Skip to content

Bump the npm-minor-patch group with 15 updates - #493

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-patch-aee0a436e7
Open

Bump the npm-minor-patch group with 15 updates#493
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-minor-patch-aee0a436e7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 15 updates:

Package From To
@types/node 26.4.1 26.5.1
playwright 1.62.1 1.63.0
sass 1.103.1 1.104.0
baseline-browser-mapping 2.11.20 2.11.23
browserslist 4.28.8 4.28.9
electron-to-chromium 1.5.420 1.5.427
fsevents 2.3.2 2.3.3
minimizer-webpack-plugin 5.8.0 5.10.1
natural-compare-lite 1.4.0 1.4.1
node-releases 2.0.54 2.0.55
playwright-core 1.62.1 1.63.0
postcss 8.5.26 8.5.28
postcss-selector-parser 7.1.5 7.1.6
schema-utils 4.3.3 4.4.0
undici-types 8.3.0 8.9.0

Updates @types/node from 26.4.1 to 26.5.1

Commits

Updates playwright from 1.62.1 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates sass from 1.103.1 to 1.104.0

Release notes

Sourced from sass's releases.

Dart Sass 1.104.0

To install Sass 1.104.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero, as well as infinity and negative infinity for polar-hue channels, to 0 as per the CSS spec.

  • The special value negative zero is now serialized as -0 instead of 0 for greater compatibility when using it in CSS calculations.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.104.0

  • Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero, as well as infinity and negative infinity for polar-hue channels, to 0 as per the CSS spec.

  • The special value negative zero is now serialized as -0 instead of 0 for greater compatibility when using it in CSS calculations.

Commits

Updates baseline-browser-mapping from 2.11.20 to 2.11.23

Commits
  • ebdc72f Patch to 2.11.23 because browser or feature data changed
  • 55fa3a1 Browser or feature data changed
  • 5ac60db Updating static site
  • af7c3c4 Patch to 2.11.22 because browser or feature data changed
  • 7e10cad Browser or feature data changed
  • ebb9702 Updating static site
  • ecc57a3 Updating static site
  • 0e5ed80 Patch to 2.11.21 because browser or feature data changed
  • 11da0b6 Browser or feature data changed
  • 69fcc81 Updating static site
  • See full diff in compare view

Updates browserslist from 4.28.8 to 4.28.9

Release notes

Sourced from browserslist's releases.

4.28.9

Changelog

Sourced from browserslist's changelog.

4.28.9

Commits

Updates electron-to-chromium from 1.5.420 to 1.5.427

Commits

Updates fsevents from 2.3.2 to 2.3.3

Release notes

Sourced from fsevents's releases.

Release v2.3.3

Released to npm as v2.3.3

Commits

Updates minimizer-webpack-plugin from 5.8.0 to 5.10.1

Changelog

Sourced from minimizer-webpack-plugin's changelog.

5.10.1

Patch Changes

5.10.0

Minor Changes

  • Allow a minimizer in minify to state its own filter. (by @​alexander-akait in #729)

  • Reject filename, filter and deleteOriginalAssets on a generator that is not type: "asset", where they did nothing. (by @​alexander-akait in #727)

  • Support [width] and [height] in an asset generator's filename, and document migrating from image-minimizer-webpack-plugin. (by @​alexander-akait in #727)

  • Allow a named generator to be an object with type: "asset", filename, filter and deleteOriginalAssets, which generates a new asset beside an emitted one. (by @​alexander-akait in #727)

  • Take a generator's options from generate itself, deprecating generatorOptions; giving both for one generator, or naming no generator, is now an error. (by @​alexander-akait in #727)

  • let generate name its generators, so an asset can pick one with ?as=<preset> and each preset carry its own generatorOptions (by @​alexander-akait in #727)

  • add the imageminGenerate generator, which runs the imagemin plugins you name and renames the asset to the format they wrote (by @​alexander-akait in #723)

  • Take a minimizer's options from minify itself, deprecating minimizerOptions; giving both for one minimizer is now an error. (by @​alexander-akait in #727)

  • A minimizer or generator written as an object names one implementation; several are an array of such objects rather than one holding two lists that must line up. (by @​alexander-akait in #727)

