@playwright/test (source)	1.60.0 → 1.63.0			dependencies	minor
@vueuse/nuxt (source)	^14.3.0 → ^14.4.0			dependencies	minor
MatteoGabriele/agentscan-action	v2.0.1 → v2.5.0			action	minor
danielroe/provenance-action	v0.1.1 → v0.2.0			action	minor

---

Release Notes

nuxt-modules/critters (@​nuxtjs/critters)

v0.10.1

Compare Source

v0.10.1 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes

• inline beasties runtime into the server bundle (03f3ec8)

❤️ Contributors

• Daniel Roe (@​danielroe)

v0.10.0

Compare Source

v0.10.0 is the next major release.

👉 Changelog

compare changes

🚀 Enhancements

• ⚠️ use beasties build-time compiler and zero-dependency runtime (#​702)

🤖 CI

• add explicit permissions (fd9b88f)
• add agent-scan workflow to flag bot-authored PRs (ced5dc5)

❤️ Contributors

• Daniel Roe (@​danielroe)

microsoft/playwright (@​playwright/test)

v1.63.0

Compare Source

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

• New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

• New apiResponse.timing() returns resource timing information for an API response.

Evaluation

• New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
• page.evaluate() and related methods now accept functions as evaluate arguments.
• page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

• Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

• The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

v1.61.1

Compare Source

v1.61.0

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

• New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
• The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

• The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
• Supported expect.soft.poll(...).
• New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
• New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
• testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
• New -G command line shorthand for --grep-invert.

🛠️ Other improvements

• Playwright now supports Ubuntu 26.04.
• HAR and trace recordings now include WebSocket requests.

Browser Versions

• Chromium 149.0.7827.55
• Mozilla Firefox 151.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 149
• Microsoft Edge 149

vueuse/vueuse (@​vueuse/nuxt)

v14.4.0

Compare Source

   🚀 Features

• Update skills  -  by @​OrbisK in #​5491 (f4758)
• nuxt: Disable useColorMode auto import if @nuxtjs/color-mode is detected  -  by @​OrbisK in #​5476 (60687)
• nuxt: Generate nuxt module builder output layout  -  by @​userquin and @​43081j in #​5503 (40a1f)
• onStartTyping: Add more configurable options for onStartTyping  -  by @​LightQuanta and @​9romise in #​5395 (1f2b7)
• useDebounceFn: Add flush and isPending to filter system  -  by @​pcoterecollective, @​OrbisK and @​antfu in #​5259 (4aa18)
• useElementOverflow: New function  -  by @​inside5545, 苏俊言, @​antfu, @​ilyaliao, @​OrbisK, @​43081j and @​9romise in #​4094 (d49f5)
• useSpeechRecognition: Expose confidence of latest result  -  by @​SAY-5 in #​5398 (17dc9)
• useVirtualList: Add options behavior, block and inline to exposed scrollTo method  -  by @​laurens94, @​OrbisK, @​43081j and @​ilyaliao in #​4905 (01875)

