chore(deps): bump the npm-minor-and-patch group with 14 updates

[dependabot]

Bumps the npm-minor-and-patch group with 14 updates:

Package	From	To
@codemirror/commands	6.10.3	6.11.1
@codemirror/lang-markdown	6.5.0	6.5.2
@codemirror/language	6.12.3	6.12.4
@codemirror/legacy-modes	6.5.3	6.5.4
@codemirror/search	6.7.1	6.7.2
@codemirror/state	6.6.0	6.7.6
@codemirror/view	6.43.0	6.43.13
@lezer/markdown	1.6.4	1.7.2
@biomejs/biome	2.4.15	2.5.14
@vscode/test-electron	3.0.0	3.1.0
esbuild	0.25.12	0.28.2
happy-dom	20.10.6	20.14.5
ovsx	1.0.2	1.2.0
playwright	1.61.1	1.63.0

Updates @codemirror/commands from 6.10.3 to 6.11.1

Commits

• See full diff in compare view

Updates @codemirror/lang-markdown from 6.5.0 to 6.5.2

Commits

• See full diff in compare view

Updates @codemirror/language from 6.12.3 to 6.12.4

Commits

• See full diff in compare view

Updates @codemirror/legacy-modes from 6.5.3 to 6.5.4

Commits

• See full diff in compare view

Updates @codemirror/search from 6.7.1 to 6.7.2

Commits

• See full diff in compare view

Updates @codemirror/state from 6.6.0 to 6.7.6

Commits

• See full diff in compare view

Updates @codemirror/view from 6.43.0 to 6.43.13

Commits

• See full diff in compare view

Updates @lezer/markdown from 1.6.4 to 1.7.2

Commits

• See full diff in compare view

Updates @biomejs/biome from 2.4.15 to 2.5.14

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.14

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

• #11790 17d0ff0 Thanks @​ematipico! - Fixed #10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.

... (truncated)

Commits

• af4365d ci: release (#11711)
• 7ee3a6c fix(useExhaustiveSwitchCases): add option requireExplicitCase (#11777)
• 02ea438 feat(json_analyze): implement noJsonUnsafeValues (#9758)
• 64fd314 feat(json_analyze): implement useConsistentObjectKeys (#9797)
• a9c4aa0 feat(html): detect undeclared custom Vue directives (#11651)
• 1fc17e3 feat: expand useIncludes (#11739)
• 71eaa0d feat(lint/html/svelte): add noSvelteAtDebugTags (#11754)
• 9bd70c7 fix: various bug fixes (#11735)
• c7c4e2b fix(analyzer): various bugs (#11720)
• 5eb5f09 feat(biome_js_analyze): implement useValidTestTitle rule (#9176) (#11725)
• Additional commits viewable in compare view

Updates @vscode/test-electron from 3.0.0 to 3.1.0

Commits

• See full diff in compare view

Updates esbuild from 0.25.12 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2025

This changelog documents all esbuild versions published in the year 2025 (versions 0.25.0 through 0.27.2).

0.27.2

• Allow import path specifiers starting with #/ (#4361)

  Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

  This change was contributed by @​hybrist.

• Automatically add the -webkit-mask prefix (#4357, #4358)

  This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:

  /* Original code */
  main {
    mask: url(x.png) center/5rem no-repeat
  }
  /* Old output (with --target=chrome110) */
  main {
  mask: url(x.png) center/5rem no-repeat;
  }
  /* New output (with --target=chrome110) */
  main {
  -webkit-mask: url(x.png) center/5rem no-repeat;
  mask: url(x.png) center/5rem no-repeat;
  }

  This change was contributed by @​BPJEnnova.

• Additional minification of switch statements (#4176, #4359)

  This release contains additional minification patterns for reducing switch statements. Here is an example:

  // Original code
  switch (x) {
    case 0:
      foo()
      break
    case 1:
    default:
      bar()
  }

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for esbuild since your current version.