Patch Changes

  • read as on an embedded JavaScript body: the built-in minimizers take module as their own option and minify an event-handler body as the function it belongs to, so neither production is read as a classic script and no engine is handed the word (by @​alexander-akait in #726)

  • invalidate the persistent cache when generate or generatorOptions change, so a restored module no longer keeps the previous generator's bytes and name (by @​alexander-akait in #722)

5.9.0

Minor Changes

  • add built-in image minimizers sharpMinify, svgoMinify and imageminMinify from image-minimizer-webpack-plugin, and dispatch the worker pool per asset so a minimizer that cannot use it no longer takes it from the others (by @​alexander-akait in #703)

  • add the napiRsImageMinify image minimizer, using @napi-rs/image codecs — oxipng for lossless png, mozjpeg for jpeg, and its own encoders for avif and webp (by @​alexander-akait in #708)

  • read transforms off an asset's name in napiRsImageMinify and svgoMinify too — the same spellings sharp accepts where the two can do the same thing (width, height, fit, filter, rotate, flip, flop, grayscale, invert, blur, quality, lossless, speed), plus precision, multipass, pretty and indent for svgo; a transform hands its output back to oxipng or mozjpeg so recompression is not lost, and rotate=auto skips the decode when the EXIF asks for nothing (by @​alexander-akait in #709)

  • read what to do off an asset's name in sharpMinify, so import banner from "./banner.png?width=320&quality=80" sizes and re-encodes that one image — width, height, unit, fit, position, background, without-enlargement, rotate, flip, flop, grayscale, blur, sharpen, quality, lossless, effort and progressive, with short forms, the query overriding minimizerOptions, and flip, flop, grayscale, blur and sharpen newly settable there too (by @​alexander-akait in #709)

Patch Changes

  • keep every asset's extracted comments when several share a comments file they do not reach in a row, or when another plugin already emitted it; end the worker pool when an asset fails after the pool started; honour an explicit minimizerOptions.module: false over the value webpack inferred; and stop a composed source map attributing generated code the input map never covered, or dropping an empty sourcesContent entry (by @​alexander-akait in #716)

... (truncated)

Commits

Updates natural-compare-lite from 1.4.0 to 1.4.1

Release notes

Sourced from natural-compare-lite's releases.

Release v1.4.1

Fixes:

  • Fix custom-alphabet order (Lauri Rooden)
  • Fix hang with custom-alphabet (Lauri Rooden)
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for natural-compare-lite since your current version.


Updates node-releases from 2.0.54 to 2.0.55

Commits

Updates playwright-core from 1.62.1 to 1.63.0

Release notes

Sourced from playwright-core's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates postcss from 8.5.26 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

  • Fixes types regression.

8.5.27

Changelog

Sourced from postcss's changelog.

8.5.28

  • Fixes types regression.

8.5.27

Commits

Updates postcss-selector-parser from 7.1.5 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)
Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)
Commits
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • See full diff in compare view

Updates schema-utils from 4.3.3 to 4.4.0

Release notes

Sourced from schema-utils's releases.

v4.4.0

Minor Changes

  • The absolutePath keyword accepts an optional file:// prefix now, so a path from import.meta.resolve() can be passed to an option that takes an absolute path. Options that take a relative path reject such a value instead, they used to accept it. (by @​laymonage, @​alexander-akait in #222)

  • process.env.SKIP_VALIDATION is now read when schema-utils is loaded rather than on every validation, so set it before starting the process. enableValidation()/disableValidation() still take effect immediately and now share their state with every copy of schema-utils in the process directly. (by @​alexander-akait in #217)

  • At most 100 errors of a list are listed in the message now, the rest is counted as and N more errors. errors still holds every error. (by @​alexander-akait in #217)

Patch Changes

  • read the format keyword as part of the type, i.e. should be a date string instead of should be a string (should match format "date") (by @​alexander-akait in #225)

  • output the type of object properties in error messages, i.e. object { foo?: boolean, bar?: integer } (by @​alexander-akait in #224)

  • Updated ajv to 8.20.0, ajv-formats to 3.0.1 and @types/json-schema to 7.0.15. ajv-formats 3 only moves ajv to a peer dependency, the formats themselves are unchanged. (by @​alexander-akait in #221)

  • A string an absolutePath keyword applies to is described as an absolute path string or a relative path string rather than as a bare string, which read as though any string would do. A failure a schema reaches through more than one branch is listed once instead of repeatedly, so a relative path given to a rule condition is reported as the one line that says so. (by @​alexander-akait in #223)

  • Fixed error filtering being quadratic in the amount of reported errors, which let a large invalid configuration lock up the process, and stopped errors from being dropped when one instance path merely contained another as a substring - two sibling properties where one name is a prefix of the other were enough to lose an error. An array of options reporting a lot of errors no longer throws RangeError: Maximum call stack size exceeded instead of a ValidationError. (by @​alexander-akait in #217)

All notable changes to this project will be documented in this file.