   🐞 Bug Fixes

• Drop unnecessary PURE annotation to avoid Rollup warning  -  by @​serkodev and @​9romise in #​5388 (16933)
• Accept array template ref bound to v-for as observer target  -  by @​eldardada in #​5514 (bccb1)
• Reintroduce package normalisation to nuxt package  -  by @​43081j in #​5551 (c04c4)
• docs: Fix typo 'feedbacks' to 'feedback' in work-with-ai.md  -  by @​firstquarterlee in #​5447 (a4253)
• nuxt: Register formatTimeAgo variants for auto-import  -  by @​ilyaliao, @​cursoragent and Claude Opus 5 in #​5492 (8a908)
• skills: Correct broken relative links in generated function references  -  by @​lazerg and @​OrbisK in #​5549 (910db)
• tests: Deduplicate ci test runs  -  by @​Tofandel in #​5509 (5b272)
• useBrowserLocation: Skip write-back watching on 'load' state  -  by @​Tobias-Braun and @​9romise in #​5485 (fbdd2)
• useDraggable: End drag on pointercancel  -  by @​ShreeBohara and Claude Opus 5 in #​5550 (6aa9d)
• useElementSize: Prefill size based on box option  -  by @​meta-syntax in #​5524 (5fe49)
• useEventBus: Use tryOnScopeDispose to avoid operating Vue internal API  -  by @​liangmiQwQ in #​5548 (2cad7)
• useFetch: Ignore stale abort error after refetch succeeds  -  by @​lazerg in #​5525 (84426)
• useFuse: Trigger fuse ref after setCollection  -  by @​ilyaliao, Claude Opus 5 and @​cursoragent in #​5479 (3e10c)
• useGamepad: Keep updating remaining gamepads after one disconnects  -  by @​lazerg in #​5523 (65328)
• usePointerSwipe: Handle pointercancel event to reset state and trigger onSwipeEnd  -  by @​DORI2001, Dor Alagem and @​43081j in #​5379 (4c08a)
• useStyleTag: Avoid error when multiple components share the same id  -  by @​ben-lau in #​5473 (6d913)
• useVibrate: Make interval option optional  -  by @​Aluomolo in #​5490 (305ee)
• useVirtualList: Recompute range when item size changes  -  by @​Antreesy in #​5533 (0f6d5)
• useWebSocket: Sync status to 'CLOSED' after explicit close()  -  by @​WuMingDao and @​OrbisK in #​5471 (351bf)

    View changes on GitHub

MatteoGabriele/agentscan-action (MatteoGabriele/agentscan-action)

v2.5.0

Compare Source

Identity update:

• fix(detectors): branch pr automation flag

Full Changelog: MatteoGabriele/agentscan-action@v2.4.0...v2.5.0

v2.4.0

Compare Source

What's Changed

• feat: make github-token optional by @​bluwy in #​35

New Contributors

• @​bluwy made their first contribution in #​35

Full Changelog: MatteoGabriele/agentscan-action@v2.3.0...v2.4.0

v2.3.0

Compare Source

What's Changed

• feat: add honeypot by @​MatteoGabriele in #​34

Full Changelog: MatteoGabriele/agentscan-action@v2.2.0...v2.3.0

v2.2.0

Compare Source

What's Changed

• refactor(evidence): remove redundant copy by @​MatteoGabriele in #​33

Full Changelog: MatteoGabriele/agentscan-action@v2.1.0...v2.2.0

v2.1.0

Compare Source

What's Changed

• feat: add evidence on comments by @​MatteoGabriele in #​32

Full Changelog: MatteoGabriele/agentscan-action@v2.0.1...v2.1.0

danielroe/provenance-action (danielroe/provenance-action)

v0.2.0

Compare Source

compare changes

🚀 Enhancements

• Respect pnpm's trustPolicyExclude (2f0f52d)
• Detect loss of npm staged publishing approval (fc86c9a)

📖 Documentation

• Update action description (e78b179)
• Add link to pnpm v10.21 trustPolicy 🎉 (fd8dd3c)

🏡 Chore

• Add licence (cafd196)
• Revert pnpm trust policy and restore provenance action (4320fb9)
• Release v0.0.2 (194cad5)
• Migrate to pnpm v11 (#​99)

✅ Tests

• Improve coverage of lockfile parsing utils (a9d6553)
• Migrate to vitest (07fa732)
• Add api responses as fixtures + test provenance utils (fd6ed30)

🤖 CI

• Pin github actions to full-length commit shas (9426311)
• Add agent-scan workflow to flag bot-authored PRs (81568f7)

❤️ Contributors

• Daniel Roe (@​danielroe)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nuxt.new	Ready	Preview	Sep 14, 2026 12:56pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vueuse/​nuxt@​14.3.0 ⏵ 14.4.0
	@​nuxtjs/​critters@​0.9.2 ⏵ 0.10.1			+6	+3
	@​playwright/​test@​1.60.0 ⏵ 1.63.0

View full report