Updates happy-dom from 20.10.6 to 20.14.5

Release notes

Sourced from happy-dom's releases.

v20.14.5

👷‍♂️ Patch fixes

• Preserve character references in comment data - By @​hampustagerud in task #2409

v20.14.4

👷‍♂️ Patch fixes

• End comments at the first comment end tag when it overlaps a comment start tag - By @​hampustagerud in task #2407

v20.14.3

👷‍♂️ Patch fixes

• Avoids cloning all properties in CSSPropertyManager.toString - By @​erictheswift in task #2363

v20.14.2

👷‍♂️ Patch fixes

• Fixes regression where not all CSS variables where resolved in getComputedStyle() - By @​klaesra in task #2344

v20.14.1

👷‍♂️ Patch fixes

• Invalidate the computed style cache for the whole subtree - By @​matmannion and @​capricorn86 in task #2366

v20.14.0

🎨 Features

• Improves computed style cache - By @​capricorn86 in task #2357

v20.13.2

👷‍♂️ Patch fixes

• Fix problem with getComputedStyle with :host and :host-context selectors - By @​capricorn86 in task #2349

v20.13.1

👷‍♂️ Patch fixes

• GetComputedStyle should return inherited value when it is set to inherit - By @​capricorn86 in task #2347

v20.13.0

🎨 Features

• Adds support for :host psuedo query selector - By @​capricorn86 in task #2345

v20.12.2

👷‍♂️ Patch fixes

• Custom elements should be upgraded when connected to DOM - By @​capricorn86 in task #2342

v20.12.1

🎨 Features

• Adds support for kebab-case properties on CSSStyleDeclaration - By @​capricorn86 in task #2256
• Adds support for all Chromium CSS properties to CSSStyleDeclaration - By @​capricorn86 in task #2256
  • Downloads a list from the Chromium project when compiling

👷‍♂️ Patch fixes

• Fixes issue with parsing CSS fallback variables - By @​capricorn86 in task #2256

v20.12.0

... (truncated)

Commits

• 0d4cdbe fix: #2409 Preserve character references in comment data (#2410)
• 9c920a4 fix: #2407 End comments at the first comment end tag when it overlaps a com...
• 5fb1df3 fix: #2363 Avoids cloning all properties in CSSPropertyManager.toString() (...
• de0a1e9 fix: #2344 Resolve every var() in a value, not only the first one (#2395)
• 64b8b94 fix: #2366 Invalidate the computed style cache for the whole subtree (#2367)
• eac5a38 feat: #2357 Improves computed style cache (#2358)
• 5b3559b fix: #2349 Fix problem with getComputedStyle with :host and :host-context s...
• f33da73 fix: #2347 getComputedStyle should return inherited value when it is set to...
• 68b9806 feat: #2345 Adds support for :host psuedo query selector (#2346)
• 9300a9f fix: #2342 Custom elements should be upgraded when connected to DOM (#2343)
• Additional commits viewable in compare view

Updates ovsx from 1.0.2 to 1.2.0

Release notes

Sourced from ovsx's releases.

CLI v1.2.0

Added

• Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
• Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
• Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
• Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
• Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
• publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
• Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
• Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

• Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

• A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

• Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

• Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

• publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
• publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
• Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

• Bump fast-uri from 3.1.5 to 3.1.7
• Bump qs from 6.15.2 to 6.16.0
• Bump @​humanfs/node from 0.16.6 to 0.16.8
• Bump js-yaml from 4.3.1 to 4.3.2
• Bump nanoid from 3.3.16 to 3.3.18