4.3.3 (2025-10-02)

Bug Fixes

  • reexport ValidationErrorConfiguration type (#204) (49af922)

4.3.2 (2025-04-22)

Bug Fixes

4.3.1 (2025-04-22)

Bug Fixes

  • export Schema and additional schemas (#197) (f72cd60)
Changelog

Sourced from schema-utils's changelog.

4.4.0

Minor Changes

  • The absolutePath keyword accepts an optional file:// prefix now, so a path from import.meta.resolve() can be passed to an option that takes an absolute path. Options that take a relative path reject such a value instead, they used to accept it. (by @​laymonage, @​alexander-akait in #222)

  • process.env.SKIP_VALIDATION is now read when schema-utils is loaded rather than on every validation, so set it before starting the process. enableValidation()/disableValidation() still take effect immediately and now share their state with every copy of schema-utils in the process directly. (by @​alexander-akait in #217)

  • At most 100 errors of a list are listed in the message now, the rest is counted as and N more errors. errors still holds every error. (by @​alexander-akait in #217)

Patch Changes

  • read the format keyword as part of the type, i.e. should be a date string instead of should be a string (should match format "date") (by @​alexander-akait in #225)

  • output the type of object properties in error messages, i.e. object { foo?: boolean, bar?: integer } (by @​alexander-akait in #224)

  • Updated ajv to 8.20.0, ajv-formats to 3.0.1 and @types/json-schema to 7.0.15. ajv-formats 3 only moves ajv to a peer dependency, the formats themselves are unchanged. (by @​alexander-akait in #221)

  • A string an absolutePath keyword applies to is described as an absolute path string or a relative path string rather than as a bare string, which read as though any string would do. A failure a schema reaches through more than one branch is listed once instead of repeatedly, so a relative path given to a rule condition is reported as the one line that says so. (by @​alexander-akait in #223)

  • Fixed error filtering being quadratic in the amount of reported errors, which let a large invalid configuration lock up the process, and stopped errors from being dropped when one instance path merely contained another as a substring - two sibling properties where one name is a prefix of the other were enough to lose an error. An array of options reporting a lot of errors no longer throws RangeError: Maximum call stack size exceeded instead of a ValidationError. (by @​alexander-akait in #217)

All notable changes to this project will be documented in this file.

Commits
  • b4fd660 chore(release): new release (#220)
  • 0f99aa9 feat: read the format keyword as part of the type (#225)
  • 4baf113 feat: output the type of object properties in error messages (#224)
  • 49bb7ce fix: say which strings an absolutePath keyword accepts (#223)
  • 5c21244 feat: allow file:// protocol prefix in absolute paths (#222)
  • fc918a9 chore: update dependencies (#221)
  • d72a15b chore: release with changesets (#219)
  • 1d0404e test: cover collecting a subtree of errors and grouping a nested anyOf (#218)
  • 17c4e3a fix: quadratic error filtering, dropped errors and validation performance (#217)
  • 2c0aedf ci: add nodejs v26 to ci (#216)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for schema-utils since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates undici-types from 8.3.0 to 8.9.0

Release notes

Sourced from undici-types's releases.

v8.9.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

Undici now validates non-string header values after coercion, including array elements, preventing crafted toString() or Symbol.toPrimitive implementations from introducing CRLF sequences. This defense-in-depth change was made in 354a151f.

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.8.0...v8.9.0

v8.8.0

What's Changed

... (truncated)

Commits
  • 21a8e1e Bumped v8.9.0 (#5589)
  • 7d3cf92 fix: validate blob body content type
  • c601fff fix(cache): harden cache directive parsing
  • 2b3f749 test(retry): correct broken content-range fixtures in retry-handler.js
  • e11a68e fix(retry): reject partial content length mismatch
  • 9f09b49 test: cover crash on mixed unqualified and qualified private cache directives
  • 4fe5bc5 fix: handle empty qualified private cache directive
  • 10d93fc fix: harden cookie domain, path, and unparsed attribute validation
  • a17e301 Ignore auto-generated .npmrc on Windows (#5583)
  • a0922b0 fix: handle frozen globalThis in setGlobalDispatcher (#5574)
  • Additional commits viewable in compare view
...

Description has been truncated

@dependabot
Bump the npm-minor-patch group with 15 updates
80b00f1 
Bumps the npm-minor-patch group with 15 updates:

| Package | From | To |
| --- | --- | --- |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.4.1` | `26.5.1` |
| [playwright](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [sass](https://github.com/sass/dart-sass) | `1.103.1` | `1.104.0` |
| [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) | `2.11.20` | `2.11.23` |
| [browserslist](https://github.com/browserslist/browserslist) | `4.28.8` | `4.28.9` |
| [electron-to-chromium](https://github.com/Kilian/electron-to-chromium) | `1.5.420` | `1.5.427` |
| [fsevents](https://github.com/fsevents/fsevents) | `2.3.2` | `2.3.3` |
| [minimizer-webpack-plugin](https://github.com/webpack/minimizer-webpack-plugin) | `5.8.0` | `5.10.1` |
| [natural-compare-lite](https://github.com/litejs/natural-compare-lite) | `1.4.0` | `1.4.1` |
| [node-releases](https://github.com/chicoxyzzy/node-releases) | `2.0.54` | `2.0.55` |
| [playwright-core](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` |
| [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.5` | `7.1.6` |
| [schema-utils](https://github.com/webpack/schema-utils) | `4.3.3` | `4.4.0` |
| [undici-types](https://github.com/nodejs/undici) | `8.3.0` | `8.9.0` |


Updates `@types/node` from 26.4.1 to 26.5.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `playwright` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `sass` from 1.103.1 to 1.104.0
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.103.1...1.104.0)

Updates `baseline-browser-mapping` from 2.11.20 to 2.11.23
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.11.20...v2.11.23)

Updates `browserslist` from 4.28.8 to 4.28.9
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.28.8...4.28.9)

Updates `electron-to-chromium` from 1.5.420 to 1.5.427
- [Changelog](https://github.com/Kilian/electron-to-chromium/blob/main/CHANGELOG.md)
- [Commits](Kilian/electron-to-chromium@v1.5.420...v1.5.427)

Updates `fsevents` from 2.3.2 to 2.3.3
- [Release notes](https://github.com/fsevents/fsevents/releases)
- [Commits](fsevents/fsevents@v2.3.2...v2.3.3)

Updates `minimizer-webpack-plugin` from 5.8.0 to 5.10.1
- [Release notes](https://github.com/webpack/minimizer-webpack-plugin/releases)
- [Changelog](https://github.com/webpack/minimizer-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webpack/minimizer-webpack-plugin/commits)

Updates `natural-compare-lite` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/litejs/natural-compare-lite/releases)
- [Commits](litejs/natural-compare-lite@v1.4.0...v1.4.1)

Updates `node-releases` from 2.0.54 to 2.0.55
- [Commits](chicoxyzzy/node-releases@v2.0.54...v2.0.55)

Updates `playwright-core` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `postcss` from 8.5.26 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.26...8.5.28)

Updates `postcss-selector-parser` from 7.1.5 to 7.1.6
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@7.1.5...7.1.6)

Updates `schema-utils` from 4.3.3 to 4.4.0
- [Release notes](https://github.com/webpack/schema-utils/releases)
- [Changelog](https://github.com/webpack/schema-utils/blob/main/CHANGELOG.md)
- [Commits](webpack/schema-utils@v4.3.3...v4.4.0)