Frontend Library v1.2.0

Added

• Add a /publish page and turn the navbar's Publish button into a drop target: a file drag anywhere in the app turns the button into a drop area, and every .vsix package dropped on it — or on the publish page's own drop area — is queued and uploaded straight away, with no confirmation dialog. The page shows the queue as a line of extension cards — a skeleton while a package uploads, the real card once the registry accepts it, labelled with whatever the registry did with it — and keeps polling anything left under review or still missing its icon
• Export PublishButton, which carries the publish link, its p shortcut and the app's .vsix drop target in one component, so a deployment with its own menu content keeps drag-and-drop publishing
• Add a "Data Consistency" page to the admin dashboard (#1622): a live overview of every registered consistency check's finding count, with actions to refresh it and to fix findings one at a time or all at once
• Show a "Namespace not verified" state on an extension card when it can't be activated because its namespace already exists in a referenced external gallery and hasn't been verified, in both the "My Extensions" and namespace member extension lists. The card keeps its colour and takes a warning-toned frame and icon, since this is the publisher's to fix rather than an extension that is simply switched off
• Show a warning notice with a claim action wherever an unverified namespace is holding something back — the extension settings page when the extension has a namespace ownership conflict, and the namespace settings page for any unverified namespace — making clear the namespace must be claimed (verified) first. The action is the deployment's configured elements.claimNamespace, falling back to the namespace access documentation when none is configured. The admin dashboard's extension and namespace views show the same explanation without the claim action, since claiming is the publisher's action to take, not an admin's on someone else's behalf
• Add a "Search Index" page to the admin dashboard: which engine answers searches, how many extensions the index holds against how many it is built from, and a button to rebuild it where there is an index to rebuild. The two counts sit side by side because an index that has quietly lost entries answers searches perfectly well, just with nothing in them, which is indistinguishable from an empty registry unless both numbers are visible at once
• Mark a version that was published through a trusted publishing workflow with an icon next to "Published by" on the extension detail page, linking to the deployment's trusted publishing documentation. The default deployment points that link at the Trusted Publishing wiki page
• Add a Pill component — the clickable glass pill the category pills are built on, now usable on its own — and extract the MonoSlash, glassSurface and compactControl page primitives out of the search field, the pills and the search header
• Add userLoading to MainContext, so custom pages can tell "not logged in" from "still resolving the user"
• Add a userMenuContent slot to PageSettings.elements: extra entries for the logged-in account menu, rendered above the admin entry. The slot receives a MenuEntry component to build entries with, so each entry is styled by the menu it appears in — the desktop and mobile menus style theirs differently, and a consumer cannot match both on its own
• Add an adminPages slot to PageSettings.elements: extra admin dashboard pages, each declaring a name, icon, optional description and optional category, and each appearing in the side panel, as a card on the dashboard overview and as a route. Contributions are additive — a category name matching a built-in group appends to it, and a page whose path would shadow a built-in one is ignored
• Widen the published API for consumers building their own pages: the request layer (sendRequest, sendNonRetriableRequest, ErrorResponse, controllerFromSignal), MainContext, AppProviders, NotFound, createDefaultTheme with the MONO_FONT/NAVBAR_HEIGHT tokens, the createRoute/createAbsoluteURL/addQuery/formatCompactNumber/toRelativeTime utils, the useDebouncedCallback and useGridCursor hooks, the navbar-chrome, search-focus and page-search-bar hooks, the category icon helpers, ExtensionDetailRoutes, and the itemIcon/MenuItemText building blocks for userMenuContent entries

... (truncated)

Changelog

Sourced from ovsx's changelog.

[v1.2.0] (10/09/2026)

Added

• Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
• Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
• Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
• Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
• Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
• publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
• Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
• Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

• Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

• A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

• Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

• Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

• createNamespace, verifyPat, publish and delete now send the personal access token primarily via an Authorization: Bearer header (or, when OVSX_USERNAME/OVSX_PASSWORD are set, an X-OpenVSX-Token header, since Authorization is then already in use for Basic auth to a fronting proxy), moving away from a token query parameter that gets recorded in server and reverse-proxy access logs. The CLI checks the registry's reported version (/api/version) and only still sends the token as a query parameter, alongside the header, when talking to a registry older than 1.3.0, i.e. one that predates header support - including one whose version can't be determined at all, which is treated as too old rather than assumed to be caught up; on 1.3.0 and later the header is all it sends (#1344)
• publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
• publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
• Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

• Bump fast-uri from 3.1.5 to 3.1.7
• Bump qs from 6.15.2 to 6.16.0
• Bump @​humanfs/node from 0.16.6 to 0.16.8
• Bump js-yaml from 4.3.1 to 4.3.2
• Bump nanoid from 3.3.16 to 3.3.18

[v1.1.1] (09/08/2026)

Dependencies

• Bump ip-address from 10.2.0 to 10.4.0
• Bump fast-uri from 3.1.4 to 3.1.5
• Bump js-yaml from 4.3.0 to 4.3.1

[v1.1.0] (02/08/2026)

Added

• Add an encrypted filestore as fallback to the system keychain if it cant be accessed (#1950)
• Add --allow-missing-repository option to the publish command, passed on to vsce to package an extension whose package.json has no repository field without asking for confirmation (#1735)

... (truncated)

Commits

• f3e479e chore: prepare for cli 1.2.0 release
• d709ca3 build(deps): bump nanoid from 3.3.16 to 3.3.18 in /cli (#2197)
• a5d81b0 chore(deps): bump vitest
• 9fa0928 fix(cli): give up on a request that stops making progress (#2186)
• 7e11b3f fix(cli): resolve a download once the file is written, not when the response ...
• a8c9582 feat(cli): forward vsce's --follow-symlinks, and document the pnpm story (#2169)
• bfec87b build(deps): bump js-yaml from 4.3.1 to 4.3.2 (#2160)
• 8db032c feat(cli): add search and list commands (#2154)
• 31d9455 feat(cli): add a show command (#2153)
• 0aed5b8 build(deps): bump @​humanfs/node from 0.16.6 to 0.16.8 in /cli (#2138)
• Additional commits viewable in compare view

Updates playwright from 1.61.1 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.