Updates `undici-types` from 8.3.0 to 8.9.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.3.0...v8.9.0)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: playwright
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: sass
  dependency-version: 1.104.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.23
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: browserslist
  dependency-version: 4.28.9
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: electron-to-chromium
  dependency-version: 1.5.427
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: fsevents
  dependency-version: 2.3.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: minimizer-webpack-plugin
  dependency-version: 5.10.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: natural-compare-lite
  dependency-version: 1.4.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: node-releases
  dependency-version: 2.0.55
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: playwright-core
  dependency-version: 1.63.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: schema-utils
  dependency-version: 4.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: undici-types
  dependency-version: 8.9.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 12, 2026
@github-actions

github-actions Bot commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

🔨 Webpack Bundle Smoke Test
Status ✅ Passed
Build Time 00:05.83
Bundle Size 485.9 KB

Updated: Sat, 12 Sep 2026 19:49:32 GMT

@github-actions

github-actions Bot commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

✅⚠️MegaLinter analysis: Success with warnings

Descriptor Linter Files Fixed Errors Max errors Warnings Elapsed time
✅ ACTION actionlint 7 0 0 0.14s
⚠️ ACTION zizmor 7 1 0 0.19s
✅ BASH bash-exec 2 0 0 0.01s
✅ BASH shellcheck 2 0 0 0.12s
⚠️ BASH shfmt 2 1 0 0.01s
⚠️ C cppcheck 8 8 0 0.06s
⚠️ CPP cppcheck 8 8 0 0.1s
✅ JSON npm-package-json-lint yes no no 0.58s
✅ JSON v8r 17 0 0 9.04s
✅ REPOSITORY betterleaks yes no no 1.15s
✅ REPOSITORY git_diff yes no no 0.21s
✅ REPOSITORY grype yes no no 56.77s
✅ REPOSITORY osv-scanner yes no no 1.11s
✅ REPOSITORY secretlint yes no no 66.2s
✅ REPOSITORY syft yes no no 2.73s
✅ REPOSITORY trivy-sbom yes no no 1.46s
✅ REPOSITORY trufflehog yes no no 6.67s
✅ TYPESCRIPT ts-standard 3 0 0 4.42s
✅ XML xmllint 1 0 0 9.22s
✅ YAML v8r 15 0 0 7.99s

Detailed Issues

⚠️ C / cppcheck - 8 errors 
Checking assets/2013-11-14-explorer-wall-avoider-kit/alternative_demo/DistanceSensor.h ...
assets/2013-11-14-explorer-wall-avoider-kit/alternative_demo/DistanceSensor.h:3:1: error: Code 'classSR04{' is invalid C code. [syntaxError]
class SR04 {
^
1/8 files checked 12% done
Checking assets/2013-11-14-explorer-wall-avoider-kit/alternative_demo/Motors.h ...
assets/2013-11-14-explorer-wall-avoider-kit/alternative_demo/Motors.h:3:1: error: Code 'classMotor{' is invalid C code. [syntaxError]
class Motor {
^
2/8 files checked 19% done
Checking assets/2013-11-14-explorer-wall-avoider-kit/demo_sketch/DistanceSensor.h ...
assets/2013-11-14-explorer-wall-avoider-kit/demo_sketch/DistanceSensor.h:3:1: error: Code 'classSR04{' is invalid C code. [syntaxError]
class SR04 {
^
3/8 files checked 31% done
Checking assets/2013-11-14-explorer-wall-avoider-kit/demo_sketch/TurtleMotors.h ...
assets/2013-11-14-explorer-wall-avoider-kit/demo_sketch/TurtleMotors.h:3:1: error: Code 'classMotor{' is invalid C code. [syntaxError]
class Motor {
^
4/8 files checked 49% done
Checking galleries/2013-11-14-explorer-wall-avoider-kit/alternative_demo/DistanceSensor.h ...
galleries/2013-11-14-explorer-wall-avoider-kit/alternative_demo/DistanceSensor.h:3:1: error: Code 'classSR04{' is invalid C code. [syntaxError]
class SR04 {
^
5/8 files checked 62% done
Checking galleries/2013-11-14-explorer-wall-avoider-kit/alternative_demo/Motors.h ...
galleries/2013-11-14-explorer-wall-avoider-kit/alternative_demo/Motors.h:3:1: error: Code 'classMotor{' is invalid C code. [syntaxError]
class Motor {
^
6/8 files checked 69% done
Checking galleries/2013-11-14-explorer-wall-avoider-kit/demo_sketch/DistanceSensor.h ...
galleries/2013-11-14-explorer-wall-avoider-kit/demo_sketch/DistanceSensor.h:3:1: error: Code 'classSR04{' is invalid C code. [syntaxError]
class SR04 {
^
7/8 files checked 81% done
Checking galleries/2013-11-14-explorer-wall-avoider-kit/demo_sketch/TurtleMotors.h ...
galleries/2013-11-14-explorer-wall-avoider-kit/demo_sketch/TurtleMotors.h:3:1: error: Code 'classMotor{' is invalid C code. [syntaxError]
class Motor {
^
8/8 files checked 100% done
⚠️ CPP / cppcheck - 8 errors 
Checking assets/2013-11-14-explorer-wall-avoider-kit/alternative_demo/DistanceSensor.h ...
assets/2013-11-14-explorer-wall-avoider-kit/alternative_demo/DistanceSensor.h:3:1: error: Code 'classSR04{' is invalid C code. [syntaxError]
class SR04 {
^
1/8 files checked 12% done
Checking assets/2013-11-14-explorer-wall-avoider-kit/alternative_demo/Motors.h ...
assets/2013-11-14-explorer-wall-avoider-kit/alternative_demo/Motors.h:3:1: error: Code 'classMotor{' is invalid C code. [syntaxError]
class Motor {
^
2/8 files checked 19% done
Checking assets/2013-11-14-explorer-wall-avoider-kit/demo_sketch/DistanceSensor.h ...
assets/2013-11-14-explorer-wall-avoider-kit/demo_sketch/DistanceSensor.h:3:1: error: Code 'classSR04{' is invalid C code. [syntaxError]
class SR04 {
^
3/8 files checked 31% done
Checking assets/2013-11-14-explorer-wall-avoider-kit/demo_sketch/TurtleMotors.h ...
assets/2013-11-14-explorer-wall-avoider-kit/demo_sketch/TurtleMotors.h:3:1: error: Code 'classMotor{' is invalid C code. [syntaxError]
class Motor {
^
4/8 files checked 49% done
Checking galleries/2013-11-14-explorer-wall-avoider-kit/alternative_demo/DistanceSensor.h ...
galleries/2013-11-14-explorer-wall-avoider-kit/alternative_demo/DistanceSensor.h:3:1: error: Code 'classSR04{' is invalid C code. [syntaxError]
class SR04 {
^
5/8 files checked 62% done
Checking galleries/2013-11-14-explorer-wall-avoider-kit/alternative_demo/Motors.h ...
galleries/2013-11-14-explorer-wall-avoider-kit/alternative_demo/Motors.h:3:1: error: Code 'classMotor{' is invalid C code. [syntaxError]
class Motor {
^
6/8 files checked 69% done
Checking galleries/2013-11-14-explorer-wall-avoider-kit/demo_sketch/DistanceSensor.h ...
galleries/2013-11-14-explorer-wall-avoider-kit/demo_sketch/DistanceSensor.h:3:1: error: Code 'classSR04{' is invalid C code. [syntaxError]
class SR04 {
^
7/8 files checked 81% done
Checking galleries/2013-11-14-explorer-wall-avoider-kit/demo_sketch/TurtleMotors.h ...
galleries/2013-11-14-explorer-wall-avoider-kit/demo_sketch/TurtleMotors.h:3:1: error: Code 'classMotor{' is invalid C code. [syntaxError]
class Motor {
^
8/8 files checked 100% done
⚠️ BASH / shfmt - 1 error 
diff .github/scripts/validate-local-build.sh.orig .github/scripts/validate-local-build.sh
--- .github/scripts/validate-local-build.sh.orig
+++ .github/scripts/validate-local-build.sh
@@ -30,9 +30,9 @@
 echo ""
 echo "=== Step 1: Checking http_serve is running ==="
 if ! docker ps --format '{{.Names}}' | grep -q "^${HTTP_SERVE_CONTAINER}$"; then
-  echo "ERROR: ${HTTP_SERVE_CONTAINER} is not running."
-  echo "Start it with: docker compose --profile manual up -d http_serve"
-  exit 1
+    echo "ERROR: ${HTTP_SERVE_CONTAINER} is not running."
+    echo "Start it with: docker compose --profile manual up -d http_serve"
+    exit 1
 fi
 
 # ─── Step 2: Quick HTTP smoke check from host ─────────────────────────────────
@@ -39,17 +39,17 @@
 echo ""
 echo "=== Step 2: HTTP smoke checks (host -> port ${HOST_PORT}) ==="
 for path in "/" "/construction_guide.html" "/tags/arduino/"; do
-  status=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:${HOST_PORT}${path}")
-  if [[ "$status" == "200" ]]; then
-    echo "  OK  ${path} -> ${status}"
-  else
-    echo "  FAIL ${path} -> ${status}"
-    SMOKE_FAILED=1
-  fi
+    status=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:${HOST_PORT}${path}")
+    if [[ "$status" == "200" ]]; then
+        echo "  OK  ${path} -> ${status}"
+    else
+        echo "  FAIL ${path} -> ${status}"
+        SMOKE_FAILED=1
+    fi
 done
 if [[ -n "${SMOKE_FAILED:-}" ]]; then
-  echo "ERROR: Smoke checks failed."
-  exit 1
+    echo "ERROR: Smoke checks failed."
+    exit 1
 fi
 
 # ─── Step 3: Verify AVIF images are generated ────────────────────────────────
@@ -62,8 +62,8 @@
 echo "  Post body WebP: ${webp_count}"
 echo "  Thumbnail AVIF: ${thumb_avif}"
 if [[ "$avif_count" -eq 0 ]]; then
-  echo "ERROR: No AVIF images found in _site/assets/images. Was the build run?"
-  exit 1
+    echo "ERROR: No AVIF images found in _site/assets/images. Was the build run?"
+    exit 1
 fi
 
 # ─── Step 4: BDD tests ─────────────────────────────────────────────────────
@@ -71,14 +71,14 @@
 echo "=== Step 4: BDD tests (via Docker, network: ${DOCKER_NETWORK}) ==="
 
 docker run --rm \
-  --network "${DOCKER_NETWORK}" \
-  -e BASE_URL="${BASE_URL}" \
-  -v "${PROJECT_ROOT}/tests:/app/src/tests" \
-  -v "${PROJECT_ROOT}/package.json:/app/src/package.json" \
-  -v "${PROJECT_ROOT}/package-lock.json:/app/src/package-lock.json" \
-  -v "${PROJECT_ROOT}/cucumber.js:/app/src/cucumber.js" \
-  "${TEST_IMAGE}" \
-  npm run test:bdd
+    --network "${DOCKER_NETWORK}" \
+    -e BASE_URL="${BASE_URL}" \
+    -v "${PROJECT_ROOT}/tests:/app/src/tests" \
+    -v "${PROJECT_ROOT}/package.json:/app/src/package.json" \
+    -v "${PROJECT_ROOT}/package-lock.json:/app/src/package-lock.json" \
+    -v "${PROJECT_ROOT}/cucumber.js:/app/src/cucumber.js" \
+    "${TEST_IMAGE}" \
+    npm run test:bdd
 
 echo ""
 echo "=== Validation complete ==="
⚠️ ACTION / zizmor - 1 error 
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'artipacked' audit failed on file://.github/workflows/on_call_build_site.yaml

Caused by:
    0: error in 'artipacked' audit
    1: couldn't list tags for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_KICS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

You could have the same capabilities but better runtime performances if you use a MegaLinter flavor:

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@10.0.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,C_CPPCHECK,CPP_CPPCHECK,JSON_V8R,JSON_NPM_PACKAGE_JSON_LINT,REPOSITORY_GIT_DIFF,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,TYPESCRIPT_STANDARD,XML_XMLLINT,YAML_V8R

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@github-actions

github-actions Bot commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

🏗️ Eleventy Site Build Smoke Test
Status ✅ Passed
Build Time 08:56.16
Site Size 341.2 MB
HTML Files 1418

Updated: Sat, 12 Sep 2026 19:58:28 GMT

@github-actions

github-actions Bot commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

🐳 Docker Base Image Available

A new base Docker image has been built and pushed for this PR:

Image: ghcr.io/orionrobots/orionrobots-site.base:493

How to use this image:

# Pull the image
docker pull ghcr.io/orionrobots/orionrobots-site.base:493

# Run with the image
docker run -it ghcr.io/orionrobots/orionrobots-site.base:493 bash

For local development:

You can use this image as a base for testing changes without rebuilding dependencies.

This comment is automatically updated when the base image is rebuilt.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants